[{"data":1,"prerenderedAt":790},["ShallowReactive",2],{"layout-sidebar-en-owncloud":3,"project-en-owncloud":493},{"id":4,"title":5,"body":6,"date":467,"description":468,"doc":469,"extension":470,"git":469,"image":471,"isExperimentation":472,"meta":473,"navigation":488,"path":489,"seo":490,"stem":491,"tags":469,"type":469,"updatedAt":469,"website":469,"__hash__":492},"projectsEn\u002Fprojects\u002Fen\u002FOwncloud.md","Owncloud - Open Source Storage Solution",{"type":7,"value":8,"toc":441},"minimark",[9,14,18,21,24,29,32,43,48,51,94,98,101,123,125,129,132,141,145,148,197,201,204,218,220,224,227,231,234,266,270,273,278,292,294,298,301,310,314,331,335,349,351,355,358,362,382,386,414,416,420,423,426],[10,11,13],"h1",{"id":12},"gitops-multi-cloud-architecture-automated-deployment-of-a-resilient-owncloud-infrastructure","🚀 GitOps & Multi-Cloud Architecture: Automated Deployment of a Resilient OwnCloud Infrastructure",[15,16,17],"p",{},"Welcome to this new KernelLab publication! Today, I invite you to take a deep technical dive into a complete infrastructure project: the highly available deployment of an OwnCloud solution. The goal of this project was to design an architecture capable of 24\u002F7 availability for global users, with a strong focus on GitOps automation, security (SecOps), and cost optimization (FinOps).",[15,19,20],{},"To get into the engineering details, I have broken down this article into several strategic areas, from network design to federated observability.",[22,23],"hr",{},[25,26,28],"h2",{"id":27},"️-multi-cloud-architecture-choosing-resilience","🏗️ Multi-Cloud Architecture: Choosing Resilience",[15,30,31],{},"To ensure maximum fault tolerance and avoid a Single Point of Failure tied to a single provider, the infrastructure was designed using a Multi-Cloud approach. This strategic decoupling separates the execution environment from its monitoring system.",[15,33,34,39],{},[35,36],"img",{"alt":37,"src":38},"Macro Architecture Diagram of OwnCloud","\u002Fpictures\u002Fowncloud\u002Fmacro.png",[40,41,42],"em",{},"(Macro\u002FMezzo architecture diagram detailing network flows and service distribution)",[44,45,47],"h3",{"id":46},"_1-google-cloud-platform-gcp-the-application-foundation","1. Google Cloud Platform (GCP): The Application Foundation",[15,49,50],{},"All application workloads are hosted on Google's infrastructure, distributed as follows:",[52,53,54,62,80],"ul",{},[55,56,57,61],"li",{},[58,59,60],"strong",{},"Google Kubernetes Engine (GKE):"," Orchestration relies on a Standard GKE cluster (non-Autopilot). This choice gives us full control over resource allocation and enables the use of Spot instances (e2-standard-2) to massively optimize costs.",[55,63,64,67,68,71,72,75,76,79],{},[58,65,66],{},"Databases & Cache:"," Persistent data rests on ",[58,69,70],{},"Cloud SQL"," (managed MySQL), guaranteeing elastic scalability and automated external backups (7-day retention). For temporary storage, ",[58,73,74],{},"Redis"," is deployed directly ",[40,77,78],{},"in-cluster"," for performance and cost reasons.",[55,81,82,85,86,89,90,93],{},[58,83,84],{},"Serverless Workloads:"," Our internal CI analysis component (built with FastAPI\u002FPython) runs on ",[58,87,88],{},"Cloud Run"," and interacts with ",[58,91,92],{},"Artifact Registry",", taking advantage of pure pay-per-use billing.",[44,95,97],{"id":96},"_2-amazon-web-services-aws-the-observability-island","2. Amazon Web Services (AWS): The Observability Island",[15,99,100],{},"Monitoring is intentionally isolated on AWS to ensure independent alerting in the