A cloud provider is building a multi-tenant GPU cluster where each host runs several isolated customer VMs. Operators notice that a significant fraction of host CPU cycles are consumed by virtual switching, encryption, and storage networking, reducing the CPU capacity available for tenant workloads. They want to offload this infrastructure processing off the host CPU while also enforcing per-tenant network isolation at line rate. Which component should they add to each server to address this?