Software-defined datacenter · built in Europe
Your own datacenter region, defined in software.
A Virtual DataCenter is a self-service, API-driven slice of GRN infrastructure that your organisation operates like its own private region. Pooled compute — KubeVirt VMs and containers side by side — with software-defined networking, software-defined storage and hard multi-tenant isolation, all behind one declarative API. The agility of cloud with the control of on-prem, and a clean exit off per-core hypervisor licensing.
- VMs + containers, one fabric
- SDN · VLAN + VXLAN overlay
- Software-defined storage
- SLA up to 99.99%
EU-owned, in the Netherlands, on 100% renewable power · View pricing
Overview
Think of it as a region of your own.
A Virtual DataCenter is a logically — and on dedicated tiers, physically — isolated slice of GRN infrastructure, with its own pooled compute, software-defined networks, software-defined storage and quotas, all behind one declarative API. You design and run the topology like a datacenter architect; we run the metal, the control plane and the storage fabric beneath it.
The problem it solves. The private datacenter still makes sense for control, sovereignty and steady-state economics. The way most organisations run one — bought hardware on a refresh cycle, virtualised with per-socket licences, networked with hand-cut VLANs — is where the pain lives.
- Capex and refresh cycles — you buy three years of peak capacity up front, run it at 30%, and repeat the purchase before it is paid off. Capacity is a procurement project, not an API call.
- VMware / Broadcom licensing shock — per-socket became per-core, perpetual became subscription, and the renewal quote arrived with a multiple in front of it.
- Rigid hardware VLANs — a new segment means a switch change, a ticket and a maintenance window. The network cannot move at application speed.
- Two stacks that never meet — VMs on one platform, containers on another, each with its own networking, storage and operations team.
- Capacity stranded in silos — spare cores on the VM cluster cannot help the container cluster.
- Sovereignty without the agility — on-prem gives you control and residency, but loses the self-service and elasticity that pulled everyone to the cloud.
# a container workload $ kubectl -n finance get deploy NAME READY UP-TO-DATE AVAILABLE ledger-api 6/6 6 6 # a virtual machine, same cluster, same quota $ kubectl -n finance get vm NAME AGE STATUS READY oracle-db-01 92d Running True $ virtctl migrate oracle-db-01 VM oracle-db-01 was scheduled to migrate
What GRN operates
Run and on-call for the platform layer — the undifferentiated heavy lifting.
- The physical hosts, the OKD/OpenShift control plane and the KubeVirt virtualisation layer, patched and backed up
- The SDN fabric (OVN + Multus + MetalLB) and the Ceph / OpenEBS storage fabric
- Hardware replacement, capacity on request and the underlying network plumbing
- The hard tenant boundary — logical on VPC, kernel + hardware on DPC
- The up-to-99.99% SLA, on dedicated tiers, with named senior engineers
What you operate
Your datacenter, self-service — with full project-admin.
- Your VMs and containers: images, instance sizing, placement and scaling
- Your network design: VLAN segments, VXLAN overlays, subnets, firewall and load-balancer rules
- Projects, RBAC bindings, quotas and the internal tenant model
- Your IaC: Terraform, Ansible and GitOps (Argo CD / Flux) against the standard API
- The decision to leave: standard APIs and image formats mean you can export and walk
The same stack underneath every tier. A Virtual DataCenter runs the identical cloud-native foundation as our Virtual Private Cloud and Dedicated Private Cloud — the only difference is the isolation and dedication of the compute beneath it. Run on shared-hardware VPC pools, or on single-tenant bare-metal DPC pools with kernel and hardware isolation for regulated and high-security workloads. You are never re-platforming to move between them.
Key features
Everything that used to be a box in a rack, defined in code.
One pool, two workload types
KubeVirt runs full virtual machines as first-class objects next to containers, co-scheduled on the same nodes against the same quotas — so capacity is never stranded on the wrong side of a VM/container divide.
