An orchestration system operated by a data center provider for a data center, the orchestration system comprising: processing circuitry coupled to a memory; and software instructions stored in the memory and configured for execution by the processing circuitry to: map packet flow virtual network identifiers to a virtual network identifier space of a plurality of tenants of the data center, wherein a tenant of the data center is associated with a first virtual network identifier of the virtual network identifier space and a second virtual network identifier of the virtual network identifier space; identify (404, 406) flow statistics corresponding to the tenant based upon the first virtual network identifier and the second virtual network identifier in the mapping; compute, based on the flow statistics indicating a first packet flow having the first virtual network identifier associated with the tenant and a second packet flow having the second virtual network identifier associated with the tenant, an aggregate bandwidth for a plurality of packet flows associated with the tenant and processed by a virtual network function that is assigned to the tenant and executes on physical compute resources of a server of the data center; and modify, based on the aggregate bandwidth, an allocation of the physical compute resources of the server to re-assign a portion of the physical compute resources of the server between the virtual network function assigned to the tenant and one or more virtual network functions associated with a different tenant. processing circuitry coupled to a memory; and software instructions stored in the memory and configured for execution by the processing circuitry to: map packet flow virtual network identifiers to a virtual network identifier space of a plurality of tenants of the data center, wherein a tenant of the data center is associated with a first virtual network identifier of the virtual network identifier space and a second virtual network identifier of the virtual network identifier space; identify (404, 406) flow statistics corresponding to the tenant based upon the first virtual network identifier and the second virtual network identifier in the mapping; compute, based on the flow statistics indicating a first packet flow having the first virtual network identifier associated with the tenant and a second packet flow having the second virtual network identifier associated with the tenant, an aggregate bandwidth for a plurality of packet flows associated with the tenant and processed by a virtual network function that is assigned to the tenant and executes on physical compute resources of a server of the data center; and modify, based on the aggregate bandwidth, an allocation of the physical compute resources of the server to re-assign a portion of the physical compute resources of the server between the virtual network function assigned to the tenant and one or more virtual network functions associated with a different tenant. map packet flow virtual network identifiers to a virtual network identifier space of a plurality of tenants of the data center, wherein a tenant of the data center is associated with a first virtual network identifier of the virtual network identifier space and a second virtual network identifier of the virtual network identifier space; identify (404, 406) flow statistics corresponding to the tenant based upon the first virtual network identifier and the second virtual network identifier in the mapping; compute, based on the flow statistics indicating a first packet flow having the first virtual network identifier associated with the tenant and a second packet flow having the second virtual network identifier associated with the tenant, an aggregate bandwidth for a plurality of packet flows associated with the tenant and processed by a virtual network function that is assigned to the tenant and executes on physical compute resources of a server of the data center; and modify, based on the aggregate bandwidth, an allocation of the physical compute resources of the server to re-assign a portion of the physical compute resources of the server between the virtual network function assigned to the tenant and one or more virtual network functions associated with a different tenant.