A network slice manager receives a workload mobility request to add network resources to a domain in the communication network, and authenticates a virtual network function (VNF) with a blockchain authentication function (BAF) over a blockchain network interface based on the workload mobility request. The network slice manager further receives an indication of a successful authentication from the BAF, and instantiates the VNF in the domain of the communication network based on the indication of the successful authentication. Notably, these authentication processes may be readily adapted to instantiate new network resources or migrate existing network resources between domains.