event of a major failure of the primary cluster.",[52,102,103,117],{},[55,104,105,108,109,112,113,116],{},[58,106,107],{},"EC2 Compute Infrastructure:"," Deployment of a ",[40,110,111],{},"t3.medium"," instance allocated to Prometheus (to meet its RAM demands) and a ",[40,114,115],{},"t3.small"," instance for Grafana (the Go language allowing a very small memory footprint).",[55,118,119,122],{},[58,120,121],{},"Isolated Network:"," Instances operate in a dedicated VPC with an Internet Gateway and strict hardening via Security Groups (allowing port 22 for restricted administration).",[22,124],{},[25,126,128],{"id":127},"️-infrastructure-as-code-iac-configuration-management","⚙️ Infrastructure as Code (IaC) & Configuration Management",[15,130,131],{},"The entire lifecycle of resources is driven by code to ensure immutability and reproducibility. No more manual configuration or configuration drift.",[15,133,134,138],{},[35,135],{"alt":136,"src":137},"Micro Infrastructure Diagram","\u002Fpictures\u002Fowncloud\u002Fmicro.png",[40,139,140],{},"(Micro view of pipelines and provisioning)",[44,142,144],{"id":143},"_1-multi-provider-provisioning-with-terraform","1. Multi-Provider Provisioning with Terraform",[15,146,147],{},"The GitOps approach starts right at the infrastructure layer:",[52,149,150,169,183],{},[55,151,152,155,156,160,161,164,165,168],{},[58,153,154],{},"Validation CI Pipeline:"," Every modification to the Terraform code triggers validation (",[157,158,159],"code",{},"fmt",", ",[157,162,163],{},"validate",") and planning (",[157,166,167],{},"plan",") jobs accessible across all Git branches.",[55,170,171,174,175,178,179,182],{},[58,172,173],{},"Controlled Deployment:"," Modification execution (",[157,176,177],{},"apply",") is strictly contingent on manual validation and only allowed on the main branch (",[157,180,181],{},"main",").",[55,184,185,188,189,192,193,196],{},[58,186,187],{},"State Security:"," The infrastructure's ",[40,190,191],{},"remote state"," is secured in a GCP bucket (Cloud Storage) with a ",[40,194,195],{},"state lock"," mechanism to prevent any corruption during collaborative work.",[44,198,200],{"id":199},"_2-post-deployment-harmonization-with-ansible","2. Post-Deployment Harmonization with Ansible",[15,202,203],{},"Once the servers are provisioned, Ansible takes over to standardize the OS:",[52,205,206,212],{},[55,207,208,211],{},[58,209,210],{},"Idempotent Playbooks:"," Installing prerequisites (Docker, system dependencies) for our monitoring tools (Grafana\u002FPrometheus).",[55,213,214,217],{},[58,215,216],{},"CI Hardening:"," Deployment relies on a single repository. The SSH keys required to connect to AWS instances are securely injected as Base64-encoded variables in GitLab CI.",[22,219],{},[25,221,223],{"id":222},"software-factory-cicd-the-gitops-approach","🔄 Software Factory (CI\u002FCD) & The GitOps Approach",[15,225,226],{},"The automation of our deployments relies on GitLab Workflow and ArgoCD, making Git the single source of truth.",[44,228,230],{"id":229},"_1-continuous-integration-gitlab-ci-shift-left","1. Continuous Integration (GitLab CI) & \"Shift-Left\"",[15,232,233],{},"Our software pipeline is divided into several critical steps to ensure deliverable quality before even thinking about production:",[52,235,236,254,260],{},[55,237,238,241,242,245,246,249,250,253],{},[58,239,240],{},"Testing & Quality Phase:"," Strict static analysis via ",[58,243,244],{},"PHPStan",", vulnerability detection and technical debt management with ",[58,247,248],{},"SonarCloud",", and functional