platform-eng
Secure Kubernetes GPU Sharing for Isolated Tenants
vCluster gives every tenant a fully isolated Kubernetes cluster on shared GPU hardware, with their own API server, RBAC, and control plane running as lightweight pods.
Trusted by the fastest-growing AI cloud providers
Problem
GPU Sharing Without Isolation Breaks Down
Standard Kubernetes forces teams to choose between efficiency and tenant safety.
Namespace Isolation Is Too Weak
Namespace-level boundaries leave tenants exposed to cluster-wide agents, other workloads, and shared blast radius on GPU nodes.
Separate Clusters Are Too Expensive
Provisioning a dedicated physical cluster per tenant drives up cost and eliminates the efficiency gains of Kubernetes GPU sharing.
GPU Contention Kills Performance
Without proper tenant isolation, noisy-neighbor workloads compete for GPU resources, degrading performance across every team.
Solution
Tenant Clusters That Share GPUs Without Sharing Risk
vCluster virtualizes the Kubernetes control plane so each tenant gets a real, CNCF-certified K8s cluster as a lightweight pod on shared GPU hardware. One host cluster runs hundreds of fully isolated tenant environments with no extra physical infrastructure. Production-proven across 100K+ GPU nodes.
Built for Secure Kubernetes GPU Sharing at Scale
Every layer of the stack — control plane, node isolation, workload runtime, and networking — is designed for safe, efficient GPU sharing across tenants.
Control Plane
Isolated Tenant Clusters on Shared GPUs
Each tenant gets their own Kubernetes API server, etcd, scheduler, and RBAC running as a lightweight pod. Spin up tenant clusters in seconds on shared GPU hardware without provisioning new physical nodes.
- Own API server per tenant
- Seconds to provision tenant clusters
- No physical cluster overhead
GPU Isolation
Dedicated GPU Nodes Per Tenant
Assign dedicated physical GPU nodes to specific tenants, eliminating noisy-neighbor contention. Each tenant's workloads run on reserved hardware while operating within the shared Kubernetes GPU sharing architecture.
- Reserved GPU nodes per tenant
- No noisy-neighbor GPU contention
- Consistent GPU performance per tenant
Resource Efficiency
Shared Nodes for Cost-Efficient GPU Utilization
For teams that need to maximize GPU density, shared nodes let multiple tenants schedule workloads on the same physical GPU hardware with namespace boundaries and resource quotas enforced at the platform level.
- Maximum GPU utilization density
- Resource quotas enforced per tenant
- Flexible sharing policies
Workload Security
Kernel-Native Isolation Without VM Overhead
vNode (currently in private beta) adds kernel-level workload isolation using seccomp, cgroups, namespaces, and AppArmor per workload. Tenants sharing GPUs get container breakout protection at bare metal performance with no hypervisor tax.
- Container breakout protection
- No hypervisor performance penalty
- Compatible with gVisor and Kata
Standards Compliance
CNCF-Certified K8s Per Sharing Tenant
Every tenant environment in the Kubernetes GPU sharing stack is a fully conformant, CNCF-certified Kubernetes cluster. Tenants get 100% API compatibility and can install their own CRDs, operators, and tooling without restriction.
- 100% Kubernetes API compatibility
- Full CRD and operator support
- CNCF-certified per tenant
Why vCluster
This isn’t a side project. Behind every vCluster deployment is 5+ years of deep K8s engineering, security hardening, and battle-tested infrastructure work at massive scale.
100K+
GPU Nodes Powered
50+
GPU Clouds & F500s
<45
Days to Launch
30K
GitHub Stars
Get Started in 3 Steps
1
Schedule a Demo
Talk to our team about your stack
2
Deploy vCluster
Deploy vCluster on your infra in minutes
3
Onboard Your Tenants
Go live with a hyperscaler-grade tenant experience in days
FAQs
How does vCluster enable Kubernetes GPU sharing with strong tenant isolation?
vCluster virtualizes the Kubernetes control plane itself — each tenant gets a dedicated API server, etcd, scheduler, and RBAC running as a lightweight pod inside a shared host cluster. This means multiple tenants can share the same physical GPU nodes while remaining completely isolated at the control plane level. Unlike namespace isolation, tenants cannot see each other's workloads, CRDs, or platform internals. Unlike separate physical clusters, there is no per-tenant hardware cost.
What isolation options are available for tenants sharing GPU nodes?
vCluster supports a flexible isolation spectrum. Shared Nodes allow multiple tenants on the same GPU hardware with resource quota boundaries for maximum density. Dedicated Nodes assign specific GPU nodes to a single tenant, eliminating noisy-neighbor contention. Private Nodes go further with their own CNI and CSI per tenant. vNode (currently in private beta) adds kernel-native workload isolation using seccomp, cgroups, and AppArmor for container breakout protection across all configurations.
Does Kubernetes GPU sharing with vCluster affect GPU performance?
vCluster control planes run as lightweight pods with minimal overhead — they do not introduce a hypervisor layer or VM tax between workloads and the GPU. When combined with vNode for workload isolation, the stack uses kernel-native mechanisms like cgroups and namespaces rather than full VMs, preserving bare metal GPU throughput. vCluster powers 100K+ GPU nodes in production across 50+ GPU cloud customers.
Can tenants install their own GPU operators and CRDs in a shared cluster?
Yes. Every tenant cluster is a fully CNCF-certified Kubernetes environment with cluster-admin permissions. Tenants can install their own CRDs, GPU operators, RBAC policies, and tooling without affecting other tenants or the underlying host cluster. CRD and resource syncing between the virtual and host cluster is also supported for advanced configurations.
Is vCluster used in production GPU cloud environments today?
Yes. vCluster powers 100K+ GPU nodes in production and is deployed across 50+ GPU cloud providers and Fortune 500 customers, including CoreWeave and Nscale. It is named in the NVIDIA DGX SuperPOD reference architecture and referenced in the SemiAnalysis ClusterMax evaluation criteria for GPU cloud providers.
How quickly can we deploy a Kubernetes GPU sharing environment with vCluster?
Tenant clusters provision in seconds once the host cluster is running. For teams starting from bare metal, vMetal handles zero-touch provisioning from PXE boot through OS installation and machine registration before vCluster takes over. Boost Run launched a full managed Kubernetes offering in less than 45 days using vCluster, and Lintasarta launched Indonesia's leading GPU cloud in 90 days.
Start Sharing GPUs Without Sacrificing Isolation
See how vCluster delivers secure, isolated tenant clusters on shared GPU hardware.
