Choose hosting provider

[reinkrul]

1. Given our requirements and hosting provider options, choose one
2. Get consent from Kring Techniek

[reinkrul]

EU Cloud Provider Scoring

Workload: one test environment. Knooppunt + embedded Nuts node, HAPI FHIR, sandbox app, NVI mock, Mitz mock, LRZA as a HAPI partition. ~6 GB RAM, ~1.5 vCPU. Config priced: 2 × 2vCPU/8GB nodes, 1 LB, 1 small managed Postgres, ~50 GB block storage, modest log ingest. Purpose: a decision paper. Four candidates clear every requirement; the team picks one and builds on it. No trial — the environment is Terraform plus Flux on one cluster, so switching later is about a day's work, which is why this doesn't warrant a paid comparison. Key evidence: Formelio evaluation, nuts-knooppunt #537 — hands-on trial of OVH, Scaleway, Exoscale, Azure. Its must-haves (audit rights, ISO 27001, encryption at rest, node repair) are stricter than ours, so its exclusions don't carry over.

✅ met · ⚠️ caveat · ❌ not met. Costs are estimates for the config above; only the OVHcloud figures come from a hands-on trial.

Provider	EU	K8s	Logs	PG	TF	IAM	OTEL	Cost	Status
STACKIT	✅	✅	✅	✅	✅	✅	✅	€90–200	Candidate
IONOS	⚠️	✅	✅	✅	✅	⚠️	✅	€85–120	Candidate
OVHcloud	✅	✅	✅	✅	✅	⚠️	❌	€100–130	Candidate
Scaleway	✅	✅	✅	✅	✅	✅	✅	~€95	Out: support, 2 accounts
Exoscale	⚠️ CH	✅	✅	✅	✅	✅	~	€100–150	Blocked: sovereignty
T Cloud Public	✅	✅	✅	✅	✅	✅	~	€120–170	Out: Huawei stack
Cyso Cloud	✅	✅	❌	⚠️ beta	⚠️	❌	❌	~€75+	Out: 3 musts unbuilt
Hetzner	✅	❌	❌	❌	✅	⚠️	❌	~€25	Baseline only

Action: confirm the two-step revocation is acceptable to whoever owns access management, and get the contracting entity right at signup.

_{Logging · IAM SSO revocation · DBaaS PG · PG API · rel. notes Mar · Jan · Jun}

Scaleway — out on support, corroborated

Scores best on paper: Cockpit is OTEL-compatible (Grafana/Loki/Mimir/Tempo), IAM is well-regarded, TF provider is the best of the bunch. Free mutualized control plane — Formelio's €131 line was the HA tier, sized for production, and doesn't apply to us.

Disqualifier: Formelio found them highly unresponsive on support and unable to supply certification/SLA docs on request. The compliance half doesn't transfer (non-requirement); responsiveness does. Public complaints cluster on billing and account lockout, not technical support — which is worse for us, since a suspended account takes the environment down regardless of architecture. Paid tiers improve it. Reasonable fallback if the shortlist disappoints: paid support, corporate card, billing alerts to a monitored shared mailbox.

Exoscale — most complete fit, blocked on one question

Every must is a Terraform resource in one provider: SKS cluster/nodepool, DBaaS pg + opensearch + grafana + thanos, block storage, IAM role/api-key/org-policy. Managed OpenSearch is offered explicitly for log analysis. Postgres is Aiven-powered, from ~€42/mo.

Blocker: Swiss — neither EU nor EEA (EFTA, GDPR adequacy not membership). Ownership runs via A1 Digital / A1 Telekom Austria (unverified). German and Austrian zones exist, so EEA hosting is available even if the company isn't EU-domiciled. Settle whether that counts before spending anything else — if no, everything above is moot. Note SKS control planes are tiered and the higher tier is paid, unlike the free control planes elsewhere in this table.

