Your own private datacenter region — software-defined, API-driven, off the VMware tax.
A Virtual DataCenter is a self-service, software-defined slice of GRN infrastructure that your organisation operates like its own private datacenter region. Pooled compute — VMs via KubeVirt and containers side by side — with software-defined networking (VLAN segmentation, VXLAN overlay via OVN + Multus), software-defined storage (Rook Ceph + OpenEBS NVMe) and hard multi-tenant isolation. All of it provisioned through one API. The agility and API of cloud, with the isolation and control of on-prem — and a clean exit off VMware licensing. EU-owned, in the Netherlands, on 100% renewable power.
Virtual DataCenter
Dedicated resource pools · up to 99.99% SLA
- TenancyDedicated pools — VPC (shared HW) or DPC (bare-metal)
- ComputeKubeVirt VMs + containers, co-scheduled
- NetworkingSDN — VLAN segmentation + VXLAN overlay
- StorageCeph (block/file/S3) + local NVMe (SDS)
- ControlFull self-service API + web console
- AutomationTerraform + Ansible, GitOps-ready
- SLAUp to 99.99% (tier-dependent)
API / IaC-driven
EU-owned — Netherlands
SLA up to 99.99%
100% renewable-powered
Built on three guarantees
The same three guarantees behind every GRN product — here, applied to a whole software-defined datacenter you operate yourself. They are the things a hyperscaler VPC and a VMware stack cannot match on all three axes at once.
Sovereign & Secure
EU-owned infrastructure under Dutch jurisdiction — not a US hyperscaler’s “European region”, which stays subject to the US Cloud Act regardless of where the data sits. Hard multi-tenant isolation, EU-only data residency and a signed Data Processing Agreement. On DPC pools you get kernel, hardware and network isolation, not just a logical boundary.
Affordable & transparent
Networking functions are included free, storage is a published €/GB-month, and annual commitments take 10% off. No per-socket hypervisor licensing, no core-tax renewal shock, and no egress tax — the line item that quietly consumes 15–40% of a typical hyperscaler bill. Verify egress
Sustainable
Hosted in the Netherlands on 100% renewable solar energy, with server heat reused to warm nearby buildings and peak-shaving to ease grid congestion. Sustainability with a mechanism behind it, not a logo.
What a Virtual DataCenter actually is
Think of it as a region of your own. A Virtual DataCenter is a logically—and on dedicated tiers, physically—isolated slice of GRN infrastructure, with its own pooled compute, software-defined networks, software-defined storage and quotas, all behind one declarative API. You design and run the topology like a datacenter architect; we run the metal, the control plane and the storage fabric beneath it. Here is exactly where the line sits.
What GRN operates
Run and on-call for the platform layer — the undifferentiated heavy lifting.
- The physical hosts, the OKD/OpenShift control plane and the KubeVirt virtualisation layer, patched and backed up
- The SDN fabric (OVN + Multus + MetalLB) and the Ceph / OpenEBS storage fabric
- Hardware replacement, capacity on request and the underlying network plumbing
- The hard tenant boundary — logical on VPC, kernel + hardware on DPC
- The up-to-99.99% SLA, on dedicated tiers, with named senior engineers
What you operate
Your datacenter, self-service — with full project-admin.
- Your VMs and containers: images, instance sizing, placement and scaling
- Your network design: VLAN segments, VXLAN overlays, subnets, firewall and load-balancer rules
- Projects, RBAC bindings, quotas and the internal tenant model
- Your IaC: Terraform, Ansible and GitOps (Argo CD / Flux) against the standard API
- The decision to leave: standard APIs and image formats mean you can export and walk
The same stack underneath every tier. A Virtual DataCenter runs the identical cloud-native foundation as our Virtual Private Cloud and Dedicated Private Cloud — the only difference is the isolation and dedication of the compute beneath it. Run on shared-hardware VPC pools, or on single-tenant bare-metal DPC pools with kernel and hardware isolation for regulated and high-security workloads. You are never re-platforming to move between them.
What a legacy datacenter and a VMware estate cost you
The private datacenter still makes sense for control, sovereignty and steady-state economics. The way most organisations run one — bought hardware on a refresh cycle, virtualised with per-socket licences, networked with hand-cut VLANs — is where the pain lives.
- Capex and refresh cyclesYou buy three years of peak capacity up front, then run it at 30% and repeat the purchase before it is paid off. Capacity is a procurement project, not an API call.
- VMware / Broadcom licensing shockPer-socket became per-core, perpetual became subscription, and the renewal quote arrived with a multiple in front of it. The hypervisor is now the most expensive line in the rack.
