Skip to content

Demonstrators

To gather feedback and identify potential for further development and improvements, the FOCIS team evaluated, coordinated and built a number of demonstrator applications. We focused on the ALASCA projects as well as SCS use cases.

SCS-compliant Yaook

Our partner Cloud&Heat Technologies has successfully used Yaook to deploy and operate an OpenStack environment that complies with SCS-compatible IaaS v5.1. To replicate the findings of our partner, we set up our own such environment on virtualized infrastructure.

This included deploying Tarook-based Kubernetes clusters, which we later reused for an OpenDesk-on-Tarook workshop at Chemnitzer Linux Tage. The manifests for running Yaook with a GitOps-approach via fluxcd are also publicly available.

The findings were used to inform and motivate the Yaook SCS Operator Hackathon in Hamburg, they have been archived with the other hackathon materials. The hackathon resulted in detailed plans to implement an SCS operator for Yaook.

Furthermore, we took a closer look at the SCS-mandated services and service catalog, especially regarding the object storage service s3. This lead to a number of bug reports and contributions towards the SCS standards, including the adoption of a new revision of SCS-0123: mandatory services.

Lastly, at the time of this investigation, passing the "OpenStack Powered Compute" test suite was a mandatory part of the SCS-compatible IaaS scope. Since this certification and the tooling for it had been abandoned, we helped transitioning these test cases into what became SCS-0128, SCS end-to-end testing. This also prompted us to implement a new feature for the Yaook tempest operator, enabling it to run a given list of test cases as specified in SCS-0128.

GitLab CI runners on SCS-compatible IaaS cloud infrastructure

CI pipelines are a fundamental building block of modern software engineering, the ALASCA projects rely heavily on them to ensure code quality, run tests and build the images that users rely on. Projects on the scale of Yaook need significant computing resources to accomplish all that, but since most pipelines are triggered when developers are working, the workload fluctuates a lot. As such, it is a good candidate for cloud-based computing, where it is possible to allocate the required resources on-demand.

GitLab provides an autoscaling mechanism for runners, different cloud providers can be used via the plugin framework fleeting. However, GitLab only offers plugins for the closed ecosystems of the US-based providers Google Cloud, AWS and Azure.

The OpenStack-based cloud provider Sardina Systems has developed a fleeting plugin for OpenStack. The FOCIS team evaluated that plugin and contributed an additional feature to improve the integration with SCS.

Building on those findings, the FOCIS team set up two GitLab runner managers on Cloud&Heat Technologies' certified SCS-compatible IaaS cloud. They run in an active-active configuration, to provide highly available CI runners for critical Yaook pipelines.

The runner managers make use of the SCS-mandated APIs and flavors to create virtual machines on-demand to run queued CI jobs. As such, the configuration is easily reusable with any SCS-compatible IaaS cloud provider.

Furthermore, the fully automated VM provisioning via the SCS-mandated APIs also made it possible to fully re-create runner instances after every job run, ensuring job isolation and thus hardening the CI infrastructure against attacks such as the copy.fail exploit.

Tarook & openDesk: Sovereign Kubernetes and Collaborative Office on SCS

Sovereign cloud infrastructure is only as valuable as the applications it can run. To demonstrate this in practice, the FOCIS team developed and published a reference deployment combining Tarook, the ALASCA stack's "batteries included" Kubernetes distribution, with openDesk, the sovereign workplace software suite developed by ZenDiS (Zentrum für Digitale Souveränität), on a Sovereign Cloud Stack-compatible OpenStack cloud.

Tarook handles the full lifecycle of a production-grade cluster — from OpenStack resource provisioning to storage controllers, monitoring, ingress, and load balancing — without depending on any hyperscaler. On top of that cluster, openDesk bundles applications such as Nextcloud, XWiki, Jitsi, and a Matrix-based messaging backend into a single, Helmfile-managed installation, providing a fully-featured collaborative office suite under sovereign operational control.

A key result of this work is a composable, standards-based architecture: Tarook leverages SCS-mandated APIs throughout, making the cluster configuration fully portable across any SCS-compatible IaaS provider. openDesk, in turn, runs on any CNCF-conformant Kubernetes distribution. The combination therefore serves as a practical and reusable blueprint for sovereign digital workplaces — particularly relevant for public administrations seeking alternatives to proprietary hyperscaler offerings.

The deployment includes automated TLS certificate provisioning via Let's Encrypt and a full user management setup through openDesk's integrated identity stack, demonstrating that a production-ready, end-to-end sovereign office environment can be stood up reproducibly on open infrastructure.