In scope because Formelio's grounds for excluding it — node repair and encryption at rest — aren't in our list, and key management is an explicit non-requirement.

_{TF reference · sks_cluster · managed OpenSearch · exoscale_database · DBaaS · PG · SKS+DBaaS TF}

T Cloud Public (ex-Open Telekom Cloud) — out on technology stack

Scored the best of any candidate on the requirements: CCE, RDS PostgreSQL, CSS/OpenSearch and a well-maintained official provider, with the strongest IAM in the document — a Keystone endpoint (iam.eu-de.otc.t-systems.com/v3) that is genuinely one identity system across every service, with identity_user_v3 as a first-class Terraform resource.

Out on a policy decision, not a score. The platform runs on Huawei FusionSphere — Huawei's OpenStack distribution — with some hardware also from Huawei. Huawei is a supplier rather than a parent, so this is not the CLOUD Act shape: T-Systems operates the datacentres under German law with no third-country access. But Huawei-supplied software is not an acceptable dependency for this project, which settles it.

Two supporting facts worth recording. T-Systems is diversifying hardware — components come from Huawei and Western manufacturers, all x86 with Intel/NVIDIA, and alternative vendors' servers have passed technical approval for forthcoming expansion — but that addresses hardware, not FusionSphere. And Deutsche Telekom's own new Industrial AI Cloud in Munich is completely separated from and independent of T Cloud Public, with no Huawei products used at that location, built on Kubernetes rather than the OpenStack lineage. Their flagship sovereign platform is being built without the stack this product runs on.

Note also the rename: Open Telekom Cloud is now T Cloud Public. Full core feature parity with US hyperscalers is only targeted for end of 2026.

_{provider repo · cce_node_pool_v3 · release notes · sovereignty claims · hardware sourcing · FusionSphere / kill-switch question · DT drops Huawei for Munich AI cloud · T Cloud Public expansion}

Cyso Cloud — out

Free control plane, Terraform/API/CLI, non-disruptive upgrades, three autoscaling modes, 99.9% SLA, hibernation by button or schedule, Garden Linux, Amsterdam + Frankfurt. Dutch, Gaia-X via CiC.

Fails three musts: no managed logs; DBaaS PostgreSQL in beta (Nov 2025); IAM still being built. Terraform ⚠️ — they advertise support but it's OpenStack with no proprietary layer, so almost certainly the generic OpenStack provider, not a registry Cyso provider. The gaps are roadmap items rather than architectural, but they're not shippable now, which is what matters.

_{managed K8s · public cloud · independent profile · directory}

Hetzner — the honest baseline

Fails managed K8s, logs and Postgres. Included because it prices the requirement list: ~€70–100/month cheaper than the shortlist, under one engineer-hour, in exchange for owning upgrades, etcd backups, node repair and observability. (2026 price rises took CPX up 2.4–2.75x in DE/FI; CX and CAX ~1.3–1.4x, so the old "10x cheaper than AWS" framing is stale.)

It frames the real question. The workload fits on one €15/mo VM with Docker Compose. The other ~€100/mo buys the operating model — managed control plane, managed logs, unified IAM, everything in Terraform. Defensible if the goal is a test environment that behaves like the production one you'll build, and ops practice where breakage is cheap. Bad deal if the goal is just somewhere to run HAPI. This is the only remaining argument for the whole requirements list — state it to whoever approves it.

---

Eliminated

Bunny.net — CDN, no K8s. Leaseweb (bare metal/IaaS), Tilaa (VPS), BIT, Previder (VMware private cloud), Fundaments (VMware sovereign IaaS, reseller channel) — no managed logs, no registry TF provider, no integrated IAM across managed services; where "managed Kubernetes" exists it's a services engagement, which fails API-first by construction. AWS European Sovereign Cloud / Azure + Bleu + Delos — fail EU-sovereign on US parentage regardless of datacentre or local operating subsidiary.

These five Dutch characterisations are the least-verified claims here — the conclusion is solid, but not proven provider by provider.

