Reference Architecture — 01 / Cloud & Infrastructure

AI Infrastructure Reference Architecture for GPU Clusters

A production-grade blueprint for standing up multi-tenant GPU infrastructure — from ingress and model serving down to NVLink-connected compute and high-throughput storage, built for real training and inference workloads.

3-Tier Design
East–West Optimized
H100 / A100 Ready
Kubernetes-Native
The Problem

GPU infrastructure isn't just “more compute”

Most teams stand up GPU clusters by extending patterns built for stateless web applications — and it shows up as idle accelerators, saturated links, and storage that can't keep pace with data loaders.

01

Idle GPUs, rising bills

Without scheduling built for accelerators — MIG, time-slicing, priority classes — clusters run at 30–40% utilization while invoices assume 100%.

02

East-west bottlenecks

Distributed training moves gradients between GPUs constantly. Route that over generic VPC networking instead of NVLink/InfiniBand, and compute sits waiting on the network.

03

Storage can't keep up

Object storage alone starves multi-GPU training jobs. Without a tiered storage layer, expensive accelerators idle waiting on I/O.

04

No governance boundary

Shared clusters without namespace quotas and cost attribution turn into a free-for-all the moment a second team joins.

The Blueprint

A three-tier architecture, built for GPU-native traffic

Presentation, platform, and infrastructure are kept as distinct tiers with clearly owned east-west paths — so scaling the GPU layer never means re-architecting the platform above it.

FIG. 01 — AI-INFRA-GPU-CLUSTER-REV3 SCHEMATIC 3-TIER / EAST–WEST TRAFFIC MODEL
TIER 1 — ACCESS & PRESENTATION INGRESS & ROUTING NGINX / Istio Ingress · AuthN/AuthZ Rate Limiting CLIENT ACCESS Web Portal · REST/API Clients JupyterHub · Model Catalog UI EDGE SERVICES CDN · WAF / DDoS Protection Bot Protection TIER 2 — AI / ML PLATFORM PLATFORM SERVICES API Services · Model Registry Feature Store · Prompt Library Experiment Tracking WORKLOAD ORCHESTRATION Kubernetes · KServe / Ray Serve Argo Workflows · Job Scheduler DATA & VECTOR SERVICES Vector DB (Milvus / pgvector) Metadata Store · Redis Cache Kafka / RabbitMQ TIER 3 — GPU COMPUTE & DATA GPU COMPUTE CLUSTER GPU Node 1 ··· GPU Node N NVIDIA H100 / A100 NVLink/NVSwitch (intra) · IB/RoCE (inter) STORAGE LAYER NVMe High-Perf · Object Storage Parallel FS (Lustre / CEPH) Backup / Archive Storage SCHEDULING & ISOLATION Node Pools · MIG / Time-Slicing Namespace Quotas · Priority Classes EAST–WEST TRAFFIC FLOW — WITHIN CLUSTER / VPC API Services Model Inference Service Feature Store Object Storage Model Registry Vector Database Training Jobs Vector DB and Training Jobs are queried synchronously by the inference service; checkpoints replicate to object storage asynchronously. NETWORK & CONNECTIVITY VPC / VNet · Private Subnets · Security Groups / NSG · NAT Gateway · VPN / Direct Connect · Peering HARDWARE REF: GPU Servers (H100/A100) · CPU Control-Plane Nodes · Non-Blocking Fabric (IB/RoCE) · Spine-Leaf Switching · Redundant Power & Cooling
Sync data traffic (gRPC / HTTP)
Async traffic (events / streaming)
Management / control plane
Tier boundary
Design Decisions

Six decisions that make or break a GPU cluster

In order — the sequence architects actually work through when standing this up.

01

Separate control plane from data plane traffic

Management, monitoring, and orchestration traffic never shares a path with training or inference data — a noisy dashboard should never stall a training job.

