🛸 Hitchhiker's Guide — Phase 09: Networking, Secure Boot & Multi-Tenancy

Read this if: "VLAN, QoS, secure boot, attestation" is a list you can't yet connect. Compressed map of isolation (traffic) and trust (boot).

0. The 30-second mental model

Two questions on a shared rack: can the wrong parties talk? (network isolation + QoS) and can I trust what's running? (secure/measured boot + attestation). Answer both with defense in depth — no single control is load-bearing. The hardest boundary: tenants must NEVER reach the management VLAN (an exposed BMC = total compromise).

1. The three planes (again)

management (OOB: BMC/PDU/CDU) · data (tenant) · scale-up. Management is a hard boundary: its own VLAN, control-plane-only, never tenant/internet-facing.

2. VLAN + Linux isolation

VLAN (802.1Q) = a broadcast domain; tag = which VLAN; access port = one VLAN, trunk = many. On a host: netns (isolated stack) + veth (virtual cable) + bridge (virtual switch) + eth0.100 (VLAN sub-iface). Crossing VLANs needs an explicit router/ACL → cross-tenant is a misconfig, not a default.

ip netns add tenantA; ip link add veth0 type veth peer name veth0-br
ip link add link eth0 name eth0.100 type vlan id 100

3. QoS = no noisy neighbor

tc + HTB: class tree, each tenant a rate (guarantee) + ceil (cap); reserve a class for management. Sum of guarantees ≤ link capacity (ceilings may oversubscribe). fq_codel leaf for low latency.

4. Secure boot (ENFORCE)

firmware→shim→GRUB→kernel, each verifies the next's signature against db (allowed) / dbx (revoked), under PK→KEK keys. Stops bootkits. Does NOT encrypt, NOT protect runtime, NOT prove to others (that's attestation). PXE chain must be signed or it's blocked (Phase 05).

5. Measured boot (MEASURE) + TPM

Each stage hashes the next into a TPM PCR: PCR = Hash(PCR || measurement) (extend-only → fingerprints the whole boot in order). Secure boot stops a bad boot; measured boot records & proves it. Enables sealing (release a secret only if PCRs match).

6. Remote attestation (PROVE)

verifier nonce → node TPM returns a signed PCR quote → verifier checks TPM signature + PCRs vs known-good → grant/deny trust (join cluster, release keys, run tenant work). Gate trust before handing a node anything. Essential for sovereign/air-gapped (Phase 06 RKE2).

7. Defense in depth vs the threat model

No single control load-bearing; each layer fails safe.

8. The "done this before" tells

"Can a tenant reach the BMC VLAN? (no)" · "Sum of QoS guarantees ≤ capacity?" · "Secure or measured boot — enforce or prove?" · "What's in PCR 0–7?" · "Did the node attest before we trusted it?" · "What's the threat model?"

9. How this phase pays off later

Attestation gates Phase 05 provisioning + Phase 06 node-join. Tenancy pairs with Phase 06. Signed firmware = Phase 08. The full design is system-design/04; sovereign deployment is the RKE2 (Phase 06) context.