General Open Source Sovereignty

Open Source as State Policy: What the EU Strategy and the Swiss Ständerat Vote Mean for IT Decision-Makers

12. Jun 2026

In the span of a few weeks, two policy signals landed that reinforce each other. The European Commission published a new open-source strategy positioning open source as central to EU technological sovereignty. Days later, the Swiss Ständerat accepted a motion for an impulse program on digital sovereignty by 30 to 7, against the Bundesrat’s recommendation. Both name the same mechanism: open-source technology as infrastructure for sovereign, independent digital states.

For Swiss organizations choosing technology stacks and cloud providers, the direction is now unmistakable.

What the EU strategy says

The Commission’s open-source strategy pursues four goals:

  1. Technological sovereignty through open source: scaling European open alternatives to non-EU proprietary solutions, including in digital identity wallets and public services.
  2. Ecosystem development: supporting startups, establishing stewardship frameworks, creating a maintenance instrument for critical open-source projects, and investing in skills.
  3. Public administration leadership: developing open-source procurement guidelines and strengthening the Commission’s Open Source Programme Office (OSPO).
  4. Standards and international cooperation: integrating open-source communities into EU standardization efforts.

The strategy takes a full lifecycle approach: from research through long-term maintenance. It explicitly names the goal of reducing dependence on non-EU technologies and increasing European control over “critical digital infrastructure, including software and hardware systems.”

This is not an abstract policy paper. It follows the EUR 180 million sovereign cloud procurement in April, where open-source technology was one of eight scored sovereignty dimensions. Open source is moving from “nice to have” to procurement criterion.

What the Ständerat decided

On June 10, the Ständerat accepted motion 22.3221 by Heidi Z’graggen (Die Mitte, Uri) calling for an impulse program to strengthen Swiss digital sovereignty. The motion demands seed funding for pilot projects in four areas:

  • Digital infrastructure
  • Open-source technologies
  • Cybersecurity
  • Artificial intelligence

Z’graggen argued that digital sovereignty is “ein zentraler Pfeiler sowohl staatlicher als auch wirtschaftlicher Handlungsfähigkeit” (a central pillar of state and business capability). She emphasized this is time-limited stimulus, not permanent state expansion: “Investitionen in offene, souveräne Technologien stärken unsere Innovationskraft, reduzieren Abhängigkeiten, schaffen Wertschöpfung” (investments in open, sovereign technologies strengthen innovation, reduce dependencies, create value).

The Parldigi parliamentary group backed the motion, citing the geopolitical situation and open source’s cost-saving potential.

Federal President Guy Parmelin recommended rejection, arguing existing strategies and funding instruments (including the “Digitale Schweiz 2026” program) already address digital sovereignty. The Ständerat disagreed, 30 to 7.

The motion now goes to the Nationalrat.

Switzerland already has the legal foundation

What makes the Ständerat vote notable is that Switzerland already has open-source legislation. The EMBAG (Bundesgesetz über den Einsatz elektronischer Mittel zur Erfüllung von Behördenaufgaben), in force since January 1, 2024, establishes:

  • Open Source by default: the federal administration must release self-developed software as open source.
  • Open Government Data: administrative data must be made accessible for free use.
  • Interoperability and open standards: interfaces must be documented and standards can be made binding.

The EMBAG was championed by National Council members Gerhard Andrey and Andri Silberschmidt, and Ständerat member Matthias Michel. When it passed, Switzerland became one of the first countries worldwide to mandate open-source publication of government software.

But a law that mandates release of government-built software is not the same as a program that funds new sovereign infrastructure. The EMBAG says “publish what you build.” The Z’graggen motion says “invest in building more.” The two are complementary: the legal framework exists, but the Ständerat believes implementation needs an impulse.

Two signals, one direction

Read together, the EU strategy and the Swiss vote point to the same conclusion:

EU Open Source StrategySwiss Ständerat Motion
ScopeEU-wide policy frameworkSwiss federal impulse program
MechanismProcurement criteria, OSPOs, maintenance fundingSeed funding for pilot projects
Open source roleCore sovereignty instrumentOne of four priority areas
StatusPublished strategyAccepted by Ständerat (30:7), Nationalrat pending
Legal basisBuilds on Cyber Resilience Act, Interoperable Europe ActBuilds on EMBAG (in force since 2024)

The convergence is not coincidental. Both respond to the same pressures: dependence on US hyperscalers, the CLOUD Act, supply chain risks exposed by geopolitical shifts, and the realization that digital sovereignty requires more than data residency. It requires control over the software stack.

What this means for Swiss organizations

Open source is becoming a compliance expectation, not just a technical preference. The EU scores it in cloud procurement. Switzerland mandates it in government software. Both are moving toward procurement frameworks that favor open, auditable technology over proprietary lock-in.

Public sector demand will grow. If the Nationalrat passes the Z’graggen motion, federal funding for open-source pilot projects will follow. Organizations positioned to deliver sovereign, open-source infrastructure, and to help public sector clients adopt it, have a structural advantage.

The EMBAG creates upstream supply. As the federal administration releases more open-source software, the ecosystem of Swiss-built, Swiss-maintained open-source components grows. This benefits private sector organizations that build on the same stack.

Geopolitical risk is now a board-level topic. Z’graggen’s core argument (dependence on foreign technology providers endangers long-term competitiveness) is the same argument regulated industries have been making for two years. The Ständerat vote gives it political legitimacy beyond the compliance department.

Where VSHN fits

VSHN has operated on the thesis that open source and sovereignty are inseparable since its founding. Every service in the VSHN Application Catalog runs on open-source software (PostgreSQL, MariaDB, Redis, Keycloak, GitLab, OpenBao, Forgejo), operated by a Swiss team on Swiss infrastructure.

The policy direction confirmed by both Brussels and Bern validates this approach:

  • Technology sovereignty: 100% open-source stack, active contributor to CNCF projects (K8up, Crossplane providers), Project Syn, and APPUiO.
  • EMBAG alignment: VSHN’s entire toolchain is open source and auditable. Government clients adopting VSHN services remain EMBAG-compliant without additional effort.
  • Operational sovereignty: Swiss 24/7 operations team, infrastructure-agnostic deployment (customer chooses provider), no foreign vendor dependency.

For organizations evaluating their technology stack against the direction set by EU and Swiss policy, the question is: does your infrastructure depend on a foreign vendor’s proprietary platform, or is it built on open, sovereign technology that you control?

Sources

Aarno Aukia

Aarno is Co-Founder of VSHN AG and provides technical enthusiasm as a Service as CTO.

Contact us

Our team of experts is available for you. In case of emergency also 24/7.

Contact us
Events General

Cloud Native Zürich 2026 Recap

Another great edition of Cloud Native Zürich is behind us. Across the two interconnected venues, Abaton and Soho Zürich, more than 400 attendees – platform engineers, Kubernetes practitioners, developers, operators, and open source enthusiasts – came together for a day of learning, networking, and discussion across four tracks, including a dedicated Sovereignty Track for the first time.

VSHN was proud to participate once again as a Silver Sponsor, while Servala sponsored the Sovereignty Track.

VSHN booth with Legos 🙂

If you stopped by our booth, thank you for the great conversations – on Kubernetes and OpenShift, platform engineering, digital sovereignty, Servala, APPUiO, Codey, and the European cloud native ecosystem more broadly. And yes, the LEGO sets found new owners again this year. 🙂

On stage

Beyond the booth, we were also happy to actively contribute to the program this year:

Tobias Brunner gave a talk on how Servala came to be – from an internal observation at VSHN that our managed services lacked the marketplace experience customers were used to from the hyperscalers, to where Servala is heading as a growing ecosystem of cloud providers, software vendors, managed service providers, and implementation partners.

Aarno Aukia spoke about running LLMs the cloud-native way – building an open-source LLM stack on Kubernetes with tools like Kubeflow, vLLM, LiteLLM, and llm-d, and why that matters for sovereignty, compliance, and long-term operational control.

And in the new Sovereignty Track, Markus Speth was track lead and moderated a panel discussion with perspectives from across the ecosystem – an implementation partner, a cloud provider, a managed service provider, a software vendor, and civil society. We wrote a separate recap of that panel, which you can find here: Digital sovereignty – perspectives from the ecosystem.

A strong keynote

We were also looking forward to seeing keynote speaker Thomas Zurbuchen live again – always a highlight, and a reminder that the questions our industry is grappling with are part of much bigger conversations.

Data centres in space?

Thomas Zurbuchen also briefly raised the idea of operating data centres in space. He suggested that the economics could shift in the coming years – on the one hand due to rising energy costs on Earth, and on the other hand due to declining costs and efficiency gains in “getting payloads into space”.

The assessments of this idea diverged significantly afterwards. While it attracted a lot of attention, both the underlying economic assumptions and the claim that such systems would be “safer” in space than on Earth were discussed in further conversations during the aperitif and were viewed quite critically from different perspectives.

But actually, it would be quite a funny thought – just imagine someone saying “I quickly have to change a disk” and watching the engineer get launched into space… 🙂

Thanks to the organizers

A big thank you to the Cloud Native Zürich organizing team for putting together another excellent event – the level of detail, the community spirit, and the quality of the program keep getting better every year. If you couldn’t make it, or want to revisit a talk you missed, recordings will be published on the official Cloud Native Zürich channels – keep an eye on cloudnativezurich.ch for updates.

Want to be part of the ecosystem?

If digital sovereignty, sovereign managed services, or the broader Servala ecosystem are topics on your mind – check out Servala, and feel free to get in touch if you’d like to become part of our growing ecosystem of cloud providers, software vendors, and implementation partners.

See you next year!

Markus Speth

Marketing, Communications, People

Contact us

Our team of experts is available for you. In case of emergency also 24/7.

Contact us
General Sovereignty

Digital sovereignty – perspectives from the ecosystem

Yesterday at Cloud Native Zürich 2026, we had the chance to moderate a panel discussion in the Sovereignty Track titled “Digital Sovereignty – Perspectives from the Ecosystem.” Five panelists, five very different angles on the same topic – and a room full of people who were interested in Digital Sovereignty.

Setting the scene

The panel didn’t happen in isolation. It came at the end of a morning packed with sovereignty content: David Sterz opened the track making the case that Europe’s cloud future should be distributed by design rather than mirroring the centralized hyperscaler model. Our own Tobias Brunner followed with a talk that connected Swiss sausages (“Cervelat”) to sovereignty – and made a convincing case for why “it’s all open source anyway” is not the same as sovereignty. Pascal Stöckli then introduced Zentrum SDS, the new “Souveräne Digitale Schweiz” initiative bringing together 32 founding organizations from federal authorities, cantons, and Swiss IT companies.

By the time the panel started, the room had already heard that digital sovereignty is distributed, political, operational, and – apparently – has something to do with Cervelat. The panel’s job was to pull these threads together from the perspective of the people actually building, running, and governing this ecosystem.

Five seats, five perspectives

We deliberately put together a panel that covered the ecosystem end to end:

  • Lena Fuhrimann (bespinian) – the implementation partner’s perspective, working directly with organizations migrating to cloud native technologies and helping them balance innovation, agility, and control.
  • Roman Bachmann (Switch) – the cloud provider’s perspective. Switch operates digital infrastructure for Swiss universities and research institutions and is itself owned by the institutions it serves – sovereignty by design, in a sense.
  • Tobias Brunner (VSHN) – the managed service provider’s perspective, on what it actually takes to make digital sovereignty operational: running production systems around the clock, not just writing about it.
  • Simon Reber (Red Hat) – the software vendor’s perspective, on how open source contributes to flexibility, interoperability, and sovereignty – and where the limits of that argument are.
  • David Sommer (Digitale Gesellschaft) – the civil society perspective, broadening the conversation from technology toward democratic rights, political will, and a digital society that works for everyone.
  • Markus Speth (VSHN) – moderator

What we explored

Before diving into the discussion, we asked the audience a simple question: how many of you have used the term “digital sovereignty” in the past six months? Not surprisingly, almost every hand went up.

