Multi-tenant Kubernetes Use Cases for AI, Secure Computing and Data Services, and More
This paper evaluates the deployment of Kubernetes on the HPE Cray EX supercomputer Isambard-AI to address the limitations of traditional single-tenant batch systems by enabling flexible, multi-tenant use cases for trusted medical research environments and confidential AI model hosting, while outlining the challenges and future steps for productionizing Kubernetes-as-a-Service on such high-performance platforms.
Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
Imagine a world where supercomputers are like massive, high-speed train stations. For decades, these stations have been designed for one specific type of passenger: the "batch" traveler. These are huge, tightly packed groups of data that arrive together, sit in a single, dedicated car for the entire journey, and leave only when the whole train is done. This system works perfectly for traditional science, but the world is changing. Now, we have a new kind of traveler: the "cloud-native" passenger. These are flexible, individual containers of data that want to hop on and off trains instantly, share cars with strangers safely, and run complex, interactive apps like AI chatbots or secure medical databases.
The problem is that the old train stations (traditional supercomputers) weren't built for this. They are great at moving massive cargo but terrible at managing a bustling, multi-tenant station where everyone needs their own secure space. Enter Kubernetes. Think of Kubernetes as the ultimate traffic controller for these containerized passengers. It's the software that makes sure everyone gets a seat, that the right people can't peek into other people's bags, and that the station runs smoothly even when thousands of different apps are running at once. But putting this flexible traffic controller onto a rigid, high-speed supercomputer is like trying to install a modern subway ticketing system inside a steam engine; it requires some serious engineering magic to make them work together without crashing the whole system.
This paper tells the story of how a team of engineers took that modern traffic controller and successfully installed it on one of the world's most advanced supercomputers, called Isambard-AI. They didn't just make it work; they tested it with two very different, very important jobs. First, they built a "Trusted Research Environment," which is like a super-secure glass room where scientists can look at sensitive medical data without ever being able to steal it or leak it. Second, they set up a "sandbox" for AI models, allowing multiple researchers to run and test powerful AI brains simultaneously without them stepping on each other's toes.
The team found that their new system works incredibly well. They proved that you can run these flexible, multi-tenant services on a supercomputer without slowing it down. In fact, when they tested the speed of the network connecting the computers, they found that adding this security layer only added a tiny, almost invisible delay—about 0.89 microseconds. To put that in perspective, that's less than the blink of an eye, even for a computer. They also showed that their setup could handle massive AI models, running them across multiple computers and keeping them secure.
However, the journey wasn't without its potholes. The team discovered a critical hardware bottleneck: the underlying network cards (Cassini NICs) have a strict limit on how many secure "service IDs" they can issue. Because the system currently assigns a unique ID to every single container, the station risks running out of these IDs, causing the system to grind to a halt if too many users try to connect at once. Furthermore, they identified a major security flaw in their current setup: to access the high-speed network, the secure "glass rooms" currently have to be built with "privileged" keys. This means the security guards are actually giving the passengers the master keys to the station, which undermines the very isolation the system was designed to create.
While they admit the system is still a bit complex to set up and needs future polishing to fix these hardware limits and security gaps, they have demonstrated that it is possible to bring the flexibility of the cloud to the raw power of a supercomputer. This opens the door for a future where scientists and AI researchers can work together on the same powerful machines, safely and efficiently, without needing to build entirely new hardware for every new type of job.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.