Running Isolated VirtualClusters With Kata & Cluster API

on YouTube ↗35m

" summary

Demonstrates a working setup that runs per-tenant Kubernetes control planes inside one supercluster using vCluster and Cluster API, and isolates workloads by running pods in Kata containers with per-tenant iptables pushed from a cube-proxy exporter to a VN agent inside each guest. Shows routable tenant Service CIDRs (example: tenant services 10.32.x.x, pod IPs 192.168.x.x), automatic runtime injection, a VC Sinker syncing pod-schedulable objects, and plans to replace iptables sync with kpng for scale.

AI-written summary · about

" chapters (8)

1. 0:00Multi-tenant Kubernetes challenges
2. 1:46Control plane multi-tenancy with VirtualCluster
3. 8:32Data plane isolation with Kata Containers
4. 12:44Routable services in isolated clusters
5. 17:14Live demo: VirtualCluster with Kata
6. 25:46Scaling networking with KPING
7. 27:11Limitations and next steps for hard multi-tenancy
8. 34:14Q&A

" related talks

• 37mVirtual Clusters in the Real World: Lessons from k3k’s Journey to ProductionRossella Sblendido · ContainerDays Hamburg 2026
• 37mTenant Autonomy & Isolation In Multi-Tenant Kubernetes Clusters - A Comprehensive GuideLukas Gentele · ContainerDays Conference 2024
• 35mMulti-Tenancy on Kubernetes with Virtual ClustersEnrico Candino · containerday 2025
• 51mMulti-tenant KubernetesMikhail Sidorov · Saint HighLoad++ 2022
• 32mFlexible Kubernetes Multitenancy with vClusterPiotr Zaniewski · SREday London 2025 Q3
• 22mTaming the VM Sprawl: KCP Meets KubeVirtSören Henning · KubeVirt Summit 2025
• 23mVirtual Kubernetes Clusters: A New Approach to Multi-tenancyHrittik Roy · SREday London 2024
• 34mBeyond Namespaces: Virtual Clusters are the Future of Multi-TenancyLukas Gentele · KubeCon + CloudNativeCon North America 2021