loft-sh/vcluster
Vcluster
vcluster is a Kubernetes virtual cluster platform that creates fully isolated Kubernetes environments with dedicated control planes, API servers, and RBAC on shared physical infrastructure. It virtualizes Kubernetes control planes by running them as pods inside a host cluster, as standalone binaries on bare metal or virtual machines, or within Docker containers, providing each tenant their own isolated Kubernetes environment without the overhead of managing separate physical clusters.
The platform enables multi-tenant Kubernetes isolation through multiple tenancy models, from shared node pools for development workloads to dedicated physical nodes for GPU-accelerated and regulated environments. It supports kernel-level workload isolation, hardware-enforced network boundaries, and private node deployments, giving teams the flexibility to choose the appropriate isolation level for their specific security and compliance requirements. Virtual clusters can be provisioned on demand through CI/CD pipelines, self-service portals, or GitOps-driven templates, with automated lifecycle management including hibernation, scaling, and teardown.
Beyond isolation, vcluster provides bidirectional resource synchronization between virtual and host clusters, allowing pods, services, configmaps, and custom resources to be mirrored across environments. It includes cost optimization features such as cluster consolidation, idle cluster auto-sleep, and GPU utilization maximization, enabling organizations to run hundreds of isolated tenant clusters on a single shared infrastructure while reducing operational expenses. The platform integrates with existing CI/CD pipelines and SSO providers, and supports deployment across EKS, GKE, AKS, bare metal, and private cloud environments.
Features
- Virtual Cluster Provisioning - Creates isolated virtual Kubernetes clusters with dedicated control planes on shared physical infrastructure for multi-tenant environments.
- Bare Metal GPU Workload Orchestrations - Manages bare metal GPU provisioning and kernel-level workload isolation for AI/ML on shared infrastructure.
- Isolated Kubernetes Environments - Provides each team its own dedicated control plane, API server, etcd, and RBAC on shared infrastructure.
- Data Tenant Isolators - Separates workloads and data by tenant inside a shared cluster to meet compliance and security requirements.
- Bidirectional Resource Synchronization - Mirrors Kubernetes objects bidirectionally between virtual and host clusters for state consistency.
- Centralized Environment Management - Automates provisioning, upgrades, monitoring, and lifecycle management across all customer environments from a single control point.
- Virtual - Controls the full lifecycle of the virtual cluster and its attached worker nodes after initial deployment.
- Full Lifecycle Automations - Automates creation, scaling, hibernation, and deletion of virtual clusters through CI/CD and self-service portals.
- Infrastructure Consolidation - Runs dozens of virtual clusters on a single physical cluster, reducing idle hardware and operational costs.
- Virtual Cluster Provisioning - Deploys virtual Kubernetes clusters on EKS, GKE, AKS, bare metal, or private cloud with a single configuration.
- Multi-Mode Deployments - Deploys virtual control planes as pods, standalone binaries on bare metal, or in Docker containers.
- Control Plane Pod Hosting - Runs dedicated Kubernetes API server and controller manager as a pod inside the host cluster.
- Cross-Cluster Resource Synchronization - Mirrors pods, configs, secrets, services, and ingress objects between clusters so tenants see a complete environment.
- Multi-Tenant GPU Workload Isolation - Provisions and isolates GPU-accelerated workloads across tenants with kernel-level security.
- GPU Resource Optimization - Dynamically allocates GPU nodes across hundreds of isolated virtual clusters to maximize hardware utilization.
- Virtual Cluster Policy Enforcement - Applies admission controls and security standards centrally across virtualized Kubernetes environments.
- Bare Metal Kubernetes Control Plane Deployments - Runs virtual Kubernetes control planes directly on bare metal or VMs without a host cluster.
- Kubernetes Cluster Provisioning - Automates provisioning, hibernation, and teardown of virtual clusters through CLI, Helm, and GitOps templates.
- Kubernetes Tenant Isolation - Runs multiple isolated Kubernetes clusters on shared physical infrastructure with dedicated control planes and RBAC per tenant.
- Multi-Cluster Operational Management - Centralizes management and standardizes configurations across many virtual clusters, reducing maintenance and operational overhead.
- Self-Service Cluster Provisioning - Lets teams provision ephemeral or persistent Kubernetes clusters on demand without platform engineering.
- Self-Service Cluster Provisioning - Spins up isolated virtual clusters in seconds through CI/CD pipelines, APIs, or internal portals for self-service access.