Software-defined networking
Segments, overlays, firewalls and load balancers are declared in code and provisioned in seconds. VLAN segmentation via Multus attachments, VXLAN overlay via OVN-Kubernetes — no switch change, no ticket, no maintenance window.
Software-defined storage
No SAN to buy, no array to forklift-upgrade. A pool of disks turned into block, file and object classes by Ceph and OpenEBS, provisioned dynamically through standard CSI drivers and billed per GB-month.
Hard multi-tenancy
Projects, RBAC, resource quotas and default-deny NetworkPolicy separate tenants logically; VPC pools share hardware while DPC pools are single-tenant bare metal with kernel, hardware and network isolation. Mix both in one VDC.
Infrastructure as code, end to end
Every object — VMs, networks, storage, quotas, RBAC — is a declarative resource behind one API. Provision from the console for exploration, then codify it and let Argo CD or Flux keep it that way.
Hybrid by interconnect
Submariner provides encrypted cross-cluster connectivity with service discovery to your on-prem racks and other GRN regions — a VDC extends your existing datacenter rather than replacing it overnight.
Platform capabilities
The OpenShift and KubeVirt capabilities we operate underneath your region.
The datacenter lifecycle, managed end to end
The interesting question about a datacenter is not day one — it is day two: who owns the maintenance that could disrupt your VMs, and what happens when a host dies at the weekend. And, eventually, how cleanly you can leave.
Provision
Resource pools, networks and storage classes on VPC or DPC, API-reachable in minutes
Operate
You run VMs and containers via API, console or GitOps; we keep the platform healthy
Scale
Grow pools on demand, add GPU or memory capacity, move to dedicated DPC hosts
Recover / DR
Velero backup, CSI snapshots and cross-region replication to your RPO/RTO
Decommission
Standard APIs and image formats mean a clean export to any conformant platform
Day-2 and portability, stated honestly. VMs live-migrate across hosts so host maintenance is invisible to your workloads, and the control plane is patched and upgraded by us on a coordinated schedule. Because the substrate is upstream Kubernetes + KubeVirt and your disks are standard images, leaving is an export, not a rewrite — the EU Data Act (applicable 12 September 2025) makes that switching capability a legal requirement, not a courtesy. Confirm cadence
Isolation, on an axis you choose
A datacenter region needs real tenant boundaries — whether your tenants are internal business units or external customers. Isolation runs on two axes: the logical model that applies everywhere, and the physical axis from shared-hardware VPC to single-tenant bare-metal DPC.
Projects & namespaces
Each tenant gets its own project: a hard boundary for workloads, networks, storage and identity. Nest business units or customers as separate projects under one VDC.
RBAC & identity
Fine-grained RBAC across projects and resources, with OIDC federation to your own IdP and full audit logging of privileged actions.
Network isolation
Default-deny NetworkPolicy, per-tenant VLAN/VXLAN segments and private subnets — tenants cannot see each other's traffic unless you allow it.
Resource quotas
Hard CPU, memory and storage quotas plus reservations per project, so a noisy tenant cannot starve the others or overrun the pool.
VPC: shared hardware
Logical isolation over a shared, multi-tenant host pool — the cost-efficient default for internal segmentation and most production workloads.
DPC: kernel + hardware
Single-tenant bare-metal pools with kernel, hardware and network isolation — for regulated, high-security or noisy-neighbour-sensitive workloads.
Security through standard primitives, layered
Security is enforced across identity, network, workload and data — using primitives your team already audits against, not proprietary bolt-ons that only we understand.
- RBAC across projects, namespaces and resources, with full audit logging
- Identity integration via OAuth / OIDC — bring your own IdP
- Secrets with encryption at rest; external secret stores supported
- TLS everywhere, issued and rotated automatically via cert-manager
- Default-deny micro-segmentation with standard NetworkPolicy
- Pod & VM security standards enforced at the project level
- Audit logging of privileged and API actions
- Hardware & kernel isolation on single-tenant DPC pools
- Image & supply-chain scanning Pending validation
- Private VDCs with no public API exposure Pending validation
High availability, backup & DR
A datacenter you cannot recover is a liability. HA is built into the platform; backup and DR are wired in and priced transparently, sized to the RPO/RTO targets you already work to.