- Rigid hardware VLANs & change windowsA new segment means a switch change, a ticket and a maintenance window. The network cannot move at the speed the application teams expect.
- Two stacks that never meetVMs live on one platform, containers on another, each with its own networking, storage and operations team. Nothing is scheduled against a single pool.
- Capacity stranded in silosSpare cores on the VM cluster cannot help the container cluster, and storage bought for one project sits idle next to another that is full.
- Sovereignty without the agilityOn-prem gives you control and residency, but losing the self-service, the API and the elasticity that pulled everyone to the cloud in the first place.
A software-defined datacenter, layer by layer
Everything that used to be a box in a rack — the hypervisor, the switches, the SAN — is software here, defined declaratively and provisioned through one API. Your workloads at the top; dedicated renewable-powered hosts at the bottom. Every layer names its real, portable components.
Your virtual machines (via KubeVirt) and containers, scheduled side by side against the same pool — deployed through the API, console, Terraform or GitOps. One control surface for both.
An OKD/OpenShift control plane with KubeVirt for virtualisation handles scheduling, RBAC, quotas, live-migration and self-healing across the pool — patched and operated by GRN.
Software-defined networking: OVN-Kubernetes for the overlay and east-west policy, Multus for multi-NIC and VLAN attachments, MetalLB for L2/BGP load balancing, Submariner for DC interconnect. VLAN segmentation and VXLAN overlay, defined in code.
Block, file and S3 object storage on Ceph; local NVMe via OpenEBS for latency-sensitive workloads; volume snapshots and Velero backup with cross-region replication. The SAN, in software.
Your resource pool on EU-owned hosts in the Netherlands — shared-hardware (VPC) or single-tenant bare-metal (DPC) — powered by 100% renewable solar with server-heat reuse.
Every layer uses standard, portable components — nothing proprietary you cannot reproduce on another conformant platform.
Compute & resource pools
One pool, two workload types. KubeVirt runs full virtual machines as first-class objects next to containers, co-scheduled on the same nodes against the same quotas — so capacity is never stranded on the wrong side of a VM/container divide. Size pools from the same instance families as the rest of the platform.
Compute optimised cx1
1–32 vCPU, high clock — for CI runners, API backends and CPU-bound services.
Memory optimised m1
Up to 256 GB RAM — for in-memory datastores, caches and JVM-heavy estates.
Network optimised n1
4–64 vCPU with high throughput — for ingress tiers, proxies and service mesh.
Universal purpose o1
0.5–128 GB, balanced — the default pool for mixed VM and container workloads.
Real-time rt1
1–32 vCPU, latency-tuned — for real-time and deterministic workloads.
Bare-metal bm1
bm1.large at 48 vCPU / 128 GB, scaling to 100+ nodes and 512 GB/node — for single-tenant DPC pools.
Reservations, quotas and co-scheduling. Carve the pool into projects with hard CPU/memory/storage quotas and reservations, so one team cannot starve another. VMs and containers share the same scheduler, the same network and the same storage classes — live-migrate VMs across hosts for maintenance with no downtime. GPU is optional: NVIDIA-accelerated nodes via OpenDataHub, within EU data residency. Optional
Software-defined networking, in depth
The whole network is software. Segments, overlays, firewalls and load balancers are declared in code and provisioned in seconds — no switch change, no ticket, no maintenance window. Every function below is a standard, named component and, unless noted, included at no extra charge.
| Function | Implementation | Price |
|---|---|---|
| Pod & VM networking | OVN-Kubernetes CNI + Multus (multi-NIC) Confirm default | Included |
| VLAN segmentation | Multus VLAN / bridge attachments | Included |
| VXLAN / overlay networks | OVN-Kubernetes Geneve/VXLAN overlay Confirm default | Included |
| Micro-segmentation / firewall | NetworkPolicy (default-deny capable) |
Included |
| Load balancing | MetalLB (Layer 2 / BGP) | Included |
| Site-to-site / DC interconnect | Submariner cross-cluster tunnels | Included |
| NAT / egress | Egress IP / egress router | Included |
| Private subnets / isolated networks | OVN logical switches + NetworkPolicy | Included |
| Public / floating IPv4 | MetalLB-advertised address | € 3.00 / mo |
| BYO-IP / BYO-ASN (BGP) | MetalLB BGP peering | € 50.00 / mo |
| Data egress | No per-GB metering Verify | No egress tax |
Dual-stack IPv4 / IPv6 throughout. Prices in EUR, ex VAT; 10% discount on annual commitment. Verify current rates on the pricing page before quoting.