- Tenant Provisioning - Automates the creation and configuration of isolated Kubernetes environments for new tenants programmatically.
- Kernel-Level Hardware Isolation - Provides secure kernel-level isolation for workloads using seccomp, cgroups, and namespaces.
- Multi-Tenant Isolation - Runs multiple isolated virtual clusters on a single physical cluster to increase density and reduce infrastructure spend.
- Control Plane Isolation - Creates a dedicated Kubernetes control plane per tenant on shared infrastructure, ensuring strong security and compliance.
- Shared Node Tenancy - Provisions isolated tenant clusters that share the host cluster's node pool, requiring no extra infrastructure.
- Virtual Cluster Tenant Management - Provisions fully isolated Kubernetes tenant clusters with dedicated API servers and RBAC within a shared physical cluster.
- GPU Resource Sharing - Runs hundreds of isolated tenant clusters on a single host cluster to share GPU resources.
- Private Node Isolation - Provisions tenant clusters on dedicated nodes for hard tenancy, suitable for GPU clouds and regulated platforms.
- Tenant Network Domain Isolation - Assigns each virtual cluster a dedicated Layer 2 and Layer 3 network domain, preventing traffic overlap.
- Network-Level Multi-Tenancy - Provides hardware-enforced network isolation using VLANs, VRFs, and ACLs for multi-tenant environments.
- Control Plane Virtualization - Deploys dedicated API servers, controller managers, and data stores as pods on an existing cluster for tenant isolation.
- Multi-Model Node Assignments - Supports shared, dedicated, and private node tenancy models for flexible workload isolation.
- Virtual Cluster Pausing - Stops inactive virtual clusters to free compute resources and automatically resumes them on demand.
- Physical Cluster Reductions - Replaces hundreds of physical clusters with a few shared ones while preserving per-customer isolation.
- Virtualization-Driven Reductions - Cuts the number of physical clusters needed by hosting many virtual clusters on a few real ones.
- Cluster State Snapshots - Creates and restores snapshots of virtual cluster state for backup, migration, and recovery.
- External Database Backends - Connects virtual clusters to external databases like etcd, SQLite, or PostgreSQL for persistent control plane storage.
- etcd-backed State Stores - Uses an embedded etcd backing store for virtual cluster state, optimized for production-grade performance.
- Multi-Backend State Stores - Stores virtual cluster state in embedded etcd, SQLite, or PostgreSQL instances alongside the control plane.
- Ephemeral Environments - Launches disposable Kubernetes environments in under three minutes through a self-service interface.
- Hard Network Isolation - Provisions VLANs, VRFs, and ACLs for hardware-enforced team network isolation.
- CI/CD Pipeline Integrations - Connects virtual clusters to existing CI/CD tooling and SSO providers for seamless developer workflows.
- Cross-Cluster Configuration Sync - Extends core syncing to include custom resource definition sync and sync patches for custom resource replication and configuration.
- Disposable Environment Issue Resolution - Tears down and recreates environments to fix problems quickly without waiting for platform support.
- Virtual Cluster Auto-Wake - Automatically wakes sleeping virtual clusters on access, eliminating wait times for resumed work.
- Idle Cluster Power Management - Adjusts compute capacity and powers down idle clusters to minimize waste and eliminate unnecessary costs.
- Custom Configuration Deployments - Configures virtual clusters using YAML files to define control planes, backing stores, networking, and syncing behavior.
- Standalone Binary Deployments - Ships a standalone binary deployment mode for virtual control planes on bare metal or VMs.
- Virtual Cluster Docker Images - Launches a virtual Kubernetes cluster directly on Docker without requiring an existing Kubernetes cluster.
- Ephemeral Docker Runtimes - Creates temporary Kubernetes clusters using only Docker containers for local development and CI.
- Local Development Deployments - Launches full tenant clusters inside Docker containers with sleep/wake, load balancers, and image caching for local development.
- Standalone Binary Deployments - Launches the virtual control plane as a self-contained binary on bare metal or virtual machines.
- Control Plane Tunneling - Routes requests like pod logs from the virtual control plane to worker nodes using Konnectivity without direct node access.
- Cross-Infrastructure Kubernetes Deployments - Deploys on standard Kubernetes nodes across virtualized, bare metal, and hybrid setups.
- Ephemeral Test Clusters - Provisions temporary Kubernetes clusters on demand for integration testing, then tears them down automatically.