- High availability — redundant control-plane nodes with an etcd quorum and automated failover; workloads reschedule across hosts on failure, and VMs live-migrate for planned maintenance.
- Backup & snapshots — scheduled Velero backups and CSI volume snapshots of VM disks and persistent volumes, application-consistent and restorable per workload, at €0.008/GB-month.
- Cross-region DR — Ceph VolumeReplication mirrors data to a second region for geo-redundancy at €0.0465/GB-month, with failover designed around your declared RPO and RTO.
On compliance, the honest version. The platform runs under EU-only data residency with a signed DPA and no US Cloud Act exposure, which is the substantive part of most regulated requirements. We will support PCI-DSS, HIPAA and NIS2-aligned deployments on dedicated, isolated infrastructure — but we do not claim certifications we do not hold. Tell us your compliance scope and we will tell you precisely what we can and cannot attest to. Review
Automation surface
| Tool | Use | Availability |
|---|---|---|
| Kubernetes / OpenShift REST API | Native control surface for every VDC object | Provided |
| kubectl / virtctl | Direct CLI control of containers and VMs | Provided |
| Terraform | Declarative provisioning of VDC resources | Compatible Confirm |
| Ansible | Configuration management & day-2 automation | Compatible Confirm |
| Argo CD | GitOps continuous reconciliation | Compatible / customer-driven |
| Flux | GitOps continuous reconciliation | Compatible / customer-driven |
"Provided" means run and supported by GRN; "Compatible / customer-driven" means it works against the standard API and you operate it, unless contracted as a managed add-on.
Benefits
The operational and commercial differences you can verify.
Sovereign & secure
EU-owned infrastructure under Dutch jurisdiction — not a US hyperscaler's "European region", which stays subject to the US Cloud Act regardless of where the data sits. Hard multi-tenant isolation, EU-only residency and a signed DPA. On DPC pools you get kernel, hardware and network isolation, not just a logical boundary.
Affordable & transparent
Networking functions are included free, storage is a published €/GB-month, and annual commitments take 10% off. No per-socket hypervisor licensing, no core-tax renewal shock, and no egress tax — the line item that quietly consumes 15–40% of a typical hyperscaler bill. Verify egress
Sustainable
Hosted in the Netherlands on 100% renewable solar energy, with server heat reused to warm nearby buildings and peak-shaving to ease grid congestion. Sustainability with a mechanism behind it, not a logo.
Portable by standard APIs
VMs are standard disk images; workloads are standard Kubernetes objects. Move them on or off any conformant platform without re-architecting — a re-point, not a rebuild.
Burst and tier across the fabric
Keep regulated workloads on DPC pools in the VDC and run general workloads on VPC pools or a connected cluster — one topology, isolation exactly where you need it.
Contractual SLA
Availability scales with tier, up to a contractual 99.99% on dedicated DPC infrastructure — backed by redundant control-plane nodes, an etcd quorum and NVMe-oF storage with configurable IOPS. VPC tiers run at 99.9%+.
Architecture
A software-defined datacenter, layer by layer.
Everything that used to be a box in a rack — the hypervisor, the switches, the SAN — is software here, defined declaratively and provisioned through one API. Your workloads at the top; dedicated renewable-powered hosts at the bottom.
Tenant workloads
VMs + containersYou operate
Your virtual machines (via KubeVirt) and containers, scheduled side by side against the same pool — deployed through the API, console, Terraform or GitOps. One control surface for both.
Orchestration & control plane
OKD/OpenShift · KubeVirtGRN-managed
An OKD/OpenShift control plane with KubeVirt for virtualisation handles scheduling, RBAC, quotas, live-migration and self-healing across the pool — patched and operated by GRN.