From there, we asked each panelist for their own definition – and got five genuinely different answers, ranging from technical and operational framings to questions of control, resilience, and democratic values. No single definition won, which was rather the point.

The discussion then moved into more concrete territory: how sovereignty shows up in day-to-day project work working with customers, what it means for a cloud provider to be “sovereign by design”, what it takes to run sovereign infrastructure in production 24/7 rather than on a slide, whether open source is sufficient on its own or just one part of the equation, and where the real blockers sit – in technology, in budgets, or in how organizations make decisions.

We also didn’t shy away from some of the harder numbers floating around this debate: the gap between what European IT leaders say they want to spend on local cloud alternatives and what they actually spend, and the sheer scale difference between hyperscaler investment and the European alternatives currently on the table.

A few things that stuck with us

Reflecting on the discussion afterwards, a few themes stood out:

Digital sovereignty is not a binary state. There’s no certificate that flips an organization from “not sovereign” to “sovereign” – it’s a spectrum across multiple dimensions, and frameworks like the EU Cloud Framework are starting to emerge specifically to measure that.

It’s also about more than where data physically lives. Control, portability, transparency, skills, governance, and legal jurisdiction all play a role – often a bigger one than location alone.

Complete sovereignty, in the sense of controlling everything end to end, is neither realistic nor desirable. Trace any dependency chain far enough and you eventually hit hardware, raw materials, and global supply chains that no single organization – or country – fully controls. The more useful goal is understanding your dependencies and making conscious choices about them.

And perhaps most importantly: sovereignty isn’t something any single company, vendor, or government can solve alone. It needs the whole ecosystem – providers, vendors, open source communities, public institutions, and civil society – all working together.

Which brings us back to a question we asked at the start: is “sovereignty” even the right word? Maybe what most organizations are really after is resilience, autonomy, or freedom of choice, or simply the ability to make their own decisions without having to ask someone else for permission first.

One phrase from our preparation for this panel stayed with us: “sovereignty is a bridge, not a bunker”. The goal isn’t isolation – it’s the freedom to choose your own path while staying connected to a broader ecosystem.

Unfortunately, our time on stage ran out far too quickly. There were so many more angles we could have explored – and judging by the energy in the room, the audience felt the same way.

We’re already thinking about a follow-up session to dig deeper into some of these threads.

Watch the full discussion

The recording of the full panel discussion will be published soon – we’ll share the link as soon as it’s available, so you can hear all five perspectives directly from the panelists themselves.

A big thank you to Lena, Roman, Tobias, Simon, and David for a genuinely thoughtful discussion.

Thanks to the organizers of Cloud Native Zürich

A big thank you to the organizers for putting together another great edition of Cloud Native Zürich. We were happy to be involved as sponsors again – VSHN as a Silver Sponsor, and Servala sponsoring the Sovereignty Track at Cloud Native Zürich 2026.

As part of the track, our colleague Tobias Brunner also held a talk on Servala earlier in the day – we’ll be publishing that recording soon as well, so stay tuned.

If you’re curious about what Servala is and how sovereign, multi-provider managed services on Kubernetes can look in practice – check out Servala – Sovereign App Store, and feel free to get in touch if you’d like to become part of our growing ecosystem.

Also check out our full Cloud Native Zürich 2026 Recap.

Markus Speth

Marketing, Communications, People

Contact us

Our team of experts is available for you. In case of emergency also 24/7.

Contact us
General Press Servala Sovereignty

Switch joins Servala as Cloud Service Provider to strengthen Switzerland’s digital sovereignty

10. Jun 2026

Switch joins Servala as Cloud Service Provider to strengthen Switzerland’s digital sovereignty

Press release: Zurich, Switzerland – June 10th, 2026

VSHN and Switch are pleased to announce a new partnership: Switch is joining Servala as a Cloud Service Provider (CSP), expanding its ecosystem of sovereign managed services in Switzerland.

The Switch foundation is a key pillar of Switzerland’s digital sovereignty. As the operator of the Swiss National Research and Education Network (NREN), Switch connects universities, and research institutions nationwide and beyond. In addition to its network backbone, Switch provides digital identity solutions, cyber security, cloud services, procurement and collaboration services to research and education institutions – forming a cornerstone of digital innovation in academia.

With around 180 employees and decades of experience, Switch plays a central role in providing secure, reliable, and high-performance digital platforms and critical infrastructure for the Swiss education and research community.

By joining Servala, Switch is extending its portfolio of cloud services to include access to a growing ecosystem of cloud-native managed services. These services can be deployed and operated in a standardised, automated, and production-ready way – aligned with the needs of universities and research institutions that require reliability, scalability, compliance, and long-term sustainability.

ROMAN BACHMANN, Head of Cloud & IT, ad interim, Switch: “By integrating Servala, we are responding to our customers’ frequent requests to be able to provision a managed database, cache or queue at the touch of a button. This way, we are expanding our Switch Cloud service portfolio with key services that are indispensable in modern software development.”

The partnership comes at a time of increasing demand for sovereign digital infrastructure in Switzerland. Organisations are looking for alternatives that combine modern cloud capabilities, providing local control, transparency, and independence from global hyperscalers at the same time.

This is where Servala comes in.

Servala connects Swiss cloud providers, software vendors, and service operators into a collaborative ecosystem. This model allows for greater flexibility, resilience, and innovation – while keeping data and operations under local control.

Servala creates shared value across the entire community:

  • Universities and research institutions gain access to modern, production-ready services tailored to their needs
  • Organisations retain freedom of choice and avoid vendor lock-in
  • Swiss providers collaborate and combine their expertise instead of operating in isolation
  • The Swiss education area is strengthened through local innovation and trusted partnerships

TOBIAS BRUNNER, Product Manager & Partner, VSHN: “What excites me most about this partnership is the shared values. Switch and VSHN have both built their reputation on trust, reliability, and a long-term perspective – not on lock-in. By joining Servala, Switch helps us demonstrate that Swiss providers can collaborate and innovate together, for the benefit of the entire ecosystem.”

For Switch, this partnership marks a step towards evolving its service offering to include cloud-native platforms and managed services. For VSHN and the broader Servala ecosystem, Switch is a strong new partner deeply rooted in the Swiss education and research sector.

Both organisations have already started working on an initial Servala minimum viable product (MVP) tailored to the Switch community. Early interest from universities and research institutions highlights the demand for sovereign, easy-to-access services.

About Servala
Servala is the sovereign application platform connecting cloud providers, software vendors, managed service providers and implementation partners to deliver cloud-native services without vendor lock-in. Built on open standards and designed for interoperability, Servala enables organizations to deploy and operate applications across multiple clouds and on-premises environments in a consistent and automated way.

At its core, Servala is not a single provider, but an ecosystem. It brings together Swiss and European partners who combine their infrastructure, software and operational expertise to deliver fully managed services. This collaborative model ensures transparency, flexibility and long-term independence for customers.

With a strong focus on digital sovereignty, Servala allows organizations to retain full control over their data, workloads and technology choices while benefiting from modern platform engineering practices, automation and scalable operations.

Servala was initiated by VSHN and is developed in close collaboration with ecosystem partners. The platform brings together services operated by multiple providers, including VSHN and other independent partners.

About Switch
Switch is the digitalisation partner for Swiss universities. The foundation collaborates with educational and research institutions to develop secure and future-oriented digital platforms and critical infrastructure. Its activities are focused on strengthening cyber security, the universal use of digital identities and sovereign cloud solutions. Switch has also operated and protected domain names ending in .ch and .li since the early days of the Internet. The non-profit foundation employs around 180 people in Zurich and Lausanne.

About VSHN
VSHN – The DevOps Company – transforms software into reliable online services by automating and operating application workloads. As Switzerland’s leading Managed Service Provider, VSHN specializes in DevOps, Kubernetes, OpenShift, and cloud-native operations, enabling organizations to run business-critical applications reliably, securely, and at scale.

VSHN provides platform engineering, 24/7 operations, and fully managed services across public cloud, private cloud, and on-premises environments – without operating its own infrastructure. Through solutions like Managed OpenShift, APPUiO, Application Catalog, and Servala, VSHN helps organizations simplify operations, avoid vendor lock-in, and retain full control over their workloads.

Founded in 2014 and 100% self-owned, VSHN serves over 350 customers and partners across 16 cloud platforms worldwide. With ISO 27001 certification, FINMA-aligned operations, and ISAE 3402 Type 2 audits, VSHN ensures the highest security and compliance standards.

Markus Speth

Marketing, Communications, People

Contact us

Our team of experts is available for you. In case of emergency also 24/7.

Contact us
AppCat Events General

A guided tour through our digitally sovereign ecosystem – Liene at KCD Czech & Slovak 2026

8. Jun 2026

At KCD Czech & Slovak 2026 in Prague, I took the stage to walk the audience through five years of building a digitally sovereign managed-services ecosystem from the ground up – the architectures that worked, the ones we threw away, and the bigger picture of where this is all going. The conference ran on May 21-22 at the Faculty of Information Technology, CTU in Prague, in three languages and packed with the wider European cloud-native community.

True to form, I framed the whole talk around Czech food – each chapter of the journey paired with a dish.

Watch the recording of my talk

The starting point: a single customer project

The story starts in February 2021 with what looked like a normal customer project. The ingredients: Crossplane v0.17, MariaDB, Redis, and an external Cloud Foundry that needed databases on demand via the Open Service Broker API. We called this Framework 0.1.

The architecture was already recognisably what we’d build on later – a control-plane cluster running Crossplane with XRDs and Compositions, talking to one or more service clusters through provider-helm, provider-sql, and provider-kubernetes. Customers ordered an instance, Crossplane composed it, and the right Helm releases, database objects, users, and Kubernetes resources showed up in the service cluster. Four environments: dev, nonprod, prod-nonpremium, prod-premium.

That worked. So I asked the obvious next question: if it works for one customer, can it be a product?

AppCat 1.0: from project to platform

By December 2022 we had AppCat 1.0 – VSHN’s Application Catalog – first wired up to external services, then by 2025 with our own catalog of managed PostgreSQL, Redis, MariaDB, Keycloak, and MinIO. The framework had matured into what we now call Framework 1.0: a clean stack with Service Definitions (XRDs), Service Implementations (Compositions), Crossplane as the control plane, and provider plugins for $App, $Cloud, and Helm – all driven by the Kubernetes API and exposed through the OSB API.

This is the picture most people see when we talk about Crossplane at VSHN. We’ve been running it in production since 2021, we’re an official Crossplane vendor, and we’ll happily argue that you should stop fighting Terraform state and manage your infrastructure through Kubernetes instead. But the framework diagram on a slide hides everything that makes a managed service actually managed.

The unglamorous middle: everything that makes a service managed

The “more features” slide was deliberately boring – a wall of words that anyone who has run a managed database in anger will recognise: backup, restore, logs, metrics, alerting, maintenance, version upgrade, scaling, user management. Plus application-specific things like Collabora for NextCloud, plus giving customers a free choice of infrastructure underneath.

This is where the real engineering lives. The control plane is the easy part. The hard part is everything you have to build, automate, and operate around it before a customer can rely on it at 3am on a Sunday.

The detour: split architecture (and back again)

Not every decision survives contact with reality, and I was refreshingly direct about one we walked back. At some point we tried a Split Architecture – separating the control cluster from the service cluster more strictly, with Crossplane on one side, managed resources and providers in their own namespace, and instances deployed into a service cluster on the other side. The diagram was elegant. The operational reality was not.

So we went back to one cluster. The “Nope – back to one cluster” slide – with the instance namespace dramatically circled in red – got a laugh, and it makes a serious point: sovereignty and operational simplicity aren’t opposed. Sometimes the right answer is the boring one.

Crossplane v2.0 – deliberate adoption

By August 2025 Crossplane v2.0 was on the horizon, with significant changes to how Compositions and packages work. Our position was simple: we wait. Not because we’re conservative for the sake of it, but because the framework we’d built was carrying real production workloads and the migration needed to be deliberate, not opportunistic.