- Cloud or Self-Hosted Deployments - Offers a hosted control plane option or a fully self-hosted installation for restricted environments.
- Template-Based Provisioning - Deploys virtual clusters from declarative YAML templates integrated with GitOps workflows.
- Idle Resource Auto-Shutdowns - Automatically scales down virtual cluster resources when not in use, reducing cloud costs.
- Kubernetes Platform Bootstraps - Installs a control plane cluster and platform on bare metal or virtual machines to build a managed Kubernetes platform.
- Virtual Control Plane Deployments - Bootstraps lightweight, fully isolated Kubernetes control planes directly on shared physical nodes without VMs.
- Kubernetes Cluster Deployments - Deploys production-grade virtual Kubernetes clusters with dedicated control planes on shared GPU infrastructure.
- Idle Virtual Cluster Deletions - Removes virtual clusters that have been idle for a defined period, preventing resource waste and controlling cloud expenditure.
- Automated Node Attachment - Attaches GPU and CPU nodes to the correct tenant network automatically, eliminating manual setup.
- Blueprint-Based Deployments - Deploys production-ready Kubernetes environments in seconds using GitOps-driven templates for customer onboarding.
- Dedicated Node Assignment - Allocates dedicated infrastructure per tenant for hard tenancy requirements like GPU clouds and regulated platforms.
- Platform Tooling Consolidation - Runs platform tools once across all virtual clusters to eliminate duplicated tooling and reduce maintenance overhead.
- Virtual Cluster Load Balancers - Makes the virtual cluster control plane accessible over a LoadBalancer service so worker nodes can join and communicate.
- Pre-Configured - Deploys pre-configured stacks like Run:AI, Ray, and Jupyter with production defaults in minutes for consistent tenant experiences.
- AI Stack Self-Service Provisioning - Deploys pre-configured AI and machine learning stacks on demand so teams can start working within minutes.
- Managed Standalone Cluster Connections - Connects a self-managed standalone virtual cluster to a management platform for coordinated configuration updates and rolling upgrades.
- Standalone Virtual Control Plane Deployments - Provides standalone virtual control plane deployment on bare metal or VMs for maximum isolation.
- Bare Metal GPU Provisioning - Automates PXE boot and configuration of physical GPU servers for cluster integration.
- Tenant Onboarding Automation - Provisions new customer environments in minutes instead of days or weeks, speeding up time to value.
- Ephemeral Virtual Clusters - Creates temporary Kubernetes clusters using only Docker for local development or CI pipelines.
- Private Worker Node Provisioning - Attaches separate physical nodes to a virtual cluster so all workloads run directly on those nodes without syncing to the host cluster.
- Virtual Node Isolation - Enforces node boundaries and scheduling constraints via virtualized node logic for workload separation.
- Hypervisor-Free Sandboxing - Sandboxes tenant containers on shared nodes using virtual nodes without hypervisor overhead.
- Shared - Reuses the underlying cluster's Ingress controller for all tenant clusters, reducing per-tenant overhead.
- Tenant Service Replication - Replicates tenant cluster services into any namespace on the underlying cluster so host pods can access them by name.
- GPU-Accelerated Workload Consolidation - Consolidates GPU-accelerated workloads onto shared infrastructure to optimize expensive hardware usage.
- Tenant DNS Management - Deploys a dedicated CoreDNS instance per tenant that maps service names to underlying cluster IPs.
- Declarative Environment Provisioning - Creates complete, secure multi-tenant Kubernetes environments in minutes with declarative configuration.
- Multi-Level Isolation - Provides multiple isolation levels from shared nodes to dedicated nodes with separate CNI and CSI for strict workload boundaries.
- Tenant Network Policy Automation - Automates per-tenant network policy provisioning including routing and load balancers.
- SSO-Integrated Access Controls - Integrates SSO via OIDC/SAML to control access to virtual clusters without separate identity systems.
- Tenancy Isolation Models - Enforces stricter multi-tenant isolation models like private nodes and standalone clusters beyond namespace-level separation.
- Isolated Test Environments - Creates dedicated virtual clusters for each pull request to test changes against the full software stack.
- Kubernetes Cluster Deployments - Launches a virtual Kubernetes cluster directly on Docker without requiring an existing Kubernetes cluster.
- Cluster Provisioning - Creates virtual clusters for improved multi-tenancy and isolation.
