What is vCluster?
vCluster helps AI cloud providers deliver highly scalable, resilient compute clusters as self-service tenant products, including managed Kubernetes, Slurm, inference, Ray, and other cluster types. Each tenant gets a dedicated tenant clusterTenant clusterA fully isolated Kubernetes environment provisioned for a single tenant. Each tenant cluster has its own API server, controller manager, and resource namespace, backed by a virtualized control plane hosted on a control plane cluster. From the tenant's perspective it behaves exactly like a standard Kubernetes cluster. on your existing infrastructure, with its own API server, RBAC, and CRDs.
What a tenant cluster looks like​
From the perspective of a user or workload, a tenant cluster is a full Kubernetes cluster. They receive a kubeconfig scoped to their cluster and interact with it using tools built for the standard Kubernetes API, such as kubectl, Helm, Argo CD, and Crossplane. They cannot see other tenant clusters or the underlying control plane clusterControl plane clusterThe Kubernetes cluster that hosts the virtualized control planes for tenant clusters. The control plane cluster is operated by the platform provider and is completely invisible to tenants. There are no shared control plane nodes, no in-cluster agent pods, and no lateral path between tenant environments. With shared nodes, this cluster also runs tenant workloads alongside the control plane pods — the same node pool is used for both. through the Kubernetes API. Network-level isolation between tenants depends on the worker node model you choose.
That same Kubernetes foundation is what higher-level cluster types like Slurm, Ray, and inference-serving stacks run on as workloads.
From the platform operator's perspective, the tenant cluster control plane runs as a pod in a namespace on the control plane cluster. Creating one requires no additional infrastructure.
Isolation model​
Each tenant cluster enforces isolation at the API level. Tenants get their own API server, their own etcd, and their own resource namespace. A resource created inside one tenant cluster has no visibility into another. CRDs, admission webhooks, and RBAC policies scope fully to each tenant and cannot affect other tenants or the host.
For workloads that require node-level isolation (GPU infrastructure, regulated industries, or paying external customers), tenant clusters support private nodes where each tenant's workloads run on dedicated compute with no cross-tenant visibility at the infrastructure level.
How Platform manages tenant clusters​
vCluster Platform is the management layer for your tenant cluster fleet. It handles:
- Provisioning — create tenant clusters from the UI, CLI, or API, with optional templates that enforce configuration baselines
- Access control — RBAC at the platform, project, and individual cluster level; SSO integration with any OIDC provider
- Lifecycle — sleep, wake, auto-delete, and version upgrades coordinated across the fleet
- Multi-cluster — manage tenant clusters across multiple control plane clusters from a single Platform instance
Learn more​
For the full architecture, deployment options, and feature reference, see the vCluster documentation.