Gaia-X membership is not a sovereignty signal — AWS, Azure and Google are all members. It certifies portability, not EU ownership.

Not assessed — the gap

SysEleven MetaKube (DE — CNCF-certified on own OpenStack, sells database and observability building blocks alongside clusters; closest to our shape and the one worth checking), UpCloud (FI), Gcore (LU), Elastx (SE), gridscale (DE). Source is a directory, not vendor docs. Nothing here verified.

---

Deployment decisions (settled alongside)

• 2 × 2vCPU/8GB. Two so a drain isn't an outage; 8 GB because the surviving node holds the whole workload (~4 GB pods + ~1.5 GB cluster overhead + ~1 GB system reserve). CPU isn't the constraint.
• Managed Postgres, one instance, two databases (Knooppunt, HAPI) over block storage. Reason is deployment mechanics: a ReadWriteOnce PVC forces strategy: Recreate and downtime every deploy, and an embedded DB means testing a different SQL dialect than production. At N=1, ~€30/mo beats owning CloudNativePG upgrades and restore tests.
• HAPI JVM heap. A 2 GB container limit is not a 2 GB heap — default MaxRAMPercentage is 25%, giving 512 MB and an OOM under real data. Set -XX:MaxRAMPercentage=75 or -Xmx1536m.
• Connection pool. HAPI defaults to ~10. Check the instance's max_connections, set HAPI's pool to 5.
• LRZA as a partition implies multitenancy — a flag, not a container, but budget 2.5 GB for that pod if the partition carries data.
• One ingress controller, not one LoadBalancer per Service. Each LB bills separately everywhere. Most common first-invoice surprise.
• Pull-based GitOps. Flux in-cluster; Actions builds to GHCR and never touches the K8s API. No long-lived kubeconfig in Actions secrets, and it sidesteps the single-OIDC-slot conflict on MKS. SOPS + age for secrets.
• Don't build autoscaling or scheduled shutdowns. Use provider hibernation if it ships (STACKIT, Cyso), else skip — savings are minutes, the automation costs hours.

# EU Cloud Provider Scoring

Workload: one test environment. Knooppunt + embedded Nuts node, HAPI FHIR, sandbox app, NVI mock, Mitz mock, LRZA as a HAPI partition. ~6 GB RAM, ~1.5 vCPU.
Config priced: 2 × 2vCPU/8GB nodes, 1 LB, 1 small managed Postgres, ~50 GB block storage, modest log ingest.
Purpose: a decision paper. Four candidates clear every requirement; the team picks one and builds on it. No trial — the environment is Terraform plus Flux on one cluster, so switching later is about a day's work, which is why this doesn't warrant a paid comparison.
Key evidence: [Formelio evaluation, nuts-knooppunt #537](#537 (comment)) — hands-on trial of OVH, Scaleway, Exoscale, Azure. Its must-haves (audit rights, ISO 27001, encryption at rest, node repair) are stricter than ours, so its exclusions don't carry over.

✅ met · ⚠️ caveat · ❌ not met. Costs are estimates for the config above; only the OVHcloud figures come from a hands-on trial.

Provider	EU	K8s	Logs	PG	TF	IAM	OTEL	Cost	Status
STACKIT	✅	✅	✅	✅	✅	✅	✅	€90–200	Candidate
IONOS	⚠️	✅	✅	✅	✅	⚠️	✅	€85–120	Candidate
OVHcloud	✅	✅	✅	✅	✅	⚠️	❌	€100–130	Candidate
Scaleway	✅	✅	✅	✅	✅	✅	✅	~€95	Out: support, 2 accounts
Exoscale	⚠️ CH	✅	✅	✅	✅	✅	~	€100–150	Blocked: sovereignty
T Cloud Public	✅	✅	✅	✅	✅	✅	~	€120–170	Out: Huawei stack
Cyso Cloud	✅	✅	❌	⚠️ beta	⚠️	❌	❌	~€75+	Out: 3 musts unbuilt
Hetzner	✅	❌	❌	❌	✅	⚠️	❌	~€25	Baseline only

Ordered by fit against the requirements, not by recommendation.