In the meantime, we kept going.

Framework 2.0 and AppSlap

By May 2026 we had Framework 2.0, with a much cleaner separation between what service maintainers do and what framework engineers do. Service maintainers work with a ServiceBundle that references their custom functions. A Converter turns that into proper Crossplane artifacts – Composition, Composite, package metadata – using the VSHN function stdlib. The Crossplane CLI reads those artifacts and builds the Crossplane package. The whole pipeline is what we now call AppSlap 2.0.

The point of this isn’t the diagram. The point is that we can now onboard new services without rebuilding the framework around them – which is what you need if you want an ecosystem rather than a product.

Servala – the sovereign app store

May 2026 also marked the Codey instance running in production on Servala – the part of all this that turns a framework into an ecosystem. Servala is, in plain terms, a sovereign app store: a marketplace and ecosystem hub that connects four kinds of players and routes services to customers.

  • Cloud Service Providers bring sovereign infrastructure – compute, storage, network
  • Software Vendors bring the applications and tools, open source and commercial
  • Managed Service Providers bring 24/7 operations and support
  • Implementation Partners bring consulting and integration

Servala sits in the middle. Customers get sovereign managed applications without having to assemble the network themselves, and without locking themselves to any single party in it.

This is what I mean when I say sovereignty is a network problem, not a software problem. No single vendor can credibly claim to be sovereign end to end. What you can do is build the connective tissue that lets independently sovereign providers compose into something a customer can actually buy and run.

What it takes from a sovereign cloud provider

A practical note from the talk: not every cloud calls itself sovereign, and not every sovereign cloud is ready to host this kind of stack. I listed the concrete requirements: a real API to manage cloud resources, self-service VM provisioning, custom VM base image upload, S3-compatible object storage, fast SSD block storage, CSI storage attachments at scale (100+), a managed load balancer with 100+ listeners, NAT gateway and firewall. If any of these are missing, the ecosystem doesn’t land.

These are not exotic asks. They’re the baseline that hyperscalers normalised a decade ago. The good news is that a growing number of European and Swiss providers now check all the boxes – which is what makes the whole project realistic in 2026 in a way it wouldn’t have been five years ago.

Always under construction

One of the slides was just a picture of the Sagrada Família. I took the joke – and the seriousness behind it. Building a sovereign ecosystem is a long game. There’s no version where you finish, take a photo, and walk away. The framework will keep evolving, Crossplane will keep evolving, partners will join and leave, and customers will ask for things nobody has thought of yet.

The CNCF landscape slide made the same point a different way – the cloud-native ecosystem is enormous, and standing on its shoulders is the only sane way to build something at this scale. Sovereignty doesn’t mean reinventing everything. It means assembling the right things, with the right partners, in the right jurisdictions, and keeping the option to change your mind.

Conclusion

Five years in, one lesson stands out above all others: digital sovereignty is not a product that any single company can sell. It’s an ecosystem that has to be built together.

Thank you, Prague

Huge thanks to the KCD Czech & Slovak organisers and the local cloud-native community for two excellent days at FIT ČVUT. The conversations after the talk were as valuable as the talk itself – it’s clear that many people across Europe are thinking hard about what a sovereign, open, and operationally serious cloud-native ecosystem should look like.

I was genuinely energised by the discussions, questions, and feedback after the session. It’s encouraging to see how much interest there is in practical approaches to digital sovereignty and how many organisations are tackling similar challenges.

If you’re building sovereign cloud platforms, managed services, or ecosystem partnerships, I’d love to exchange experiences and explore how we can work together.

Want to learn more about VSHN’s work on digitally sovereign managed services? Visit crossplane.ch, servala.com, or appcat.ch.

About VSHN Application Catalog (AppCat)

VSHN Application Catalog (AppCat) is VSHN’s platform for delivering production-ready managed services across multiple cloud providers and Kubernetes environments. Built on Crossplane and Kubernetes, AppCat automates the full lifecycle of services such as PostgreSQL, MariaDB, Redis, and Keycloak – from provisioning and upgrades to backups, monitoring, and day-2 operations.

What started as a solution for a single customer project has evolved into a framework that powers managed services for organisations across Switzerland and beyond. AppCat enables customers to consume services through self-service interfaces while giving operators a consistent way to manage applications across different infrastructures.

Today, AppCat serves as a core building block of the wider sovereign ecosystem presented in Liene’s talk. It provides the automation and operational foundation that allows managed service providers, cloud providers, software vendors, and implementation partners to collaborate through platforms such as Servala while maintaining openness, portability, and customer choice.

Liene Luksika

Product Manager

Contact us

Our team of experts is available for you. In case of emergency also 24/7.

Contact us
Events General

Cloud Native Computing Switzerland Meetup May 2026 Recap

22. May 2026

On May 21, 2026 the Cloud Native Computing Switzerland Meetup Community gathered once again at the VSHN Tower in Zürich for an afternoon of technical talks, discussions, and community exchange.

With more than 3’000 members in the meetup group, the CNC Switzerland community continues to bring together platform engineers, DevOps practitioners, architects, and open-source enthusiasts from across the Swiss cloud-native ecosystem.

The May edition featured four talks covering topics from Kubernetes-native deployment orchestration and Rust-based control planes to open-source project governance in the age of AI and cluster autoscaling for non-mainstream clouds.

Opening and community updates

The meetup kicked off with a short welcome and community update by the organizers. As always, the CNC Switzerland meetup follows a few important principles:

  • All talks are technical and open-source focused
  • No product or sales pitches
  • Talks are held in English
  • Speakers from diverse backgrounds are strongly encouraged

These principles help keep the meetup a true technical community event rather than a marketing stage.

Kuberik: Safe, hands-off deployments for Kubernetes

Luka Rumora

Luka Rumora opened the technical programme with a look at what continuous delivery on Kubernetes still gets wrong. Most teams, he argued, end up in one of two places: GitOps setups that stop at applying manifests, or brittle CI pipelines held together with bash and glue. Neither delivers true end-to-end delivery.

The ingredients of a good deployment pipeline are well known – canaries, health checks, smoke tests, promotions, rollback – but Kubernetes lacks a native, reusable way to compose them. Existing tools like Argo Rollouts, Flagger, and Kargo each solve a piece of the puzzle, but not the whole pipeline.

Kuberik aims to fill that gap. It orchestrates the full journey from release to production – detecting, gating, rolling out, verifying, and promoting – using opinionated, pluggable Kubernetes resources that integrate cleanly with existing GitOps setups.

The talk highlighted how a more composable, Kubernetes-native approach to CD can:

  • replace step-based pipelines with reusable resources
  • bring canaries, verification, and rollback under one model
  • integrate with the GitOps tooling teams already run

Download slides

Kubernetes without the operator: A Minecraft panel with Rust and kube-rs

Hadi Cherkaoui – CM Informatik AG

Hadi Cherkaoui, a 17-year-old Plattformentwickler apprentice at CM Informatik AG, brought a refreshingly contrarian take on a pattern many in the room build their daily work around: the operator.

The project Anvil is a Kubernetes-native Minecraft server panel written in Rust. It creates one StatefulSet, PVC, and Service per server through direct kube-rs calls – with no CRD and no controller. The Kubernetes API itself serves as the runtime state store, and every user action is a direct API call.

The argument behind the design was just as interesting as the implementation: the operator pattern is sometimes the wrong tool. Controllers earn their complexity when there is autonomous state to reconcile. When there isn’t, they become ceremony. Anvil is a worked example of the imperative alternative, running on a home lab k0s cluster.

Key takeaways from the talk:

  • not every Kubernetes-native application needs a controller
  • direct API calls can be a perfectly valid pattern
  • Rust and kube-rs make for an ergonomic combination
  • homelab projects remain a great place to challenge defaults

Vibe code survival guide for open-source

Vadim Bauer – 8gears

Vadim Bauer, maintainer of the CNCF project Harbor, tackled a topic that is rapidly becoming one of the hardest in open source: how to keep a project coherent when AI-assisted contributions arrive faster than maintainers can review them.

Banning AI contributions outright, he argued, isn’t the answer – but neither is letting the volume erode a project’s direction. Drawing on experience from Harbor and Harbor Satellite, Vadim shared the playbook his team is building to stay sane:

  • define a clear project direction so contributors, human or AI-assisted, know what is in scope
  • set explicit acceptance criteria and guardrails
  • use AI on the maintainer side to triage, review, and filter incoming contributions
  • decide as a project what is core, what is an extension, and what is out of scope

The session was an honest look at what works, what fails, and how open-source projects can rethink contribution, community, and project boundaries in the age of vibe coding.

Writing a Kubernetes Cluster Autoscaler provider with externalgrpc

Marco De Luca – VSHN

The final talk closed out the afternoon with a deep technical walkthrough from VSHN’s own Marco De Luca. At mdnix.io, he writes about infrastructure, Linux, Kubernetes, and the things he builds along the way.

The Kubernetes Cluster Autoscaler decides when to scale, but it doesn’t know how to create a VM – that’s the cloud provider’s job. The upstream tree covers mostly the big clouds, which leaves regional and specialised providers out in the cold. With externalgrpc, you can plug virtually any cloud into the autoscaler over gRPC.

Marco walked the audience through:

  • how the Cluster Autoscaler works under the hood and where the cloud provider fits in
  • implementing an out-of-tree gRPC provider for a Swiss IaaS platform
  • the design choices and parts of the contract that really matter
  • the gotchas you only discover by reading the autoscaler source

By the end of the talk, attendees had a solid mental model of how to attach autoscaling to any cloud that isn’t on the upstream list – a topic particularly relevant for the Swiss ecosystem, where sovereign and regional cloud providers play an important role.

Download slides

Marco wrote a follow-up blog post about this topic if you want to dive deeper!

Networking and apéro

After the talks, participants stayed for networking and the traditional Swiss meetup apéro, continuing discussions about Kubernetes-native delivery, Rust, open-source governance, and autoscaling.

Meetups like these highlight the strength of the Swiss cloud-native community: engineers from different companies sharing real-world experiences, lessons learned, and open-source solutions.

Watch the talks

The sessions from this meetup will be published on the VSHN TV YouTube channel.

Subscribe to stay notified when the recordings become available.

Join the community

The Cloud Native Computing Switzerland Meetup welcomes engineers, architects, and developers interested in cloud-native technologies and open source.

If you would like to present a talk or share your project or sponsor the meetup location and apéro, submit your proposal here.

We look forward to seeing you at the next CNC meetup in September!

Markus Speth

Marketing, Communications, People

Contact us

Our team of experts is available for you. In case of emergency also 24/7.

Contact us
Events General

VSHN is back as a Matterhorn sponsor of Swiss Software Festival 2026

19. May 2026

We are happy that VSHN is once again a Matterhorn sponsor of the Swiss Software Festival 2026. The festival takes place on June 24, 2026, at uptownBasel in Arlesheim, bringing together more than 600 peers, two plenary sessions, and over 75 speakers across seven thematic tracks and two special tracks.

This year’s edition has a clear focus, and it is one close to our heart: in times of geopolitical uncertainty, Swiss companies and organizations are increasingly looking for autonomy-first, Swiss-made solutions that support digital sovereignty. That is exactly the conversation we want to be part of – not just as a sponsor, but on stage and behind the program.

Aarno Aukia keynotes the opening plenary

VSHN co-founder Aarno Aukia is one of the keynote speakers in Plenary Session 1, “The future of software development.” His talk, “Digital Neutrality: Switzerland’s Engineering Advantage in the AI Era,” looks at a question that runs through the whole festival: who will build software in the future, humans or machines, and what that means for Switzerland’s position in an AI-shaped world.

He shares the stage with keynote speakers from UBS, IMD, and ti&m, followed by a leadership panel with voices from Adnovum, Adobe, and Abacus Research – a strong lineup for a discussion about where the Swiss software industry is heading.

