docs(network): add network segmentation and policy boundaries article#296
Open
Sven-Ric wants to merge 2 commits into
Open
docs(network): add network segmentation and policy boundaries article#296Sven-Ric wants to merge 2 commits into
Sven-Ric wants to merge 2 commits into
Conversation
✅ Deploy Preview for metal-stack-io ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
vknabel
reviewed
Jul 1, 2026
|
|
||
| ## Segmentation Model | ||
|
|
||
| A tenant owns one or more projects, and a project owns one or more private networks. Every [private network](./04-inventory-management.md#logical-inventory) is allocated its own VRF, which maps 1:1 to a VNI in the EVPN/VXLAN overlay. Because each network routes in its own VRF (see [VRF](./01-theory.md#vrf)), no two networks share a routing table, which isolates projects and tenants from one another and lets the same IP ranges be reused across networks without colliding. [Picture 6](./01-theory.md#physical-wiring) illustrates this separation and the VRF termination that happens on the firewall. |
Contributor
There was a problem hiding this comment.
every private network is allocated its own VRF sounds a bit off
Comment on lines
+28
to
+31
| ## Defense in Depth | ||
|
|
||
| A packet from a tenant machine crosses several independent enforcement layers before it can reach anything, and because each layer is rendered from the same metal-api state they cannot drift out of agreement. Any one of them is sufficient to deny the traffic. | ||
|
|
Contributor
There was a problem hiding this comment.
|
|
||
| ### Routing Isolation (VRFs) | ||
|
|
||
| VRFs provide hard layer-3 isolation. A packet in `vrf5417` has no route to a destination in another VRF. Route-leaking between VRFs happens only where it is explicitly configured, and even then it is constrained. On a tenant firewall, `import vrf` installs routes from a foreign VRF, but an `import vrf route-map` plus a prefix-list decide exactly which prefixes may cross (see [Tenant Firewalls](./01-theory.md#tenant-firewalls-evpn-to-the-host) and Listing 9). The default posture is no reachability, and every leak is a named, prefix-scoped exception. |
Contributor
There was a problem hiding this comment.
Suggested change
| VRFs provide hard layer-3 isolation. A packet in `vrf5417` has no route to a destination in another VRF. Route-leaking between VRFs happens only where it is explicitly configured, and even then it is constrained. On a tenant firewall, `import vrf` installs routes from a foreign VRF, but an `import vrf route-map` plus a prefix-list decide exactly which prefixes may cross (see [Tenant Firewalls](./01-theory.md#tenant-firewalls-evpn-to-the-host) and Listing 9). The default posture is no reachability, and every leak is a named, prefix-scoped exception. | |
| VRFs provide hard layer-3 isolation. Packets in `vrf5417` have no route to a destination in another VRF. Route-leaking between VRFs happens only where it is explicitly configured, and even then it is constrained. On a tenant firewall, `import vrf` installs routes from a foreign VRF, but an `import vrf route-map` plus a prefix-list decide exactly which prefixes may cross (see [Tenant Firewalls](./01-theory.md#tenant-firewalls-evpn-to-the-host) and Listing 9). The default posture is no reachability, and every leak is a named, prefix-scoped exception. |
Contributor
Author
There was a problem hiding this comment.
I think I will rework the entire sentence. Writing from the perspective of a single packet is pretty standard in literature, but saying that it has a route is a bit weird.
Co-authored-by: Valentin Knabel <dev@vknabel.com>
|
Thanks for this contribution! With the requested changes of Valentin this would be good to go from my side. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Standalone article on network segmentation in metal-stack. Standalone for now, I would like to connect my articles in a more meaningful way, once more has been written / refactored.
Used AI-Tools ✨
research supported by claude