Tenant Networking #

Defines the network isolation model for tenant workloads.

Purpose #

Tenant networking provides:

• Isolation — Tenants cannot see each other’s traffic
• Controlled access — Explicit rules for shared services
• Scalability — New tenants get dedicated network segments
• Security boundaries — Limit blast radius of compromised workloads

VLAN Isolation Model #

Each tenant receives a dedicated VLAN:

VLAN IDs and subnets are assigned from a reserved range to avoid conflicts with substrate segments (Management, Trusted, Storage, IoT, Guest).

Tenant DNS Zones #

Each tenant has a DNS zone scoped to its site:

tenant.site.deevnet.net

Examples:

• grooveiq.dvntm.deevnet.net — GrooveIQ on dvntm site
• vintronics.dvnt.deevnet.net — Vintronics on dvnt site

Services within a tenant use the pattern:

service.tenant.site.deevnet.net

Examples:

• api.grooveiq.dvntm.deevnet.net
• db.grooveiq.dvntm.deevnet.net
• web.vintronics.dvnt.deevnet.net

Inter-Tenant Routing #

Default Policy: Deny #

Tenants cannot communicate with each other by default:

• No routing between tenant VLANs
• Firewall blocks cross-tenant traffic
• Each tenant is an isolated security domain

Explicit Allow #

Cross-tenant communication requires explicit firewall rules:

• Documented in IaC
• Reviewed for security implications
• Scoped to specific services and ports

Access to Shared Services #

Tenants may need access to substrate-level shared services:

Access is granted via firewall rules from tenant VLANs to specific management segment services.

Per-Tenant DHCP #

Each tenant VLAN has its own DHCP scope:

The Core Router serves DHCP for all tenant VLANs via its VLAN interfaces.

Static DHCP reservations may be used for tenant VMs with deterministic identity requirements.

Relationship to Substrate Networking #

Tenant networking is a layer on top of Substrate Networking:

graph TB
    subgraph tenant["Tenant VLANs (per-tenant)"]
        T["grooveiq (100), vintronics (101), etc."]
    end
    subgraph substrate["Substrate Segments (shared)"]
        S["Management, Trusted, Storage, IoT, Guest"]
    end
    tenant -->|isolated from| substrate

Tenant VLANs:

• Use the same Core Router for routing and firewall
• Share physical switch infrastructure (802.1Q trunking)
• Are isolated from substrate management traffic

Core Router Integration #

The Core Router provides tenant networking via:

Future: Tenant Self-Service #

Planned capabilities for tenant networking:

• Tenant-defined internal DNS records
• Tenant-scoped firewall rule requests
• Bandwidth and QoS policies per tenant
• Tenant network dashboards

These are tracked in the Roadmap.

Summary #

1. Each tenant gets a dedicated VLAN for isolation
2. Default-deny routing between tenants
3. DNS follows service.tenant.site.deevnet.net pattern
4. Per-tenant DHCP scopes from Core Router
5. Access to shared services via explicit firewall rules