Give Kubernetes customers separate API and worker boundaries. vMetal provisions infrastructure, and vCluster assigns dedicated Private Nodes alongside independent tenant control planes.
Production tenant isolation requires more than a shared API server and namespace boundary.
Namespace-only designs share the API server and node-level components between tenants.
A separate management stack for every tenant increases infrastructure and operational work.
Customers expect self-service access to a Kubernetes environment they can manage without seeing the provider's control plane cluster.
vCluster gives customers independent Kubernetes control planes and dedicated workers through Private Nodes. vMetal manages the infrastructure layer, with optional runtime and network controls selected for the deployment's threat model. vCluster Labs serves 50+ GPU clouds & Fortune 500s.
vCluster combines isolated tenant control planes, Private Nodes, optional runtime isolation, and standard Kubernetes APIs.
Private Nodes dedicate worker capacity to one tenant cluster, with its own CNI and storage configuration. For customer Kubernetes security, select physical servers or VMs according to the required infrastructure boundary.
Every tenant gets its own virtualized Kubernetes control plane, API server, and RBAC boundary.
vNode uses Linux user namespaces and seccomp to restrict workload privileges and system calls. It adds runtime hardening for customer Kubernetes security without a guest kernel or hypervisor, complementing dedicated workers rather than allocating GPUs.
Tenant-owned CNI configuration and supported Netris integrations provide separate network controls for customer Kubernetes security. Ethernet segmentation can use VLANs, VRFs and ACLs; InfiniBand isolation uses fabric partitions rather than Ethernet constructs.
Tenant clusters use a certified Kubernetes distribution and standard APIs for existing workloads, tools, CRDs, and operators.
This isn’t a side project. Behind every vCluster deployment is 5+ years of deep K8s engineering, security hardening, and battle-tested infrastructure work at massive scale.
Talk to our team about your stack
Deploy vCluster on your infra in minutes
Go live with a hyperscaler-grade tenant experience in days
Namespaces divide resources within a Kubernetes cluster, but share its API and cluster-wide administrative scope. RBAC, quotas and network policies remain useful controls. vCluster adds a separate tenant API and data store, with Private Nodes dedicating production workers. This reduces dependencies between tenant environments while platform administrators still manage the underlying infrastructure and its failure domains.
Private Nodes are worker nodes joined to one tenant cluster, with that tenant's own CNI and storage configuration. They can be physical machines or supported VMs. Use dedicated bare metal when the service requires exclusive physical servers. vMetal can provision the underlying machines, while platform policies define which capacity a tenant may request and how it is released.
vCluster gives each tenant an independent Kubernetes API, data store and RBAC scope. Private Nodes dedicate worker capacity to that tenant, including its own CNI and storage configuration. vMetal orchestrates the machines underneath. This separates tenant administration and worker placement; shared infrastructure, application permissions and network policies still require an explicit security design.
vNode uses Linux user namespaces and seccomp to restrict workload privileges and system calls, helping prevent container breakout. It uses the underlying Linux kernel rather than a separate guest kernel. Add it as runtime hardening alongside dedicated Private Nodes, patching and least-privilege policies. Validate kernel, container runtime, GPU access and workload compatibility; it is not a replacement for GPU allocation or application authorization.
Standard Kubernetes APIs support familiar deployment tools, but migration still requires validation of storage, networking, identity, GPU drivers and runtime-dependent operators. Create a tenant cluster with the required Private Nodes configuration, test representative workloads, and plan data movement and rollback before switching traffic. Boost Run's launch timeline is not a migration estimate for your existing environment.
Supported plans include air-gapped deployment and FIPS features. Private Nodes, tenant-scoped access and optional network segmentation provide controls you can include in a regulated deployment. Select supported images and configurations, and validate the full environment against your requirements. These capabilities do not establish certification of the customer's service, application, hardware or operational procedures.
See how vCluster delivers production-grade tenant isolation on your GPU infrastructure.