02

Keep GPU traffic off generic networking

NVLink / NVSwitch for intra-node, InfiniBand or RoCE for inter-node. Routing gradient sync over standard VPC networking is the single most common cause of idle accelerators.

03

Right-size storage by access pattern

NVMe for hot checkpoints, a parallel file system for training data, object storage for archives. One tier of storage cannot serve all three access patterns well.

04

Treat the model registry as core infrastructure

Model registry, feature store, and experiment tracking are platform services with their own SLAs — not an afterthought bolted onto the compute layer.

05

Design for multi-tenancy from day one

Namespace quotas, MIG / time-slicing, and priority classes — retrofitting isolation onto a shared cluster after the second team joins is far more expensive.

06

Instrument what actually matters

GPU utilization, network fabric saturation, and job queue depth — not just CPU and memory, which are the wrong signals for accelerator-bound workloads.

Reference Stack

Technology choices by tier

Illustrative — final selection depends on existing platform investments, team skillset, and cloud vs. on-prem constraints.

Tier 1 — Access & Presentation
NGINX / Istio Ingress
AuthN/AuthZ
Rate Limiting
CDN
WAF / DDoS Protection
JupyterHub
Tier 2 — AI / ML Platform
Kubernetes
KServe / Ray Serve
Argo Workflows
MLflow / Model Registry
Milvus / pgvector
Kafka / RabbitMQ
Redis
Tier 3 — GPU Compute & Data
NVIDIA H100 / A100
NVLink / NVSwitch
InfiniBand / RoCE
Lustre / CEPH
S3-Compatible Object Storage
MIG / Time-Slicing
Foundation Services
IAM / RBAC
Secrets Management
Policy as Code
Prometheus / Grafana
ELK / Loki
GitLab CI
What This Is Designed to Deliver

Engineering targets, not marketing claims

We haven't published a client case study for this pattern yet — these are the outcomes this architecture is engineered to hit, based on established infrastructure practice.

A note on the numbers below: these are industry-recognized engineering benchmarks for well-architected systems of this kind, not results from a specific Vakratron deployment. We'll publish real project data as engagements complete.
70–85%
Sustained GPU utilization achievable with proper scheduling, vs. 30–40% in ad-hoc setups
Sub-ms
Intra-node latency with NVLink/NVSwitch vs. standard networking for gradient sync
Per-team
Cost attribution and quota enforcement across every namespace sharing the cluster
Zero
Cross-tenant interference when MIG / time-slicing and priority classes are enforced
FAQ

Common questions from platform teams

How is this different from a standard Kubernetes cluster?
Standard Kubernetes scheduling has no concept of GPU topology, NVLink domains, or accelerator fractioning. This architecture adds GPU-aware scheduling, a dedicated compute fabric, and storage tiers sized for training I/O — layered on top of, not instead of, Kubernetes.
Do we need InfiniBand, or is high-speed Ethernet (RoCE) enough?
RoCE over high-speed Ethernet gets close to InfiniBand performance for most training workloads at lower cost and operational complexity. InfiniBand still leads for the largest, most latency-sensitive distributed training jobs.
How does this handle multiple teams sharing one cluster?
Through namespace-level quotas, MIG or time-slicing for GPU fractioning, and priority classes for job scheduling — so one team's burst workload can't starve another's.
Does this run on AWS / Azure / GCP, or only on-prem?
The pattern is cloud-neutral. Managed GPU instances and equivalent networking exist on all three major clouds; the same tiering applies on-prem with NVIDIA DGX or comparable hardware.
What's a realistic timeline to stand this up?
For an existing Kubernetes footprint: 4–6 weeks for the platform and compute tiers. Add 2–4 weeks if InfiniBand fabric or new GPU hardware procurement is involved.

Planning a GPU cluster or AI platform build-out?

We design and stand up infrastructure like this for enterprise and government teams. Bring us your constraints — cloud, on-prem, or hybrid — and we'll work through the architecture with you.

Continue Reading

More reference architectures