Breaking Free From the Cloud: Banking on Self-Hosted Kubernetes
Talkat KubeCon + CloudNativeCon Europe 2025 · on Thursday, 2025-04-03· at 15:00· Level 0 | ICC Capital Hall | Room J·
summary
Global investment bank moves from managed cloud to on‑prem Kubernetes and reports ~85% compute+storage cost savings, 15–20x faster cluster creation, and roughly 30% CIS benchmark improvement. Architecture uses Cluster API on VMware with Rook for S3 storage (replacing MinIO due to AGPL concerns), sealed‑secrets instead of Vault for many workflows, and a custom cronjob to delete “ghost” pods caused by unreliable cloud stop/start. Migration still depends on cloud for some workload identities and KMS, and HA across three data centers remains a work in progress.
AI-written summary · about
chapters (19)
- 0:00Introduction
- 2:29Motivation to leave cloud
- 3:52Cost savings of on-prem
- 5:38Cloud stop-start reliability issues
- 7:46Solving ghost pods and instability
- 8:48Security benchmarks and CIS
- 10:12Lack of cloud support
- 10:54Cluster API and on-prem setup
- 13:26Replacing MinIO with Rook
- 14:51Service account certificate limits
- 16:16Spreading control plane across DCs
- 16:38Replacing Vault with Sealed Secrets
- 17:38Migration strategy and trade-offs
- 18:42Single-zone Kubernetes handling
- 19:24Migration waves and workloads
- 20:47High availability challenges
- 21:51Cluster API risks
- 22:54Future vision and Kubernetes agnosticism
- 24:01Is this the right path
related talks
24mWe Broke Free From Cloud-Managed Kubernetes...
34mTaking Back Control: Building Cloud-Agnostic Container Platforms for Regulated Environments
14mFrom cloud to bare metal with Kubernetes, a bad idea?
21mHybrid Cloud - nothing to worry about! 🌥️
12mHow to Effectively Manage Kubernetes in a Regulated Environment
19mKeynote: From COBOL to Kubernetes: A 250 Year Old Bank's Cloud-Native Journey
31mOn-Prem is the new Black
36mKubernetes in the Enterprise Transforming Rabobanks On Premise Applications