Three providers clear every must and the cost spread between them is under half an engineer-hour a month, so the requirements alone no longer separate them — see Ergonomics below for the unscored criterion that does.

Spread across viable options: ~€50/month = 25 min of engineer time at €120/hr. Cost is not a decision input. Decide on IAM and support.

Not scored per-provider: block storage (universal), GitHub deployment (Flux pulls from Git — our architecture, not a provider feature), update policy (all publish one).

Ergonomics — the unscored criterion

Nothing in the requirement list captures how much friction a platform imposes on
a small ops team: console and docs quality, ecosystem depth, how much of the
platform is reachable without learning its idioms. This matters at €120/hour —
friction is the same currency as everything else — but it is a judgement, not a
requirement, so it is stated here rather than hidden in the scores.

On that axis, roughly: STACKIT good but a smaller ecosystem with
German-leaning docs, OVHcloud mid, IONOS held back by building around its
console rather than its API.

It is an explicit criterion rather than a hidden one because unscored factors have
done all the eliminating here. The requirement list has ruled out none of the
serious candidates; Scaleway (top scorer) and T Cloud Public (best
requirements fit) are both out on grounds that appear nowhere in it.

---

The choice — what each one means

STACKIT. Equal on scoring, no ⚠️, best-documented IAM (IdP + Workload
Identity), and hibernation for idle periods. Choosing it means accepting no
support evidence whatsoever and a cost figure we cannot pin down — price the SKU
before signing.

IONOS. Cheapest, full managed LGTM including Tempo, and 24/7 support included
rather than sold as a tier. Choosing it means three things must be done right at
setup, each fine if you know about it and a problem if you don't:

• Removing a user takes two steps. Take them out of IAM and out of the
  Grafana organisation. Doing only one looks like it worked but doesn't — they
  can still open Grafana and read the logs.
• The console is where the platform lives. IONOS builds around a drag-and-drop
  "Data Center Designer" rather than an API with a console on top. A few things
  appear to be done there rather than in Terraform, so check whether anything in
  the setup can't be scripted.
• Sign with the German company. ionos.com is the US storefront (IONOS Inc.,
  Philadelphia). Use cloud.ionos.com, confirm the contract is with the German
  entity, and pick Frankfurt or Berlin.

OVHcloud. The only candidate where anyone comparable has verified that
support responds and documents arrive. Choosing it means running Tempo and
kube-prometheus-stack in-cluster because OTEL is not native — roughly half a day
of work, one Helm release, a few hundred MB — and testing the IAM story early,
since their own docs contradict each other on it.

The trade in one line: STACKIT and IONOS are better on paper; OVHcloud is the
only one with evidence behind it. Specifications are exactly what misled about
Scaleway.

---

STACKIT — highest score with no open questions

	Why
K8s	SKE. Free control plane, CNCF-certified, Calico or Cilium, auto-repair, autoscaling. Hibernation by schedule — 40–60% saving on an idle test env, zero build effort.
Logs	Observability: Grafana + Prometheus + Thanos + Loki + Tempo, one service.
IAM	Best documented of any candidate. SKE connects to STACKIT IdP (no separate cluster credentials), then standard RBAC. Workload Identity: service account federation + auto token injection, so CLI/SDK reach STACKIT APIs with no manual secrets.
OTEL	Published tutorial ships metrics, logs and traces from SKE to Observability.

Unknowns: support responsiveness (not in Formelio's trial — the largest gap in this document). Cost range is wide because their price list splits shared vs dedicated cores hard: ~€12/mo for 2vCPU/2GB shared, ~€144 for 4vCPU/8GB dedicated. Price the exact SKU before committing.

