Only one minute late, it's been a long day, so bear with me.
So hello everyone, thanks for joining this talk so late in the day.
My name is Thierry Carras, I work for the Open Infrastructure Foundation, which is the
home for the OpenStack project and Cata containers and a few others.
From the accent, you can probably tell I'm based in France, and so I'm very aware of
the questions around digital sovereignty, and I wanted to use this talk to give you
a sense of why, from our perspective, digital sovereignty really matters, and how can open
infrastructure help in that area.
But first, what do we mean by digital sovereignty?
If you've been in this room for the whole day, I'm pretty sure you've already heard
10 definitions, I'll just add one.
Obviously, the digital sovereignty is around access to data, and the 21st century is really
global and driven by software, and so in a fast-changing world, whoever adapts the fastest
really wins.
It's really a question of disrupt or be disrupted.
So the ability to adapt fast and ship new features fast and deliver new applications
fast is really critical.
But the way you deliver those applications has really been evolving over the past 20
years.
20 years ago, if you started, same time I started, you would procure some physical hardware
and as an application employer, you would install your operating system, your dependencies,
and your application on top of that.
But that was a bit inconvenient, so we added more and more layers.
The first layer we added was hardware virtualization, abstracting the server your application is
running on from the physical hardware that runs it, and you gained a lot of efficiency
doing that.
Then we added another layer, which is cloud APIs, which allows you to programmatically
access those virtualized resources.
And so you have those two concepts.
You have programmable infrastructure on one side, and you have cloud-aware applications
being deployed on top of that.
And this programmable infrastructure is really key to reach the next level of velocity because
machines need to be able to provision the resources that they need by themselves.
And so you really need that programmable infrastructure to reach the next level of velocity and ability
to deliver applications fast.
The building up this programmable infrastructure by yourself is really a challenge.
It's complex to do, and it's difficult to find talent that knows how to do it, because
there is a lot of demand for those skills.
Luckily, you can pay others to do it for you by using public clouds, available public
clouds, or managed private clouds.
But the trick is, the cloud market is really cornered by a couple of internal giants based
in the US or China.
So this really creates a challenge for European governments and companies.
The challenge is that in order to stay competitive, European companies really need access to programmable
infrastructure.
But the most obvious way to get to that programmable infrastructure is to use a hyperscaler cloud
based in the US.
But data is really the basic resource of the 21st century, and which legislation your
data lives under, like Ludovic just said, really ultimately defines who controls it.
Like the US government can't compel any US company to disclose their customer data.
In case of a geopolitical conflict, you can see the US government shutting down access
to vital data that is hosted on a US-based company.
This creates really a significant geopolitical vulnerability, and if the last 10 years are
any guide, this vulnerability, if we don't address it, will only grow.
With the recent pandemic, with the war in Ukraine, we've seen growing willingness by
governments to weaponize their control of the international supply chain.
So really, even assuming good intent from those governments and companies, we are all
friends, right?
Well, the legislation that data lives under actually affects which laws apply to it.
An obvious statement, but Europe has really very progressive privacy laws that protect
individuals from the reach of greedy data aggregation companies.
And so how do we enforce those laws in a world where all of that data actually lives
in a place where those laws do not apply?
So even if you assume good intent, there is the risk there.
The solution is, of course, to build our own European-based public clouds.
But it's easier said than done.
Europe really has a vibrant ecosystem of companies, but it really lacks the giants that can compete
with a Google or a Microsoft or an Amazon.
So how can we turn that vibrant ecosystem of smaller actors from a liability to an asset?
Germany and France have really acknowledged this critical geopolitical vulnerability for
a while.
But I would say that the previous attempts at solving it weren't super successful.
Like for example, we had several attempts at building giant sovereign clouds in the past,
but they were really not adapted to the nature of the European ecosystem.
More recently, they moved towards mandating locally operated systems, which is a great
step, especially as far as government data is concerned.
And for others, it also encouraged cataloging and describing available services through
initiatives like Gaia X, which make it clear which laws and policy really apply to the
data.
