Physical tenant separation: evaluation of concepts and proposed implementations
summary
Evaluates concrete options for making tenant workloads physically exclusive: full extra clouds (high overhead), OpenStack Ironic bare‑metal nodes (user manages any nested VMs), and host aggregates plus flavors (operator per‑project setup). Proposes and demos a new OpenStack‑native mechanism that adds hypervisor metadata fields (separation_host, project_id), a tenant_separation_filter and a nova scheduler flag so VMs with project_isolated=true auto‑allocate an empty host to that project; demo shows scheduler enforces exclusivity without extra controllers.
AI-written summary · about
chapters (7)
- 0:00Intro
- 1:07Motivation
- 3:36Exclusive clusters
- 4:56Ironic
- 7:05Host aggregates and flavors
- 9:20Flexible compute host isolation
- 13:41Conclusion
related talks
37mTenant Autonomy & Isolation In Multi-Tenant Kubernetes Clusters - A Comprehensive Guide
37mMulti-Tenancy in Kubernetes: Best Practices Today, and Future Directions
40mMulti-tenancy in Kubernetes
14mYour Containers Aren’t Alone: Demystifying Container Isolation
01h 00mArchitecting multi-tenant PaaS offerings
27mConfidential Tenancy: Towards Digital Sovereignty on Public Clouds
25mUnderstanding Isolation Levels in the Kubernetes Landscape
19mRethinking Isolation Mechanisms for Datacenter Multitenancy