From IaaS to PaaS and Beyond: Value-Added Services for Service Providers on Nutanix
A service provider that sells vanilla IaaS and virtual machines competes on price per core. The providers that grow sell the services on top: load balancing that keeps an app up, encrypted connections with certificates handled for the tenant, a web application firewall (WAF) that stops attacks before they reach the app, and an API gateway that decides who can call an app's APIs and how often. Tenants pay for these every month, on top of every VM, and they carry a better margin than the VM underneath.
This post covers the multi-tenant foundation Nutanix gives a service provider, why value-added services are where a provider's business model goes next, and how Traefik Hub delivers those services on Nutanix Cloud Platform in 3 deployment models that a provider can sell as value-added tiers.
Start with the Right Foundation: Nutanix for Multi-Tenant Service Providers
A provider can only sell services per tenant if the platform keeps tenants apart, lets each one serve itself, and lets the provider run many of them from one place. Nutanix built that foundation for service providers.
Nutanix Service Provider Central (SP Central), generally available since August 2026, is the control plane for it. It manages many Prism Central instances, and each tenant gets its own space, quota, and sign-in, with self-service inside the guardrails the provider sets. Underneath, Nutanix Cloud Infrastructure 7.6 builds multi-tenancy on Prism Central projects through Projects 2.0, so a tenant is a project with its own VPC in each Prism Central. AHV runs the tenants' VMs, Flow Virtual Networking gives each tenant a private network, and Nutanix Kubernetes Platform (NKP) runs their Kubernetes.
For service providers, this is more than multi-tenant infrastructure management. SP Central provides a common foundation for repeatable cloud offerings and tenant self-service, helping providers introduce higher-value services without building their own multi-tenant control plane.
The network design stays with the provider. The SP Central 1.0 Admin Deployment Guide describes 3 tenant network models: a shared transit VPC with NAT, partial transit, and a tenant-specific transit VPC with its own BGP speakers and underlay VRF, which the guide calls the strongest isolation. Those 3 models come back later in this post as 3 price points.
Beyond the technology, Nutanix helps service providers develop differentiated cloud offerings through Powered by Nutanix. Its Verified Solutions program recognizes provider offerings built around defined architectures and best practices, including private cloud, disaster recovery, and multi-tenant infrastructure. Ecosystem technologies such as Traefik Hub can extend these offerings with application services and new recurring revenue opportunities.
For more on the platform, see Delivering Next Generation Multi-tenant Services, Powered by Nutanix: Solutions for the Service Provider, and the Nutanix Validated Design (NVD) Guide.
Move Up the Stack: From IaaS to PaaS and Beyond
Infrastructure as a service (IaaS) is where a provider starts, and it is also where prices are easiest to compare. A tenant can price a VM against any other cloud in minutes. A tenant that runs its apps on the provider's load balancing, certificates, firewall, and API gateway compares the whole service, and it stays.
That makes value-added services the first step of a business model that lasts. The same services serve a tenant at every level of the stack. On IaaS, they sit in front of the tenant's VMs on AHV. On platform as a service (PaaS), they sit in front of the tenant's containers on NKP. Beyond that, they become the controlled front door for the APIs a tenant publishes to its own customers.
A provider that builds the catalog once, on one platform, can sell it to a tenant on VMs today and to the same tenant on Kubernetes tomorrow, without changing what the tenant buys.
What Each Service Brings, and When Tenants Need It
Every tenant starts with VMs. These are the services it adds as its apps grow, and each one is its own line on the tenant's monthly bill:
| Service | What it gives the tenant | When a tenant needs it |
|---|---|---|
| Load balancing | Keeps an app up by spreading traffic across healthy servers and taking a failed one out of the pool on its own. | As soon as an app runs on more than one VM or container, or can't go down during an update. |
| Encrypted connections | HTTPS on every app, with certificates issued and renewed automatically, so every visit is private and the padlock shows in the browser. | Any app that faces the internet, takes a login, or handles customer data. |
| Web application firewall (WAF) | Inspects each request and blocks common attacks, such as SQL injection and cross-site scripting, before they reach the app. | Apps that take payments, store personal data, or face compliance audits such as PCI DSS. |
| API gateway | Decides who can call an app's APIs and how often: API keys, JWT and OpenID Connect sign-in, rate limits, and request checks against the API's OpenAPI definition. | Tenants that publish APIs to partners, mobile apps, or their own customers. |
“Enabling tenants to leverage value-added services is a great way for service providers to differentiate their offerings. We have been closely collaborating with Traefik Labs to validate Traefik Hub with Nutanix Cloud Platform and Nutanix SP Central. Our goal is to enable SPs to deliver additional value-added services such as web application firewalls, encrypted application delivery, and API gateways for their tenants in dedicated and shared private cloud services powered by Nutanix.”