SDN fabric
OVN · Multus · MetalLB · SubmarinerGRN-managed
OVN-Kubernetes for the overlay and east-west policy, Multus for multi-NIC and VLAN attachments, MetalLB for L2/BGP load balancing, Submariner for DC interconnect. VLAN segmentation and VXLAN overlay, defined in code.
Software-defined storage
Rook Ceph · OpenEBS · VeleroGRN-managed
Block, file and S3 object storage on Ceph; local NVMe via OpenEBS for latency-sensitive workloads; volume snapshots and Velero backup with cross-region replication. The SAN, in software.
Dedicated hosts
Netherlands · 100% renewableGRN-managed
Your resource pool on EU-owned hosts in the Netherlands — shared-hardware (VPC) or single-tenant bare-metal (DPC) — powered by 100% renewable solar with server-heat reuse.
Every layer uses standard, portable components — nothing proprietary you cannot reproduce on another conformant platform.
Common use cases
What teams build on a VDC.
Enterprise private cloud
A self-service software-defined datacenter for internal business units — pooled compute, per-team projects, quotas and SDN, all behind one API.
MSP multi-tenant platform
Operate isolated tenants for your own customers on shared or dedicated pools, federated across regions with Submariner — a hosting platform you control end to end.
VMware → KubeVirt migration
Modernise off per-core licensing by re-homing VMs onto KubeVirt — keep running virtual machines while you containerise at your own pace, on one pool.
Regulated workloads
Finance, healthcare and government estates on EU-sovereign, single-tenant DPC pools with a signed DPA — subject to your compliance scope. Review
Dev / test environments
Spin up isolated, quota-bounded environments per team or per branch through the API — identical to production, torn down when done.
Substrate for VDI & AI
The same pool underpins our VDI desktops and GPU-backed AI platform — one datacenter region, many higher-level services on top.
Technical highlights
The detail an infrastructure architect actually evaluates.
Items tagged for review are confirmed against a live cluster before publishing — we would rather leave a value open than print one we cannot stand behind.
| Control plane | OKD/OpenShift, 3-node HA, etcd quorum, managed |
| Virtualisation | KubeVirt — VMs as first-class objects, live migration |
| Container runtime | containerd / CRI-O (CRI-conformant) Confirm |
| SDN / CNI | OVN-Kubernetes + Multus (VLAN / VXLAN) Confirm default |
| Load balancing | MetalLB (Layer 2 / BGP) |
| DC interconnect | Submariner cross-cluster / site-to-site |
| CSI / storage | Rook Ceph (RBD / FS / RGW), OpenEBS local NVMe |
| Storage classes | NVMe local, Ceph block / file / S3 |
| Networking | Dual-stack IPv4 / IPv6, NetworkPolicy, floating IPv4 |
| Backup / DR | Velero, CSI snapshots, cross-region replication |
| Instance families | cx1 1–32 vCPU · m1 to 256 GB · n1 4–64 vCPU · o1 0.5–128 GB · rt1 real-time · bm1 bare metal · GPU optional |
| Scale | bm1.large 48 vCPU / 128 GB; 100+ nodes, 512 GB/node |
| Tenancy | Shared-hardware (VPC) or single-tenant bare-metal (DPC) |
| Automation | REST API, Terraform / Ansible Confirm, GitOps |
| SLA | Up to 99.99% (tier-dependent) |
| Region | Netherlands (EU), 100% renewable-powered |
Networking functions & pricing
| Function | Implementation | Price |
|---|---|---|
| Pod & VM networking | OVN-Kubernetes CNI + Multus (multi-NIC) Confirm default | Included |
| VLAN segmentation | Multus VLAN / bridge attachments | Included |
| VXLAN / overlay networks | OVN-Kubernetes Geneve/VXLAN overlay Confirm default | Included |
| Micro-segmentation / firewall | NetworkPolicy (default-deny capable) | Included |
| Load balancing | MetalLB (Layer 2 / BGP) | Included |
| Site-to-site / DC interconnect | Submariner cross-cluster tunnels | Included |
| NAT / egress | Egress IP / egress router | Included |
| Private subnets / isolated networks | OVN logical switches + NetworkPolicy | Included |
| Public / floating IPv4 | MetalLB-advertised address | € 3.00 / mo |
| BYO-IP / BYO-ASN (BGP) | MetalLB BGP peering | € 50.00 / mo |
| Data egress | No per-GB metering Verify | No egress tax |
Dual-stack IPv4 / IPv6 throughout. Prices in EUR, ex VAT; 10% discount on annual commitment. Verify current rates on the pricing page before quoting.
