Kubernetes Private Cloud: Sovereign Cloud für deutsche Unternehmen

Warum Sovereign Private Cloud für deutsche Unternehmen?

Deutsche Unternehmen stehen vor der strategischen Entscheidung, ob sie ihre IT-Infrastruktur in die Hände von Hyperscalern geben oder eigene, souveräne Cloud-Lösungen aufbauen. Kubernetes Private Cloud bietet die perfekte Grundlage für eine unabhängige, sichere und DSGVO-konforme Infrastruktur:

Datensouveränität - Vollständige Kontrolle über Daten
Unabhängigkeit - Keine Abhängigkeit von Hyperscalern
Compliance - DSGVO, BSI und nationale Standards
Kostentransparenz - Keine versteckten Cloud-Kosten
Sicherheit - Deutsche Sicherheitsstandards

Sovereign Cloud vs. Hyperscaler

Vorteile Sovereign Cloud

Datenschutz - Daten bleiben in Deutschland
Compliance - Vollständige DSGVO-Compliance
Kontrolle - Eigene Infrastruktur-Kontrolle
Kostentransparenz - Vorhersehbare Kosten
Sicherheit - Deutsche Sicherheitsstandards

Nachteile Hyperscaler

Datenschutz-Risiken - Daten im Ausland
Vendor Lock-in - Abhängigkeit von Cloud-Providern
Kostenexplosion - Unvorhersehbare Kosten
Compliance-Probleme - DSGVO-Herausforderungen
Sicherheitsbedenken - Ausländische Sicherheitsstandards

Kubernetes Private Cloud Architektur

Sovereign Cloud Stack

Sovereign Kubernetes Architecture
├── Infrastructure Layer
│   ├── Bare Metal Servers
│   ├── Hypervisor (VMware/KVM)
│   ├── Storage (Ceph/NetApp)
│   └── Networking (Cisco/Juniper)
├── Platform Layer
│   ├── Kubernetes Cluster
│   ├── Container Registry
│   ├── Load Balancer
│   └── Storage Classes
├── Application Layer
│   ├── Microservices
│   ├── Legacy Applications
│   ├── Database Services
│   └── Monitoring Stack
└── Security Layer
    ├── Identity Provider
    ├── Network Policies
    ├── Secrets Management
    └── Audit Logging

Private Cloud Components

Kubernetes Cluster - Multi-Node Production Cluster
Container Registry - Private Registry (Harbor)
Load Balancer - HAProxy oder F5
Storage - Ceph, NetApp oder vSAN
Monitoring - Prometheus, Grafana, ELK Stack
Security - RBAC, Network Policies, Secrets

Private Cloud Setup

Infrastructure Requirements

# Infrastructure Specification
apiVersion: v1
kind: ConfigMap
metadata:
  name: infrastructure-spec
data:
  spec.yaml: |
    servers:
      master_nodes: 3
      worker_nodes: 5
      storage_nodes: 3
    specifications:
      cpu: "32 cores"
      memory: "128 GB"
      storage: "2 TB NVMe"
      network: "25 Gbps"
    hypervisor:
      type: "VMware vSphere"
      version: "7.0"
    storage:
      type: "Ceph"
      replication: 3
      encryption: true

Kubernetes Cluster Setup

# Kubernetes Cluster Installation
# 1. Prepare nodes
for node in master1 master2 master3 worker1 worker2 worker3 worker4 worker5; do
  ssh $node "sudo apt update && sudo apt install -y docker.io"
done

# 2. Install Kubernetes
curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC="--flannel-backend=none --disable-network-policy" sh -s - server --cluster-init

# 3. Join worker nodes
TOKEN=$(sudo cat /var/lib/rancher/k3s/server/node-token)
for node in worker1 worker2 worker3 worker4 worker5; do
  ssh $node "curl -sfL https://get.k3s.io | K3S_URL=https://master1:6443 K3S_TOKEN=$TOKEN sh -"
done

Storage Configuration

# Ceph Storage Class
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: ceph-rbd
provisioner: rbd.csi.ceph.com
parameters:
  clusterID: ceph-cluster
  pool: k8s-pool
  imageFormat: '2'
  imageFeatures: layering
reclaimPolicy: Delete
allowVolumeExpansion: true
mountOptions:
  - debug

Sovereign Cloud Security

Identity and Access Management

# LDAP Integration
apiVersion: v1
kind: ConfigMap
metadata:
  name: ldap-config
data:
  ldap.yaml: |
    ldap:
      host: ldap.company.local
      port: 389
      base_dn: "dc=company,dc=local"
      bind_dn: "cn=kubernetes,ou=service,dc=company,dc=local"
      user_search:
        base_dn: "ou=users,dc=company,dc=local"
        filter: "(uid={username})"
      group_search:
        base_dn: "ou=groups,dc=company,dc=local"
        filter: "(member={user_dn})"

