TechPrufer
Sign inGet started

Blogs›NVIDIA›Tenant Isolation for Kubernetes on Shared GPU Infrastructure

Tenant Isolation for Kubernetes on Shared GPU Infrastructure

Tenant Isolation for Kubernetes on Shared GPU Infrastructure

2
posts
2026

This feature thread tracks the evolution of enabling isolated tenant Kubernetes clusters on shared GPU infrastructure. Initial efforts focused on addressing the challenges of managing multiple teams with conflicting requirements (CRDs, RBAC, Kubeflow versions) on shared hardware. The solution combines KAI Scheduler for topology-aware, hierarchical GPU scheduling with per-team quotas and dynamic allocation, and vCluster for provisioning fully isolated tenant clusters with independent control plans. Subsequent developments have introduced intent-based security profiles in Unified Fabric Manager (UFM) for NVIDIA Quantum InfiniBand, enabling rapid, automated multi-tenant fabric security and tenant isolation for large-scale GPU clusters. Three predefined profiles (General, Bare Metal Cloud, and Secured Bare Metal Cloud) allow administrators to deploy robust security features like PKey isolation, MAD key protection, and GUID-based access control, reducing manual configuration errors and deployment time. Continuous Security Verification (CSV) provides automated auditing and remediation guidance, giving users a real-time security health score to ensure ongoing protection and compliance across InfiniBand deployments.

2026

How to Run Isolated Tenant Kubernetes Clusters on Shared GPU Infrastructure | NVIDIA Technical Blog

8/3/2026

This post introduces a pattern for running isolated tenant Kubernetes clusters on shared GPU infrastructure using KAI Scheduler and vCluster. It details the architecture where KAI Scheduler handles topology-aware GPU scheduling with per-team quotas and vCluster provisions virtualized Kubernetes clusters per team, ensuring logical separation of control planes, RBAC, and CRDs. The post provides a tutorial demonstrating this setup on a single NVIDIA L40S GPU, highlighting how teams can manage their own workloads and resources independently while sharing the underlying hardware. It also covers prerequisites, tooling installation (kubectl, helm, MicroK8s addons), and confirmation of the NVIDIA GPU Operator.

One-Click Multi-Tenant Security with NVIDIA Quantum InfiniBand | NVIDIA Technical Blog

6/11/2026

Introduced intent-based security profiles in Unified Fabric Manager (UFM) for NVIDIA Quantum InfiniBand, enabling one-click multi-tenant fabric security and tenant isolation. This includes three predefined profiles (General, Bare Metal Cloud, Secured Bare Metal Cloud) that automate PKey isolation, MAD key protection, and GUID-based access control. Also introduced Continuous Security Verification (CSV) for automated auditing and remediation of security posture.