Software-defined storage & data services
No SAN to buy, no array to forklift-upgrade. Storage is a pool of disks turned into block, file and object classes by Ceph and OpenEBS, provisioned dynamically through standard CSI drivers and billed transparently per GB-month. Portable storage classes you could re-create on any conformant platform.
| Storage class | Implementation (CSI) | Best for | Price |
|---|---|---|---|
| Local NVMe | OpenEBS LocalVolume | Latency-sensitive — databases, brokers | € 0.044 / GB-mo |
| Block (RWO) | Rook Ceph RBD | VM disks, general-purpose volumes | € 0.044 / GB-mo |
| Shared file (RWX) | Rook Ceph FS | Shared volumes across VMs/pods | € 0.044 / GB-mo |
| S3 object | Ceph ObjectBucketClaim |
Artifacts, backups, data lakes | € 0.044 / GB-mo |
| Cross-region replication | Ceph VolumeReplication |
Geo-redundancy / DR | € 0.0465 / GB-mo |
| Backup & snapshots | Velero + CSI snapshots | Scheduled backup to meet RPO/RTO | € 0.008 / GB-mo |
All classes are dynamically provisioned and expandable. NVMe-oF with configurable IOPS available on dedicated tiers. Prices ex VAT; verify on the pricing page before quoting.
Hard isolation, on an axis you choose
A datacenter region needs real tenant boundaries — whether your tenants are internal business units or external customers. Isolation runs on two axes: the logical model (projects, RBAC, quotas, network policy) that applies everywhere, and the physical axis from shared-hardware VPC to single-tenant bare-metal DPC.
Projects & namespaces
Each tenant gets its own project: a hard boundary for workloads, networks, storage and identity. Nest business units or customers as separate projects under one VDC.
RBAC & identity
Fine-grained RBAC across projects and resources, with OIDC federation to your own IdP and full audit logging of privileged actions.
Network isolation
Default-deny NetworkPolicy, per-tenant VLAN/VXLAN segments and private subnets — tenants cannot see each other’s traffic unless you allow it.
Resource quotas
Hard CPU, memory and storage quotas plus reservations per project, so a noisy tenant cannot starve the others or overrun the pool.
VPC: shared hardware
Logical isolation over a shared, multi-tenant host pool — the cost-efficient default for internal segmentation and most production workloads.
DPC: kernel + hardware
Single-tenant bare-metal pools with kernel, hardware and network isolation — for regulated, high-security or noisy-neighbour-sensitive workloads.
The isolation axis, stated plainly. Every tier runs the same cloud-native stack — the difference is the isolation of the compute. VPC gives you logical multi-tenancy on shared hardware; DPC gives you a dedicated, physically isolated pool. Mix them within one VDC: run general workloads on VPC pools and your regulated estate on DPC pools, under one API and one console.
Security through standard primitives, layered
Security is enforced across identity, network, workload and data — using primitives your team already audits against, not proprietary bolt-ons that only we understand. Defence in depth, with nothing you have to take on trust.
- RBAC across projects, namespaces and resources, with full audit logging
- Identity integration via OAuth / OIDC — bring your own IdP
- Secrets with encryption at rest; external secret stores supported
- TLS everywhere, issued and rotated automatically via cert-manager
- Default-deny micro-segmentation with standard NetworkPolicy
- Pod & VM security standards enforced at the project level
- Image & supply-chain scanning Pending validation
- Private VDCs with no public API exposure Pending validation
- Audit logging of privileged and API actions
- Hardware & kernel isolation on single-tenant DPC pools
On compliance, the honest version. The platform runs under EU-only data residency with a signed DPA and no US Cloud Act exposure, which is the substantive part of most regulated requirements. We will support PCI-DSS, HIPAA and NIS2-aligned deployments on dedicated, isolated infrastructure — but we do not claim certifications we do not hold. Tell us your compliance scope and we will tell you precisely what we can and cannot attest to. Review
Infrastructure as code, end to end
If the whole datacenter is software, the whole datacenter is programmable. Every object — VMs, networks, storage, quotas, RBAC — is a declarative resource behind one API. Provision it from the console for exploration, then codify it and let GitOps keep it that way.
One declarative API
The full Kubernetes / OpenShift REST API drives everything in the VDC. VMs (KubeVirt), networks (OVN/Multus), storage (CSI), quotas and RBAC are all first-class API objects — no separate control panels to stitch together.