VSHN chairs Tech Track 2: Platform Engineering & Software Architecture

We are also the track chair of Tech Track 2, “Platform Engineering & Software Architecture.” Modern software systems need more than tooling – they need thoughtful architecture and resilient platforms. This track digs into platform engineering, internal developer platforms, distributed systems, and cloud-native runtime strategies, from Kubernetes-based control planes to distributed AI workloads.

Our Product Manager & Partner Tobias Brunner contributes a talk titled “From platforms to ecosystems – why software innovation is a team sport,” alongside speakers from Eficode, White Duck, Abacus Research, and Noser Engineering.

See you in Arlesheim

The Swiss Software Festival has become a unique meeting point for the Swiss software ecosystem, and the topics on this year’s agenda – sovereignty, platform engineering, and the role of AI in software development – are right at the center of what we do at VSHN. We are looking forward to good conversations, great talks, and meeting the community in person.

Join us on June 24, 2026, at uptownBasel in Arlesheim. Tickets are available here.

Markus Speth

Marketing, Communications, People

Contact us

Our team of experts is available for you. In case of emergency also 24/7.

Contact us
General OpenShift Press Sovereignty

Digital Sovereignty Made in Switzerland: HIN Becomes a Global Red Hat Success Story

12. May 2026

A Swiss Success Story with Global Impact

When we originally published the HIN (Health Info Net) success story at VSHN, we already knew this project was something special.

Now, the story has reached a global stage: Red Hat officially published the modernization of HIN as a global customer success story and announced it during Red Hat Summit 2026 in Atlanta on May 11, 2026.

For us, this is far more than just another reference project. It is a strong validation that sovereign, open, cloud-native infrastructure is no longer a niche topic – it is becoming a strategic requirement for critical industries such as healthcare.

And it also highlights something important: Switzerland is no longer only discussing digital sovereignty in theory. It is actively building it.

Why HIN (Health Info Net) Matters

HIN is one of the most important digital healthcare platforms in Switzerland.

More than 50,000 healthcare professionals use HIN services, and over 90% of relevant actors in the Swiss healthcare ecosystem are connected through the platform. Secure communication, digital identities, and trust are at the core of the Swiss healthcare ecosystem – and HIN plays a central role in enabling this infrastructure.

This makes HIN far more than a typical IT platform. It is part of Switzerland’s critical digital infrastructure.

Modernizing such a platform is therefore not simply about upgrading technology. It is about resilience, security, operational flexibility, long-term independence, and trust.

From Legacy Infrastructure to a Sovereign Cloud-Native Platform

Like many established organizations, HIN faced the challenge of evolving a proven and highly trusted platform while preparing it for future requirements.

The goal was not change for the sake of change. The objective was to build a modern operating model that increases flexibility, automation, scalability, and security – without compromising stability and reliability.

Together with Red Hat and VSHN, HIN modernized its platform using Red Hat OpenShift and cloud-native technologies.

The result:

  • A more flexible and scalable platform architecture
  • Increased automation and operational efficiency
  • Stronger security segmentation and Zero Trust principles
  • Kubernetes Gateway API-based protection for web applications and APIs
  • Greater portability and long-term independence
  • A modern foundation for future healthcare services

One particularly important aspect was avoiding unnecessary vendor lock-in.

Digital sovereignty does not mean isolation. It means maintaining strategic control over critical infrastructure, data, operations, and future decisions. Open standards, Kubernetes, and Open Source technologies are key building blocks for achieving this.

Security and Sovereignty Go Hand in Hand

Healthcare platforms are among the most demanding environments when it comes to security and compliance.

The HIN platform therefore consistently applies Defense in Depth and Zero Trust concepts – including network microsegmentation, clear workload segmentation, and modern authentication mechanisms.

As part of this cloud-native security approach, HIN also uses Airlock Microgateway to protect applications and APIs directly within the OpenShift environment. This adds Kubernetes-native Web Application and API Protection close to the workloads and fits naturally into an automated, container-based operating model.

This is an important point that is often overlooked in sovereignty discussions:
Open infrastructure and digital sovereignty are not in conflict with security – they can significantly strengthen it.

Cloud-native architectures enable highly automated, resilient, and observable systems while still maintaining strong control over where and how workloads operate.

Recognition Beyond Switzerland

This project has now received recognition on multiple levels.

Earlier this year, VSHN received the Red Hat Partner Award 2025 for Platform Modernization for the joint success with HIN.

Now, Red Hat has further elevated the story through an official global success story announcement during Red Hat Summit 2026 in Atlanta.

For us, this recognition is not only about VSHN. It highlights the growing importance of sovereign digital infrastructure across Europe and Switzerland.

And it shows that Open Source, Kubernetes, and cloud-native operating models are no longer purely technical topics. They are increasingly becoming strategic foundations for critical industries and public trust.

A Blueprint for Sovereign Digital Infrastructure

We believe the HIN story represents far more than a single modernization project.

Organizations across Europe are currently rethinking:

  • dependencies on hyperscalers
  • operational resilience
  • data sovereignty
  • supply chain risks
  • long-term platform strategies
  • digital sovereignty requirements

In healthcare, these challenges become especially tangible.

HIN demonstrates that modern sovereign infrastructure is already possible today – with Open Source, strong ecosystem partnerships, and cloud-native operating models.

And perhaps most importantly: digital sovereignty can be practical, operationalized, and production-ready.

Not as a future vision.
But as infrastructure already running today.

Projects like this are not built by technology alone. A huge thank you to the entire HIN team for the excellent collaboration and trust – and to all VSHNeers whose incredible dedication made this project possible.

Download the Case Study

Health Info Net is modernizing healthcare with Red Hat and VSHN.

Learn More

👉 Red Hat Success Story

👉 Red Hat Case Study

👉 VSHN HIN Success Story

👉 Red Hat Partner Award Announcement

Markus Speth

Marketing, Communications, People

Contact us

Our team of experts is available for you. In case of emergency also 24/7.

Contact us
Events General

VSHN Returns as Sponsor of Cloud Native Zürich 2026

11. May 2026

We have been supporting the Cloud Native community for many years and are excited to once again sponsor Cloud Native Zürich in 2026.

Over the years, Cloud Native Zürich has become one of the most important cloud native community events in Switzerland – bringing together platform engineers, Kubernetes practitioners, developers, operators, architects, startups, enterprises, and open source enthusiasts from across the ecosystem.

At VSHN, supporting and helping grow the cloud native community has always been an important part of who we are. From sponsoring and attending community events, to organizing the Cloud Native Computing Switzerland Meetups, to contributing to open source projects and Kubernetes ecosystems – community has always mattered to us.

That is why we are very happy to be back as sponsors again this year.

Meet Us at Our Booth

If you are attending Cloud Native Zürich, make sure to stop by our booth.

We are looking forward to many great discussions around:

  • Kubernetes & OpenShift
  • Platform Engineering
  • Digital Sovereignty
  • Cloud Native Operations
  • Servala – Sovereign App Store
  • APPUiO
  • Codey
  • Open Source & European cloud ecosystems

Or simply stop by for a chat and good conversations. And of course, you can once again win a nice LEGO set at our booth. 😉

👉 Event website: Cloud Native Zürich

Servala sponsors the Sovereignty Track

This year, Servala is also sponsoring and helping shape the dedicated Sovereignty Track at Cloud Native Zürich 2026.

The track brings together talks and discussions around sovereign cloud infrastructure, open ecosystems, digital sovereignty, and practical cloud native approaches for independent infrastructure strategies.

👉 Read more about the Sovereignty Track at CNZ on Servala

Tobias Brunner: How to build a Sovereign App Store

At VSHN we’d been running managed services for Swiss companies for years before we noticed something obvious.

Our customers loved how we operated their PostgreSQL or their OpenShift, but they couldn’t reach it the way they reached AWS: through a marketplace, a self-service portal, a few clicks. So we set out to build one. That’s how Servala started.

In this talk I’ll walk you through how Servala came to be, what it is today, and where we want to take it next. On paper it’s a marketplace for sovereign managed applications like PostgreSQL, GitLab, Keycloak, and Nextcloud, deployed on European cloud providers and operated by managed service providers you can name and trust. In practice, it’s growing into an ecosystem of CSPs, ISVs, MSPs, and implementation partners who’ve decided that sovereignty is worth working on together.

I’ll also be honest about why this work feels urgent right now, and about what it will take for a sovereign app store to succeed: open standards, real choice, partners who show up, and customers willing to bet on something other than the default.

Panel Discussion: Digital Sovereignty – Perspectives from the Ecosystem

Markus Speth will be moderating the panel discussion “Digital Sovereignty – Perspectives from the Ecosystem”.

Digital sovereignty is widely discussed across technology, business, and society – yet what it means in practice is still evolving.

In this panel, participants share perspectives and experiences from different angles, exploring how digital infrastructure is shaped and how approaches in this space are developing.

Panelists representing the various stakeholders in the ecosystem:

  • Implementation Partner: bespinian, Lena Fuhrimann
  • Cloud Provider: Switch, Roman Bachmann
  • Managed Service Provider: VSHN, Tobias Brunner
  • Software Vendor: Red Hat, Simon Reber
  • Society: Digitale Gesellschaft, David Sommer

Aarno Aukias talk: Running LLMs the Cloud-Native Way: Kubeflow, vLLM, LiteLLM and llm-d on Kubernetes

LLMs do not have to be consumed only through hyperscaler APIs. With Kubernetes and open source tools like Kubeflow, vLLM, LiteLLM, and llm-d, platform teams can build their own cloud-native LLM stack with more control over cost, data locality, model choice, and operations.

At VSHN, we believe AI platforms should be operated like other critical cloud-native workloads: automated, observable, reproducible, secure, and portable across infrastructure.

This session shows how an open-source LLM stack can be built on Kubernetes and why that matters for sovereignty, compliance, and long-term operational control.

Not Just a Sponsor, But Also on Stage

We are especially excited to not only participate as a sponsor with our booth this year, but also to actively contribute to the program – as speakers and moderators of the Sovereignty Track.

Through talks, discussions, and the panel around digital sovereignty, we want to help bring topics like open source, sovereign cloud infrastructure, and independent digital ecosystems further into the cloud native community.

We are also especially looking forward to seeing keynote speaker Thomas Zurbuchen live again.

Get Your Ticket with 20% Discount

Want to join Cloud Native Zürich 2026?

Use our discount code:

VSHN-20

and get 20% off your ticket purchase.

Cloud Native Zürich is one of the best opportunities in Switzerland to connect with the local and European cloud native ecosystem, discover new ideas, meet maintainers and practitioners, and exchange experiences around Kubernetes, platform engineering, AI, security, operations, and digital sovereignty.

Whether you are deeply technical, leading platform teams, building products, or simply interested in where the cloud native ecosystem is heading – this event is absolutely worth attending.

👉 Get your ticket now

Markus Speth

Marketing, Communications, People

Contact us

Our team of experts is available for you. In case of emergency also 24/7.

Contact us
General Servala Tech

VSHN AppCat Update – Servala Foundations, Garage Monitoring and OpenBao Sneak Peek

With AppCat v4.186.0, a lot happened behind the scenes. This release is less about visible UI changes and more about the foundation for what comes next: deeper Servala integration, improved storage operations, and new services on the horizon.

From enabling additional networking and storage capabilities for Servala, to preparing migrations from MinIO to Garage, to quietly introducing OpenBao support – this release is all about building the next layer of the platform.

👉 Full release details: Changelog 2026-05-05

Servala Enablement

A large part of this release focuses on extending the technical foundation behind Servala – Sovereign App Store.

Several new capabilities were added to AppCat to support future services and integrations, including generic object buckets, HTTPRoute, TCPRoute and TCP Gateway support.

While most of these improvements stay invisible to end users for now, they are important building blocks for providing more flexible, production-ready services through Servala in the future.

This is one of those releases where the impact will become more visible over time.

👉 Learn more about Servala: Servala – Sovereign App Store

Garage Monitoring and Upcoming Migrations

We have started gathering metrics and monitoring data for Garage object storage.

This allows us to improve alerting, operational visibility and reliability for managed object storage services.

At the same time, we are officially starting the migration path from MinIO to Garage.

