Multi-tenancy cluster-level administration
Manage cluster-level multi-tenancy by configuring network spaces and isolated tenant environments to define resource quotas and security policies.
Overview
Multi-tenancy cluster-level administration enables cluster administrators to isolate a single cluster into independent environments, each with its own network boundaries, resource limits, and security policies. This is essential for tenants that need to share infrastructure across multiple teams or business units while maintaining strict separation between them.
At the foundation of this model is the network space, a cluster-level construct that defines a logical network boundary using a VLAN ID and an IP address range. Network spaces serve as the building blocks for tenant isolation by providing dedicated datapath endpoints.
Once network spaces are established, tenant environments can be created around them. Each tenant has its own administrator, storage quota, and assigned network spaces. A single tenant can span multiple network spaces to support use cases such as separating data traffic from management services, accommodating clients on different VLANs, and enabling redundant network paths.
Administrators control the full tenant lifecycle, creation, configuration, and removal, and can adjust resource limits, security policies, and quality-of-service (QoS) settings at any time. All tasks in this topic require the ClusterAdmin role.
Create a network space
A network space defines a cluster-level network boundary, including a VLAN ID and an IP range. After the administrator creates the network space, it can be assigned to a specific tenant to provide isolated datapath endpoints.
Before you begin
Ensure each server has an NVIDIA NIC.
Ensure the switch ports connected to WEKA backend servers are configured as trunk ports that carry all VLANs intended for use in network spaces.
Size the IP range using these guidelines:
IPs are assigned to NICs, not containers. When multiple backend containers share a NIC, they share the same IP.
Reserve one IP per NIC per server: 1 IP per server in an LACP configuration, 2 IPs per server in an HA dual-NIC configuration.
The range can exceed this minimum but must not be smaller.
IPs in this range are reserved for WEKA backend use only. Do not assign them to clients or any other resource.
Each VLAN is assigned to a single network space. Network spaces that use the same VLAN cannot share the same backends.
Use
weka cluster network-space show-usageto inspect current IP allocation.
GUI procedure
From the menu, select Manage > Tenants.
Select the Network Spaces tab and select Create.
Provide network space details:
Network Space Name: Enter a unique name for the network space (for example,
Eng_net).VLAN ID: Enter the VLAN ID assigned to this network boundary (for example,
100).
In the IP Range section, provide the following:
IP Range: Enter the starting and ending IP addresses for the network space. If the UI shows a CIDR notation option, do not use it.
Netmask (Bits): Provide the subnet mask bits (for example,
24). Default: 16.Gateway: Provide an optional default gateway IP address to specify the routing exit point for traffic leaving the local network space. The gateway must be visible from all IPs in range.
Select Save.
CLI alternative
Use the following command to add a network space:
Parameters
name*
Unique name for the network-space.
vlan
VLAN ID (1..4094) for tagged traffic.
range
Specific IP range allocated for this space.
gateway
Default gateway IP for the network-space.
netmask-bits
Subnet mask bits (1..32). Default: 16.
Edit a network space
Cluster administrators can update the network boundaries of an existing network space, such as changing the VLAN ID or adjusting the IP address pool. While you can modify networking parameters, the network space name remains fixed.
GUI procedure
From the menu, select Manage > Tenants.
Select the Network Spaces tab.
Locate the target network space, select the Actions menu (three vertical dots), and select Edit.
Modify the network space properties as needed. For detailed information on these fields, refer to the network space creation procedure:
Update the VLAN ID if required.
Modify the IP Range as described in the creation procedure.
Update the Gateway or Netmask (Bits) if the subnet routing or size has changed.
Click Save.
CLI alternative
Use the following command to update a network space by its ID:
Parameters
id*
Network space id.
name
New name for the network-space.
vlan
New VLAN ID (1..4094) for tagged traffic.
range
New IP range for the network-space.
gateway
New default gateway IP for the network-space.
netmask-bits
New subnet mask bits (1..32). Default: 16.
Remove a network space
Removing a network space permanently deletes its configuration from the cluster. Before proceeding, ensure that the network space is no longer assigned to any active tenants.
GUI procedure
From the menu, select Manage > Tenants.
Select the Network Spaces tab.
Locate the target Network Space, select the Actions menu (three vertical dots), and select Edit.
In the Remove Network Space dialog, enter the exact Network Space Name to confirm the action.
Remove network space Select Confirm.
CLI alternative
Parameters
name
Network space name.
Create a tenant environment
To establish a new tenant environment, the cluster administrator defines the tenant's identity, resource limits, and network boundaries. This procedure creates an isolated container where a designated tenant administrator manages their own filesystems, users, and security settings.
During creation, you can assign multiple network spaces to a single tenant. This capability allows you to:
Separate data traffic from management services like LDAP or KMS.
Support clients residing on different physical VLANs.
Provide redundant network paths for high availability.
GUI procedure
From the menu, select Manage > Tenants.
Select the Tenants tab and select Create.
Configure the tenant properties:
Tenant Name: Enter a unique name for the tenant (for example,
Engineering).Capacity Quota: Toggle this to ON to limit the total storage capacity assigned to the tenant.
