platform-eng
Separate Kubernetes Cluster Per Tenant for AI Clouds
Give each tenant a separate Kubernetes API and dedicated workers. vMetal supplies machines, and vCluster combines lightweight tenant control planes with Private Nodes.
Trusted by the fastest-growing AI cloud providers
Problem
Customer Kubernetes Needs Explicit Tenant Boundaries
Customer-facing Kubernetes needs stronger tenant boundaries than a shared API server and namespace model.
Namespaces Share Control-Plane Components
Namespace-only designs share control-plane and node-level components between tenants.
Separate Management Stacks Add Work
A separate management stack for every tenant increases infrastructure and operational work.
Cluster Dependencies Widen Incident Scope
Shared control-plane components make configuration mistakes and operational incidents harder to contain within one tenant.
Solution
Separate Cluster Per Tenant Kubernetes With Private Nodes
vCluster provides a separate Kubernetes API and data store for each tenant. vMetal supplies machine capacity and Private Nodes dedicate workers, while Platform coordinates fleet access and templates. vCluster Labs serves 50+ GPU clouds & Fortune 500s.
Built for Separate Tenant Clusters
A separate Kubernetes cluster per tenant combines independent APIs, dedicated Private Nodes, standard tooling and centralized fleet operations.
Tenant Isolation
Separate Control Plane Per Tenant
Each tenant receives its own virtualized API server and RBAC boundary on the control plane cluster.
- Independent tenant API and data store
- Tenant-scoped scheduling on Private Nodes
- No dedicated control-plane servers per tenant
Worker Isolation
Private Nodes Per Tenant
Private Nodes dedicate worker capacity to one tenant cluster, with its own CNI and storage configuration. For separate customer clusters, select physical servers or VMs according to the required infrastructure boundary.
- Dedicated worker nodes per tenant
- Tenant-owned CNI and storage configuration
- Physical servers or supported VMs
Standards Compliance
Standard Kubernetes APIs
Tenant clusters use a certified Kubernetes distribution and standard APIs for existing tools, CRDs, and operators.
- Standard Kubernetes APIs
- Familiar Kubernetes clients and tools
- Validate infrastructure integrations
Self-Service
Cluster Admin Within Each Tenant
Tenants receive cluster-admin inside their own environment without access to the provider's control plane cluster.
- Cluster admin within the tenant
- Tenant-scoped Kubernetes API access
- Tenant-scoped administration
Workload Security
Runtime Isolation With vNode
vNode uses Linux user namespaces and seccomp to restrict workload privileges and system calls. It adds runtime hardening for separate customer clusters without a guest kernel or hypervisor, complementing dedicated workers rather than allocating GPUs.
- Linux user namespaces and seccomp
- No guest kernel or hypervisor
- Helps limit workload breakout
Why vCluster
This isn’t a side project. Behind every vCluster deployment is 5+ years of deep K8s engineering, security hardening, and battle-tested infrastructure work at massive scale.
100K+
GPUs Powered
50+
GPU Clouds & F500s
<45
Days to Launch
30K
GitHub Stars
Get Started in 3 Steps
1
Schedule a Demo
Talk to our team about your stack
2
Deploy vCluster
Deploy vCluster on your infra in minutes
3
Onboard Your Tenants
Go live with a hyperscaler-grade tenant experience in days
FAQs
What does a separate Kubernetes cluster per tenant provide?
vCluster gives each tenant an independent Kubernetes API, data store and RBAC scope. Private Nodes dedicate worker capacity to that tenant, including its own CNI and storage configuration. vMetal orchestrates the machines underneath. This separates tenant administration and worker placement; shared infrastructure, application permissions and network policies still require an explicit security design.
How does vCluster create a separate cluster for each tenant?
With Private Nodes, each tenant cluster runs its own Kubernetes scheduler against its own dedicated workers. The API, scheduler and backing store are components of the tenant control plane; they are not necessarily separate pods. Tenant priority and placement policies operate within that cluster. GPU allocation still depends on supported drivers and device resources, while vMetal supplies machine provisioning.
Why use tenant clusters instead of namespaces?
Namespaces divide resources within a Kubernetes cluster, but share its API and cluster-wide administrative scope. RBAC, quotas and network policies remain useful controls. vCluster adds a separate tenant API and data store, with Private Nodes dedicating production workers. This reduces dependencies between tenant environments while platform administrators still manage the underlying infrastructure and its failure domains.
How quickly can operators create a tenant cluster?
A tenant control plane and its worker capacity have different readiness requirements. Existing provisioned workers can shorten onboarding, while new machines require the selected infrastructure driver's provisioning workflow. Templates, networking, storage and GPU drivers must also be ready before workloads can run. Configure Private Nodes when creating the tenant cluster, and validate application readiness separately from Kubernetes API availability.
Do tenant clusters support standard Kubernetes tools?
vCluster is a CNCF-certified Kubernetes distribution and exposes standard Kubernetes APIs in tenant environments. This supports familiar clients, Helm charts and cluster-scoped resources such as CRDs. Certification covers Kubernetes conformance rather than an entire AI platform or customer deployment. Validate the selected version, networking, storage, GPU drivers and runtime integrations for the workloads you plan to support.
How does vCluster Platform manage tenant cluster fleets?
vCluster Platform coordinates tenant environments through a central UI, CLI and API. Operators use templates, access policies and quotas while each Kubernetes tenant retains its own API and dedicated production workers. vMetal manages supported machine provisioning below the fleet. Operational consistency still depends on template configuration, version management and the monitoring and recovery workflows you connect to the platform.
Launch Separate Tenant Clusters
See how vCluster Platform gives each tenant a separate Kubernetes cluster on dedicated Private Nodes.