Storage classes & pricing
| Storage class | Implementation (CSI) | Best for | Price |
|---|---|---|---|
| Local NVMe | OpenEBS LocalVolume | Latency-sensitive — databases, brokers | € 0.044 / GB-mo |
| Block (RWO) | Rook Ceph RBD | VM disks, general-purpose volumes | € 0.044 / GB-mo |
| Shared file (RWX) | Rook Ceph FS | Shared volumes across VMs/pods | € 0.044 / GB-mo |
| S3 object | Ceph ObjectBucketClaim | Artifacts, backups, data lakes | € 0.044 / GB-mo |
| Cross-region replication | Ceph VolumeReplication | Geo-redundancy / DR | € 0.0465 / GB-mo |
| Backup & snapshots | Velero + CSI snapshots | Scheduled backup to meet RPO/RTO | € 0.008 / GB-mo |
All classes are dynamically provisioned and expandable. NVMe-oF with configurable IOPS available on dedicated tiers. Prices ex VAT.
Against VMware, the hyperscalers, and on-prem
An objective comparison against the incumbent ways to run a private cloud. Subjective claims ("faster", "simpler") are left out — only things you can check.
| Capability | GRN.CLOUD VDC | Proprietary / hyperscaler | Do it yourself | |
|---|---|---|---|---|
| VMware Cloud Foundation | Hyperscaler VPC (AWS/Azure) | Traditional on-prem | ||
| Vendor lock-in | None / portable APIs | Proprietary stack | ~ ecosystem pull | ~ hardware + hypervisor |
| Licensing model | No per-socket/core licence | Per-core subscription | Usage-based | Per-socket/core licence |
| Genuine EU sovereignty (non-US-owned) | ✓ Netherlands | ✕ US-owned vendor | ✕ US-owned | Depends on your DC |
| Pricing transparency | Published €/GB, flat tiers | ~ negotiated / opaque | ~ complex | Your capex |
| Egress / cross-AZ fees | Networking included | Your network | Per-GB + cross-AZ | Your network |
| VM + container unified | ✓ KubeVirt, one pool | ~ Tanzu add-on | ~ separate services | Separate stacks |
| Infrastructure control | High (self-service SDDC) | High | ~ abstracted | Total |
| SLA | Up to 99.99% | You operate it | 99.9% / 99.99% | You operate it |
| 100% renewable-powered | ✓ | Depends on your DC | ~ varies by region | Depends on your DC |
✓ yes · ~ partial · ✕ no. Compiled from public product & pricing pages, June 2026; competitor features change — verify before quoting.
FAQ
The questions an engineer actually asks.
What is a Virtual DataCenter, and how is it different from a VPC?
A VPC is a private network and compute boundary. A Virtual DataCenter is the whole software-defined datacenter around it — pooled compute (VMs and containers), software-defined networking, software-defined storage, multi-tenant projects and quotas — that you operate like your own region. A VPC can be one isolation tier inside a VDC; the VDC is the datacenter, the VPC is one network within it.
Can I really run VMs and containers together?
Yes. KubeVirt runs full virtual machines as first-class objects on the same nodes, scheduler, networks and storage classes as your containers. You manage VMs with virtctl and the API just as you manage pods — one pool, no VM/container divide, no stranded capacity.
How is tenant isolation actually enforced?
