To give each trusted team its own Kubernetes API environment on shared infrastructure, create a vCluster in a dedicated namespace on an existing host cluster. This separates each team’s Kubernetes API and namespace view, but it does not give workloads separate worker nodes or kernels. Treat shared-node vClusters as a tenancy pattern for trusted internal development, testing, and CI/CD—not as a security boundary for untrusted users who can run arbitrary workloads.
What a vCluster isolates—and what it does not
A vCluster provides a separate Kubernetes control plane and API experience for a tenant. In shared-node mode, that virtual cluster runs in a namespace on an existing Kubernetes cluster. The vCluster syncer translates selected workload resources into the host environment, where they run on the host’s worker nodes.
As an Amazon Associate I earn from qualifying purchases.
That separation is useful for team autonomy: teams can work through their own API and namespace view without each needing a separate physical cluster. But their workloads still share the host’s worker nodes and kernel. The vCluster API boundary is not equivalent to dedicated infrastructure or a strong isolation boundary against a hostile tenant. The official shared-node quick-start documentation puts the intended use plainly: “Shared nodes are a supported, common model for trusted tenants.” Read the shared-node quick start.
NetworkPolicy is not automatic protection. Policies help only when NetworkPolicy resources are synced to the host and the host cluster’s CNI actually enforces them. Confirm both conditions before relying on a policy as a control.
#1 Best Overall
How do I create a vCluster for my team?
1. Check access and available capacity
You need access to the Kubernetes host cluster you intend to use and kubectl configured for it. The vCluster quick start lists 2 vCPU and 2 GB RAM as minimum available capacity. Those are tutorial prerequisites, not a production sizing recommendation; actual needs depend on the control plane and workloads you run.
Check the active context and access before creating anything:
kubectl config current-context
kubectl get nodes2. Install the vCluster CLI
Install the CLI using the current official instructions for your operating system. Follow the instructions on the vCluster setup page rather than treating a download URL containing latest as a permanent version pin. Confirm the CLI is available:
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesRank #2
vcluster --help3. Create a team cluster
Create the virtual cluster in a namespace reserved for the team:
vcluster create my-vcluster --namespace team-xThe documented quick-start version defaults to Kubernetes v1.36.0. Defaults can change between releases. If you need a specific Kubernetes version, check the live documentation and configure controlPlane.distro.k8s.image.tag rather than assuming the default remains the same.
4. Verify the tenant context and deploy a test workload
After creation, the CLI switches your kubeconfig to the vCluster context. Confirm the context, inspect the tenant’s namespaces, and deploy a small workload to check that the tenant API responds:
kubectl config current-context
kubectl get namespaces
kubectl create deployment web --image=nginxCheck the tenant-side deployment and pod:
kubectl get deployments
kubectl get podsThis verifies basic API and workload behavior; it is not a security test.
5. Inspect the host-side representation
Disconnect from the vCluster context and return to the host context you checked before installation. Then inspect the team namespace:
vcluster disconnect
kubectl config current-context
kubectl get pods -n team-xThe workload is represented in the host namespace, with a rewritten name. This illustrates how shared-node mode maps tenant resources into the underlying cluster; it does not demonstrate isolation from the host’s nodes or kernel.
What the syncer does in shared-node mode
The syncer translates selected tenant resources into the underlying Kubernetes environment. Depending on configuration, these can include Pods, ConfigMaps, Secrets, Services, Ingress, and Gateway API objects. The tenant works against its own API, while the corresponding resources are handled in the host cluster.
Networking resources may need careful configuration because their behavior depends on what is synced and on the host cluster’s networking implementation. For NetworkPolicy, enable syncing policies to the host and verify that the host CNI enforces them; creating a policy object in the tenant API alone does not establish that traffic is blocked.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Optional check: verify NetworkPolicy enforcement
Use this only after confirming that NetworkPolicy syncing is enabled and that the host CNI supports enforcement. A policy object can exist without the expected traffic controls if either condition is missing.
-
Configure the vCluster to sync NetworkPolicy resources to the host, following the current vCluster configuration documentation.
-
In the tenant cluster, apply a default-deny policy for the namespace you are checking. Confirm that the policy appears in the tenant API.
-
Run a client pod in that namespace and test access to a destination that should be denied.
Free tools Windows power users keep installed
One-click scans. No signup required.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Check the host-side policy and the CNI’s enforcement behavior. A failed connection is meaningful only when the test destination, policy, and CNI behavior make the result interpretable.
Do not treat this check as proof that shared-node workloads are isolated from one another at the kernel level.
Choose the node model to match tenant trust
| Choice | Isolation and intended use | Infrastructure and flexibility |
|---|---|---|
| Shared nodes | Separate control plane and API view, but workloads share host workers and kernel. Appropriate for trusted internal teams. | Reuses the host node pool with lower infrastructure overhead. Relies on host infrastructure behavior and resource syncing. |
| Private nodes | Dedicated infrastructure for a tenant; documented for stronger separation, including external, regulated, or GPU workloads. | Requires dedicated compute and has higher overhead. Supports tenant-specific infrastructure such as CNI and CSI. |
Dedicated node placement can constrain where a team’s workloads run on a shared-node cluster, but it does not turn that architecture into private-node isolation. If tenants are external, regulated, otherwise untrusted, or can submit arbitrary workloads, evaluate private nodes or another suitable isolation model instead of relying on namespace separation alone. Platform tooling can manage tenant projects and access; it cannot remove the need to choose an appropriate worker isolation boundary.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →
