Lab 01 — VLAN Separation & QoS Tenant Isolation

Phase: 09 — Networking & Tenancy | Difficulty: ⭐⭐⭐⭐☆ | Time: 4–6 hours Language: Python 3 (sim) + real ip/tc | Hardware: none (Linux/VM for the live build)

Concept primer: ../WARMUP.md Ch. 2–4, ../HITCHHIKERS-GUIDE.md §1–§3.

Run

python3 solution.py     # reachability + QoS policy engine with isolation invariants

0. The mission

Encode the two isolation guarantees of a shared rack as enforceable policy: reachability (same-VLAN ok, cross-tenant denied without an ACL, tenant→management always denied) and QoS (per-tenant guarantees + ceilings with a reserved management class).

1. The invariants to internalize

  • Tenant → management is a hard rule that overrides even a (mis)configured ACL — the self-test proves adding (100,10) to the ACLs still can't let a tenant reach the BMC VLAN. An exposed BMC is total compromise; this boundary cannot be soft.
  • Cross-tenant requires an explicit ACL — default-deny between VLANs.
  • QoS: sum of guarantees ≤ link capacity (ceilings may oversubscribe); management always has a reserved guarantee so the rack stays manageable under tenant load.

2. Build it for real (extension)

sudo ip netns add tenantA
sudo ip link add veth-a type veth peer name veth-a-br
sudo ip link set veth-a netns tenantA
sudo ip link add link eth0 name eth0.100 type vlan id 100   # tenant VLAN
# QoS: reserve mgmt, cap tenants (HTB)
sudo tc qdisc add dev eth0 root handle 1: htb default 30
sudo tc class add dev eth0 parent 1: classid 1:1 htb rate 100gbit
sudo tc class add dev eth0 parent 1:1 classid 1:10 htb rate 10gbit ceil 40gbit  # mgmt
sudo tc class add dev eth0 parent 1:1 classid 1:20 htb rate 40gbit ceil 90gbit  # tenantA

Then verify isolation and bandwidth shares with iperf3.

3. Extensions

  1. Build the real ip netns/veth/bridge/VLAN + tc setup above and test with iperf3.
  2. Add a Kubernetes NetworkPolicy (Phase 06) equivalent and reconcile the two policy models.
  3. Add SR-IOV VF assignment for accelerator NICs and reason about its isolation.
  4. Model the management plane being unreachable during a tenant DDoS without the reserved QoS class — then add it back and show the rack stays manageable.

4. What this lab proves

You can specify and enforce tenant isolation + fairness — the JD's "VLAN separation and QoS enforcement for multi-tenant environments" — with the management boundary treated as inviolable. "Isolate tenants on a shared rack" becomes a precise, testable policy. Pairs with Phase 06 tenancy and feeds system-design/04.