On two axes. Logically: projects/namespaces, RBAC, resource quotas and default-deny NetworkPolicy separate tenants everywhere. Physically: VPC pools share hardware with logical isolation, while DPC pools are single-tenant bare metal with kernel, hardware and network isolation. You choose the axis per workload — and can mix both in one VDC.
What is the difference between VLAN and VXLAN here?
VLAN segmentation is delivered through Multus VLAN/bridge attachments — useful where you map to existing physical segments. VXLAN/overlay networking is delivered through OVN-Kubernetes, decoupling the logical topology from the physical fabric so segments span hosts without a switch change. Both are declared in code.
Can I migrate off VMware?
Yes — that is one of the main reasons the VDC exists. Re-home virtual machines onto KubeVirt to drop per-core licensing, keep running them as VMs, and containerise at your own pace on the same pool. Tell us your current estate and we will scope the migration path.
Does Terraform / IaC work against it?
Everything is a declarative API object, so the VDC is fully infrastructure-as-code. The REST API, kubectl and virtctl are provided; Terraform and Ansible work against the standard API and GitOps via Argo CD or Flux is ready out of the box.
Are there egress costs?
Networking functions — firewall, load balancer, VLAN/VXLAN, NAT, VPN, private subnets — are included free; public/floating IPv4 is €3.00/month and BYO-IP/ASN €50.00/month. There is no per-GB egress tax.
How are HA and DR handled?
Redundant control-plane nodes with an etcd quorum and automated failover; workloads reschedule on host failure and VMs live-migrate for maintenance. Backup is scheduled Velero plus CSI snapshots at €0.008/GB-month, with cross-region VolumeReplication at €0.0465/GB-month, sized to your RPO/RTO.
Can I interconnect with my on-prem datacenter?
Yes. Submariner provides encrypted, cross-cluster connectivity with service discovery between your VDC, your on-prem racks and other GRN regions — so a VDC extends your existing datacenter rather than replacing it overnight.
Is the sovereignty real, or "sovereignty-washing"?
Genuinely EU-owned infrastructure under Dutch jurisdiction — not a US hyperscaler's "European region", which remains subject to the US Cloud Act regardless of where the bytes live. EU-only residency, a signed DPA, and no US ownership in the chain.
What is the SLA?
The SLA scales with tier, up to a contractual 99.99% on dedicated DPC infrastructure — backed by redundant control-plane nodes, an etcd quorum and NVMe-oF storage with configurable IOPS. VPC tiers run at 99.9%+.
How does pricing work?
Compute runs on the standard tiers (VPC from €99/month, DPC from €330/month, with a €99 control-panel fee on VPC/BMC); storage is €0.044/GB-month; backup €0.008 and cross-region replication €0.0465. Networking is included free apart from public IPv4 (€3) and BYO-IP/ASN (€50). Annual commitment takes 10% off.
Will I get locked in?
No. The substrate is upstream Kubernetes + KubeVirt, your VM disks are standard images and your workloads are standard objects. Export and run them on any conformant platform — the EU Data Act now makes that switching capability a legal requirement, not a courtesy.
Can I provision it myself, through an API?
The VDC is designed to be self-service: VMs, networks, storage, quotas and RBAC are all API objects, drivable from the console, REST API or IaC.
Run your own datacenter region on a sovereign, renewable cloud.
Stand up a software-defined Virtual DataCenter — VMs and containers, SDN and SDS, multi-tenant and API-driven — or talk to our engineers about migrating off VMware without re-architecting.
100% renewable energy · EU data residency · No US Cloud Act exposure · No vendor lock-in
Far far away, behind the word moun tains, far from the countries Vokalia and Consonantia, there live the blind texts. Separated they live in Bookmarksgrove right at the coast of
-
759 Pinewood Avenue
Marquette, Michigan -
info@domain.com
Online Support -
906-624-2565
Mon-Fri 8am-5pm
Switch The Language
Nederlands (Dutch)
English