But those efforts were really easily, trivially worked around by the hyperscader companies.
Some of them co-opted the requirements through local partnerships, so they would work with
the local EU-based company to help them run locally the thing.
So the problem is, working with EU-based organizations to run the services locally really
maintains this critical technological dependency that Amazon could just shut down access or
weaponize access to information really easily.
In some, I picked on Amazon right now, but it's actually the wrong approach because they
are actually not the ones doing that.
Google and Microsoft have been doing a lot more partnerships.
Amazon just decided to lobby against the law and trying to convince legislators that depriving
EU companies from the amazing Amazon web services would critically impact their ability to
be innovative and competitive on the market.
So they basically tried to convince legislators that if they don't let people access freely
Amazon web services, we're doomed because obviously we can't do that here.
So what do we do now?
In that context, I think open infrastructure can help and I want to explain what we mean
by open infrastructure first.
What is it and why can it help?
So if we go back to our picture from earlier, a programmable infrastructure and cloud-aware
applications being deployed on top of that, open infrastructure is really open-source solutions
that help you provide that programmable infrastructure.
And standard there, used by millions of CPU cores all around the world, is a stack composed
of Linux at the virtualization layer, open stack at the cloud APIs layer, and Kubernetes
at the application orchestration layer, what we call the lucky stack.
But why would you use open source for infrastructure?
Why does it matter?
First, it really gives everyone access to infrastructure providing technology.
All organizations, all countries, it really allows to distribute the future more evenly
and by making those technologies accessible to all, you actually allow everyone to play
and innovate without friction or having to ask for permission, you maximize innovation
as a result.
But beyond those two key benefits, you actually have three properties of open infrastructure
that make it really suitable for using it in a digital sovereignty context.
Independence is one of them.
Open infrastructure is not just open source, it's also openly developed.
So Linux, open stack, Kubernetes, those are all developed not by a single vendor, but
by a massive global open collaboration.
And that means everyone can participate on a level playing field under a neutral governance.
Nobody is owning the keys to the kingdom.
Nobody will pull the rug below you by selling to someone else.
Another benefit of open development is transparency, all technical discussions are happening in
the open, all governance decisions are publicly documented.
Trust is really essential in building a digital sovereign, digitally sovereign cloud system.
And open infrastructure is really naturally transparent.
And finally, being able, giving everyone access to that technology, it allows everyone
to standardize on using the same solutions, which enables interoperability.
Interoperability is really the main challenge for federating a group of smaller actors to
compete with giants because it's really hard to eliminate the differences and present a
coherent user experience.
So you can standardize on available features, that's a good first step.
You can expose the same APIs, which is even better.
Using the same technical stack obviously is one step above that.
And so EU companies that are standardized on the low key stack like Deutsche Telekom,
Chloroise, I've seen a hoodie there, OVH Cloud in France, Orange Business Services, Binaural
Exine, for many a cloud fair in Poland, Elastics in the Nordics, they all give you the same
APIs backed by the same software and showing good interoperability.
And once combined, all of those public cloud providers give you enough points of presence
and capacity to actually rival any of the hyperscaders.
But in order to increase interoperability even further, you can build a common distribution
and share operational practices that will give you the next level, I mean perfect interoperability
because it will be basically the same software running in the same conditions in different
data centers.
And this is what the sovereign cloud stack project is, aims to solve, and we'll have
a presentation later, here you are, by Kurt.
So I suspect it will go into a lot more details, but I'll just summarize for those who will
not stay in the room, sovereign cloud stack as the name implies is an initiative aiming
to build a standard stack for providing sovereign infrastructure.
It's composed of a standard Loki stack, also making use of SEF, another open infrastructure
component.
It's aiming at enabling a federation of highly interoperable infrastructure providers, and
it's going beyond proposing the same features, exposing the same APIs, running the same software
to sharing the operational choices and best practices.
It's also openly developed open source, so anyone can join and participate in the level
playing field, and I'll conclude on that in summary.