validation with ",[58,251,252],{},"PHPUnit",".",[55,255,256,259],{},[58,257,258],{},"Build & Push:"," Generation of the OwnCloud Docker image compiled from source, then persisting the artifact to the GitLab Container Registry.",[55,261,262,265],{},[58,263,264],{},"Manifest Updates:"," A CI job automatically updates the new image SHA in our dedicated Kubernetes manifests Git repository.",[44,267,269],{"id":268},"_2-continuous-deployment-with-argocd","2. Continuous Deployment with ArgoCD",[15,271,272],{},"Rather than \"pushing\" modifications to the cluster, the cluster synchronizes its state with Git.",[15,274,275],{},[40,276,277],{},"(ArgoCD interface ensuring workload synchronization: Kong, Redis, OwnCloud, Cert-Manager)",[52,279,280,286],{},[55,281,282,285],{},[58,283,284],{},"Automated Synchronization:"," ArgoCD, deployed via Helm, constantly monitors our repository. As soon as a change is detected (new image tag, config modification), it synchronizes the GKE cluster.",[55,287,288,291],{},[58,289,290],{},"Traceability and Reversibility:"," Since all history is versioned, rolling back to a previous stable version is instantaneous in case of a production anomaly.",[22,293],{},[25,295,297],{"id":296},"observability-federating-for-better-proactivity","📊 Observability: Federating for Better Proactivity",[15,299,300],{},"Our monitoring strategy relies on CNCF standards, with an architecture designed for resilience.",[15,302,303,307],{},[35,304],{"alt":305,"src":306},"Grafana Dashboard","\u002Fpictures\u002Fowncloud\u002Fgrafana.png",[40,308,309],{},"(Grafana Dashboard: Monitoring GKE Pod states, memory saturation, and network traffic)",[44,311,313],{"id":312},"_1-federated-prometheus-architecture","1. Federated Prometheus Architecture",[52,315,316,325],{},[55,317,318,321,322,324],{},[58,319,320],{},"Local Collection (GCP):"," A primary Prometheus agent is deployed ",[40,323,78],{}," on GKE to automatically scrape metrics from our workloads (Pods, Nodes).",[55,326,327,330],{},[58,328,329],{},"External Centralization (AWS):"," A second external Prometheus instance queries the GCP agent. This separation ensures data is neither altered nor lost in the event of a total Kubernetes cluster crash.",[44,332,334],{"id":333},"_2-dynamic-control-with-grafana","2. Dynamic Control with Grafana",[52,336,337,343],{},[55,338,339,342],{},[58,340,341],{},"Visual Analytics:"," Creation of granular dashboards to observe node CPU\u002FRAM consumption, In\u002FOut network traffic, and container health (Running, Pending, Failed) in real time.",[55,344,345,348],{},[58,346,347],{},"Proactive Alerting:"," Configuration of critical thresholds generating automatic notifications (via SMTP and Discord Webhooks) to alert teams before users experience slowness.",[22,350],{},[25,352,354],{"id":353},"finops-security-secops","💰 FinOps & Security (SecOps)",[15,356,357],{},"An elegant architecture must also be cost-effective and deeply secure.",[44,359,361],{"id":360},"_1-cost-management-finops-approach","1. Cost Management (FinOps Approach)",[52,363,364,370,376],{},[55,365,366,369],{},[58,367,368],{},"Database Trade-Offs:"," Deploying Redis as an in-cluster container saves at least €25\u002Fmonth compared to a managed cloud offering.",[55,371,372,375],{},[58,373,374],{},"Compute Optimization:"," Choosing Standard GKE over Autopilot, combined with Spot instances, significantly reduces the GCP bill (around 20-30% savings).",[55,377,378,381],{},[58,379,380],{},"Monitoring Hosting:"," AWS EC2 instances proved 10-15% more cost-effective than GCP equivalents for the workload