Services / On-prem and hybrid
DatacenterServer room and cloud as one system, not two worlds
Proxmox or other virtualization holds machines. Kubernetes can stand beside it, in the same GitOps discipline. Backup has a second path. ntopng watches the bridge and the LAN. IAM and monitoring are shared with the cloud when hybrid is the goal.
How it fits together
Hall, cluster, copy, bridge
On-prem without hybrid can be a goal. Two worlds without shared IAM are a risk. We put virtualization, Kubernetes, backup, and network into one operation.
- Migration to the cloud is staged. Big-bang downtime is not a plan.
- Latency and data residency are arguments for on-prem, not sentiment for a rack.
Cluster, storage, and HA in a known console
Nodes, Ceph or other storage, SDN, firewall. Live migration and HA are practiced. A golden image instead of a manual system on every machine. Data that cannot leave stays here by design, not by accident.
Cluster
Quorum, fencing, patch order. A node-loss test.
Storage
Snapshot retention, performance, alerting on filling.
Network
VLAN, SDN, firewall on the hypervisor and at the edge.
Capacity
An expansion plan before RAM and IOPS run out on Friday.
GitOps in the server room, not only in EKS
A cluster on Proxmox or on bare metal. The same manifests as in the cloud, different values. Upgrade and certificates are an administration change window, not an ad hoc project.
Metal
Load balancer, storage class, NTP, DNS. Without this, self-hosted lies in health.
GitOps
Argo CD on the LAN. Production does not accept manual kubectl from the office.
Bridge
Image in a local registry or pull-through. An internet outage does not stop a pod restart.
People
The same platform for the team, whether the node is in an AZ or in a rack.
A copy outside the hall, not on the same storage
PBS in the server room for a short RTO and a second path outside the building or in the cloud on another account. Ransomware on the cluster does not delete the only copy. Restore is on the calendar.
Tor A
Close, fast restore of VM and CT.
Tor B
Another location, another key, immutability.
Scope
Guests, databases, configuration, optionally tapes or object lock.
Exercise
Restore on cold hardware or in the cloud, with DNS written down.
LAN, VPN, and Direct Connect have a baseline
ntopng on the gateway and in the core. You see whether the hybrid is alive, whether someone is scanning, whether backup eats the link during office hours. Cloudflare or another edge can stand in front of the application, the origin stays private.
Baseline
Peer, port, hour. A deviation has an alert.
Hybrid
VPN and dedicated link. DNS failover and routing are in the playbook.
Exposure
No RDP and SSH to the world. Jump and MFA.
Capacity
Backup and replication do not choke the application. QoS or a change window.
Operations
From hall to hybrid
First inventory and network. Then HA and backup. Finally GitOps and a bridge to the cloud.
- Hall Nodes, storage, power, who has physical access and to ILO.
- Platform Virtualization, K8s cluster, golden images.
- Continuity Dual-path backup, restore exercise and node loss.
- Bridge VPN or Direct Connect, IAM, shared on-call.
Talk
We will discuss the server room, HA, and the bridge to the cloud
On that basis we will prepare a scope for on-prem or hybrid.
Contact us