ControlOS™

<!-- GPU Passthrough via VFIO -->
<hostdev mode='subsystem' type='pci' managed='yes'>
  <driver name='vfio'/>
  <source>
    <address domain='0x0000' bus='0x41' slot='0x00' function='0x0'/>
  </source>
</hostdev>

<!-- 1GB Huge Pages + Memory Locking -->
<memoryBacking>
  <hugepages>
    <page size='1048576' unit='KiB' nodeset='0'/>
  </hugepages>
  <locked/>
</memoryBacking>

<!-- Pin to same NUMA node as GPU -->
<numatune>
  <memory mode='strict' nodeset='0'/>
</numatune>

<!-- Expose host CPU features -->
<cpu mode='host-passthrough'>
  <topology sockets='1' cores='16' threads='1'/>
</cpu>

# Create logical switch for tenant network
ovn-nbctl ls-add tenant-a-network

# Create port with MAC/IP binding (anti-spoofing)
ovn-nbctl lsp-add tenant-a-network vm-001-port
ovn-nbctl lsp-set-addresses vm-001-port "fa:16:3e:aa:bb:cc 10.100.0.10"
ovn-nbctl lsp-set-port-security vm-001-port "fa:16:3e:aa:bb:cc 10.100.0.10"

# Allow inbound SSH (to-lport = traffic TO the port)
ovn-nbctl acl-add tenant-a-network to-lport 1000 \
  'outport == "vm-001-port" && ip4 && tcp.dst == 22' allow-related

# Allow inbound HTTPS
ovn-nbctl acl-add tenant-a-network to-lport 1000 \
  'outport == "vm-001-port" && ip4 && tcp.dst == 443' allow-related

# Allow all outbound (from-lport = traffic FROM the port)
ovn-nbctl acl-add tenant-a-network from-lport 1000 \
  'inport == "vm-001-port" && ip4' allow-related

# Default deny inbound (lower priority)
ovn-nbctl acl-add tenant-a-network to-lport 900 \
  'outport == "vm-001-port"' drop

# Define physical hierarchy
ceph osd crush add-bucket dc1-row1-rack1 rack
ceph osd crush add-bucket dc1-row1-rack2 rack
ceph osd crush add-bucket dc1-row1-rack3 rack
ceph osd crush add-bucket dc1-row1 row
ceph osd crush add-bucket dc1 datacenter

# Build the tree
ceph osd crush move dc1-row1-rack1 row=dc1-row1
ceph osd crush move dc1-row1-rack2 row=dc1-row1
ceph osd crush move dc1-row1-rack3 row=dc1-row1
ceph osd crush move dc1-row1 datacenter=dc1

# Create CRUSH rule for rack-level failure domain
ceph osd crush rule create-replicated replicated_rack default rack

# Create pool (PG autoscaling enabled by default in Reef)
ceph osd pool create vms replicated replicated_rack
ceph osd pool set vms size 3        # 3 replicas
ceph osd pool set vms min_size 2    # Operate with 2 (degraded)

# Enable RBD application tag
ceph osd pool application enable vms rbd

# Create isolated namespace per tenant
rbd namespace create vms/tenant-a
rbd namespace create vms/tenant-b

# Tinkerbell Template (Kubernetes CRD format)
apiVersion: tinkerbell.org/v1alpha1
kind: Template
metadata:
  name: compute-node
spec:
  data: |
    version: "0.1"
    name: compute-node
    global_timeout: 3600
    tasks:
      - name: "os-installation"
        worker: "{{.device_1}}"
        actions:
          - name: "stream-image"
            image: quay.io/tinkerbell/actions/image2disk:v1.0.0
            timeout: 600
            environment:
              IMG_URL: http://images.controlos.local/ubuntu-22.04.raw.zst
              DEST_DISK: /dev/sda
              COMPRESSED: "true"
          - name: "write-netplan"
            image: quay.io/tinkerbell/actions/writefile:v1.0.0
            timeout: 90
            environment:
              DEST_DISK: /dev/sda3
              DEST_PATH: /etc/netplan/config.yaml
              CONTENTS: {{.netplan_config}}
          - name: "install-agent"
            image: controlos/node-bootstrap:v1.0.0
            timeout: 300
            environment:
              API_ENDPOINT: https://api.controlos.local
              NODE_TOKEN: {{.node_token}}

package controlos.authz

import future.keywords.in

default allow = false

# Tenant admin can manage their tenant's resources
allow {
    input.user.roles[_] == "tenant_admin"
    input.resource.tenant == input.user.tenant
}

# Users can manage VMs in their tenant
allow {
    input.user.roles[_] == "user"
    input.resource.tenant == input.user.tenant
    allowed_user_actions[input.action]
}

allowed_user_actions := {
    "vm:create", "vm:read", "vm:delete",
    "vm:start", "vm:stop", "volume:create",
    "volume:read", "network:read"
}

# Quota enforcement
deny[msg] {
    input.action == "vm:create"
    tenant_vms := count([vm |
        vm := data.vms[_]
        vm.tenant == input.user.tenant
    ])
    tenant_vms >= data.quotas[input.user.tenant].max_vms
    msg := "Tenant VM quota exceeded"
}