_{[K8s Engine](https://docs.stackit.cloud/products/runtime/kubernetes-engine/) · [basics](https://docs.stackit.cloud/[product](https://stackit.com/en/products/runtime/stackit-kubernetes-engine)s/runtime/kubernetes-engine/basics/basics/) · product · [OTEL tutorial](https://docs.stackit.cloud/stackit/en/how-to-ship-traces-logs-and-metrics-to-observability-using-opentelemetry-146276901.html) · [monitoring SKE](https://docs.stackit.cloud/de/products/runtime/kubernetes-engine/how-tos/monitor-applications-with-observability/) · [TF log alerts](https://registry.terraform.io/providers/stackitcloud/stackit/latest/docs/guides/ske_log_alerts) · [release notes](https://docs.stackit.cloud/stackit/en/release-notes-23101442.html)}

OVHcloud — only verified support

	Why
K8s	MKS. Free-plan control plane, 100 nodes, 400 MB etcd.
Logs	LDP: OpenSearch + Logstash/Flowgger/Filebeat, Graylog or Grafana UI. Fluent Bit guide for K8s→LDP. Meets the must.
IAM ⚠️	Docs contradict themselves. Product page: no service-specific identifier needed, log in with your OVH identifier. Quick-start and intro guides: managed Graylog accessed with LDP account credentials, plus LDP's own Roles tab. Stale or coexisting — needs a live test.
OTEL ❌	Syslog/GELF lineage. Not OTLP-native. Only a should.

Why it stays: Formelio trialled it — fast, responsive, compliance docs supplied without negotiation. Only first-hand support evidence we have, on the exact axis Scaleway failed.
Cost basis (most reliable figures here): 4vCPU/8GB node €60.88, LB €18.31, storage €0.044/GB, egress free, control plane free. A 2vCPU/8GB shape is lower, so €100–130 is conservative. Apply 3–6 month commitment discounts to the baseline pool.

_{[LDP product](https://www.ovhcloud.com/en/identity-security-operations/logs-data-platform/) · [Service Logs](https://www.ovhcloud.com/en/identity-security-operations/service-logs/) · [LDP intro](https://support.us.ovhcloud.com/hc/en-us/articles/27980753174035-Introduction-to-Logs-Data-Platform) · [quick start](https://support.us.ovhcloud.com/hc/en-us/articles/28017122298771-Quick-Start-for-Logs-Data-Platform) · [Service Logs + LDP](https://support.us.ovhcloud.com/hc/en-us/articles/42281466467987-Introduction-to-OVHcloud-Service-Logs-with-Logs-Data-Platform) · [Grafana](https://docs.ovhcloud.com/en/guides/manage-and-operate/observability/logs-data-platform/using-grafana-with-logs) · [OpenSearch Dashboards](https://docs.ovhcloud.com/en/guides/manage-and-operate/observability/logs-data-platform/opensearch-dashboards)}

IONOS — cheapest, clears every must, full OTEL

	Why
EU ⚠️	German. IONOS SE, Montabaur, Frankfurt-listed. United Internet ~64%. Warburg Pincus exited fully March 2025. The US arm is a sibling — IONOS Inc., Philadelphia — which is the reverse of CLOUD Act exposure, since that needs a US parent. But ownership isn't the whole story: ionos.com is the US storefront, and signing up there makes IONOS Inc. your counterparty. Use cloud.ionos.com, check the contract names the German entity, and pick Frankfurt or Berlin — not Lenexa, Kansas. Passes if you sign correctly.
K8s	Free control plane and clusters; 24/7 support included, not a paid tier.
Logs	Logging Service: Loki + managed Grafana (v12.3 since Mar 2026). Kubernetes is a first-class source. Configurable/unlimited retention.
PG	DBaaS PostgreSQL 14/15/16, HA, 7-day backups, TLS, Terraform/Ansible. No superuser.
IAM ⚠️	Grafana logs in through IONOS IAM SSO. Removing someone takes two steps: restrict them in IAM (controls whether they can sign in) and remove them from the Grafana organisation (clears their roles). Doing one and not the other looks like it worked but doesn't. Not broken — but the safe procedure isn't the obvious one, and getting it wrong fails silently.
API ⚠️	The Data Center Designer — a drag-and-drop console where you compose a "Virtual Data Center" — is the platform's centre of gravity, rather than an API with a console on top. Savings plans, Central Monitoring and logging pipelines read as DCD-or-API in the docs. Inferred from doc phrasing rather than a definitive console-only list, so check whether any setup step can't be scripted.

