Mastering Multi-Tenant GPU Kubernetes with Kamaji and HAMi
In today's cloud-native landscape, efficiently managing GPU resources across multiple tenants is crucial for maximizing hardware utilization and reducing costs. Kamaji and HAMi provide a robust solution for running multi-tenant GPU Kubernetes on simulated hardware, allowing you to create isolated environments for different teams or projects without the overhead of dedicated physical GPUs.
Kamaji operates by running each tenant's Kubernetes control plane as pods within a single management cluster. This architecture simplifies management while ensuring that each tenant remains isolated. The HAMi component allows pods to request specific slices of GPU resources, such as memory in MB and compute in percentage, effectively packing multiple pods onto a single GPU card. The integration of Konnectivity creates a secure tunnel that enables the API server in the management cluster to communicate with the tenant's worker nodes, facilitating seamless GPU pod creation. Key configuration parameters include serviceType, kubernetes.version, and podCidr, which help tailor the environment to your needs.
In production, be aware of a few critical gotchas. For instance, avoid labeling the worker with gpu=on, as this triggers HAMi's real NVIDIA device plugin, which can fail without the appropriate drivers. Additionally, the mock plugin does not behave like a real GPU, so ensure your testing reflects actual hardware constraints. This setup is lightweight, requiring only a single Linux host with minimal resources, making it ideal for development and testing scenarios.
Key takeaways
- →Utilize Kamaji to run each tenant's Kubernetes control plane as pods for better resource management.
- →Leverage HAMi to allocate GPU slices, optimizing GPU utilization across multiple pods.
- →Configure Konnectivity to ensure secure communication between the management cluster and tenant worker nodes.
- →Avoid labeling workers with gpu=on to prevent issues with the NVIDIA device plugin.
- →Test your configurations on a single Linux host to simplify setup and reduce overhead.
Why it matters
This approach significantly enhances resource efficiency, allowing organizations to maximize their GPU investments while providing isolated environments for different teams. It streamlines GPU management, making it easier to scale workloads as demand grows.
Code examples
1helm repo add clastix https://clastix.github.io/charts
2helm upgrade --install kamaji clastix/kamaji \
3 --namespace kamaji-system --create-namespace \
4 --set 'resources=null' --version 0.0.0+latest
5
6kubectl -n kamaji-system get pods1export TENANT_VERSION=v1.36.4
2kubectl create namespace tenants
3for t in tenant-a tenant-b; do
4cat <<EOF | kubectl apply -f -
5apiVersion: kamaji.clastix.io/v1alpha1
6kind: TenantControlPlane
7metadata:
8 name: ${t}
9 namespace: tenants
10 labels:
11 tenant.clastix.io: ${t}
12spec:
13 controlPlane:
14 deployment:
15 replicas: 1
16 service:
17 serviceType: LoadBalancer
18 kubernetes:
19 version: "${TENANT_VERSION}"
20 kubelet:
21 configurationJSONPatches:
22 - op: add
23 path: /cgroupDriver
24 value: systemd
25 networkProfile:
26 port: 6443
27 podCidr: 10.244.0.0/16
28 addons:
29 coreDNS: {}
30 kubeProxy: {}
31 konnectivity:
32 server:
33 port: 8132
34 agent:
35 mode: DaemonSet
36EOF
37done1curl -sLO https://raw.githubusercontent.com/projectcalico/calico/v3.31.2/manifests/calico.yaml
2
3sed -i 's|# - name: CALICO_IPV4POOL_CIDR|- name: CALICO_IPV4POOL_CIDR|; s|# value: "192.168.0.0/16"| value: "10.244.0.0/16"|' calico.yaml
4
5kubectl --kubeconfig tenant-a.kubeconfig apply -f calico.yaml
6
7kubectl --kubeconfig tenant-a.kubeconfig get nodesWhen NOT to use this
The official docs don't call out specific anti-patterns here. Use your judgment based on your scale and requirements.
Want the complete reference?
Read official docsIndustry-standard certifications built by the people behind Linux and Kubernetes. Earn the CKA — the gold standard Kubernetes administrator cert. OpsCanary readers get 30% off year-round with code OPSCANARY3.
Get CKA certified →Maximize Your AI SRE Evaluation with Contextual Awareness
Before diving into AI SRE evaluations, ensure your existing agent has the right context. By leveraging Radar's read-only MCP tools, you can access critical insights like current failures and change timelines that raw kubectl can't provide. This context is essential for effective decision-making.
Unlocking BackstageCon: Insights for KubeCon + CloudNativeCon 2026
BackstageCon is set to be a pivotal gathering for Backstage enthusiasts at KubeCon + CloudNativeCon 2026. Dive into AI features and the Model Context Protocol that are reshaping software development workflows. This is your chance to connect with the community and deepen your understanding of Backstage.
Transforming AI Workloads: My Journey from Attendee to Speaker at KubeCon India 2026
KubeCon + CloudNativeCon India 2026 was a turning point for me, moving from attendee to speaker. I shared insights on building a self-hosted AI cluster with NVIDIA's DGX Spark, leveraging Dynamic Resource Allocation (DRA) for optimal GPU scheduling.
Get the daily digest
One email. 5 articles. Every morning.
No spam. Unsubscribe anytime.