Total Quota: Enter the maximum capacity allowed and select the appropriate unit (for example,
300 GB).Tenant Admin Username: Enter the username for the tenant administrator (for example,
eng_tenant_admin).Tenant Admin Password: Enter and confirm a secure password for the tenant administrator.
Network Spaces: Select one or more predefined network spaces from the dropdown menu to assign them to the tenant.
Enforce Filesystem Authentication: Toggle this to ON to require user authentication for all filesystems created within this tenant.
Enforce Network Space Access: Toggle this to ON to restrict all mount operations to the assigned network space IP addresses.
Select Save.
CLI alternative
Parameters
name*
Tenant name.
username*
Username of the tenant admin.
password*
Password of the tenant admin.
ssd-quota
SSD quota. Supports decimal or binary units (for example, 1GB, 1GiB).
total-quota
Total quota; supports decimal or binary units (for example, 1TB, 1TiB).
enforce-fs-authentication
Forces every filesystem under this tenant to require authentication.
enforce-mount-netspace-access
Restricts mount requests to only those originating from the tenant's network space.
network-spaces...
Network space names to assign (repeatable or comma-separated).
Edit a tenant environment
To modify an existing tenant's resource limits, security configuration, or S3 defaults, use the Edit Tenant dialog. While a cluster administrator can update quotas, network settings, and tenant-level S3 settings, the Tenant Name, Tenant Admin Username, and password fields are fixed and cannot be modified once the tenant is created.
GUI procedure
From the menu, select Manage > Tenants.
Select the Tenants tab.
Locate the target tenant, select the Actions menu (three vertical dots), and select Edit.
Modify the tenant properties as needed. For detailed information on these fields, refer to the tenant creation procedure:
Tenant Name
Capacity Quota and Total Quota
Network Spaces
Enforce Filesystem Authentication
Enforce Network Space Access
S3 settings: Set the tenant-specific S3 defaults:
Default filesystem: Filesystem used when a bucket is created through the S3 API without an explicit filesystem.
Anonymous UID/GID: POSIX identity assigned to anonymous or public S3 access for this tenant.
Edit tenant Click Save.
CLI alternative
Add or remove network spaces for a tenant
A network space must be created in advance by a ClusterAdmin. You cannot assign a non-existent network space.
Parameters
tenant*
Tenant name (default: current user's tenant).
network-spaces...
Network space names to add to or remove from a tenant (can be repeated or comma-separated).
Update tenant quotas
Parameters
tenant*
Tenant name or ID.
ssd-quota
SSD quota: Capacity in decimal (for example, 1GB) or binary units (for example, 1GiB).
total-quota
Total quota: Capacity in decimal (for example, 1TB) or binary units (for example, 1TiB).
Update tenant security options
Parameters
tenant*
Tenant name or ID.
enforce-fs-authentication
Forces every filesystem under this tenant to require authentication.
enforce-mount-netspace-access
Restricts mount requests to only those originating from the tenant's network space.
Remove a tenant
Deleting a tenant is a permanent action that removes the tenant and its associated configuration. Before proceeding, ensure that the tenant no longer contains active filesystems or S3 buckets.
GUI procedure
From the menu, select Manage > Tenants.
Select the Tenants tab.
Locate the target tenant, select the Actions menu (three vertical dots), and select Edit.
In the Remove Tenant dialog, enter the exact Tenant Name to confirm the action.
Remove tenant Select Confirm.
CLI alternative
Manage tenant security policies
Tenant security operations are part of the broader security configuration and are documented in the Security section.
At a high level, the CLI enables the following tenant-level security tasks:
List security policies assigned to a tenant.
Set (replace) security policies for a tenant.
Reset (remove all) security policies.
Attach additional security policies.
Detach specific security policies.
Revoke all API tokens for a tenant.
These operations are performed using the weka tenant security command group.
Related topic
Manage tenant-level security policies
Manage tenant quality of service
Modify a tenant's performance limits to control resource consumption and ensure quality of service across the cluster.
Parameters
tenant*
The name or ID of the tenant.
max-throughput
The maximum total throughput allowed for the tenant per second. Use a number with capacity units in Decimal or Binary: for example, 200GiB or 500GB.
max-iops
The maximum total I/O operations allowed for the tenant per second. Use a number without units: for example, 500000.
Configure tenant S3 settings
As a tenant administrator, you can configure dedicated S3 settings for a specific tenant. This includes defining a default filesystem for buckets created through the S3 API and assigning an anonymous POSIX User ID (UID) and Group ID (GID) for anonymous or public S3 access.
Before you begin
Ensure you are logged in with tenant administrator privileges.
GUI procedure
Select Manage > Protocols.
On the S3 Cluster Configuration page, select the plus (+) icon.
In the Configure Tenant S3 Settings dialog, configure the following fields:
Default Filesystem: Select the filesystem to use as a fallback when buckets are created through the S3 API.
Anonymous Posix UID: Enter the POSIX User ID to assign for identity mapping during anonymous or public S3 access. The default value is 65534.
Anonymous Posix GID: Enter the POSIX Group ID to assign for identity mapping during anonymous or public S3 access. The default value is 65534.
Select Save.
CLI alternative
Last updated