AMD Validated Reference Architecture: Data Storage for GPU-Accelerated AI

Learn More

Velocity • Durability

Book a Briefing
Contact Sales
Book a Briefing
Book A Demo
Contact Sales
Contact Sales
AI SOLUTIONS / MULTI-TENANCY

Sell one fleet to many tenants, without selling them each other's blast radius.

Hard multi-tenancy is built into the platform, not bolted on. Each tenant gets its own namespace, its own VLAN and subnet, its own AES-256 keys, and a failure domain that ends at their pool. An incident touches one isolation domain, never the fleet.

✓ Per-tenant VLANs and subnets ✓ Per-tenant AES-256 keys ✓ Hourly metering per volume
ONE CONTROL PLANE · SEPARATE BLAST RADIUSES
CONTROL PLANE Director quorum · stateless · instant failover · serves VeLO metadata for all domains Dedicated customer A all-flash pool · dedicated SLA Vol 1 Vol 2 DEDICATED BLAST RADIUS StorageSet = failure domain vlan 101 · own AES-256 key Dedicated customer B all-flash pool · dedicated SLA Vol 1 Vol 2 DEDICATED BLAST RADIUS StorageSet = failure domain vlan 102 · own AES-256 key Shared capacity pool mixed fleet · volume-isolated Tenant 1 Tenant 2 SHARED, VOLUME-ISOLATED StorageSet = failure domain flash + HDD, one namespace Per-tenant VLANs · per-tenant AES-256 keys (BYOK) · per-tenant telemetry and hourly metering
HDD issues in a capacity tier never touch a performance tier. SLA exposure stays contained to one customer's domain, with no cascade across the fleet.
WHY TENANCY IS A STORAGE PROBLEM

Compute partitions cleanly. Storage is where tenants collide.

A scheduler hands each tenant its own GPUs without argument. The storage tier underneath is still one shared resource, and that is where one tenant's bad hour becomes another tenant's missed SLA.

NOISY NEIGHBORS
One tenant can spend the whole tier
A checkpoint burst, a metadata storm, or a bad data loader consumes bandwidth that another tenant is paying for. On a flat shared tier there is nothing structural stopping it.
VDURA: Volumes map to StorageSets, so tenant traffic sits inside its own pool. Telemetry reports p99 latency and queue depth per tenant, and volume QoS adds hard bandwidth and IOPS guarantees.
BLAST RADIUS
One incident becomes every SLA
When every tenant sits in one failure domain, a hardware problem is a fleet-wide credit event. The cost of an outage scales with how well you sold the cluster.
VDURA: A StorageSet is an independent group of storage nodes with its own erasure-coding boundary. An incident touches one isolation domain, and HDD issues in a capacity tier never reach a performance tier.
ONBOARDING
Storage is the ticket that holds up the contract
If provisioning a tenant means LUN carving, a rebalance, and a change window, storage sets the pace of revenue instead of following it.
VDURA: One API call sets capacity, quota, encryption key, and VLAN. The volume is mountable in seconds, with no LUN carving and no rebalance.
THREE CONSTRUCTS

Platform, StorageSet, Volume. That is the whole model.

Three constructs map cleanly onto how a GPU cloud deploys capacity and bills for it. One namespace for simplicity, multiple StorageSets for isolation, volumes per tenant for control.

PLATFORM · REALM
Platform
One unified view
· Single view across all storage, with one control plane for management and policy
· REST API, observability, UI and CLI
· Owns storage-node membership
· Spans one or many StorageSets
STORAGESET
StorageSet
The blast radius
· Physical isolation boundary: an independent group of storage nodes
· Defines the failure domain and the erasure-coding boundary
· Hardware issues stay inside it
· Sized to the workload and the tier it serves
VOLUME
Volume
The tenant unit
· Tenant namespace isolation with quota and encryption controls
· A tenant can own one volume or many
· Per-volume keys and VLAN or network isolation
· POSIX via DirectFlow, NFS, SMB, S3, and Kubernetes CSI
ONE SHARED TIER, NO ISOLATION
Tenant A's checkpoint burst is Tenant B's latency spike.
Tenant A bursts a checkpoint takes what it can
Tenant B is serving inference under SLA p99 blows out
You find out from the customer, not the dashboard. The credit comes out of the same fleet you were trying to fill.
VOLUME-ISOLATED ON VDURA
Separate namespaces, separate network paths, separate keys.
Tenant A bursts a checkpoint lands on flash
Tenant B is serving inference under SLA holds steady
Telemetry surfaces noisy neighbors per tenant: p99 latency, queue depth, cache hit ratios. Per-tenant bandwidth and IOPS guarantees land with the volume QoS phase.
HOW ISOLATION IS ACTUALLY ENFORCED

Network, crypto, fairness, and governance. Not a quota field.