Garage is becoming the future default for object storage services within AppCat and Servala. Existing users will hear from us soon to plan migrations together.

The goal is simple: improved operations, better scalability and a smoother long-term experience.

👉 Learn more about Garage: Garage by VSHN

OpenBao Is Coming

One small line in the changelog might actually hint at one of the most exciting additions in recent months: OpenBao.

The service is not publicly available yet, but the first building blocks are already landing in AppCat.

OpenBao is an open source fork of HashiCorp Vault, focused on open governance and community-driven development. For organizations looking at secure secret management, encryption and identity workflows without vendor lock-in concerns, this is a very interesting space to watch.

We are excited about the possibilities here – and more information will follow soon.

👉 Learn more about OpenBao: OpenBao by VSHN

PostgreSQL with CloudNativePG Is Now Production Ready

Another major milestone: PostgreSQL by VSHN with CloudNativePG is now officially production ready.

Over the last months, CloudNativePG has evolved from a promising new PostgreSQL foundation into the default future direction for PostgreSQL services in AppCat.

With self service restore, operational maturity and migration tooling now in place, we recommend users start planning migrations to CloudNativePG-based PostgreSQL instances.

You can either follow the migration guide yourself or reach out to us if you want support with the transition.

👉 Learn more about PostgreSQL with CloudNativePG: PostgreSQL by VSHN with CloudNativePG

👉 Migration guide: Migrate a PostgreSQL instance to another PostgreSQL instance

Quiet Releases Matter

Not every AppCat release is about flashy new features. Sometimes the most important work happens in the platform foundations: networking, observability, migrations, reliability and preparing the next generation of services.

AppCat v4.186.0 is exactly that kind of release.

And while some of the improvements may still stay invisible today, they are already shaping what users will be able to build and operate tomorrow.

👉 Learn more about VSHN AppCat: Application Catalog by VSHN AG

Liene Luksika

Product Manager

Contact us

Our team of experts is available for you. In case of emergency also 24/7.

Contact us
Events General

DevOpsDays Zurich 2026 – Still One of the Best Community Events in Tech

8. May 2026

On May 6 and 7, 2026, the Swiss DevOps and cloud native community gathered once again at Alte Kaserne Winterthur for DevOpsDays Zurich 2026. Once again, it reminded us why this event has become such an important part of the community over the years.

For us at VSHN, DevOpsDays Zurich is something special. We have been part of it since the very first edition in 2016 – as sponsors, participants, speakers, and community members. Watching the event grow over the years, while still keeping its open and community-driven spirit, has honestly been pretty amazing.

And somehow, despite the industry changing massively over the last decade, the core idea of DevOpsDays still feels just as relevant as it did back then: bring people together, share real experiences, talk openly about challenges, and learn from each other.

This year’s edition once again had exactly that feeling.

Real Talks Instead of Buzzwords

The program covered many of the topics currently shaping our industry – from platform engineering and AI to software supply chain security, observability, developer experience, and organizational culture. But what made the event valuable was not just the topics themselves, it was the way people talked about them: practical, honest, and grounded in real-world experience.

Some talks focused on scaling engineering organizations and platforms, others on AI-assisted operations and the growing importance of observability and verification. Security and software supply chain topics were also everywhere this year – from SBOMs and dependency management to secure coding practices in the age of AI-generated code.

One thing that stood out across many sessions was how much the industry is shifting from “just running infrastructure” towards building platforms, workflows, and ecosystems that actually help developers move faster without losing control or reliability. Platform engineering clearly continues to mature from a trend into a real discipline.

Really Fun Ignite Talks

One highlight this year were definitely the ignite talks. The new format with auto-advancing slides made the sessions feel even more dynamic, entertaining, and challenging for the speakers at the same time.

The format forced people to get straight to the point, which led to many talks feeling more personal, honest, and memorable. From AI and security to team culture and engineering realities, the ignites brought a great mix of technical insights, humor, and community spirit.

Aarno Aukia’s Sponsor Talk About VSHN

DevOps Is Still About People

At the same time, many talks also reminded us that DevOps has never only been about tooling. Sessions around leadership, collaboration, communication, and team dynamics showed once again that most technical challenges eventually become organizational challenges at scale.

That has honestly always been one of the strengths of DevOpsDays: it is one of the few technical conferences where people openly talk not only about successes, but also about failures, friction, and the messy reality behind engineering work.

And that openness continues outside the talks themselves.

Our Booth, Great Conversations, and the LEGO Winners 🎁

Of course, we also want to thank everyone who stopped by our booth. It was two days full of really interesting conversations – about Kubernetes, Servala, Codey, platform engineering, open source, AI, digital sovereignty, community topics, and everything in between.

That is honestly what makes events like DevOpsDays so valuable for us every year. Some of the best ideas and connections happen outside the talks themselves – somewhere between coffee breaks, sticker exchanges, and spontaneous discussions at the booth.

We were also very happy about the huge interest in our LEGO giveaways 👀

The winners of the two LEGO sets:

  • LEGO The Simpsons Krusty Burger
  • LEGO Red Hat Fedora

Congratulations again to the winners and have fun building. 😊

The Community Aspect Matters

The open spaces are still one of the best parts of DevOpsDays. Some of the most valuable conversations happen outside the official talks: spontaneous discussions in hallways, small groups debating architecture decisions, or people openly sharing what did not work in production.

That willingness to exchange experiences without pretending everything is perfect is what makes community events like this so valuable.

It was also simply great seeing so many familiar faces again and many new ones joining the community for the first time. The Swiss cloud native ecosystem has grown enormously over the last years, and DevOpsDays Zurich has definitely played a role in that journey.

Looking Ahead to 2027

A huge thank you to the organizers, volunteers, speakers, sponsors, and everyone involved. Community events like this require a massive amount of work behind the scenes, and it showed throughout the entire two days.

And now we are already looking forward to next year: the 10th anniversary of DevOpsDays Zurich. That is honestly quite wild to think about.

See you in 2027. 🎉

Markus Speth

Marketing, Communications, People

Contact us

Our team of experts is available for you. In case of emergency also 24/7.

Contact us
General Sovereignty

TRANSFORM 2026 – Why Open Source Makes Digital Sovereignty Real

5. May 2026

On May 5, 2026, everyone in Switzerland with a stake in digital administration, infrastructure, and sovereignty gathered in Bern. TRANSFORM 2026 brought together experts from politics, public administration, business, and academia at the Bern City Hall – under the theme “Digital Public Infrastructure”.

One thing became very clear: digital sovereignty is no longer an abstract concept. It is becoming real.

From vision to implementation

Over the past years, discussions have often focused on strategies and high-level visions. In Bern, the focus clearly shifted towards implementation. Topics such as e-ID, electronic health records, and mobility data infrastructures show that key building blocks of digital public infrastructure are slowly but visibly taking shape.

At the same time, the core challenge remains: how can federal structures, diverse stakeholders, and existing systems be brought together to create scalable and functional platforms?

Digital public infrastructure as the foundation

A central topic was the role of Digital Public Infrastructure (DPI). These are foundational digital building blocks upon which services can be built – comparable to roads or power grids in the physical world.

This includes identity solutions, data infrastructures, and trust mechanisms. The key question is not just technology, but also governance, openness, and long-term control.

Open source as the anchor of sovereignty

One of the most impactful talks came from Dirk Schrödter.

His key message: digital sovereignty is primarily a technological issue today. It determines whether states can act independently in the digital space – and is therefore a prerequisite for political and economic autonomy.

It also became clear that “Buy European” alone is not enough. Replacing one proprietary dependency with another does not solve the underlying problem.

The real difference lies in openness: open source reduces technological dependencies – and therefore economic ones as well. It creates transparency, control, and long-term independence.

Beyond that, open source was framed as a growth driver: knowledge becomes shareable, innovation accelerates, and collaboration across organizational boundaries becomes possible.

Equally important is the cultural dimension: open source requires a real shift in mindset. Moving away from closed systems and silos towards openness, sharing, transparency, and collaboration. Organizations that embrace this shift build not only better technology, but also more resilient and sustainable structures.

The impact is measurable: a European Commission study (2021) shows that a 10% increase in open source investment could boost EU GDP by 0.4-0.6% and lead to more than 600 additional ICT startups.

And these effects are already visible in practice: Schleswig-Holstein alone saved around EUR 15 million in licensing costs in 2025 – funds that are being reinvested into open source, regional expertise, resilience, and innovation.

Another key takeaway: success requires more than technology – including Open Source Program Offices, strong networks, and active ecosystem development.

Ecosystems over isolated solutions

Another strong theme throughout the event: complex digital challenges cannot be solved in isolation.

It is no longer about individual tools or platforms, but about building functioning ecosystems – connecting public administration, private sector, and communities in a meaningful way.

Digital sovereignty is not only a result of technology choices, but also of how collaboration and marketplaces are structured. This is exactly where platforms like Servala come in – as a sovereign app store connecting providers, technologies, and organizations in an open ecosystem, enabling real choice.

What this means for VSHN

For us at VSHN, TRANSFORM 2026 confirms much of what we have been working on for years.

We build on open source, open standards, and cloud-native platforms. With solutions like APPUiO – Expert Hosting, Servala – Sovereign App Store and Codey – European Code Collaboration, we aim to make digital sovereignty practical while enabling strong ecosystems.

We also actively contribute to open source: projects like k8up (a Kubernetes backup operator for automated backup and restore processes, now a CNCF Sandbox Project), Project Syn (tooling for managing large-scale Kubernetes cluster fleets using GitOps and centralized configuration), and most recently Espejote (a Kubernetes operator for managing arbitrary resources in-cluster, combining GitOps principles and leveraging Server-Side Apply and Jsonnet).

Because in the end, digital sovereignty is not achieved through isolation, but through strong, open, and well-connected systems.

Conclusion

TRANSFORM 2026 showed that Switzerland is moving in the right direction. Maybe not as fast as some would hope – but with a clear trajectory.

Digital sovereignty is becoming tangible – and open source plays a central role.

Now it is time to turn these insights into action.

Markus Speth

Marketing, Communications, People

Contact us

Our team of experts is available for you. In case of emergency also 24/7.

Contact us
General Sovereignty

VSHN is a founding member of Zentrum SDS – Souveräne Digitale Schweiz

29. Apr 2026

On April 28, 2026, the Zentrum SDS – Souveräne Digitale Schweiz officially launched its activities – and we at VSHN are very happy to be part of the founding members.

Together with 30 other organizations from government, business, and academia, we are sending a clear signal: digital sovereignty in Switzerland is no longer an abstract concept – it is actively being shaped. Participants include institutions such as Kommando Cyber, the Canton of Solothurn, the Office for IT and Organization of the Canton of Bern, the Statistical Office of the Canton of Basel-Stadt, Organization and Informatics (OIZ) of the City of Zurich, the SWITCH foundation, as well as many leading Swiss IT companies.

The announcement can also be read on netzwoche and Inside-IT.

Why the Zentrum SDS matters

Digital sovereignty means maintaining control over data, technologies, and digital infrastructure – and consciously deciding which dependencies to accept. This is exactly where the Zentrum SDS comes in: it brings together key stakeholders to jointly develop solutions, define standards, and drive concrete alternatives forward.

In the coming months, members will collaborate across four key areas:

  • Financing and procurement of Open Source technologies
  • Sovereign workplace solutions such as openDesk
  • Swiss cloud offerings
  • Open Source-based AI platforms

The initiative was launched by the Institut Public Sector Transformation at the Berner Fachhochschule. Thanks to the contributions of its members, the collaboration can be structured effectively and developed sustainably over time.

Open Source as a key to sovereignty

A central pillar is the use of Open Source technologies. They enable transparency, control, and independence – exactly the qualities required for a sovereign digital infrastructure.

The growing international importance of this topic is reflected in the close collaboration with Germany. There is active exchange with the Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDis), which is involved in the development of openDesk.