Sachin Chheda, VP Service Provider and Global System Integrators, Nutanix
Add the Services Layer: Traefik Hub on Nutanix
Traefik Hub is the services layer for that catalog. It is one product that delivers all 4 services in front of VMs on AHV and containers on NKP, and the Nutanix partner page lists Traefik as a Nutanix Ready validated integration. Traefik Proxy is already the default ingress controller in NKP, and an NKP cluster can move up to Traefik Hub with one Helm chart.
For VMs, the key piece is the Prism Central provider, generally available since Traefik Hub v3.20.0. A provider can't sell a service that needs a ticket every time a tenant's VM gets a new address. The Prism Central provider removes that step: it reads AHV VMs from Prism Central and turns every powered-on VM that carries a chosen category into a server of a matching Traefik service. A category is the only thing set on the VM, and the provider needs only read access. A service account with the read-only Prism Viewer role and an API key is all it takes:
hub:
providers:
nutanixPrismCentral:
enabled: true
endpoint: https://prism-central.example:9440
apiKey: <prism-central-api-key>
serviceNameCategoryKey: TraefikServiceName
filename: /etc/traefik/nutanix/base.yaml
pollInterval: 10The category value names the service. A VM tagged TraefikServiceName: orders-api joins the orders-api service, and the routing rules, ports, health checks, and middlewares for that service live in a base configuration file on the gateway, kept in Git:
http:
services:
orders-api:
loadBalancer:
scheme: http
port: "80"
healthCheck:
path: /healthz
interval: 5sKubernetes routes then reference the discovered service as orders-api@nutanixprismcentral, the same way they reference any other Traefik service. No configuration names a VM or its address, so tenant VMs can come, go, and change addresses freely. Remove the category from a VM and it leaves the pool within 5 to 10 seconds. Add it back and the VM returns within 5 seconds, with no restart or configuration change.
The service provider can discover VMs across tenant projects through Prism Central using its own credentials, including Projects 2.0 environments managed through SP Central. A tenant can also run discovery itself: Traefik Hub v3.22 (Early Access) adds a tenantName option to the same provider, so a gateway pointed at SP Central with the tenant's own API key finds that tenant's VMs, with no Prism Central credentials.
Deliver Value-Added Services on Top of IaaS
Traefik Hub delivers all 4 services from one product, the same way for VMs and containers.
Most tenants run a mix of VMs and containers, and a catalog that needs one product for each doubles the provider's work and splits the tenant's policy. Traefik Hub serves both from the same gateway. Take a tenant app behind one host name: /api runs on AHV VMs found through Prism Central, and / runs on containers on NKP. One middleware chain protects both paths: a JWT check against a Keycloak realm, followed by a rate limit of 10 requests per second with a burst of 5. Requests sent all at once get the burst of 5 immediately, plus whatever the limit refills at 10 per second while they arrive.
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
name: tenant-jwt
spec:
plugin:
jwt:
trustedIssuers:
- jwksUrl: https://auth.example/realms/tenant-a/protocol/openid-connect/certs
issuer: https://auth.example/realms/tenant-a
claims: Equals(`team`, `store-ops`) && Contains(`aud`, `shop`)The policy enforces identically on both backends:
| Test | /api (AHV VMs) | / (NKP containers) |
|---|---|---|
| No token | 401 | 401 |
| Valid token | 200 | 200 |
| Altered signature, edited claim, forged HS256 token, or alg: none | 401 for each | 401 for each |
| 40 parallel requests with a valid token | 10 × 200, 30 × 429 | 10 × 200, 30 × 429 |
The tenant gets one policy, written once, in front of everything it runs. The provider gets one product to operate, patch, and support.
A services layer also has to be light, because every megabyte a gateway holds is a megabyte a tenant can't buy. Traefik Hub is a single static binary that installs in a few hundred megabytes. On NKP with the WAF on, each replica uses about 125 MiB of memory idle and stays under 300 MiB while serving about 2,100 requests per second, where a load-balancer appliance needs gigabytes. Routes and certificates drive memory most, so plan capacity on your own route and certificate counts.
For regulated tenants, Traefik Hub v3.21.0 added 2 images: Distro Zero, a minimal image with nothing in it but Traefik Hub, so there is far less to patch, and a FIPS 140-3 compliant image built on a validated cryptographic module, which government and regulated customers require.
Monetize 3 Ways, Whether You Sell IaaS or PaaS
Every provider decides how to keep its tenants apart on the network, and Traefik Hub follows that design. Each of SP Central's tenant network models has a natural place for Traefik Hub, and each place is a price point. The tiers work the same whether the tenant runs VMs on AHV, containers on NKP, or both.
