> ## Content Index > Fetch the complete content index at: https://www.stirup.si/llms.txt > Use this file to discover other available public pages before exploring further. # Share GPU clusters across teams with isolation and fairness using Amazon SageMaker HyperPod - URL: https://www.stirup.si/share-gpu-clusters-across-teams-with-isolation-and-fairness-using-amaz-294e69e6/ - Published: 2026-10-12T03:11:28.000Z - Updated: 2026-10-12T03:11:28.000Z - Description: This article explores a reference architecture for securely sharing an Amazon SageMaker HyperPod EKS cluster across multiple teams, leveraging AWS IAM Identity Center for authentication, Kubernetes namespaces for isolation, and HyperPod Task Governance for fairness. The architecture ensures resource - Author: Satish Das - Tags: Cloud, Stirup Research ## Multi-Team GPU Cluster Sharing with Amazon SageMaker HyperPod As organizations scale their AI and machine learning operations, the need for shared GPU resources across multiple teams becomes increasingly critical. Amazon SageMaker HyperPod offers a scalable and optimized solution for managing large-scale compute clusters, particularly for generative AI workloads. However, without a well-structured architecture, shared GPU environments can lead to uncontrolled resource consumption, weak isolation, and administrative overhead. This article outlines a reference architecture that enables secure, efficient, and fair sharing of a single HyperPod EKS cluster among multiple teams. ## Architecture Overview The proposed architecture is designed to ensure isolation, fairness, and cost visibility for each team using a shared HyperPod EKS cluster. It leverages several AWS services and Kubernetes features to achieve these goals: - **AWS IAM Identity Center** for centralized authentication and federation with external identity providers. - **SageMaker AI Domains** for team-specific user experiences and execution roles. - **Kubernetes Namespaces** for workload isolation and access control. - **HyperPod Task Governance** for fair resource allocation and scheduling. - **Namespace-level cost allocation** for visibility and chargeback of GPU usage. ## Authentication and Authorization The architecture begins with centralized authentication through AWS IAM Identity Center, which federates with external identity providers such as Microsoft Entra ID. This ensures that users from different teams can authenticate using their existing corporate credentials. Once authenticated, users are directed to their team-specific SageMaker AI domain, where they can access a tailored environment with appropriate permissions. Each team is assigned a dedicated IAM role that defines the permissions required for accessing AWS services and the HyperPod EKS cluster. These roles are mapped to Kubernetes RBAC policies, ensuring that users can only interact with resources within their designated namespace. This dual-layer approach to authorization ensures that teams remain isolated from one another while still being able to use shared GPU resources efficiently. ## Workload Isolation and Resource Fairness Kubernetes namespaces are used to isolate workloads for each team. This ensures that resources such as CPU, memory, and GPU usage are confined to specific namespaces, preventing one team from monopolizing resources at the expense of others. HyperPod Task Governance further enhances fairness by managing compute quotas and scheduling priorities, ensuring that each team receives a fair share of the available resources based on predefined policies. ## Cost Allocation and Chargeback Namespace-level cost allocation is a key component of this architecture, enabling organizations to track and attribute GPU usage costs to individual teams. This provides visibility into team-specific spending and supports chargeback models, ensuring that teams are held accountable for the resources they consume. This is particularly useful in enterprise environments where cost management and budgeting are critical. ## Storage and Data Management The architecture also includes a two-tier storage model. The first tier is a POSIX-compliant file system (such as Amazon FSx for Lustre or OpenZFS), organized into per-team shared directories and per-user home directories. The second tier consists of Amazon S3 buckets for object storage, governed by team-specific IAM execution roles. This ensures that data is securely managed and accessible only to the appropriate teams. ## Conclusion This reference architecture provides a blueprint for securely sharing a single Amazon SageMaker HyperPod EKS cluster across multiple teams. By leveraging AWS IAM Identity Center, Kubernetes namespaces, and HyperPod Task Governance, organizations can ensure isolation, fairness, and cost visibility while maintaining operational efficiency. This approach is particularly well-suited for enterprises with multiple AI teams that require shared GPU resources but need to maintain strict control over resource usage and cost allocation. **Source:** [AWS Machine Learning](https://aws.amazon.com/blogs/machine-learning/share-gpu-clusters-across-teams-with-isolation-and-fairness-using-amazon-sagemaker-hyperpod/?ref=stirup.si). Analysis based on publicly available information; no hands-on testing is claimed.