Is there a way to turn on network isolation for an existing project? I see that the docs talk about the option existing, but I don't see it anywhere (my CNI is calico that supports network policies)

You enable this at the cluster management level when you create a cluster. You can edit it afterwards, but it will cycle/upgrade the nodes if it wasn't enabled prior.

perfect, thanks!