On a GPU cluster, network isolation has to keep one tenant's traffic off another's path, ideally in the switch fabric as well as in software. Private Nodes give each tenant its own workers and CNI, and Netris adds per-tenant VLANs, VRFs and ACLs.
GPU clusters serving several tenants need network boundaries that match the trust level of each tenant.
Namespace-only designs depend on shared cluster and network components that are unsuitable for untrusted tenants.
A separate management stack for every tenant adds infrastructure and operational work.
Manual network configuration becomes harder to apply consistently as tenant environments change.
Private Nodes keep each production tenant's workloads on its own worker nodes, and Netris moves the network boundary into the physical fabric with per-tenant VLANs, VRFs, and ACLs. A separate virtualized control plane covers the API server and RBAC layer.
Combine isolated tenant control planes, Private Nodes, and optional Netris hardware network isolation for GPU infrastructure.
The Netris integration attaches each tenant network environment to its own hardware-backed L2 boundary.
Private Nodes dedicate physical or virtual worker capacity, networking, and storage to one tenant cluster at a time.
vNode uses Linux user namespaces and seccomp filters to strengthen the runtime boundary for tenant workloads and is designed to help prevent container breakout.
Every tenant cluster gets its own virtualized API server and RBAC boundary on the control plane cluster.
vCluster Platform supports air-gapped deployments and FIPS features on supported plans for regulated deployment patterns.
This isn’t a side project. Behind every vCluster deployment is 5+ years of deep K8s engineering, security hardening, and battle-tested infrastructure work at massive scale.
Talk to our team about your stack
Deploy vCluster on your infra in minutes
Go live with a hyperscaler-grade tenant experience in days
Private Nodes give each production tenant dedicated worker nodes and tenant-scoped networking. With vMetal and the Netris integration configured, each tenant network environment can get its own hardware-backed L2 boundary, enforced with VLANs, VRFs, and ACLs in the switch fabric.
In our analysis, namespace and NetworkPolicy controls operate inside shared cluster and network infrastructure. Private Nodes separate worker capacity, and Netris can move the network boundary into the physical fabric for untrusted tenants.
Yes. The tenant control plane runs as isolated pods on the control plane cluster, so it does not require separate control-plane servers. Private Nodes still provide dedicated production worker capacity.
Private Nodes run tenant workloads directly on their assigned worker nodes. vNode can add a stronger runtime boundary without adding a VM layer, while the GPU driver and device plugin remain responsible for presenting GPU resources.
vCluster Platform supports air-gapped deployments and FIPS features on supported plans. Netris network integration provides hardware-backed L2 isolation when configured for separate tenant network environments.
Tenant control planes come up in minutes, not hours. Bare metal provisioning time depends on the infrastructure driver, server state, OS image, and network configuration.
See how vCluster and Netris deliver per-tenant VLANs alongside Private Nodes.
