Separate tenant network traffic across GPU infrastructure. vMetal coordinates supported Netris automation, while vCluster gives tenants independent control planes and dedicated workers through Private Nodes.
GPU clusters serving several tenants need network boundaries that match the trust level of each tenant.
Namespace-only designs depend on shared cluster and network components that are unsuitable for untrusted tenants.
A separate management stack for every tenant adds infrastructure and operational work.
Manual network configuration becomes harder to apply consistently as tenant environments change.
Private Nodes provide tenant-owned worker networking, and supported Netris integrations add Ethernet segmentation. vMetal coordinates infrastructure provisioning, while vCluster supplies separate tenant APIs; InfiniBand partitions require their own fabric configuration. vCluster Labs software powers 100K+ GPUs.
Combine isolated tenant control planes, Private Nodes, and optional Netris hardware network isolation for GPU infrastructure.
Tenant-owned CNI configuration and supported Netris integrations provide separate network controls for tenant network segmentation. Ethernet segmentation can use VLANs, VRFs and ACLs; InfiniBand isolation uses fabric partitions rather than Ethernet constructs.
Private Nodes dedicate worker capacity to one tenant cluster, with its own CNI and storage configuration. For tenant network segmentation, select physical servers or VMs according to the required infrastructure boundary.
vNode uses Linux user namespaces and seccomp to restrict workload privileges and system calls. It adds runtime hardening for tenant network segmentation without a guest kernel or hypervisor, complementing dedicated workers rather than allocating GPUs.
Every tenant cluster gets its own virtualized API server and RBAC boundary on the control plane cluster.
vCluster Platform supports air-gapped deployments and FIPS features on supported plans for regulated deployment patterns.
This isn’t a side project. Behind every vCluster deployment is 5+ years of deep K8s engineering, security hardening, and battle-tested infrastructure work at massive scale.
Talk to our team about your stack
Deploy vCluster on your infra in minutes
Go live with a hyperscaler-grade tenant experience in days
Private Nodes give a tenant its own worker networking configuration. Supported Netris integrations can add Ethernet segmentation through VLANs, VRFs and ACLs on compatible infrastructure. These controls require explicit setup and do not reserve all fabric bandwidth. InfiniBand uses partition keys and fabric management rather than Ethernet segmentation; design the relevant fabric controls alongside tenant cluster access policies.
Namespaces divide resources within a Kubernetes cluster, but share its API and cluster-wide administrative scope. RBAC, quotas and network policies remain useful controls. vCluster adds a separate tenant API and data store, with Private Nodes dedicating production workers. This reduces dependencies between tenant environments while platform administrators still manage the underlying infrastructure and its failure domains.
vCluster gives each tenant an independent Kubernetes API, data store and RBAC scope. Private Nodes dedicate worker capacity to that tenant, including its own CNI and storage configuration. vMetal orchestrates the machines underneath. This separates tenant administration and worker placement; shared infrastructure, application permissions and network policies still require an explicit security design.
Network segmentation establishes traffic boundaries, rather than guaranteeing GPU throughput. Latency and bandwidth depend on switch hardware, fabric topology, routing, RDMA configuration and the policies applied. Dedicated workers do not make a shared interconnect exclusive to one tenant. Benchmark representative workloads and configure congestion and access policies for your service; vNode runtime hardening addresses a different layer.
Supported plans include air-gapped deployment and FIPS features. Private Nodes, tenant-scoped access and optional network segmentation provide controls you can include in a regulated deployment. Select supported images and configurations, and validate the full environment against your requirements. These capabilities do not establish certification of the customer's service, application, hardware or operational procedures.
A tenant control plane and its worker capacity have different readiness requirements. Existing provisioned workers can shorten onboarding, while new machines require the selected infrastructure driver's provisioning workflow. Templates, networking, storage and GPU drivers must also be ready before workloads can run. Configure Private Nodes when creating the tenant cluster, and validate application readiness separately from Kubernetes API availability.
See how vCluster and Netris deliver per-tenant VLANs alongside Private Nodes.
