Need stronger isolation than Rafay without full cluster costs? vCluster Labs builds the runtime Rafay embeds, and vCluster Platform adds what the open-source layer does not carry: Private Nodes, Auto Nodes, and bare metal provisioning.
A bundled management layer can only offer the isolation the runtime underneath it supports.
A platform built on the open-source runtime inherits its limits: the shared-node model, with no route to Private Nodes or Auto Nodes.
Bare metal support is limited, per public documentation. Provisioning racks, installing the OS, and automating the network stay outside the platform.
Cluster management, cost optimization, AI orchestration, and GitOps ship as one bundle. In our analysis, you adopt all of it to get any of it.
vCluster Labs builds the runtime. vCluster Platform is where the enterprise capabilities live: each tenant gets a fully isolated, CNCF-certified cluster with its own API server, etcd, and RBAC. Private Nodes, the production default, assign dedicated worker nodes with per-tenant CNI and storage over an encrypted WireGuard VPN. Auto Nodes provision GPU hardware on demand, vMetal handles the racks underneath, and snapshots cover Day 2. Proven across 100K+ GPU nodes and 50+ GPU clouds.
Five capabilities that separate vCluster Platform from a management layer running the open-source runtime.
Each tenant gets a fully isolated K8s control plane running as a lightweight pod: own API server, etcd, and scheduler. Spins up in seconds with near-zero marginal cost on shared GPU infrastructure.
vNode wraps each workload in kernel-native security using seccomp, cgroups, namespaces, and AppArmor, preventing container breakouts without hypervisor overhead. Bare metal GPU performance is preserved.
Private Nodes, the production default, deliver complete hardware separation per tenant: fully dedicated physical nodes with per-tenant CNI and CSI. No workloads from any other tenant share the underlying GPU hardware.
Manage all tenant clusters from a single UI, CLI, and API. SSO, quotas, templates, and RBAC across the entire fleet, giving your operations team full visibility without per-cluster overhead.
Every tenant cluster is a fully conformant, CNCF-certified Kubernetes control plane, not a proprietary partition. Tenants get 100% API compatibility and full cluster-admin rights without affecting neighbors.
This isn’t a side project. Behind every vCluster deployment is 5+ years of deep K8s engineering, security hardening, and battle-tested infrastructure work at massive scale.
Talk to our team about your stack
Deploy vCluster on your infra in minutes
Go live with a hyperscaler-grade tenant experience in days
In our analysis, Rafay is a management platform that bundles several tools together and embeds the open-source vCluster runtime for its virtualization layer. As a downstream consumer of that runtime, it works within the capabilities the open-source project provides. vCluster Labs builds the runtime, and vCluster Platform adds the enterprise layer on top: Private Nodes with an encrypted WireGuard VPN, Auto Nodes for on-demand GPU provisioning, snapshots, advanced scheduling, and vMetal for bare metal. Fleet management, SSO, and RBAC are native to the platform rather than assembled around it.
Yes. vCluster is purpose-built for GPU cloud providers and AI infrastructure teams. It powers 100K+ GPU nodes in production across 50+ GPU clouds and Fortune 500 customers, including CoreWeave and Nscale. vCluster is named in the NVIDIA DGX SuperPOD reference architecture: a signal of its readiness for production GPU environments.
Yes. Namespace isolation shares the same API server across all tenants, meaning a misconfiguration or compromised workload can affect others. vCluster gives every tenant a completely separate API server and etcd, so the control plane blast radius is strongly contained. For deeper isolation, vNode adds kernel-native workload protection at the runtime level without hypervisor overhead.
vCluster integrates with existing Kubernetes infrastructure, GitOps pipelines, and CI/CD tooling including Terraform and Argo CD. Because each tenant cluster is CNCF-certified and API-compatible, existing workloads and tooling migrate without modification. Customers like Boost Run have launched full managed Kubernetes offerings in less than 45 days using vCluster.
Yes. vCluster supports a flexible isolation spectrum: Private Nodes, the production default, deliver full hardware separation per tenant with dedicated worker nodes and per-tenant CNI and storage; Shared Nodes serve cost-efficient dev, test, CI/CD, and trusted-team environments; and vNode adds kernel-native workload isolation on top of either model for the strongest security posture. This lets GPU cloud operators match isolation depth to each tenant's requirements and price point without running separate physical clusters.
The vCluster runtime is open source and vCluster Labs maintains it. Platforms that embed the runtime, Rafay among them in our analysis, get what the open-source project offers. vCluster Platform is the commercial layer, adding Private Nodes, Auto Nodes, snapshots, advanced scheduling, the built-in VPN, fleet management, SSO, and Day 2 operations for GPU cloud providers running tenant isolation at scale.
Book a demo and see isolated tenant clusters on GPU infrastructure in action.
