Create and Manage Network Isolation

This guide describes how to set up and manage Network Isolation for Compute Pools. You connect PaletteAI to an Aviz ONES fabric with an integration, define isolation units (Aviz ONES Tenants) on that fabric, and then select an isolation unit when you create a Compute Pool.

Network isolation is configured from the Network Isolation page, available at the System, Tenant, and Project scope. The page has three tabs — Integrations, Isolation Units, and Tenancy Settings. The Tenancy Settings tab is not shown at the Project scope. For what network isolation does and the network planes it separates, refer to the Network Isolation concept.

Prerequisites

• Access to an Aviz ONES fabric, including the ONES API host (with the authentication service port, typically 8089) and an account username and password.

• Adding or editing an integration requires the spectrocloud.com/settings:update permission. Adding, editing, or deleting an isolation unit requires the spectrocloud.com/aviztenants:create, spectrocloud.com/aviztenants:update, and spectrocloud.com/aviztenants:delete permissions. If an action or button described in the documentation is not displayed, your role does not include the required permission.

Access the Network Isolation Page

1. Log in to PaletteAI.

2. From the Projects Menu in the top-left, select the scope you want to configure — System, a Tenant, or a Project.

3. From the left main menu, select Network Isolation.

Add an Aviz Integration

An integration is the connection between PaletteAI and your Aviz ONES fabric.

Only one Aviz integration is allowed per scope. If an integration already exists at this scope, edit it to change it, or delete it before adding a new one.

1. On the Integrations tab, select Add Aviz Integration. If no integration exists yet, select Create Aviz Network Isolation Integration from the empty state. The Create Aviz Network Isolation Integration wizard opens.

2. On the General information step, provide the connection details for Aviz ONES:

   • Name — A unique name for the integration.
   • Host — The Aviz ONES API base URL, including the authentication service port (typically 8089), for example https://ones.example.com:8089.
   • Username and Password — The Aviz ONES account PaletteAI uses to create and manage network isolation.
   • (Optional) Enable Skip TLS Verification to disable TLS certificate verification when connecting to Aviz ONES. Not recommended — disabling verification exposes the connection to man-in-the-middle attacks that can intercept Aviz credentials and management traffic. Prefer a trusted certificate chain for the Aviz ONES host.
   • Select Validate Credentials to verify the account against Aviz ONES.
   • (System and Tenant scopes) Under Shared access, choose which lower scopes can use this integration. Shared scopes can use the integration but cannot change or delete it.

   Select Next.

3. On the Isolation Units step, select Add Aviz ONES Tenant to define one or more isolation units for this integration. Each unit requires an Aviz ONES Tenant name, a Fabric name, and a Max GPUs value. You can also add isolation units later from the Isolation Units tab. Select Next.

4. On the Review step, confirm the details, and then select Create Aviz Network Integration.

Edit or Delete an Aviz Integration

1. On the Integrations tab, open the action menu on the integration's row.

2. Select Configure to edit the integration. The integration name cannot be changed. To change the password, re-enter it; leave the Password field blank to keep the existing one. Select Confirm to save.

3. Select Delete to remove the integration. If the integration is in use by Compute Pools, acknowledge the impact and select Force Delete. Removing an integration that Compute Pools depend on disrupts those workloads.

Add an Isolation Unit

An isolation unit is an Aviz ONES Tenant — an isolated environment on your Aviz ONES fabric with dedicated GPU capacity that Compute Pools consume.

1. On the Isolation Units tab, select Add Aviz ONES Tenant. The Add Aviz ONES Tenant drawer opens.

2. Complete the fields:

   • Aviz Integration — The integration this unit belongs to. This field is required and cannot be changed after the unit is created.
   • Aviz ONES Tenant name — A unique name for the unit. It must start with a letter, be at most 12 characters, and contain only letters, numbers, underscores, or dashes.
   • Fabric name — The Aviz ONES fabric that provides the unit's isolation.
   • Max GPUs — The maximum number of GPUs the unit can allocate. Must be greater than zero.
   • (Optional) Description — A description of the unit.

3. Select Confirm to add the isolation unit.

Edit or Delete an Isolation Unit

1. On the Isolation Units tab, open the action menu on the unit's row.

2. Select Edit to change the unit's fabric name, maximum GPUs, or description. The unit name and its integration cannot be changed. Editing a unit that is in use by Compute Pools is irreversible and causes those Compute Pools to fail, so Day-2 operations become unavailable for them.

3. Select Delete to remove the unit. If the unit is in use, acknowledge the impact and select Force Delete.

4. Select View status to inspect the unit's condition, or View compute pools to review which Compute Pools use it.

Require Network Isolation

On the Tenancy Settings tab, govern whether network isolation is required for Compute Pools at the current scope and the child scopes you select. This tab is available at the System and Tenant scope. At the Project scope, PaletteAI displays the inherited governance state as read-only. System requirements take precedence over Tenant requirements.

For the scope-specific steps, refer to Require Network Isolation for System-Scoped Compute Pools or Require Network Isolation for Tenant-Scoped Compute Pools.

Use Network Isolation on a Compute Pool

Select an isolation unit when you create a Compute Pool. On the Deployment step, select Network Isolation, set the Network Isolation Type to Aviz ONES, and choose a Ready Aviz ONES Tenant. Isolation is applied when the Compute Pool is created and cannot be changed afterward.

For the full Compute Pool workflow, refer to Create and Manage Compute Pools. For the manifest field, refer to Network Isolation Configuration.

Validate

1. On the Integrations tab, confirm the integration shows a Ready status.

2. On the Isolation Units tab, confirm each isolation unit shows a Ready status.

Next Steps

• Network Isolation — Understand the network planes and isolation guarantees.

• Create and Manage Compute Pools — Create a Compute Pool that uses an isolation unit.