Shared bare metal, private Kubernetes

The situation

Your lab runs one or two powerful ARM64 hosts with eight accelerators each. Today, jobs land in a shared namespace: one runaway workload can starve everyone, and nobody can install an operator or a CRD without stepping on another team's cluster.

With KubeCell

Publish a quota tier with two whole cards, then hand out clusters. Each one is a real K3s control plane, so teams install whatever operators they need inside their own API server while the host still enforces the quota.

What you get

• Each cluster gets whole cards; two clusters never share one accelerator.
• Capacity shown in status is what the hardware actually reports, not what was requested.
• Quota usage is measured on the host, so the limits you set are the limits that apply.
• Works with any accelerator your cluster advertises, NVIDIA or Ascend alike.

The situation

Integration tests need cluster-scoped objects: CRDs, webhooks, storage classes, and a control plane that can be restarted. A shared namespace cannot provide that, and provisioning a whole managed cluster per test is too slow and too expensive.

With KubeCell

A cluster is created in seconds once images are warm, and deletion is complete: KubeCell removes the cluster, its credentials, and everything it created on the host. The kubeconfig is always published to one Secret, so CI can pick it up with a single command.

What you get

• One cluster per branch: apply a manifest, wait for Ready, run tests, delete.
• An admin kubeconfig is published every time — no manual hand-off.
• Predictable cleanup, including PVCs, with Retain as the storage safety net.
• Dry-run checks let CI fail fast when the host is out of capacity instead of hanging.

The situation

Students need admin rights to learn Kubernetes: install operators, break things, and fix them. Namespace-only classrooms cannot teach cluster-scoped concepts, and per-student VMs are expensive and slow to prepare.

With KubeCell

Create one small quota tier and issue a cluster per student. Each cluster shows a single node, so every kubectl tutorial works verbatim, and the host keeps a misbehaving cluster from affecting the rest of the class.

What you get

• Admin kubeconfigs without giving anyone access to the host.
• Hard CPU and memory caps per student, enforced by Kubernetes, not by convention.
• Students cannot break the host: privileged Pods and hostPath volumes are rejected.
• Teardown is one delete per student cluster.

The situation

Your accelerators and data live at a remote site behind NAT. You still need one place to declare changes, watch capacity, and hand out developer clusters — without opening inbound management paths to every machine.

With KubeCell

Hosts connect outbound to the management cluster. Every change is applied through that one channel and every observation comes back the same way, so there is no inbound tunnel to maintain and no agent to babysit.

What you get

• One management plane for many sites, with each site isolated on its own hosts.
• No inbound SSH or API access to hosts required for day-to-day operation.
• Sites that stop reporting are visible immediately, before anyone tries to create a cluster.
• Endpoints are discovered and republished, so kubeconfigs keep working after address changes.

The situation

Requests for clusters arrive faster than your team can provision hardware. You need the platform to own capacity and guardrails while product teams self-serve inside them — without negotiating every request in chat.

With KubeCell

The platform publishes hosts with their observed capacity and a small set of quota tiers. Teams check a request with a dry run, then create the cluster. Every step is visible as a Kubernetes resource with status, so capacity conversations happen against real data.

What you get

• Dry runs before commitment: accepted, rejected with reasons, or unknown.
• Capacity accounting per host: requested, pending, and available estimates.
• Bindings are immutable, so capacity cannot silently move between hosts.
• The same tested versions everywhere, upgraded through releases.