profile of our observability tools.",[44,383,385],{"id":384},"_2-access-hardening-secops","2. Access Hardening (SecOps)",[52,387,388,394,408],{},[55,389,390,393],{},[58,391,392],{},"Identity Access Management (IAM):"," Strict application of the principle of least privilege. Every resource (Terraform, Cloud Run, EC2) only holds the exact IAM rights or Service Accounts required for execution.",[55,395,396,399,400,403,404,407],{},[58,397,398],{},"Controlled Exposure:"," Public access to the OwnCloud application goes through ",[58,401,402],{},"Kong API Gateway"," (deployed inside GKE) which handles TLS termination (HTTPS) and application routing. This choice anticipates the Kubernetes ",[40,405,406],{},"Gateway API"," standard, which is more robust than traditional Ingresses.",[55,409,410,413],{},[58,411,412],{},"Digital Identity:"," Sovereign usage of OVHCloud for DNS management and business SMTP server implementation ensures full control over communication flows and budget.",[22,415],{},[25,417,419],{"id":418},"future-perspectives-and-improvements","🚀 Future Perspectives and Improvements",[15,421,422],{},"This project tangibly demonstrates the agility offered by the Cloud Native ecosystem. Combining Terraform, Kubernetes, and a GitOps workflow under ArgoCD provides essential deployment peace of mind in production environments.",[15,424,425],{},"However, infrastructure is a living product. Next iterations include:",[427,428,429,435],"ol",{},[55,430,431,434],{},[58,432,433],{},"Advanced SecOps:"," Integrating Trivy into our CI pipelines for upstream Docker image vulnerability scanning, and implementing an administration Bastion host on the AWS VPC to eliminate public SSH access to EC2 instances.",[55,436,437,440],{},[58,438,439],{},"Predictive Observability:"," Fine-tuning Grafana alert thresholds and directly leveraging the Prometheus UI.",{"title":442,"searchDepth":443,"depth":443,"links":444},"",2,[445,450,454,458,462,466],{"id":27,"depth":443,"text":28,"children":446},[447,449],{"id":46,"depth":448,"text":47},3,{"id":96,"depth":448,"text":97},{"id":127,"depth":443,"text":128,"children":451},[452,453],{"id":143,"depth":448,"text":144},{"id":199,"depth":448,"text":200},{"id":222,"depth":443,"text":223,"children":455},[456,457],{"id":229,"depth":448,"text":230},{"id":268,"depth":448,"text":269},{"id":296,"depth":443,"text":297,"children":459},[460,461],{"id":312,"depth":448,"text":313},{"id":333,"depth":448,"text":334},{"id":353,"depth":443,"text":354,"children":463},[464,465],{"id":360,"depth":448,"text":361},{"id":384,"depth":448,"text":385},{"id":418,"depth":443,"text":419},"2026-07-21","Deployment of an open-source file storage application, OwnCloud, on a resilient and highly available multi-cloud GCP & AWS infrastructure.",null,"md","\u002Fpictures\u002Fowncloud\u002Fowncloud.png",false,{"category":474,"stack":475},"cloud",[476,477,478,479,480,481,482,483,484,485,482,486,487],"DOCKER","GCP","GKE","AWS","K8S","KONG","ArgoCD","Terraform","Ansible","GitLab","K3S","SRE",true,"\u002Fprojects\u002Fen\u002Fowncloud",{"title":5,"description":468},"projects\u002Fen\u002FOwncloud","fklAkbn86P3OpEu-WpMihzd-ARFldq9IdJGsH7-keSg",{"id":4,"title":5,"body":494,"date":467,"description":468,"doc":469,"extension":470,"git":469,"image":471,"isExperimentation":472,"meta":787,"navigation":488,"path":489,"seo":789,"stem":491,"tags":469,"type":469,"updatedAt":469,"website":469,"__hash__":492},{"type":7,"value":495,"toc":764},[496,498,500,502,504,506,508,514,516,518,542,544,546,560,562,564,566,572,574,576,604,606,608,618,620,622,624,626,628,