A highlight in this context is the TRANSFORM conference 2026 on May 5, 2026 in Bern. There, Dirk Schrödter will demonstrate how Open Source concretely contributes to digital sovereignty. The program is complemented by international perspectives on Digital Public Goods and insights into the role of the state in digital infrastructure.

Servala – Sovereign App Store as a cloud-agnostic marketplace

With Servala, we at VSHN are taking this idea one step further. Servala connects providers, partners, and enterprises through a cloud-agnostic marketplace, making sovereign, standardized services easy to consume. Instead of locking into a single cloud provider early on, Servala enables real choice – based on open standards and interoperable services.

In the context of the Zentrum SDS, we see strong potential here: a shared ecosystem where services are available across different providers strengthens not only sovereignty, but also innovation and collaboration across the entire market.

Our perspective at VSHN

For us, participating in the Zentrum SDS is a natural next step. For years, we have been building on Open Source, open standards, and collaborative ecosystems – whether operating Kubernetes platforms, developing platforms like APPUiO, or driving initiatives like Servala.

Digital sovereignty does not emerge through isolation, but through collaboration on equal footing. This is exactly what the Zentrum SDS enables: a shared foundation on which innovation, security, and independence can grow together.

See also: EUR 180 Million for Sovereign Cloud: What the EU’s First Sovereignty-Scored Procurement Means for Swiss Organisations.

We look forward to actively shaping this journey.

Markus Speth

Marketing, Communications, People

Contact us

Our team of experts is available for you. In case of emergency also 24/7.

Contact us
General Sovereignty

EUR 180 Million for Sovereign Cloud: What the EU’s First Sovereignty-Scored Procurement Means for Swiss Organisations

24. Apr 2026

On April 17, 2026, the European Commission awarded EUR 180 million in cloud contracts to four European providers – Post Telecom Luxembourg, STACKIT, Scaleway, and Proximus. For the first time, providers were scored on sovereignty using a formal framework with eight measurable dimensions. Hyperscaler involvement cost one consortium a lower score. Here is what this means for Swiss organizations choosing cloud providers.

The EU now scores sovereignty

The Commission’s Cloud Sovereignty Framework (v1.2.1, October 2025) defines eight Sovereignty Objectives and five assurance levels (SEAL-0 to SEAL-4). Providers bidding for these contracts were evaluated on:

  • Strategic sovereignty – EU ownership and anchoring, resilience against foreign interference
  • Legal & jurisdictional sovereignty – insulation from extraterritorial laws such as the US CLOUD Act
  • Data & AI sovereignty – where data is stored, who holds encryption keys, independence of AI services
  • Operational sovereignty – can EU-based teams operate the service independently?
  • Supply chain sovereignty – geographic origin of components and sub-suppliers (highest weight: 20%)
  • Technology sovereignty – open source, open standards, no proprietary lock-in
  • Security & compliance sovereignty – certifications, independent patching, EU-based SOC
  • Environmental sustainability – energy efficiency, renewable energy, carbon disclosure

Each objective carries a defined weight. Supply chain sovereignty is the highest at 20%, followed by strategic, operational, and technology sovereignty at 15% each.

What the results tell us

Three of the four winners achieved SEAL-3 (“Digital Resilience”), meaning EU actors exercise meaningful control with only marginal non-EU influence:

ProviderCountryPartnersSEAL Level
Post TelecomLuxembourgCleverCloud, OVHcloudSEAL-3
STACKIT (Schwarz Group)GermanySEAL-3
Scaleway (Iliad Group)FranceSEAL-3
ProximusBelgiumS3NS (Thales/Google Cloud JV), Clarence, MistralSEAL-2

The Proximus consortium – which includes S3NS, a joint venture between Thales and Google Cloud – achieved only SEAL-2 (“Data Sovereignty”), where EU law is enforceable but material non-EU dependencies remain.

The message is clear: involving a US hyperscaler – even through a European joint venture with a defense contractor – measurably reduces your sovereignty score. The framework does not ban hyperscaler partnerships, but it scores them lower.

Why Swiss organizations should pay attention

Although this procurement targets EU institutions, the framework will cascade:

  • EU member states will adopt similar criteria for national cloud procurement, following France’s “Cloud de Confiance” and Germany’s “Souveräner Cloud” strategies that the framework explicitly references.
  • Regulated industries (banking, insurance, healthcare) already face FINMA, DORA, and NIS2 requirements that overlap with these sovereignty objectives – particularly legal jurisdiction, data sovereignty, and security compliance.
  • Swiss public sector procurement increasingly references EU standards. Organizations evaluating cloud providers now have a structured vocabulary to compare sovereignty claims instead of relying on marketing.

Eight dimensions, not just “data stays in Switzerland.”

Most sovereignty marketing stops at data residency. The EU framework goes much further – and so should your evaluation criteria:

DimensionWhat to ask your provider
StrategicWho owns the company? Any foreign investors or parent entities?
LegalWhich law governs your contracts? Are you exposed to the US CLOUD Act?
DataWhere is data stored? Who holds the encryption keys?
OperationalWhere is your operations team? Can you patch and upgrade without any non-EU vendor?
Supply chainWho are your infrastructure sub-suppliers? Can you disclose the full chain?
TechnologyIs the software open source? Can I migrate to another provider?
SecurityWhere is your SOC? Can you apply security patches independently?
EnvironmentalWhat is your energy source? Do you disclose PUE and carbon emissions?

Where VSHN stands: self-assessment against the framework

We applied the EU’s eight sovereignty objectives to our own services. This is a self-assessment – VSHN has not been formally scored by the European Commission – but we believe transparency is more useful than vague claims. The full assessment with references is available on request.

#DimensionWeightVSHN assessmentEvidence
SOV-1Strategic15%StrongSwiss AG, no foreign parent company, all shareholders Swiss citizens (Commercial Register)
SOV-2Legal10%StrongSwiss law governs all contracts (GTC), no CLOUD Act exposure, EU adequacy decision for Switzerland
SOV-3Data & AI10%StrongInfrastructure-agnostic: customer chooses provider. Open-source software, fully auditable. Swiss-owned options available (e.g., cloudscale.ch — 100% Swiss-owned)
SOV-4Operational15%StrongSwiss 24/7 ops team, optional Switzerland-only support. All services available on vanilla Kubernetes — no non-Swiss vendor dependency required
SOV-5Supply Chain20%StrongInfrastructure-agnostic: customer chooses provider. Open-source software, fully auditable. Swiss-owned options available (e.g. cloudscale.ch — 100% Swiss-owned)
SOV-6Technology15%Strong100% open-source stack. Active contributor: K8up (CNCF Sandbox), Crossplane providersProject SynAPPUiO
SOV-7Security10%StrongISO 27001, ISAE 3402 Type II (2025), Swiss SOC. Serving FINMA-regulated customers
SOV-8Environmental5%ModerateCloudscale operates in Green Datacenter AG facilities (ISO 22301/27001/27701). Exoscale sustainability with per-customer environmental impact reports. VSHN CSR policy

Overall: SEAL-3 equivalent – the same level achieved by the three strongest providers in the EU’s own tender. No provider achieved SEAL-4.

Why not SEAL-4?

SEAL-4 (“Full Sovereignty”) requires complete EU/EEA control with no non-EU dependencies. No provider achieved it – not even in the EU’s own EUR 180M procurement. The gaps are structural, not provider-specific:

  • Switzerland is not an EU/EEA member but participates in the single market through bilateral agreements, is Schengen-associated, and has an EU adequacy decision for data protection. The gap is formal, not substantive.
  • Hardware supply chains are global: semiconductors, networking equipment, and storage are manufactured in Asia and the US. This applies to every cloud provider, including the SEAL-3 winners.
  • Open-source foundations are US-based: the Linux Foundation, CNCF, and the Apache Foundation are US entities. Open-source licensing mitigates this (code is forkable and auditable), but strict SEAL-4 interpretation could flag it.

VSHN operates at the practical maximum. The remaining gaps in SEAL-4 are shared by every cloud provider worldwide.

Sovereignty is a bridge, not a bunker

It’s tempting to frame sovereignty as a defensive exercise — protecting data, avoiding foreign law, ticking compliance boxes. But that misses the point.

As Stefan van Oirschot argues, infrastructure should be a bridge that enables agility, not a bunker that constrains it. The distinction matters: organizations on proprietary platforms ask their vendor for permission to innovate. Organizations on sovereign, open-source platforms grant themselves permission.

The invisible taxes of lock-in: Proprietary platforms carry two hidden costs that don’t appear on invoices. First, implementation debt: migrating working solutions to a vendor’s proprietary framework burns capital and frustrates engineering talent. Second, compliance reset: regulations like DORA and NIS2 increasingly require credible exit strategies. An infrastructure that can’t be migrated creates audit risk — what van Oirschot calls “regulatory deadlock.”

The sovereignty dividend: Open-source infrastructure — Linux, Kubernetes, PostgreSQL, OpenBao, Crossplane — transfers ownership from vendors to the organizations using it. Vendors become partners, not landlords. When your infrastructure is built on standards rather than rented land, you can change providers, add clouds, or adopt new technology without rebuilding from scratch.

AI readiness requires sovereign infrastructure: The next wave of enterprise technology, agentic AI, RAG pipelines, and private LLM inference demands infrastructure that you control. Running AI workloads on a platform where a foreign vendor holds the keys to your data, your models, and your compute is the opposite of self-determination. Sovereign infrastructure is the prerequisite for sovereign AI. This is why VSHN operates managed LLM inference on customers’ infrastructure, so that organizations deploying AI keep control of their data and their models.

The EU framework scores eight technical dimensions. But the strategic question is simpler: does your infrastructure let you move faster, or does it slow you down?

The bottom line

The EU Cloud Sovereignty Framework confirms what VSHN has built over the past decade: sovereign cloud operations are not just about where data is stored. They require European ownership, independent operational capability, open-source technology, transparent supply chains, and jurisdictional insulation from foreign law.

Sovereignty is not a cost center; it is the foundation for agility, compliance, and AI readiness. Organizations that treat it as a checkbox will find themselves asking their vendor for permission. Organizations that build on sovereign infrastructure will already be shipping.

For Swiss organizations evaluating cloud providers, the question is no longer “Do you host in Switzerland?” but “How do you score across all eight sovereignty dimensions, and does your infrastructure enable or constrain your next move?”

For product-specific sovereignty assessments, see GitLabKeycloakOpenShiftOpenBao, and our full service catalog.

Sources:

Aarno Aukia

Aarno is Co-Founder of VSHN AG and provides technical enthusiasm as a Service as CTO.

Contact us

Our team of experts is available for you. In case of emergency also 24/7.

Contact us
Codey General

Codey is Live: New Features & Lock In Your Price Until April 30th

22. Apr 2026

When we quietly put Codey – European Code Collaboration Platform online a few months ago, we weren’t ready to make a big deal of it. We had early customers, a working service, and a soft launch page on vshn.ch but no fanfare. That changes today.

Codey now has a proper home at codey.ch, and with it comes a real launch: new features on the roadmap, a cleaner onboarding experience through the Servala portal, and a pricing offer worth paying attention to.

What Is Codey, For Those Who Missed the Soft Launch

Codey is VSHN’s managed Forgejo platform. You get your own dedicated, isolated Forgejo instance – not a shared multi-tenant setup – hosted on European cloud infrastructure, fully managed by us. That means updates, backups, monitoring, and security patches are handled. Your team just uses it.

Forgejo itself is a community-driven, 100% free software Git forge, governed by the non-profit Codeberg e.V. It covers everything a development team needs: Git hosting, pull requests, CI/CD via Forgejo Actions (compatible with GitHub Actions workflows), package hosting, Kanban boards, issue tracking, and more – with no feature gating behind an enterprise tier.

Codey adds Renovate integration on top, keeps your instance on the latest stable release, and handles the operational overhead you’d rather not think about.

