AWS Details Open-Source HyperPod InstantStart Control Plane for Agent Ops

Amazon Web Services has detailed HyperPod InstantStart, an open-source control plane that composes Amazon EKS orchestration with the managed capabilities of Amazon SageMaker HyperPod, in an AWS Machine Learning Blog post published September 4, 2026. The project pairs a web interface with an AI agent that plans and executes multi-stage cluster operations through Model Context Protocol tools.

InstantStart runs as a single out-of-band management container inside a user’s AWS account, calling AWS service APIs and the Kubernetes API without sitting in the data path of training jobs or inference requests. Every resource it creates is a standard AWS or Kubernetes object that remains inspectable with the AWS Command Line Interface and kubectl. The web UI, a REST API, and the MCP tools used by the agent are three faces of the same container, so both interfaces enter through one backend and pass the same validations.

One Backend Behind Two Interfaces

The post’s central design argument is that the MCP tools wrap the control plane’s own REST APIs rather than the AWS CLI or SDK, so a validation added once protects the browser and the agent alike. In the web interface, creating a cluster with dependencies installed, automatic node recovery on, and storage mounted is a form and a progress panel; in a terminal, it is a single natural-language sentence to an agent configuration called hypd-inst-agent, built for Kiro CLI. The agent then sequences the work: EKS control-plane creation, active-cluster selection, dependency reconciliation, HyperPod cluster creation, and storage setup. AWS says EKS control-plane creation finishes in roughly 8 to 12 minutes, and each later stage records its own status and is independently retryable.

Three workflow rules are encoded in the project’s agent skills, which the post describes as markdown playbooks versioned in the repository. The agent polls every long-running operation to a terminal state rather than reporting a submitted request. It asks only decision-grade questions, such as Availability Zone, instance type, and capacity type, while treating subnet CIDRs, route tables, and security groups as control-plane work. And it inspects before it creates, listing existing clusters and querying valid zones and instance types before offering choices.

Managed Capabilities as Reconciled State

InstantStart creates HyperPod clusters with automatic node recovery enabled, under which HyperPod can reboot or replace faulty nodes based on its health-monitoring agent, basic health checks, and optional deep health checks that stress-test GPUs and Elastic Fabric Adapter connectivity before nodes accept work. When a user adds an instance group, capacity type, network interface mode, and subnet placement are settled as one create-time operation; capacity type and EFA-only interface mode are fixed for the life of the group. The control plane routes every capacity path through a single function that provisions compute subnets sized at /20 for large accelerator fleets.

HyperPod managed Karpenter-based node autoscaling decides how much of that capacity runs at any moment, with AWS operating the Karpenter controller itself and nodes launching from HyperPod instance groups scaled up from zero. The post notes one scoping limit: managed Karpenter manages HyperPod instance groups, not general-purpose Amazon EC2 capacity.

The Advanced Features panel exposes HyperPod’s managed capabilities, including the training operator, the inference operator, managed tiered checkpointing, and managed autoscaling, with each toggle mapped to a dependency-aware backend operation. Enabling tiered checkpointing provisions an identity chain spanning a Kubernetes service account, an IAM role and policy, an OpenID Connect trust relationship, and the binding annotation, and disabling it removes the same chain. The post also describes an explicit-diff contract adopted after an early bug: the interface submits only fields the user actually changed, and the backend reads actual cluster state and no-ops when requested and actual state already match.

Training and Inference Paths

For training, InstantStart offers two submission paths. The HyperPod training operator, installed as an EKS add-on, adds process-level fault recovery, hang-job detection through log-pattern monitoring, and outlier detection, with work submitted as HyperPodPyTorchJob resources carrying a visible recovery budget. The second path is standard KubeRay, aimed at Ray-native workloads such as reinforcement learning. Above both sits a recipe layer for plain PyTorch scripts, LLaMA-Factory, MS-Swift, and VERL reinforcement learning, all sharing one data contract in which the same Amazon S3 bucket is mounted in the development environment and inside pods. Job logs stream to the browser over WebSocket, and recipes can report metrics such as training throughput to managed MLflow on Amazon SageMaker AI.

Inference likewise has two paths. The managed path hands lifecycle to the HyperPod inference operator, with managed tiered KV caching and intelligent routing strategies declared alongside the endpoint. The self-managed path deploys a serving container of the user’s choice, such as vLLM or SGLang, as a standard Kubernetes deployment, with service shapes including an external load balancer, a cluster-internal service, and a model pool of warm GPU workers that can be reassigned by changing a label. For multi-replica SGLang serving, the control plane can deploy the SGLang router with cache-aware routing and drive autoscaling through Kubernetes Event-driven Autoscaling.

Agent Tooling and Boundaries

The MCP server publishes 38 tools covering cluster lifecycle, instance groups, managed features, storage, model download, inference deployment, jobs, and node operations, according to the post. Every mutating tool names the status tool that determines completion, and operations persist their phase before polling begins so an agent retry cannot replay a mutation. The project’s GitHub repository describes the platform as a training-and-inference-integrated system built on SageMaker HyperPod and standard EKS orchestration, and its README states that the MCP tools wrap project backend APIs for best-practice compliance while agent skills orchestrate end-to-end workflows with zero local setup beyond the agent.

The post draws explicit operational boundaries. Bundled diagnostic skills for NCCL, node health, and cluster-creation failures investigate read-only on their own, present state-changing commands as suggestions, and escalate in the order investigate, reboot, then replace. IAM, Kubernetes authorization, network controls, and backend validation remain the actual security boundaries; the agent widens access to the control plane without widening its privileges. AWS also advises that elastic training currently excludes Spot Instances, managed tiered checkpointing, and checkpointless training, and that SageMaker HyperPod cluster-usage quotas and training-plan reservations for high-end GPU types need arranging before the first cluster.

Deployment starts from a CloudFormation template that creates the management environment, a shared S3 bucket, and supporting IAM roles, with the web interface served from the container on port 3099 and reached through an AWS Systems Manager port-forwarding session.