OpsCanary
kubernetesai workloadsPractitioner

Mastering Multi-Tenant GPU Kubernetes with Kamaji and HAMi

5 min read CNCF BlogOct 23, 2026Reviewed for accuracy
Share
Practitioner — Hands-on experience recommended

In today's cloud-native landscape, efficiently managing GPU resources across multiple tenants is crucial for maximizing hardware utilization and reducing costs. Kamaji and HAMi provide a robust solution for running multi-tenant GPU Kubernetes on simulated hardware, allowing you to create isolated environments for different teams or projects without the overhead of dedicated physical GPUs.

Kamaji operates by running each tenant's Kubernetes control plane as pods within a single management cluster. This architecture simplifies management while ensuring that each tenant remains isolated. The HAMi component allows pods to request specific slices of GPU resources, such as memory in MB and compute in percentage, effectively packing multiple pods onto a single GPU card. The integration of Konnectivity creates a secure tunnel that enables the API server in the management cluster to communicate with the tenant's worker nodes, facilitating seamless GPU pod creation. Key configuration parameters include serviceType, kubernetes.version, and podCidr, which help tailor the environment to your needs.

In production, be aware of a few critical gotchas. For instance, avoid labeling the worker with gpu=on, as this triggers HAMi's real NVIDIA device plugin, which can fail without the appropriate drivers. Additionally, the mock plugin does not behave like a real GPU, so ensure your testing reflects actual hardware constraints. This setup is lightweight, requiring only a single Linux host with minimal resources, making it ideal for development and testing scenarios.

Key takeaways

  • →Utilize Kamaji to run each tenant's Kubernetes control plane as pods for better resource management.
  • →Leverage HAMi to allocate GPU slices, optimizing GPU utilization across multiple pods.
  • →Configure Konnectivity to ensure secure communication between the management cluster and tenant worker nodes.
  • →Avoid labeling workers with gpu=on to prevent issues with the NVIDIA device plugin.
  • →Test your configurations on a single Linux host to simplify setup and reduce overhead.

Why it matters

This approach significantly enhances resource efficiency, allowing organizations to maximize their GPU investments while providing isolated environments for different teams. It streamlines GPU management, making it easier to scale workloads as demand grows.

Code examples

Bash
1helm repo add clastix https://clastix.github.io/charts
2helm upgrade --install kamaji clastix/kamaji \
3 --namespace kamaji-system --create-namespace \
4 --set 'resources=null' --version 0.0.0+latest
5
6kubectl -n kamaji-system get pods
Bash
1export TENANT_VERSION=v1.36.4
2kubectl create namespace tenants
3for t in tenant-a tenant-b; do
4cat <<EOF | kubectl apply -f -
5apiVersion: kamaji.clastix.io/v1alpha1
6kind: TenantControlPlane
7metadata:
8 name: ${t}
9 namespace: tenants
10 labels:
11 tenant.clastix.io: ${t}
12spec:
13 controlPlane:
14 deployment:
15 replicas: 1
16 service:
17 serviceType: LoadBalancer
18 kubernetes:
19 version: "${TENANT_VERSION}"
20 kubelet:
21 configurationJSONPatches:
22 - op: add
23 path: /cgroupDriver
24 value: systemd
25 networkProfile:
26 port: 6443
27 podCidr: 10.244.0.0/16
28 addons:
29 coreDNS: {}
30 kubeProxy: {}
31 konnectivity:
32 server:
33 port: 8132
34 agent:
35 mode: DaemonSet
36EOF
37done
Bash
1curl -sLO https://raw.githubusercontent.com/projectcalico/calico/v3.31.2/manifests/calico.yaml
2
3sed -i 's|# - name: CALICO_IPV4POOL_CIDR|- name: CALICO_IPV4POOL_CIDR|; s|#   value: "192.168.0.0/16"|  value: "10.244.0.0/16"|' calico.yaml
4
5kubectl --kubeconfig tenant-a.kubeconfig apply -f calico.yaml
6
7kubectl --kubeconfig tenant-a.kubeconfig get nodes

When NOT to use this

The official docs don't call out specific anti-patterns here. Use your judgment based on your scale and requirements.

Want the complete reference?

Read official docs

Test what you just learned

Quiz questions written from this article

Take the quiz →
Linux FoundationSponsor

Industry-standard certifications built by the people behind Linux and Kubernetes. Earn the CKA — the gold standard Kubernetes administrator cert. OpsCanary readers get 30% off year-round with code OPSCANARY3.

Get CKA certified →

Get the daily digest

One email. 5 articles. Every morning.

No spam. Unsubscribe anytime.