The networking behind this architecture is designed to provide fully isolated tenant environments with public and private networks as well as dedicated compute and storage resources. The architecture is designed with high availability in mind through the deployment of a cluster for tenant workloads. There are some differences than what would be implemented in a production environment, mainly the implementation of a multiple clusters, one for backup, one for tenant workloads and another for the provider workloads.

The reference implementation utilizes inter-VLAN routing to provide isolated networking for each tenant. A Cisco router handles all routing between VLANs through a Router-on-a-stick configuration, with sub interfaces defined for each network segment. A Cisco switch trunks all VLANS to the router as well as the required VLANS to each Proxmox node. Within Proxmox, Software Defined Networking VLAN Zones have been utilized in Proxmox to provide a network a bridge for each tenants public and private network, allowing Virtual Machines and Containers to be attached to required networks easily.

Access Control to each tenants respective private network has been implemented through SDN Firewall Rules in Proxmox directly. Since the management network is not added as a SDN Network like tenant networks, ACL Rules to restrict access to the management network have been applied on the router.

To see the router and switch configuration for each tenant, please refer to - Router Configuration File and Switch Configuration File

below is the assigned network and VLAN for each tenant / use case

Note - for a full look at the addressing scheme for all networks, please refer to - Addressing Scheme

For a better look at the topology, please refer to - private cloud.drawio.png

This topology diagram provides a comprehensive overview of the network topology, including the core networking equipment, Proxmox cluster nodes, resource pools, replication and HA failover overview

Due to the resource limitations for this capstone, I wasn't able to implement some things I was intending to, one of them is a cluster for FMJ Systems and their workloads as well as a backup cluster, I touch on this more in Limitations and Considerations

In a full production environment, the previously mentioned additions would be made as well as multiple locations to offer availability across regions and a proper web portal for clients to provision resources within agreed limitations in a self-service model. Off site backups could be hosted across multiple regions or encrypted and hosted in a public cloud.