GitOps as the source of truth
Declare the desired state of your VDC in Git and reconcile it with Argo CD or Flux. The cluster is GitOps-ready out of the box; drift is detected and corrected, and every change has a history.
| Tool | Use | Availability |
|---|---|---|
| Kubernetes / OpenShift REST API | Native control surface for every VDC object | Provided |
| Terraform | Declarative provisioning of VDC resources | Compatible Confirm |
| Ansible | Configuration management & day-2 automation | Compatible Confirm |
| Argo CD | GitOps continuous reconciliation | Compatible / customer-driven |
| Flux | GitOps continuous reconciliation | Compatible / customer-driven |
kubectl / virtctl |
Direct CLI control of containers and VMs | Provided |
“Provided” means run and supported by GRN; “Compatible / customer-driven” means it works against the standard API and you operate it, unless contracted as a managed add-on.
The datacenter lifecycle, managed end to end
The interesting question about a datacenter is not day one — it is day two: who owns the maintenance that could disrupt your VMs, and what happens when a host dies at the weekend. And, eventually, how cleanly you can leave. Here is the lifecycle we operate.
Provision
A right-sized VDC — resource pools, networks and storage classes — on VPC or DPC substrate, API-reachable in minutes.
Operate
You run VMs and containers via API, console or GitOps; we keep the control plane, virtualisation and storage healthy underneath.
Scale
Grow pools on demand, add GPU or memory-optimised capacity, or move workloads to dedicated DPC hosts — no rebuild.
Recover / DR
Velero backup, CSI snapshots and cross-region replication to your RPO/RTO — live-migrate VMs around hardware maintenance.
Decommission / exit
Standard APIs and image formats mean a clean export to any conformant platform — portability by construction, not a paid feature.
Day-2 and portability, stated honestly. VMs live-migrate across hosts so host maintenance is invisible to your workloads, and the control plane is patched and upgraded by us on a coordinated schedule. Because the substrate is upstream Kubernetes + KubeVirt and your disks are standard images, leaving is an export, not a rewrite — the EU Data Act (applicable 12 September 2025) now makes that switching capability a legal requirement, not a courtesy. Confirm cadence
High availability, backup & disaster recovery
A datacenter you cannot recover is a liability. HA is built into the platform; backup and DR are wired in and priced transparently, sized to the RPO/RTO targets you already work to.
High availability
Redundant control-plane nodes with an etcd quorum and automated failover; workloads reschedule across hosts on failure, and VMs live-migrate for planned maintenance. Backed by an SLA of up to 99.99% on dedicated tiers.
Backup & snapshots
Scheduled Velero backups and CSI volume snapshots of VM disks and persistent volumes — application-consistent, restorable per workload. Backup storage is €0.008/GB-month.
Cross-region DR
Ceph VolumeReplication mirrors data to a second region for geo-redundancy, at €0.0465/GB-month — failover designed around your declared RPO and RTO.
RPO/RTO targets are configured per workload; tell us yours and we will size the backup schedule and replication topology to meet them.
Hybrid by interconnect, sovereign by construction
A Virtual DataCenter is not an island. Connect it to your on-prem racks and to other clusters over an encrypted fabric, and keep your workloads portable because everything speaks standard APIs — all on genuinely EU-owned infrastructure.
- DC interconnect via SubmarinerEncrypted, cross-cluster connectivity to your existing on-prem datacenter or other GRN regions — with service discovery across the link, not just an L3 tunnel.
- Portable by standard APIsVMs are standard disk images; workloads are standard Kubernetes objects. Move them on or off any conformant platform without re-architecting — a re-point, not a rebuild.
- Genuine EU sovereigntyEU-owned, in the Netherlands, under Dutch jurisdiction — not a US hyperscaler’s “European region” that stays subject to the US Cloud Act. EU-only residency and a signed DPA.
- Burst and tier across the fabricKeep regulated workloads on DPC pools in the VDC and run general workloads on VPC pools or a connected cluster — one topology, isolation where you need it.
Against VMware, the hyperscalers, and on-prem
An objective comparison against the incumbent ways to run a private cloud: a VMware/Broadcom stack, a hyperscaler VPC, or a traditional on-prem datacenter. Subjective claims (“faster”, “simpler”) are left out — only things you can check.