Basic tier: inside the transit VPC. One Traefik Hub, run by the provider, serves many small tenants. The provider runs it with its own Prism Central credentials and limits discovery to the tenant VPCs it serves with the Prism Central provider's allowedVPCs option. Because one gateway serves many tenants, the provider keeps category assignment to itself and uses tenant-prefixed values such as tenant-a-orders, so each tenant's VMs join only that tenant's services and routes. Tenant subnets must not overlap and must be routable from the transit VPC, because the gateway reaches each VM at its own address. It has the lowest cost to run, spread across many tenants: an easy base price.
Premium tier: inside a dedicated transit VPC. A tenant that needs its own protection, such as one that takes payments, gets its own Traefik Hub in its own transit VPC. The provider still runs it and sets allowedVPCs to that tenant's VPC, so the gateway discovers only that tenant's VMs. Nutanix's guide calls this model the strongest isolation, with more administrator effort per tenant, which is what a premium tier pays for.
Enterprise tier: inside the tenant VPC. A tenant that wants to hold the keys gets its own Traefik Hub inside its own VPC, next to its workloads, run its way. With the tenantName option in Traefik Hub v3.22 (Early Access), that gateway discovers the tenant's VMs through SP Central with the tenant's own API key, so the tenant tags its own VMs.
All 3 tiers run from one place. SP Central manages each Prism Central, and each Prism Central runs every deployment model, so a provider can mix tiers across its tenant base without a second control plane. The provider can also vary the services by tier: for example, load balancing and encryption in Basic, the WAF added in Premium, and the API gateway added in Enterprise.
Tenants also grow, and a tenant can move up a tier while it keeps its web address. The mechanism is a weighted Traefik service: 2 backends sit behind one route, and the provider shifts the weights in steps.
apiVersion: traefik.io/v1alpha1
kind: TraefikService
metadata:
name: orders-api
spec:
weighted:
services:
- name: orders-api-current
port: 80
weight: 75
- name: orders-api@nutanixprismcentral
kind: TraefikService
weight: 25We have moved live traffic for a running app onto AHV VMs and NKP containers this way, in steps of 5%, 25%, and 100%, with a rollback in the middle. Across 3,001 API calls and 1,501 page loads during the moves, 0 requests failed. Each weight change took effect within 5 seconds, and a rollback returned all traffic to the old backend within about 5 seconds. A tier move uses the same weighted route with a different pair of backends, and every step up is more revenue for the provider.
Deploy with Confidence: Best Practices for the Full Nutanix Stack
This architecture runs on the full Nutanix stack a service provider operates: Traefik Hub on NKP 2.18 (Kubernetes 1.35), AHV, and Prism Central 7.6, with discovery, policy, and live traffic moves validated on Nutanix Cloud Clusters (NC2). These practices keep a production deployment clean:
- Install the current release with the Helm chart. The Traefik Hub Helm chart on NKP gives you the Prism Central provider and the hardened images from day one.
- Give Traefik Hub its own ingress class. Set a class such as traefik-hub on Hub and its routes, and Hub runs side by side with the Traefik in NKP's management plane (Kommander), with no overlap.
- Create the category key before you install. Hub then picks up every new VM and every tag change live, with no restart.
- Map VMs to HTTP services. Prism Central discovery fills HTTP services. Declare TCP and UDP backends in the base configuration.
- Keep the access read-only and verified. Give the provider a service account with the Prism Viewer role, and a Prism Central certificate it trusts.
Start the Conversation
Nutanix gives a service provider the multi-tenant platform: SP Central, Prism Central with Projects 2.0, AHV, Flow, and NKP. Traefik Hub adds the services tenants pay for on top: load balancing, encrypted connections with certificates handled, a WAF, and an API gateway, for VMs and containers alike, in whichever tier each tenant needs. Together, they take a provider from IaaS to PaaS and beyond on one platform.
For providers, the opportunity is to expand the value of existing IaaS relationships, not replace them. Application delivery and security services can be introduced for VM-based workloads today and extended to Kubernetes-based applications as customers evolve.
Watch the "Complete Your Catalog" video for the 5-minute version. Then contact your Nutanix or Traefik Labs team to plan your catalog.
You can also meet both teams at KubeCon + CloudNativeCon North America 2026, November 9 to 12 in Salt Lake City. Sudeep Goswami, CEO of Traefik Labs, is speaking at the Nutanix booth (#118) on Thursday, November 12, at 10:45 a.m., and the Traefik Labs team is at booth #290 throughout the show.