Action: confirm the two-step revocation is acceptable to whoever owns access management, and get the contracting entity right at signup.

_{[Logging](https://docs.ionos.com/cloud/observability/logging-service/overview) · [IAM SSO revocation](https://docs.ionos.com/cloud/observability/monitoring-service/quick-start/access-metrics-from-platform) · [DBaaS PG](https://docs.ionos.com/cloud/databases/postgresql/overview) · [PG API](https://docs.ionos.com/cloud/databases/postgresql/api) · [rel. notes Mar](https://docs.ionos.com/cloud/release-notes/previous-releases/2026/march-2026) · [Jan](https://docs.ionos.com/cloud/release-notes/previous-releases/2026/january-2026) · [Jun](https://docs.ionos.com/cloud/release-notes/june-2026)}

Scaleway — out on support, corroborated

Scores best on paper: Cockpit is OTEL-compatible (Grafana/Loki/Mimir/Tempo), IAM is well-regarded, TF provider is the best of the bunch. Free mutualized control plane — Formelio's €131 line was the HA tier, sized for production, and doesn't apply to us.

Disqualifier: Formelio found them highly unresponsive on support and unable to supply certification/SLA docs on request. The compliance half doesn't transfer (non-requirement); responsiveness does. Public complaints cluster on billing and account lockout, not technical support — which is worse for us, since a suspended account takes the environment down regardless of architecture. Paid tiers improve it. Reasonable fallback if the shortlist disappoints: paid support, corporate card, billing alerts to a monitored shared mailbox.

Exoscale — most complete fit, blocked on one question

Every must is a Terraform resource in one provider: SKS cluster/nodepool, DBaaS pg + opensearch + grafana + thanos, block storage, IAM role/api-key/org-policy. Managed OpenSearch is offered explicitly for log analysis. Postgres is Aiven-powered, from ~€42/mo.

Blocker: Swiss — neither EU nor EEA (EFTA, GDPR adequacy not membership). Ownership runs via A1 Digital / A1 Telekom Austria (unverified). German and Austrian zones exist, so EEA hosting is available even if the company isn't EU-domiciled. Settle whether that counts before spending anything else — if no, everything above is moot. Note SKS control planes are tiered and the higher tier is paid, unlike the free control planes elsewhere in this table.

In scope because Formelio's grounds for excluding it — node repair and encryption at rest — aren't in our list, and key management is an explicit non-requirement.

_{[TF reference](https://community.exoscale.com/reference/terraform/) · [sks_cluster](https://community.exoscale.com/reference/terraform/provider/resources/sks_cluster/) · [managed OpenSearch](https://community.exoscale.com/community/dbaas/managed-opensearch) · [exoscale_database](https://registry.terraform.io/providers/exoscale/exoscale/latest/docs/resources/database) · [DBaaS](https://www.exoscale.com/dbaas/) · [PG](https://www.exoscale.com/dbaas/postgresql/) · [SKS+DBaaS TF](https://www.exoscale.com/syslog/sks-dbaas-terraform/)}

T Cloud Public (ex-Open Telekom Cloud) — out on technology stack

Scored the best of any candidate on the requirements: CCE, RDS PostgreSQL, CSS/OpenSearch and a well-maintained official provider, with the strongest IAM in the document — a Keystone endpoint (iam.eu-de.otc.t-systems.com/v3) that is genuinely one identity system across every service, with identity_user_v3 as a first-class Terraform resource.