What’s New

Two features have been on top of our customer wishlist and are now on their way:

  • SSH access – until now, Git operations over HTTPS with personal access tokens was the supported workflow. SSH support is coming, so you can add your public keys and work the way you’re used to.
  • Self-service via the Servala portal – Codey instances are ordered through Servala, VSHN’s Sovereign App Store. We’re expanding what you can manage yourself directly in the portal, so you don’t need to go through us for routine changes to sizing, storage, or Forgejo configurations of your instance

For existing customers, we’ll be in touch individually to coordinate the migration to the new infrastructure that enables these features.

Lock In Your Price – Until April 30th

We’re introducing updated pricing alongside the new platform. But here’s the deal: if you’re already a Codey customer, or if you order or upgrade before April 30th, 2026, your current plan price is locked in permanently. Whatever we charge going forward, your rate doesn’t change – ever.

It’s our way of rewarding early adopters and giving anyone on the fence a concrete reason to decide now.

👉 Get Started at portal.servala.com

Why We Built Codey

GitHub and GitLab are excellent platforms run by large corporations with their own pricing roadmaps, data handling policies, and strategic interests. For many teams that’s fine. For teams who care about data sovereignty, vendor independence, or just want their code to stay in Europe on infrastructure they can trust – the choice looks different.

Codey is built on free software with no enterprise paywall. Every Forgejo feature is available to every customer. And because it’s Forgejo, there’s no lock-in: you can export everything and self-host at any time if you ever want to.

We’ve been running open-source infrastructure for over 10 years at VSHN. Codey is what we’re using to develop portal.servala.com ourselves.

Check Out codey.ch →

Markus Speth

Marketing, Communications, People

Contact us

Our team of experts is available for you. In case of emergency also 24/7.

Contact us
Events General

Meet VSHN at DevOpsDays Zurich 2026

20. Apr 2026

DevOpsDays Zurich is back – and of course we’re joining again. We’re happy to announce that VSHN is once again Gold Sponsor of DevOpsDays Zurich 2026, taking place on May 6 and 7, 2026 at the Alte Kaserne in Winterthur.

Two Days of DevOps, Community, and Good Conversations

DevOpsDays Zurich is one of our favourite events of the year – and for good reason. This is where the Swiss DevOps community comes together for two days of talks, open spaces, workshops, and the hallway conversations that sometimes move things more than any presentation. If you care about software delivery, infrastructure, platform engineering, or simply building better teams, this is the place to be.

Come Find Us at the Booth

Come by, ask us anything, and find out how we at VSHN help teams run their applications on Kubernetes and OpenShift – reliably, securely, and with a great developer experience.

Whether you want to learn more about what we offer, geek out on specific topics, or just say hi – we’d love to see you.

Win a Lego – Yes, Really

A VSHN booth without a Lego raffle? Unthinkable. Stop by, enter the draw, and maybe you’ll walk away with something to keep you busy for a while. It’s become a little event tradition of ours – and we’re keeping it going, of course. 🙂

See You in Winterthur!

You can find the full programme at devopsdays.ch. We’re looking forward to great conversations, good coffee – and of course finding out who takes home the Lego this year.

Markus Speth

Marketing, Communications, People

Contact us

Our team of experts is available for you. In case of emergency also 24/7.

Contact us
General Tech

Espejote: A GitOps journey

14. Apr 2026

Espejote (big mirror in Spanish) manages arbitrary resources in a Kubernetes cluster. Built from the ground up to take advantage of Server-Side Apply and Jsonnet templating.

VSHN manages a large fleet of Kubernetes clusters for our customers, and we try to automate as much as possible to keep our operations efficient and sustainable. We use GitOps principles, but sometimes external state needs to be merged into the desired state defined in Git. This GitOps journey took us from Ansible playbooks directly applying YAML, to various operators, to bash “reconcilers”, and finally to Espejote, our shiny new GitOps operator.

Chapter 1: The Ansible era and first operator attempts

In the beginning, we used Ansible playbooks and custom roles to manage our OpenShift 3 Kubernetes clusters. We had a set of YAML files that defined the desired state of our clusters, and we would run Ansible playbooks to apply those YAML files to the clusters. This worked, but it was not very efficient. We had to run the playbooks manually, and if we forgot to run them, the clusters would drift from the desired state.

The collection of roles was nicknamed “mungg”, the Swiss German word for “marmot”. Nobody seems to know why, but it stuck.

We were just getting into writing operators and developed espejo to quickly sync resources between namespaces. It was the very early days of our operator journey.

Chapter 2: The sea of operators and tears

To solve the problem of manual intervention (and because we migrated to OpenShift 4, where the install procedure doesn’t use Ansible anymore), we started looking into Kubernetes operators.
It can’t be that hard to patch a Kubernetes manifest. Right? Wrong.
Some of the operators were buggy, some of them were not flexible enough, some of them loved to randomly go into reconcile loops, and most of them used too many resources. Some of them crashed our API servers. We started with resource-locker-operator, migrated to patch-operator, generated outages with Kyverno, and tested all other policy engines we could find. Kubewarden was the only one we really liked, but the cluster context API was not yet flexible enough for our use cases.

Espejo had been a good start, but we did not yet have the experience to build well-designed operators.
It showed. Every event triggered a full reconciliation of every resource, so syncing slowed down dramatically on larger clusters. We missed a lot of flexibility.

Chapter 3: Getting desperate for safe landings

We were fed up with the constant bugs and breaking changes in Kyverno, and patch-operator was barely maintained. Espejo was at its limits.

Desperate times called for desperate measures, so we started using an amalgamation of bash “reconcilers” – hacks with cron jobs, tiny custom controllers, and pre-processing resources in Project Syn.

We were using Jsonnet more and more. Project Syn components primarily use Jsonnet. We use Jsonnet for our cloudscale machine-api provider, for our SSO solution, and many other projects.

A growing issue were our heavily patched OpenShift alerting rules. We curate upstream rules and only enable the ones we need. Some are heavily patched. Every OpenShift release the upstream definitions are moved around and are sometimes only available embedded into Go code. We needed something that was able to patch rules already deployed in the cluster, as this was the only stable interface we had.

Chapter 4: Espejote, the shiny new GitOps operator

Bolstered by our growing operator experience and our love for Jsonnet, we decided to build our own operator to rule them all. We wanted something that was flexible, efficient, and easy to use. We wanted something that could handle all our use cases, from syncing resources between namespaces to patching OpenShift alerting rules.

Espejote is the result of that journey. It merges cluster state with GitOps principles, using Jsonnet to define the desired state of our clusters. It efficiently caches cluster state, and the reconcile trigger logic is explicitly defined. Sane controller-runtime rate limits apply. Jsonnet allows a huge amount of flexibility, and native server-side apply makes adding and removing keys a breeze. Every Espejote “resource manager” – the dynamic controller spawned for a config unit – uses its own ServiceAccount for least privilege.

Espejote is the operator we always wanted, and we are excited to share it with the world.

What is Espejote?

Espejote is a Kubernetes operator allowing you to manage arbitrary resources in a Kubernetes cluster.
It can mix GitOps principles with in-cluster state.

Why Espejote?

There are plenty of similar tools (and policy engines), but Espejote sets itself apart by focusing on three core pillars:

1. Powered by Jsonnet

Espejote uses Jsonnet as its templating engine. Unlike YAML combined with Go templates, Jsonnet treats the configuration as a data structure. It understands objects, arrays, and strings. It can’t accidentally generate broken YAML because Jsonnet ensures the internal data structure is valid before it ever exports the final file.

2. Native Server-Side Apply

Espejote is built from the ground up to leverage server-side apply (SSA). This means Espejote plays nicely with other controllers and operators. It can manage a single annotation or an entire resource; SSA ensures that the changes are merged without stomping on other tools.

3. Reliability

Reliability isn’t an afterthought. Espejote was born out of the frustration of watching operators enter infinite reconcile loops or crash clusters. It features:

  • Sane rate limiting and backoff strategies.
  • Every configuration unit or “resource manager” runs its own dynamically spawned controller, so a misbehaving unit won’t affect others.
  • Least privilege: Every resource manager runs with its own ServiceAccount.
  • Explicit control: There are no implicit watches or “magic” triggers. You have complete control over what gets reconciled and when.

Real-World Use Cases

What can you actually do with Espejote? Here are a few ways VSHN is using it in production:

  • Secret Syncing: Automatically replicate specific secrets (like image pull secrets or certificates) across multiple namespaces.
  • Autoscaler Patching: Patching the OpenShift Cluster Autoscaler using Admission Webhooks.
  • Alerting Rule Management: Curate and patch OpenShift alerting rules across different cluster versions.

The Future: WASM and Beyond

The roadmap includes a kro-like API builder for easy custom resource creation and support for WebAssembly plugins, which will allow developers to write custom logic in almost any language and run it safely within the Espejote controller.

Getting Started

Example

This example ManagedResource patches the RedHat OperatorHub config singleton to disable all default sources. It shows the simplest usecase of unconditionally patching a static manifest.
More complex use cases can be found in the above getting started section.

apiVersion: espejote.io/v1alpha1
kind: ManagedResource
metadata:
  annotations:
  name: disable-default-sources
  namespace: openshift-marketplace
spec:
  serviceAccountRef:
    name: disable-default-sources
  triggers:
    - name: operatorhub
      watchResource:
        apiVersion: config.openshift.io/v1
        kind: OperatorHub
        name: cluster
  template: |-
    {
        "apiVersion": "config.openshift.io/v1",
        "kind": "OperatorHub",
        "metadata": {
            "name": "cluster"
        },
        "spec": {
            "disableAllDefaultSources": true
        }
    }

Sebastian Widmer

Contact us

Our team of experts is available for you. In case of emergency also 24/7.

Contact us
Events General Kubernetes Sovereignty

KubeCon Europe 2026 Recap – Sovereignty, AI Agents and a Strong Community

26. Mar 2026

KubeCon + CloudNativeCon Europe 2026 in Amsterdam is coming to an end – and it once again showed why this event remains the beating heart of the cloud native ecosystem.

A Clear Direction: Sovereignty and “Agentic” AI

Two themes were impossible to miss this year.

First: digital sovereignty.
Not as a buzzword, but as a real, practical goal. Across talks and discussions, it became clear that organizations are actively looking for ways to build independent, resilient platforms – based on open standards and open ecosystems.

Second: AI – especially “agentic” systems.
From hallway conversations to keynote stages, the focus has shifted from experimentation to application. The big question is no longer if AI will be integrated into platforms, but how.

K8up: Strong Interest and a Call for Maintainers

One of the highlights for us was the strong interest in K8up.

At the K8up kiosk in the Project Pavilion, we had many great conversations with users, contributors, and curious newcomers.

It became clear:
👉 The need for simple, reliable Kubernetes backup solutions is growing
👉 The community around K8up is highly engaged
👉 There is real momentum to push the project forward together

At the same time, we’re actively looking for maintainers and contributors to help shape the future of K8up.

If you’re interested in getting involved, join the discussion here:
https://github.com/k8up-io/k8up/issues/1187

Lightning Talk: Aarno on Stage

A special moment was Aarno Aukia’s lightning talk on K8up.

Short, focused, and right to the point – it sparked great discussions afterwards and brought even more attention to the project.

(And yes – in true Kubernetes fashion, there was even a live moment where an NGINX ingress got archived during a talk. Cloud native never gets boring.)

Servala: From Concept to Real Interest

Servala – Sovereign App Store was another big topic throughout the week, not only because of the goodie bags for the KubeTrain attendees:

What stood out most was the level of understanding and curiosity.

The conversations have clearly evolved:

  • From ‘What is Servala?’
  • To ‘How can we participate?’

This reflects a broader shift in the industry – towards ecosystems instead of isolated platforms, and towards practical implementations of sovereignty.

Switzerland Punching Above Its Weight

One thing that stood out clearly this year: Switzerland’s impact on the cloud native ecosystem is disproportionately strong.

Despite its size, Switzerland contributed 3 out of 48 CNCF projects present at KubeCon – roughly 6%.
Projects like Harbor, K8up and Capsule are actively shaping the ecosystem.

And that’s only part of the story.

When including major contributions such as Cilium, the influence of Swiss engineering and open source involvement becomes even more significant.

