platform-eng
Virtual Control Plane Kubernetes for AI Clouds
Use a virtual control plane for each Kubernetes tenant. vMetal supplies infrastructure, and vCluster separates tenant APIs while Private Nodes dedicate production worker capacity.
Trusted by the fastest-growing AI cloud providers
Problem
Why Traditional Kubernetes Falls Short
Scaling GPU tenants with standard Kubernetes forces painful tradeoffs between isolation, cost, and speed.
Namespace Isolation Is Too Weak
A shared Kubernetes API requires careful RBAC and admission policies to prevent access beyond the tenant’s intended administrative scope.
Full Clusters Are Too Expensive
Provisioning separate physical clusters per tenant drives up costs, slows onboarding, and wastes GPU capacity at scale.
DIY Takes Too Long
Building a GPU cloud platform in-house requires significant engineering investment.
Solution
One Virtual Control Plane Per Tenant, at Scale
vCluster runs each tenant's Kubernetes API and data store as a lightweight control-plane workload. vMetal provides infrastructure, and Private Nodes dedicate production workers without requiring control-plane servers for each customer. vCluster Labs serves 50+ GPU clouds & Fortune 500s.
Built for GPU Clouds That Need Real Isolation
The virtual control plane is the core, backed by dedicated nodes, workload hardening, and central fleet operations.
Core Technology
Virtual Control Planes Per Tenant Cluster
Each tenant has an independent Kubernetes API, data store and RBAC boundary. Lightweight control-plane hosting reduces dedicated server requirements for tenant control plane hosting; Private Nodes keep production workers tenant-specific.
- Independent tenant API and data store
- Tenant-scoped scheduling on Private Nodes
- No dedicated control-plane servers per tenant
Standards Compliance
CNCF-Certified K8s Per Tenant
Every tenant cluster is a conformant, CNCF-certified Kubernetes control plane on standard Kubernetes APIs. Tenants run their usual tooling, operators, and CRDs without proprietary limits.
- Standard Kubernetes APIs
- Standard APIs and familiar tools
- Validated in NVIDIA's DGX reference architecture
Worker Isolation
Dedicated Worker Nodes Per Tenant
Private Nodes dedicate worker capacity to one tenant cluster, with its own CNI and storage configuration. For tenant control plane hosting, select physical servers or VMs according to the required infrastructure boundary.
- Dedicated worker nodes per tenant
- Tenant-owned CNI and storage configuration
- Physical servers or supported VMs
Workload Security
Kernel-Native Isolation Without VM Overhead
vNode uses Linux user namespaces and seccomp to restrict workload privileges and system calls. It adds runtime hardening for tenant control plane hosting without a guest kernel or hypervisor, complementing dedicated workers rather than allocating GPUs.
- Linux user namespaces and seccomp
- No guest kernel or hypervisor
- Helps limit workload breakout
Platform Operations
Central Fleet Management Across Tenants
Coordinate tenant environments for tenant control plane hosting through one UI, CLI and API. Templates, access policies and quotas provide central operator controls while tenant Kubernetes APIs and dedicated production workers remain separate.
- Single pane across all tenant clusters
- SSO, quotas, and templates built in
- Central fleet access and templates
Why vCluster
This isn’t a side project. Behind every vCluster deployment is 5+ years of deep K8s engineering, security hardening, and battle-tested infrastructure work at massive scale.
100K+
GPUs Powered
50+
GPU Clouds & F500s
<45
Days to Launch
30K
GitHub Stars
Get Started in 3 Steps
1
Schedule a Demo
Talk to our team about your stack
2
Deploy vCluster
Deploy vCluster on your infra in minutes
3
Onboard Your Tenants
Go live with a hyperscaler-grade tenant experience in days
FAQs
What is a virtual control plane in Kubernetes?
A virtual control plane is a tenant's own Kubernetes API server, data store, and scheduler, running as a lightweight workload inside a control plane cluster instead of on dedicated servers. vCluster implements this model so each tenant gets a real control plane with cluster-admin rights and independent RBAC. Namespace isolation, by contrast, puts every tenant on one shared control plane.
How does a virtual control plane differ from namespace isolation?
Namespace isolation partitions resources inside one Kubernetes control plane, so tenants can still see cluster-wide agents, nodes, and platform internals. A virtual control plane gives each tenant its own API server and data store, which keeps one tenant's activity out of another's control plane state. For untrusted or production tenants, Private Nodes add dedicated GPU worker nodes with per-tenant CNI and storage, moving the boundary down to the hardware as well.
Can a virtual control plane run on bare metal GPU servers?
vCluster Standalone runs as a Kubernetes binary directly on Linux without requiring another Kubernetes cluster, k3s or kubeadm. It can provide an initial Kubernetes foundation. vMetal is a separate infrastructure orchestration layer that requires vCluster Platform and a connected Kubernetes cluster for its Metal3/Ironic path. Hardware registration, images, credentials and driver setup remain prerequisites for machine provisioning.
How many tenant clusters can a single control plane cluster support?
It depends on control plane cluster capacity and tenant workload profiles, but because each virtual control plane is a lightweight pod, one control plane cluster can host many of them. Lintasarta runs 170+ tenant clusters in production. Worker capacity is a separate question: production tenants get dedicated nodes through Private Nodes, so each new tenant brings its own hardware rather than adding load to someone else's.
Is vCluster's virtual control plane Kubernetes CNCF-certified?
vCluster is a CNCF-certified Kubernetes distribution and exposes standard Kubernetes APIs in tenant environments. This supports familiar clients, Helm charts and cluster-scoped resources such as CRDs. Certification covers Kubernetes conformance rather than an entire AI platform or customer deployment. Validate the selected version, networking, storage, GPU drivers and runtime integrations for the workloads you plan to support.
How long does it take to launch a managed Kubernetes service using vCluster?
Boost Run went from decision to production launch of its managed Kubernetes offering in under 45 days. The platform ships with fleet management, self-service portals, and Day 2 operations, and tenant clusters come up once its control plane and workers are ready, so most of the remaining work is product decisions rather than custom platform code.
Launch Tenant Clusters in Minutes
See how a virtual control plane for Kubernetes scales your GPU cloud without physical cluster overhead.