Out on a policy decision, not a score. The platform runs on Huawei FusionSphere — Huawei's OpenStack distribution — with some hardware also from Huawei. Huawei is a supplier rather than a parent, so this is not the CLOUD Act shape: T-Systems operates the datacentres under German law with no third-country access. But Huawei-supplied software is not an acceptable dependency for this project, which settles it.

Two supporting facts worth recording. T-Systems is diversifying hardware — components come from Huawei and Western manufacturers, all x86 with Intel/NVIDIA, and alternative vendors' servers have passed technical approval for forthcoming expansion — but that addresses hardware, not FusionSphere. And Deutsche Telekom's own new Industrial AI Cloud in Munich is completely separated from and independent of T Cloud Public, with no Huawei products used at that location, built on Kubernetes rather than the OpenStack lineage. Their flagship sovereign platform is being built without the stack this product runs on.

Note also the rename: Open Telekom Cloud is now T Cloud Public. Full core feature parity with US hyperscalers is only targeted for end of 2026.

_{[provider repo](https://github.com/opentelekomcloud/terraform-provider-opentelekomcloud) · [cce_node_pool_v3](https://registry.terraform.io/providers/opentelekomcloud/opentelekomcloud/latest/docs/resources/cce_node_pool_v3) · [release notes](https://docs.otc.t-systems.com/releasenotes/terraform-provider-opentelekomcloud/) · [sovereignty claims](https://www.open-telekom-cloud.com/en/benefits/sovereignty) · [hardware sourcing](https://www.open-telekom-cloud.com/en/blog/benefits/the-secure-cloud-made-in-europe) · [FusionSphere / kill-switch question](https://european.cloud/provider/open-telekom-cloud/) · [DT drops Huawei for Munich AI cloud](https://www.lightreading.com/ai-machine-learning/deutsche-telekom-breaks-with-huawei-and-us-big-tech-in-new-clouds) · [T Cloud Public expansion](https://www.telekom.com/en/media/media-information/archive/t-cloud-public-sovereign-power-1101542)}

Cyso Cloud — out

Free control plane, Terraform/API/CLI, non-disruptive upgrades, three autoscaling modes, 99.9% SLA, hibernation by button or schedule, Garden Linux, Amsterdam + Frankfurt. Dutch, Gaia-X via CiC.

Fails three musts: no managed logs; DBaaS PostgreSQL in beta (Nov 2025); IAM still being built. Terraform ⚠️ — they advertise support but it's OpenStack with no proprietary layer, so almost certainly the generic OpenStack provider, not a registry Cyso provider. The gaps are roadmap items rather than architectural, but they're not shippable now, which is what matters.

_{[managed K8s](https://cyso.cloud/services/managed-kubernetes) · [public cloud](https://cyso.cloud/public-cloud) · [independent profile](https://european.cloud/provider/cyso-cloud/) · [directory](https://european-alternatives.eu/product/fuga-cloud)}

Hetzner — the honest baseline

Fails managed K8s, logs and Postgres. Included because it prices the requirement list: ~€70–100/month cheaper than the shortlist, under one engineer-hour, in exchange for owning upgrades, etcd backups, node repair and observability. (2026 price rises took CPX up 2.4–2.75x in DE/FI; CX and CAX ~1.3–1.4x, so the old "10x cheaper than AWS" framing is stale.)

It frames the real question. The workload fits on one €15/mo VM with Docker Compose. The other ~€100/mo buys the operating model — managed control plane, managed logs, unified IAM, everything in Terraform. Defensible if the goal is a test environment that behaves like the production one you'll build, and ops practice where breakage is cheap. Bad deal if the goal is just somewhere to run HAPI. This is the only remaining argument for the whole requirements list — state it to whoever approves it.