But it’s not just about projects.

Switzerland was highly visible across the board:

  • Talks and lightning talks
  • Maintainers and contributors
  • Active community participation
  • Strong presence at events and discussions

This combination of engineering quality, open collaboration and community engagement is what makes the Swiss cloud native scene stand out.

Clément Nussbaumer – PostFinance

A perfect example of what makes this community special:
Open, collaborative, and deeply involved.

Because in the end, the best conversations often happen outside of the actual sessions.

The Swiss Apéro – Community at Its Best

One of the highlights of the week was the KubeCon Swiss Apéro organized by Rocket Engineers.

Around 130 people from the Swiss cloud native community came together in Amsterdam.

More Than Just Talks

Beyond the official program, KubeCon once again delivered a full week of side events and community moments:

  • KubeTrain
  • KubeCon Swiss Apero
  • Upbound, Isovalent and many more community events
  • Countless spontaneous meetups and discussions

These moments are where ideas turn into collaborations.

What We Take Away

KubeCon Europe 2026 confirmed a few key trends:

  • Sovereignty is becoming a real, actionable priority
  • AI is moving into practical, platform-level use cases
  • Open ecosystems are replacing isolated solutions
  • Community remains the driving force behind everything

And maybe most importantly:

👉 The best ideas don’t happen in isolation – they happen when people come together

Thank You, Amsterdam

A big thank you to everyone we met throughout the week – partners, contributors, customers and the broader cloud native community.

We’re heading home with new ideas, new connections, and a lot of momentum.

See you next year in Barcelona!

Markus Speth

Marketing, Communications, People

Contact us

Our team of experts is available for you. In case of emergency also 24/7.

Contact us
General Press

VSHN Wins Red Hat Partner Award 2025 for Platform Modernization

12. Mar 2026

On March 10, 2026, at the Red Hat Switzerland Partner Day 2026 in Zurich, VSHN AG received the Red Hat Partner Award 2025 for “Platform Modernization of the Year.”

The award recognizes VSHN’s joint work with Health Info Net AG (HIN) to modernize one of the most important digital infrastructures in the Swiss healthcare ecosystem.

Supporting the backbone of digital healthcare

For almost thirty years, HIN has been at the forefront of digitalizing Swiss healthcare. The organization provides secure digital services such as encrypted @hin.ch email addresses for healthcare professionals and organizations including doctors, hospitals, pharmacies, and authorities across Switzerland.

Today, more than 50,000 healthcare professionals rely on HIN services, and the network connects over 90% of relevant actors in the Swiss healthcare system. This makes HIN an essential part of the country’s healthcare communication ecosystem.

Operating such a platform requires the highest standards of security, reliability, and scalability, as sensitive healthcare data and critical communication depend on it.

Building on a proven foundation

As HIN’s digital services continued to evolve, the underlying infrastructure increasingly reflected an earlier stage in the organization’s technical development. The existing environment, built around dedicated physical servers and long-term provider relationships, had proven reliable over many years.

At the same time, HIN saw the opportunity to complement this stable foundation with greater flexibility, standardization, and modern operating models.

To address this, HIN launched Project Phoenix – an initiative inspired by the principles of The Phoenix Project book – with the goal of reinventing its IT infrastructure and enabling a more agile and resilient organization.

The guiding principles of the project included:

  • GitOps and traceability, enabling a single, well-managed source of truth for configuration and infrastructure changes
  • A dual-vendor strategy to avoid vendor lock-in across infrastructure layers
  • A security-first architecture prioritizing privacy, compliance, and data protection
  • Standardization and scalability through open technologies
  • Automation and iterative improvement to increase operational efficiency
  • Faster time-to-market for new digital healthcare services

A strategically important part of the transformation is the planned implementation of the Secure Swiss Health Network (SSHN) based on the SCION Internet architecture, a next-generation networking architecture designed to provide highly available and secure communication paths.

A cloud-native platform for the future

To bring this vision to life, HIN partnered with VSHN to design and deploy a modern cloud-native platform.

The platform is built on Red Hat OpenShift, a Kubernetes-based container platform that enables scalable application deployment and modern DevOps workflows.

As part of this platform, HIN uses Airlock Microgateway to secure web applications and APIs running on OpenShift. Airlock Microgateway implements the Kubernetes Gateway API and provides application-level protection directly within the cloud-native platform. This supports HIN’s security approach by defining security policies as code and operating them according to GitOps principles.

An important aspect of the platform architecture is a modern security approach based on the principles of Zero Trust and Defense in Depth. Unlike traditional perimeter-based network security models that rely primarily on a central firewall, a Zero Trust approach leads to much stronger network microsegmentation and therefore a more distributed security model.

At HIN, the infrastructure is separated into public and private environments, while the private networks are further segmented wherever possible using Kubernetes Network Policies.

This layered security architecture means that a potential attacker would first have to bypass multiple protection layers and then authenticate across different components using mechanisms such as OIDC or certificates. Even in the unlikely event of a successful breach, segmentation ensures that access would be limited to a specific zone rather than the entire platform.

To ensure long-term flexibility and avoid dependence on a single provider, the platform follows a dual-vendor cloud strategy and runs across two European cloud providers:

  • cloudscale.ch, a Swiss cloud provider specializing in sovereign infrastructure
  • Exoscale, a European cloud provider with data centers across Europe and strong privacy and compliance standards

This architecture allows HIN to operate a modern platform while maintaining independence and long-term flexibility in its infrastructure choices.

The results

The platform transformation delivered several important improvements for HIN:

  • Rapid deployment and scalability for applications
  • Web application and API protection using Airlock Microgateway, a Kubernetes Gateway API implementation
  • Enhanced security and compliance aligned with Swiss healthcare regulations
  • Operational efficiency through automation and reduced manual processes
  • A cultural shift toward DevOps, enabling continuous improvement and innovation

By combining cloud-native technologies with strong security and compliance principles, HIN is now well positioned to support the evolving needs of the Swiss healthcare sector.

Recognition from Red Hat

Sandhya Prabhu (Red Hat) & Tania Vonarburg-Romero (VSHN)

The Red Hat Partner Award for Platform Modernization of the Year recognizes projects that demonstrate how open technologies and modern platforms can successfully transform critical IT environments.

At the event in Zurich, Red Hat recognized several Swiss and international partners for projects implemented using Red Hat technologies across areas such as automation, hybrid cloud, virtualization, and platform modernization.

Receiving this award together with HIN highlights the impact that modern DevOps practices and open platforms can have in sectors where security, trust, and reliability are essential.

A strong ecosystem

Projects of this scale are only possible through collaboration. The modernization of HIN’s platform brought together technology providers, cloud infrastructure partners, and platform engineering expertise.

The project is also an example of the Open Sovereign ecosystem, where organizations collaborate to build secure, open, and sovereign digital infrastructure for critical sectors such as healthcare.

Want to learn more?

If you would like to explore the project in more detail, read the full HIN success story, where we explain the platform architecture, transformation journey, and collaboration behind the modernization of Switzerland’s healthcare communication infrastructure.

👉 Read our Success Story with HIN

Thank you

A big thank you to the teams at HIN, Red Hat, and everyone involved in this project.

We are proud to support platforms that play such an important role in Switzerland’s digital infrastructure and look forward to continuing this journey together.

Markus Speth

Marketing, Communications, People

Contact us

Our team of experts is available for you. In case of emergency also 24/7.

Contact us
Events General Tech

Cloud Native Computing Switzerland Meetup – March 2026 Recap

10. Mar 2026

On March 10, the Cloud Native Computing Switzerland Meetup Community gathered again at the VSHN Tower in Zürich for an afternoon of technical talks, discussions, and community exchange.

With more than 3,000 members in the meetup group, the CNC Switzerland community continues to bring together platform engineers, DevOps practitioners, architects, and open-source enthusiasts from across the Swiss cloud-native ecosystem.

The March edition featured four talks covering topics from Kubernetes security and networking to platform engineering and MLOps.

Opening and Community Updates

Aarno Aukia and Patrick Mathers – VSHN

The meetup kicked off with a short welcome and community update by the organizers. As always, the CNC Switzerland meetup follows a few important principles:

  • All talks are technical and open-source focused
  • No product or sales pitches
  • Talks are held in English
  • Speakers from diverse backgrounds are strongly encouraged

These principles help keep the meetup a true technical community event rather than a marketing stage.

TLS Hot Reload in Kubernetes

Janne Kataja – SIX

Janne Kataja from SIX explained how applications can implement hot reloading of TLS certificates, allowing certificates stored in Kubernetes Secrets to be updated without restarting pods.

Instead of forcing service restarts during certificate renewals – which can introduce downtime and operational risk – hot reload mechanisms detect changes in mounted secret volumes and reload certificates dynamically.

This approach enables:

  • seamless certificate rotation
  • higher availability
  • the use of shorter-lived certificates for improved security

The talk demonstrated how relatively small architectural decisions can significantly improve reliability and operational resilience.

Application-Centric Platforms with OAM and KubeVela

Raffael Klingler – AXA Schweiz

The second session explored a topic that is gaining traction across many organizations: platform engineering and internal developer platforms.

Raffael Klingler from AXA introduced the Open Application Model (OAM) and how it shifts the focus from Kubernetes infrastructure toward application-centric definitions.

Instead of writing complex Kubernetes manifests, developers define applications using modular building blocks. These definitions are then rendered into deployable infrastructure resources using KubeVela.

The talk showed how this approach allows organizations to:

  • standardize application deployment patterns
  • reduce Kubernetes complexity for developers
  • integrate cloud services and GitOps workflows

As more companies build internal developer platforms, models like OAM illustrate how Kubernetes can become more accessible and developer-friendly.

DevOps for AI: Running ML in Production with Kubeflow

Fabrizio Lazzaretti (Wavestone) & Marco Crisafulli (enki)

AI is everywhere right now, but turning machine learning experiments into reliable production systems remains difficult.

Fabrizio Lazzaretti and Marco Crisafulli explored how MLOps practices and Kubeflow help bridge the gap between data science experimentation and production-grade systems.

The session demonstrated how Kubeflow enables:

  • reproducible ML pipelines
  • collaboration between teams
  • automated training workflows
  • integration with the broader CNCF ecosystem

Using a real end-to-end example, the speakers showed how organizations can move from ad-hoc AI experiments to repeatable, scalable ML platforms running on Kubernetes.

The talk highlighted a key insight: AI systems still need strong DevOps foundations.

Bye-bye Ingress-NGINX – Hello Gateway API

Urs Zurbuchen – Airlock

The final talk addressed a major architectural shift happening in the Kubernetes networking ecosystem.

Urs Zurbuchen from Airlock explained why the traditional Ingress model – often powered by the NGINX Ingress Controller – is reaching its limits.

Many Kubernetes users have experienced challenges such as:

  • configuration complexity
  • heavy reliance on annotations
  • security issues in older controller implementations

The emerging Gateway API aims to address these limitations with a more structured and extensible networking model.

The talk walked through:

  • the architectural improvements of Gateway API
  • why it is becoming the future standard
  • migration considerations for existing Kubernetes clusters

For many attendees, this session provided a helpful overview of where Kubernetes networking is heading next.

Networking and Apéro

After the talks, participants stayed for networking and the traditional Swiss meetup apéro, continuing discussions about Kubernetes, platform engineering, and the rapidly evolving cloud-native ecosystem.

Meetups like these highlight the strength of the Swiss cloud-native community: engineers from different companies sharing real-world experiences, lessons learned, and open-source solutions.

Watch the Talks

The sessions from this meetup will be published on the VSHN TV YouTube channel.

Subscribe to stay notified when the recordings become available.

Join the Community

The Cloud Native Computing Switzerland Meetup welcomes engineers, architects, and developers interested in cloud-native technologies and open source.

If you would like to present a talk or share your project, submit your proposal here.

We look forward to seeing you at the next meetup!

Markus Speth

Marketing, Communications, People

Contact us

Our team of experts is available for you. In case of emergency also 24/7.

Contact us