Digital sovereignty is a major challenge for Europe in the 21st century, especially around
infrastructure, the infrastructure layers, because if we leave the hyperscalers in full
control of that layer, we are going to be easily cut from our sources of information
in case of any tension.
Open infrastructure is open source solutions for providing infrastructure for applications
and data.
It enables independence, transparency, and interoperability, which are necessary to
really federate a bunch of local actors to compete with the U.S.-based giants.
And so if you care about digital sovereignty, as you should, have a look at the open infrastructure
to power providers that I mentioned, but also at the software and cloud stack and stay in
the room to see the CURTS presentation later today.
Thanks for listening.
And we have plenty of time for questions.
Hi, my name is Michael.
I tried to deploy OpenStack about a decade ago in our internal stuff.
We found it very difficult.
In fact, one of the problems we had were an organization of about 12 people, and OpenStack
was clearly appropriate for an organization of 100 people.
And so we went for both simpler solutions, you know, plain Zen, KVM, and hyperscalar
sides of things.
And my impression is that it hasn't changed much.
That OpenStack has a scaling issue, meaning it's great for large systems and large installations,
but it's not good for small systems.
And so what that means is that I don't develop for the stack that you want to deploy.
I develop for something else because I can't afford to maintain that piece.
One of the annoyances, and I'll just let you answer it, one of the annoyances at the time
was the V6 support was abysmal, and it's better now.
But my impression is still that Kubernetes, for instance, is like, what's an IPv6, they
just don't care.
And I wonder in this common operational choices and carriers stuff that you're talking about,
so this is, you're going to address this issue of, well, I can't really move a cluster
from point A to point B if I have overlapping 1918 dress spaces.
I need V6 and I need it to work natively and well so that I could don't have to think
about this nonsense.
So should I repeat the question for, I hope the question was recorded, it was a long one.
So first on the concern around the size of deployment or the inability to scale down
to simpler deployments, I would say that it has improved a lot.
Providing infrastructure is really a difficult job.
It's not like something you would deploy on your garage.
If you're at a stage where, like you say, a company with 10 people, I don't think there
is much sense in doing it, but the main concern was really keeping up to date with upgrades
and the cycle of six months releases that we had and we made a lot of progress there
in securing the updates, in limiting the amount of changes that are happening over a cycle
of six months, pretty mature and stable now.
And we are seeing teams of relatively small numbers running gigantic systems.
Like Ubisoft, for example, is running a very large open stack private cloud for their game
servers and it's a team of 10 to 12, what they said in the latest webcast.
So obviously, yeah, more for 100 people company than for 10 people company.
In terms of, I think distributions like sovereign cloud stack, others where there is also more
guidance in the type of options that you should be deploying, more partners, you can really
rely on and sharing the same issues will further help, but it's true that it's more targeted
to people that have enough, I would say, the minimum size of the deployment is more like
dozens of servers than three or four servers, for sure.
In terms of the V6 support, I'm actually surprised because open stack had IPv6 support
before Amazon did.
Amazon is totally sorry.
Okay.
Well, maybe that's placing the bar very low.
And I don't necessarily have the dual contact that I'm interested in hearing more about
it if we can do that, but it feels like overall, in terms of updates, and I'm actually very
surprised when I talk to some of the big deployments that we have and see that they're actually
running it with a team of three or four people.
So I would say, I mean, I'm not an operator myself, I'm not running an open stack cloud
myself, so it's difficult to see directly how easy it is or how difficult it is.
But what we are seeing from practical data is that the more we go, the smaller the teams
are, we have clearly a talent shortage, so it's difficult to find talent.
I would say that's the main challenge right now for open stack is really the difficulty
to find people that actually have experience doing it.
So most of the companies that are deploying it today, especially in Western Europe, France
and Germany, there is a lot of training of new people, they will train their own teams
because finding talent on the market is very, very difficult.
I would say that's the main blocker right now if you had to cite one.
Other questions?
I'll be in the room for the rest of the day, so thank you so much.