Isolation
✓ Dedicated namespaces with per-tenant VLANs and subnets
✓ Volume to StorageSet mapping keeps tenant data inside one physical failure domain
✓ Option of fully independent namespaces per domain
✓ Control plane and data plane stay separated throughout
Fairness
✓ Per-tenant namespaces isolate metadata
✓ Noisy-neighbor detection in telemetry: per-tenant p99 latency, queue depth, cache hit ratios
✓ Quotas re-tunable live, with no remount and no downtime
✓ Per-tenant bandwidth and IOPS guarantees with priority scheduling arrive in the volume QoS phase
Cryptography
✓ Per-tenant AES-256 keys, set immutably at volume creation
✓ Bring your own keys through an external KMS over KMIP v1.4 or later
✓ Client-side encryption, so storage nodes never receive or hold a key
✓ FIPS-140 approved AES-256-XTS
Governance
✓ Granular RBAC with MFA on all admin access
✓ Immutable, UTC-stamped audit logs
✓ Hourly consumption metering per tenant volume, feeding your billing directly
✓ HIPAA capable: NIST 800-88 erase, six-year audit retention, BAA
Same mechanisms for a dedicated 2,000-GPU customer and a 100-GPU pool tenant. The difference is deployment model and billing, not architecture.
PER-TENANT CRYPTOGRAPHIC ISOLATION

Storage nodes never hold a key, and never see plaintext.

The DirectFlow client encrypts before data leaves the compute node. It is ciphertext over the wire and ciphertext at rest, so there is no separate TLS stack to deploy alongside self-encrypting drives. Theft of a drive, a JBOD, or a whole server exposes nothing.

✓ Per-tenant keys give you per-tenant cryptographic isolation, not one fleet-wide secret
✓ You hold the keys in your own KMS, which is what data-sovereignty commitments actually require
✓ One step instead of two: no separate TLS plus self-encrypting-drive stack to run
✓ Zero plaintext on storage, so media handling and RMA stop being a disclosure question
Worth knowing up front: on client-side encrypted volumes, access is DirectFlow only. The NFS, SMB, and S3 gateways are disabled by design, because storage never holds the keys.
DirectFlow client AES-256-XTS FIPS-140 approved ciphertext Over the wire no separate TLS VPOD cluster ciphertext only holds no keys Your external KMS KMIP v1.4+ · Vault, Entrust, Thales KEYS NEVER LEAVE YOUR CONTROL
TENANT LIFECYCLE

Onboard a tenant without a human in the loop.

Storage should not be the ticket that holds up a GPU contract. The whole tenant lifecycle is API-driven, so your portal and your billing system can run it end to end.

1
Create
One API call sets capacity, quota, encryption key, and VLAN binding.
2
Mount
DirectFlow on compute, a CSI PVC in Kubernetes, or issued S3 credentials.
3
Observe
The volume appears in Prometheus and Grafana with per-tenant latency, IOPS, and capacity.
4
Bill
An hourly consumption feed per volume flows into your billing system.
5
Adjust
Grow a quota, snapshot, or clone. All online, with no remount.
REST API Kubernetes CSI Terraform Ansible Crossplane Prometheus /metrics Management CLI VDURA Ops Portal
WHAT THIS MEANS FOR THE BUSINESS

Isolation is what lets one fleet carry more paying customers.

More Tenants Per Rack
Hard isolation is what lets you sell a shared pool to customers who would otherwise each demand dedicated hardware.
Contained SLA Exposure
A credit event stays inside one domain. Your downside stops scaling with how well the cluster is sold.
Two Products, One Fleet
Dedicated all-flash pools for platinum customers and a mixed-fleet capacity pool for everyone else, from the same platform and the same namespace.
Faster Time To Revenue
Tenants onboard in minutes through the API rather than in tickets, so storage stops setting the pace of the contract.
Enterprise Renters Say Yes
Per-tenant keys, KMIP, RBAC with MFA, and immutable audit logs answer the security review before it stalls the deal.
Billing That Matches Usage
Hourly metering per volume means what you invoice matches what the tenant actually consumed.
A Lean Team Runs An Exabyte
Automation is the only way tenant count grows faster than headcount. Every step of the lifecycle is an API.
Same Architecture At Both Ends
A 2,000-GPU dedicated customer and a 100-GPU pool tenant run the same mechanisms. Only deployment model and billing differ.

Tell us how many tenants you need to serve.

We will show you what the pools, isolation, and billing look like on your fleet.