First of all: what is the current state of data centres in the public sector? Certain weaknesses are evident here. Not only are the existing data centres showing their age, but IT consolidation is also lagging behind schedule. Capacity expansions involve considerable lead times. This makes these data centres rather inflexible when it comes to meeting increased demands.
In contrast, there are modern and scalable data centres from major market providers, which also offer a very comprehensive range of services. With their help, existing data centres can be expanded and vulnerabilities addressed. The sovereign cloud is coming into focus – it is fast, cost-effective and service-oriented.
Public administration on the path to sovereignty
The federal government, the Länder and local authorities have jointly set themselves the goal of continuously strengthening sovereignty in public administration. Within the framework of the target architecture, the IT Planning Council has defined the necessary standards for the German Administrative Cloud Strategy (DVS) and continues to update them. This encompasses both existing cloud solutions from the federal, state and local authorities, such as the Federal Cloud, as well as the European Gaia-X Cloud with its rigorous open-source approach and the Sovereign Cloud Stack (SCS) with its fully open software stack. The common background is the implementation of the Online Access Act in accordance with the ‘one for all’ (EfA) principle.
Further guidelines and specifications, such as the BSI’s IT-Grundschutz and Cloud Computing Criteria Catalogue, as well as the architectural guidelines of the federal and state governments, specify technical, infrastructural and organisational aspects for the introduction of the sovereign cloud and minimum requirements for the information security of services in the cloud.
Technical and organisational standards for public authorities and IT service providers
Public authorities must ensure that their cloud service providers meet various business requirements as well as the key architectural specifications. In particular, for container operations, software components must be used in accordance with the standards of the German Public Administration Cloud Strategy, and a container environment and registry must be in place that support vulnerability scans.
All technical components of a sovereign cloud are centred around Kubernetes. This is the orchestration tool for containers and can, in effect, be regarded as the cloud’s operating system. However, a wide range of other open-source components are required to operate Kubernetes securely and effectively – regardless of the cloud platform used – such as observability/monitoring, malware scans, and policy definition and enforcement. Materna has created such a Kubernetes environment and installed it on several sovereign clouds. In doing so, the IT Planning Council’s specifications were implemented and the first applications were migrated to it.
When a development environment is provisioned, it must allow access to the ÖV Open CoDE OS platform (which is relevant, for example, for registers) and support continuous integration and continuous deployment (CI/CD).
Public authorities must implement the business, technical, information security and data protection architectural requirements, as well as the prescribed standards for interoperability, digital sovereignty, modularity and reusability of components.
How does the sovereign cloud change the way data centres operate?
One advantage of using larger cloud providers is that they take care of capacity planning, thereby freeing up some of the administration’s own budgets and resources. However, overall responsibility for the security and availability of the services remains with the organisation itself and, at the same time, becomes even more demanding, as modern technologies must be assessed, deployed and monitored.
System administrators in public authorities have, until now, been highly specialised: in networks, servers, storage and other components. Here, requirements are shifting and new areas of responsibility are emerging. This means that, in future, there will be greater demand for generalists who can maintain an overview of the whole picture. At the same time, there is a need for cloud experts and trusted partners who are familiar with various cloud providers and can continuously evaluate cloud offerings in detail. In the case of a sophisticated multi-cloud environment comprising various platforms from international and national hyperscalers, this can present a greater challenge.
Materna supports IT and data centres at federal, state and local government levels with consultancy on infrastructure, automation and monitoring, and provides cloud operations as a managed service. This forms part of our modular approach to Journey2Cloud™ Public. You can find out more in our new white paper.
Click here to download the Journey2Cloud™ white paper
More on the “Sovereign Cloud” series:
Part 1: Sovereign Cloud drives
digitalisation in public administration; Part 2: Ready for the Sovereign Cloud? Public sector data centres in the spotlight
Part 3 Cloudy with a chance of specialist procedures: how the Sovereign Cloud is revolutionising
the public sector Part 4 New perspectives: GIS goes Sovereign Cloud