| Capability | GRN.CLOUD VDC | VMware Cloud Foundation | Hyperscaler VPC (AWS/Azure) | Traditional on-prem |
|---|---|---|---|---|
| Vendor lock-in | None / portable APIs | Proprietary stack | ~ ecosystem pull | ~ hardware + hypervisor |
| Licensing model | No per-socket/core licence | Per-core subscription | Usage-based | Per-socket/core licence |
| Genuine EU sovereignty (non-US-owned) | Yes (Netherlands) | US-owned vendor | US-owned | Depends on your DC |
| Pricing transparency | Published €/GB, flat tiers | ~ negotiated / opaque | ~ complex | Your capex |
| Egress / cross-AZ fees | Networking included Verify | Your network | Per-GB + cross-AZ | Your network |
| VM + container unified | Yes (KubeVirt, one pool) | ~ Tanzu add-on | ~ separate services | Separate stacks |
| Infrastructure control | High (self-service SDDC) | High | ~ abstracted | Total |
| SLA | Up to 99.99% | You operate it | 99.9% / 99.99% | You operate it |
| 100% renewable-powered | Yes | Depends on your DC | ~ varies by region | Depends on your DC |
Compiled from public product & pricing pages, June 2026; competitor features change — verify before quoting. Yes = supported, ~ = partial/conditional, No = not available.
Technical specifications
The detail an infrastructure architect actually evaluates. Items tagged for review are confirmed against a live cluster before publishing — we would rather leave a value open than print one we cannot stand behind.
- Control planeOKD/OpenShift, 3-node HA, etcd quorum, managed
- VirtualisationKubeVirt — VMs as first-class objects, live-migration
- Container runtime
containerd/ CRI-O (CRI-conformant) Confirm - SDN / CNIOVN-Kubernetes + Multus (VLAN / VXLAN) Confirm default
- Load balancingMetalLB (Layer 2 / BGP)
- DC interconnectSubmariner cross-cluster / site-to-site
- CSI / storageRook Ceph (RBD / FS / RGW), OpenEBS local NVMe
- Storage classesNVMe local, Ceph block / file / S3
- NetworkingDual-stack IPv4 / IPv6, NetworkPolicy, floating IPv4
- Backup / DRVelero, CSI snapshots, cross-region replication
- Instance families
cx1/m1/n1/o1/rt1/bm1, GPU optional - Scale
bm1.large48 vCPU / 128 GB; 100+ nodes, 512 GB/node - TenancyShared-HW (VPC) or single-tenant bare-metal (DPC)
- AutomationREST API, Terraform / Ansible Confirm, GitOps
- SLAUp to 99.99% (tier-dependent)
- RegionNetherlands (EU), 100% renewable-powered
What teams build on a VDC
Each of these is well-served because the substrate is standard — the same patterns you would run on-prem, on infrastructure that happens to be self-service, sovereign and renewable.
Enterprise private cloud
A self-service software-defined datacenter for internal business units — pooled compute, per-team projects, quotas and SDN, all behind one API.
MSP multi-tenant platform
Operate isolated tenants for your own customers on shared or dedicated pools, federated across regions with Submariner — a hosting platform you control end to end.
VMware → KubeVirt migration
Modernise off per-core licensing by re-homing VMs onto KubeVirt — keep running virtual machines while you containerise at your own pace, on one pool.
Regulated workloads
Finance, healthcare and government estates on EU-sovereign, single-tenant DPC pools with a signed DPA — subject to your compliance scope. Review
Dev / test environments
Spin up isolated, quota-bounded environments per team or per branch through the API — identical to production, torn down when done.
Substrate for VDI & AI
The same pool underpins our VDI desktops and GPU-backed AI platforms via OpenDataHub — one datacenter region, many higher-level services on top.
The questions an engineer actually asks
What is a Virtual DataCenter, and how is it different from a VPC?
Can I really run VMs and containers together?
virtctl and the API just as you manage pods — one pool, no VM/container divide, no stranded capacity.How is tenant isolation actually enforced?
NetworkPolicy separate tenants everywhere. Physically: VPC pools share hardware with logical isolation, while DPC pools are single-tenant bare-metal with kernel, hardware and network isolation. You choose the axis per workload — and can mix both in one VDC.What is the difference between VLAN and VXLAN here?
Can I migrate off VMware?
Does Terraform / IaC work against it?
kubectl and virtctl are provided; Terraform and Ansible work against the standard API and GitOps via Argo CD or Flux is ready out of the box. Confirm Are there egress costs?
How are HA and DR handled?
VolumeReplication at €0.0465/GB-month, sized to your RPO/RTO.Can I interconnect with my on-prem datacenter?
Is the sovereignty real, or “sovereignty-washing”?
What is the SLA?
How does pricing work?
Will I get locked in?
Can I provision it myself, through an API?
Run your own datacenter region on a sovereign, renewable cloud.
Stand up a software-defined Virtual DataCenter — VMs and containers, SDN and SDS, multi-tenant and API-driven — or talk to our engineers about migrating off VMware without re-architecting.
100% renewable energy · EU data residency · No US Cloud Act exposure · No vendor lock-in
