Tenant Connection, VPN, and Service Access
Tenant network access is separate from GWEB platform-administrator network access.
Tenant connection
Use the connection method assigned during tenant onboarding.
Depending on the tenant and enabled GWEB Cloud service, access may use:
- normal tenant-facing HTTPS/API connectivity;
- tenant-specific VPN/private connectivity;
- an approved service-access workflow.
Not every tenant requires VPN access.
Tenant VPN
If tenant VPN is enabled, GWEB provides the tenant-specific configuration or private connection material through the approved onboarding process.
The tenant documentation can explain how to use the supported tenant VPN/service-access feature, but tenants must not receive or reuse GWEB administrator VPN credentials.
gwebc may expose tenant-safe VPN/service-access workflows when those capabilities are enabled for the tenant.
Safety
Tenants must never publish or share:
- tenant VPN private keys;
- OIDC/session tokens;
- service credentials;
- another tenant's connection material;
- GWEB platform credentials.
Application networking
Normal tenant deployment should describe the application's required service ports and protocols through the supported application/deployment model rather than requesting unrestricted host networking.
Special workloads such as real-time UDP/media services can require explicit GWEB approval, dedicated workers, or additional network policy.
Troubleshooting
If a tenant cannot reach a GWEB tenant-facing service:
- verify the assigned connection/VPN is active if one is required;
- verify tenant authentication;
- verify the intended tenant profile;
- verify that the requested service-access capability is enabled;
- contact GWEB with the tenant, environment, application/service, timestamp, and tenant-visible error.
E3 managed outbound HTTPS
Application outbound access remains default-deny. E3 adds tenant-authorized, controller-owned public HTTPS egress for mutable non-production environments.
Managed outbound HTTPS
Application outbound access remains default-deny.
Tenant applications in dev and preprod can enable application-scoped managed public HTTPS egress through gwebc.
Production NetworkPolicy mutation remains disabled.
See ../gwebc/egress.md.
Current private-network product status
Managed application public HTTPS egress is an accepted tenant self-service feature in dev and preprod.
Tenant VPN/private networking is separate and remains IN PROGRESS.
Current control-plane work includes tenant network allocation, device binding records. Those records do not prove that the tenant private-network data plane is active.
Remaining work includes desired-state v2, gateway reconciler v2, actual tenant 10.130.x.x runtime realization, tenant connect/disconnect UX, and final hard isolation acceptance.