Network Security

# Network Policies
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny
  namespace: default
spec:
  podSelector: {}
  policyTypes:
    - Ingress
    - Egress
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-web-traffic
  namespace: default
spec:
  podSelector:
    matchLabels:
      app: web
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              name: ingress-nginx
      ports:
        - protocol: TCP
          port: 80
        - protocol: TCP
          port: 443

Secrets Management

# External Secrets Operator
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: database-secret
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: vault-backend
    kind: SecretStore
  target:
    name: database-credentials
  data:
    - secretKey: username
      remoteRef:
        key: database/credentials
        property: username
    - secretKey: password
      remoteRef:
        key: database/credentials
        property: password

Application Migration

Legacy Application Migration

# Migration Strategy
apiVersion: v1
kind: ConfigMap
metadata:
  name: migration-strategy
data:
  strategy.yaml: |
    phases:
      phase1:
        name: "Assessment"
        duration: "2 weeks"
        tasks:
          - "Application Inventory"
          - "Dependency Analysis"
          - "Resource Requirements"
      phase2:
        name: "Containerization"
        duration: "4 weeks"
        tasks:
          - "Docker Images"
          - "Helm Charts"
          - "Configuration Management"
      phase3:
        name: "Deployment"
        duration: "2 weeks"
        tasks:
          - "Kubernetes Deployment"
          - "Testing"
          - "Go-Live"

Database Migration

# Database Migration Job
apiVersion: batch/v1
kind: Job
metadata:
  name: database-migration
spec:
  template:
    spec:
      containers:
        - name: migration
          image: migration-tool:latest
          command: ['python', 'migrate.py']
          env:
            - name: SOURCE_DB
              value: 'legacy-database'
            - name: TARGET_DB
              value: 'kubernetes-database'
            - name: MIGRATION_TYPE
              value: 'full'
      restartPolicy: Never
  backoffLimit: 3

Monitoring und Observability

Monitoring Stack

# Prometheus Configuration
apiVersion: v1
kind: ConfigMap
metadata:
  name: prometheus-config
data:
  prometheus.yml: |
    global:
      scrape_interval: 15s
    scrape_configs:
    - job_name: 'kubernetes-pods'
      kubernetes_sd_configs:
      - role: pod
      relabel_configs:
      - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_scrape]
        action: keep
        regex: true
    - job_name: 'kubernetes-nodes'
      kubernetes_sd_configs:
      - role: node

Logging Architecture

# ELK Stack Deployment
apiVersion: apps/v1
kind: Deployment
metadata:
  name: elasticsearch
spec:
  replicas: 3
  selector:
    matchLabels:
      app: elasticsearch
  template:
    metadata:
      labels:
        app: elasticsearch
    spec:
      containers:
        - name: elasticsearch
          image: elasticsearch:7.17.0
          env:
            - name: discovery.type
              value: 'single-node'
            - name: ES_JAVA_OPTS
              value: '-Xms2g -Xmx2g'
          ports:
            - containerPort: 9200

DevOps und CI/CD

GitOps mit ArgoCD

# ArgoCD Application
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: production-app
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://git.company.local/kubernetes/apps
    targetRevision: HEAD
    path: production
  destination:
    server: https://kubernetes.default.svc
    namespace: production
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true

Helm Charts

# Helm Chart Structure
apiVersion: v2
name: company-app
description: Company Application Helm Chart
version: 1.0.0
appVersion: '1.0.0'
dependencies:
  - name: postgresql
    version: 12.1.0
    repository: https://charts.bitnami.com/bitnami
  - name: redis
    version: 16.8.0
    repository: https://charts.bitnami.com/bitnami

Cost Optimization

Resource Management

# Resource Quotas
apiVersion: v1
kind: ResourceQuota
metadata:
  name: compute-quota
  namespace: production
spec:
  hard:
    requests.cpu: '20'
    requests.memory: 40Gi
    limits.cpu: '40'
    limits.memory: 80Gi
    requests.ephemeral-storage: 100Gi
    limits.ephemeral-storage: 200Gi

Cost Monitoring

# Cost Analysis Tool
apiVersion: apps/v1
kind: Deployment
metadata:
  name: cost-analyzer
spec:
  replicas: 1
  selector:
    matchLabels:
      app: cost-analyzer
  template:
    metadata:
      labels:
        app: cost-analyzer
    spec:
      containers:
        - name: analyzer
          image: cost-analyzer:latest
          env:
            - name: INFRASTRUCTURE_COST
              value: '50000' # Monthly infrastructure cost
            - name: ALERT_THRESHOLD
              value: '100000' # Monthly budget threshold

Erfolgsgeschichten

Fallstudie: Manufacturing Unternehmen

Ausgangssituation:

Legacy-Monolith-Systeme
Hohe Wartungskosten
Compliance-Probleme
Vendor Lock-in

Lösung:

Sovereign Kubernetes Private Cloud
Application Migration
DevOps Pipeline
Monitoring Stack

Ergebnisse:

60% Kosteneinsparung
Vollständige DSGVO-Compliance
90% schnellere Deployments
Unabhängigkeit von Hyperscalern

Fallstudie: Financial Services