---

Eliminated

Bunny.net — CDN, no K8s. Leaseweb (bare metal/IaaS), Tilaa (VPS), BIT, Previder (VMware private cloud), Fundaments (VMware sovereign IaaS, reseller channel) — no managed logs, no registry TF provider, no integrated IAM across managed services; where "managed Kubernetes" exists it's a services engagement, which fails API-first by construction. AWS European Sovereign Cloud / Azure + Bleu + Delos — fail EU-sovereign on US parentage regardless of datacentre or local operating subsidiary.

These five Dutch characterisations are the least-verified claims here — the conclusion is solid, but not proven provider by provider.

Gaia-X membership is not a sovereignty signal — AWS, Azure and Google are all members. It certifies portability, not EU ownership.

Not assessed — the gap

SysEleven MetaKube (DE — CNCF-certified on own OpenStack, sells database and observability building blocks alongside clusters; closest to our shape and the one worth checking), UpCloud (FI), Gcore (LU), Elastx (SE), gridscale (DE). Source is a [directory](https://european-alternatives.eu/category/managed-kubernetes-services), not vendor docs. Nothing here verified.

---

Deployment decisions (settled alongside)

• 2 × 2vCPU/8GB. Two so a drain isn't an outage; 8 GB because the surviving node holds the whole workload (~4 GB pods + ~1.5 GB cluster overhead + ~1 GB system reserve). CPU isn't the constraint.
• Managed Postgres, one instance, two databases (Knooppunt, HAPI) over block storage. Reason is deployment mechanics: a ReadWriteOnce PVC forces strategy: Recreate and downtime every deploy, and an embedded DB means testing a different SQL dialect than production. At N=1, ~€30/mo beats owning CloudNativePG upgrades and restore tests.
• HAPI JVM heap. A 2 GB container limit is not a 2 GB heap — default MaxRAMPercentage is 25%, giving 512 MB and an OOM under real data. Set -XX:MaxRAMPercentage=75 or -Xmx1536m.
• Connection pool. HAPI defaults to ~10. Check the instance's max_connections, set HAPI's pool to 5.
• LRZA as a partition implies multitenancy — a flag, not a container, but budget 2.5 GB for that pod if the partition carries data.
• One ingress controller, not one LoadBalancer per Service. Each LB bills separately everywhere. Most common first-invoice surprise.
• Pull-based GitOps. Flux in-cluster; Actions builds to GHCR and never touches the K8s API. No long-lived kubeconfig in Actions secrets, and it sidesteps the single-OIDC-slot conflict on MKS. SOPS + age for secrets.
• Don't build autoscaling or scheduled shutdowns. Use provider hibernation if it ships (STACKIT, Cyso), else skip — savings are minutes, the automation costs hours.

[reinkrul]

Checking the costs for OVHcloud, STACKIT and IONOS. The setups:

Essentials

• Managed K8s cluster; 2 nodes 2 CPU, 8GB RAM, 50GB SSD
• Postgresql database 5GB SSD
• 1GB attached block storage

Full suite

Essentials, plus:

• OTEL observability stack (ingestion, analytics)
• Log (ingestion, analytics)
  (Log and Metrics 50GB storage)

Estimated costs

• IONOS

  • Essentials: €178
  • Full suite: €220

• STACKIT

  • Essentials: €300
  • Full suite: €369

• OVHcloud

  • Essentials: €110
  • Full suite: €160 without OTEL (not supported), est. total €180 inc. node for OTEL services (Jaeger + UI or ClickHouse)

[reinkrul]

I propose we use OVHcloud mainly for the price aspect, we've got evidence from Formelio that setting up OTEL with ClickHouse on OVHcloud was trivial.

Why not others:

• STACKIT comes out a lot more expensive
• IONOS comes out somewhat more expensive
• Scaleway is cheaper, but their support is very poor (evidence from Gaspar and Edwin)