Share GPU clusters across teams with isolation and fairness using Amazon SageMaker HyperPod
A reference architecture for securely sharing one Amazon SageMaker HyperPod EKS cluster across multiple teams, using AWS IAM Identity Center for authentication, per-team SageMaker Domains and Kubernetes namespaces for isolation, HyperPod Task Governance for fairness, and namespace-level cost…
This article presents a reference architecture for securely sharing an Amazon SageMaker HyperPod EKS cluster across multiple teams, ensuring isolation, fairness, and cost visibility through a combination of AWS IAM Identity Center, Kubernetes namespaces, and HyperPod Task Governance.
What happened
AWS introduced a reference architecture for securely sharing an Amazon SageMaker HyperPod EKS cluster across multiple teams. This architecture uses AWS IAM Identity Center for authentication, per-team SageMaker Domains for user experience, Kubernetes namespaces for isolation, HyperPod Task Governance for resource fairness, and namespace-level cost allocation for cost visibility.
Why it matters
This architecture is crucial for organizations with multiple teams needing shared access to expensive GPU clusters for generative AI operations. It ensures isolation, resource fairness, and cost accountability, which are essential for efficient and secure multi-tenant environments.
- Use AWS IAM Identity Center for centralized authentication and federation.
- Leverage Kubernetes namespaces for workload isolation and resource management.
- Implement HyperPod Task Governance for fair compute allocation.
- Utilize namespace-level cost allocation for per-team spend visibility.
- Create per-team SageMaker Domains for tailored user experiences.
The bigger picture
This architecture allows organizations to efficiently share expensive GPU infrastructure while maintaining isolation and fairness, which is essential for scaling AI operations across teams without compromising security or resource management.
The reference architecture presented in this article provides a blueprint for securely sharing an Amazon SageMaker HyperPod EKS cluster across multiple teams, ensuring isolation, fairness, and cost visibility through a combination of AWS IAM Identity Center, Kubernetes namespaces, and HyperPod Task Governance.
Technical details
- AWS IAM Identity Center for centralized authentication and federation with external identity providers.
- Kubernetes namespaces for workload isolation and resource management.
- HyperPod Task Governance for fair compute allocation and scheduling priorities.
- Namespace-level cost allocation for per-team spend visibility and chargeback.
- SageMaker AI domains for tailored user experience and execution roles.
FAQ
What is the purpose of the reference architecture described in the article?
The purpose is to securely share an Amazon SageMaker HyperPod EKS cluster across multiple teams while ensuring isolation, fairness, and cost visibility.
How does the architecture ensure isolation between teams?
The architecture uses Kubernetes namespaces to isolate workloads and ensure that each team operates within its own namespace.
What role does AWS IAM Identity Center play in the architecture?
AWS IAM Identity Center is used for centralized authentication and federation with external identity providers, ensuring secure access to the cluster.
How does the architecture ensure fair resource allocation?
The architecture uses HyperPod Task Governance to ensure fair resource allocation and scheduling priorities across teams.
How is cost visibility achieved in the architecture?
Namespace-level cost allocation provides visibility and chargeback for per-team spending, allowing organizations to track and manage costs effectively.
This summary and analysis were generated with AI from the original article and may contain errors. Read the original for the full story.
Read the full story
Originally published by AWS ML Blog on Oct 8, 2026.
Comments
Sign in to join the discussion.