648,650,652,656,666,668,670,672,678,680,692,694,704,706,708,710,712,726,728,746,748,750,752,754],[10,497,13],{"id":12},[15,499,17],{},[15,501,20],{},[22,503],{},[25,505,28],{"id":27},[15,507,31],{},[15,509,510,512],{},[35,511],{"alt":37,"src":38},[40,513,42],{},[44,515,47],{"id":46},[15,517,50],{},[52,519,520,524,534],{},[55,521,522,61],{},[58,523,60],{},[55,525,526,67,528,71,530,75,532,79],{},[58,527,66],{},[58,529,70],{},[58,531,74],{},[40,533,78],{},[55,535,536,85,538,89,540,93],{},[58,537,84],{},[58,539,88],{},[58,541,92],{},[44,543,97],{"id":96},[15,545,100],{},[52,547,548,556],{},[55,549,550,108,552,112,554,116],{},[58,551,107],{},[40,553,111],{},[40,555,115],{},[55,557,558,122],{},[58,559,121],{},[22,561],{},[25,563,128],{"id":127},[15,565,131],{},[15,567,568,570],{},[35,569],{"alt":136,"src":137},[40,571,140],{},[44,573,144],{"id":143},[15,575,147],{},[52,577,578,588,596],{},[55,579,580,155,582,160,584,164,586,168],{},[58,581,154],{},[157,583,159],{},[157,585,163],{},[157,587,167],{},[55,589,590,174,592,178,594,182],{},[58,591,173],{},[157,593,177],{},[157,595,181],{},[55,597,598,188,600,192,602,196],{},[58,599,187],{},[40,601,191],{},[40,603,195],{},[44,605,200],{"id":199},[15,607,203],{},[52,609,610,614],{},[55,611,612,211],{},[58,613,210],{},[55,615,616,217],{},[58,617,216],{},[22,619],{},[25,621,223],{"id":222},[15,623,226],{},[44,625,230],{"id":229},[15,627,233],{},[52,629,630,640,644],{},[55,631,632,241,634,245,636,249,638,253],{},[58,633,240],{},[58,635,244],{},[58,637,248],{},[58,639,252],{},[55,641,642,259],{},[58,643,258],{},[55,645,646,265],{},[58,647,264],{},[44,649,269],{"id":268},[15,651,272],{},[15,653,654],{},[40,655,277],{},[52,657,658,662],{},[55,659,660,285],{},[58,661,284],{},[55,663,664,291],{},[58,665,290],{},[22,667],{},[25,669,297],{"id":296},[15,671,300],{},[15,673,674,676],{},[35,675],{"alt":305,"src":306},[40,677,309],{},[44,679,313],{"id":312},[52,681,682,688],{},[55,683,684,321,686,324],{},[58,685,320],{},[40,687,78],{},[55,689,690,330],{},[58,691,329],{},[44,693,334],{"id":333},[52,695,696,700],{},[55,697,698,342],{},[58,699,341],{},[55,701,702,348],{},[58,703,347],{},[22,705],{},[25,707,354],{"id":353},[15,709,357],{},[44,711,361],{"id":360},[52,713,714,718,722],{},[55,715,716,369],{},[58,717,368],{},[55,719,720,375],{},[58,721,374],{},[55,723,724,381],{},[58,725,380],{},[44,727,385],{"id":384},[52,729,730,734,742],{},[55,731,732,393],{},[58,733,392],{},[55,735,736,399,738,403,740,407],{},[58,737,398],{},[58,739,402],{},[40,741,406],{},[55,743,744,413],{},[58,745,412],{},[22,747],{},[25,749,419],{"id":418},[15,751,422],{},[15,753,425],{},[427,755,756,760],{},[55,757,758,434],{},[58,759,433],{},[55,761,762,440],{},[58,763,439],{},{"title":442,"searchDepth":443,"depth":443,"links":765},[766,770,774,778,782,786],{"id":27,"depth":443,"text":28,"children":767},[768,769],{"id":46,"depth":448,"text":47},{"id":96,"depth":448,"text":97},{"id":127,"depth":443,"text":128,"children":771},[772,773],{"id":143,"depth":448,"text":144},{"id":199,"depth":448,"text":200},{"id":222,"depth":443,"text":223,"children":775},[776,777],{"id":229,"depth":448,"text":230},{"id":268,"depth":448,"text":269},{"id":296,"depth":443,"text":297,"children":779},[780,781],{"id":312,"depth":448,"text":313},{"id":333,"depth":448,"text":334},{"id":353,"depth":443,"text":354,"children":783},[784,785],{"id":360,"depth":448,"text":361},{"id":384,"depth":448,"text":385},{"id":418,"depth":443,"text":419},{"category":474,"stack":788},[476,477,478,479,480,481,482,483,484,485,482,486,487],{"title":5,"description":468},1785319260347]