All decks

Going full arctic circle:
Running ALASCA on open cloud infrastructure & standards.

TECH TALK #38 by ALASCA FOCIS

Image from sysadminday.com

Shows them that you truly appreciate their hard work and dedication

Agenda

1. Which dogfood do you need to eat to run ALASCA?

2. Running on open standards - what worked for us, and what did not

Tofu-based IDM
GitLab CI autoscaler
Woodpecker CI autoscaler
RacStack

3. Open build infrastructure for ALASCA

Von Caro Wedekind - http://foxitalic.de/2014/12/31c3/, CC BY 3.0, Link

Wimmelbild of 31st Chaos Communication Congress

ALASCA projects

The tip of the iceberg

ALASCA Friends

Underneath the surface

Cloud & Heat sponsored us resources in an SCS-compatible IaaS environment, a.k.a. dd8a 🙏 -> we created „Terms of Use” form to get access -> Apply now! via hello@alasca.cloud
Friends, configured over identity management repository
- FOCIS (Tarook + Yaook)
- Turing e.V.
- fediway
- FOSSGIS e.V.
- Elbforge.org
- SCOMB - SONiC Community Build
- Yake
- Pacifico

ALASCA Tools and Services

The Abyss

Do you want to have hedgedocs? Sure. — TSC, Projects & FOCIS meeting · That escalated quickly...

is Hedgedoc up? -> install status monitor (Uptime Kuma)
is Hedgedoc secure? -> install Traefik/Let's Encrypt
how to share admin password -> install password manager (VaultWarden)
how to login in password manager -> install identity provider (Keycloak)
are service up to date -> install renovate
what if service breaks -> configure S3 backup & restore
document everything -> configure MkDocs at docs.alasca.cloud -> store IaC repo

ALASCA Tools and Services

The Abyss II

provide Thanos Helm chart via charts.alasca.cloud/thanos
GitLab Runner Manager (active/active) (see Part II)
multi-forge Woodpecker CI (WIP) (see Part II)
Other stuff to manage:
- WIP: Grafana + Prometheus
- OpenStack Billing Dashboard (see Part II)
- SCS: SIG Standardization/Certification
- Public issue board
- SCS compliance monitor
- alasca.cloud Wordpress, 19 mailing lists via mailman3, DNS entries, ALASCA Summit, Tech talks, Podcast, Mastodon, LinkedIn, Youtube, Marketing MeetUp and so on...

<!--
 SPDX-FileCopyrightText: 2026 ALASCA e.V. <hello@alasca.cloud>

SPDX-License-Identifier: Apache-2.0
        -->

Running on open standards

## Tofu-based IDM

_Goal:_ Transparent and auditable management of identities and resource allocation on our SCS cloud domain, across ALASCA, FOCIS & Community Resources.

_What does SCS offer:_ `DomainManager` role has to be available ([SCS-0302](https://docs.scs.community/standards/scs-0302-v1-domain-manager-role)).

_Solution:_ Open source IaC approach: [Tofu file](https://gitlab.com/alasca.cloud/infra/identity/-/blob/main/main.tf?ref_type=heads) that uses the OpenStack provider.

---

Tofu-based IDM

## What worked: projects & groups

```text
        # Projects
        resource "openstack_identity_project_v3" "prod" {
          name      = "prod"
          domain_id = var.alasca_id
        }

# Groups
        resource "openstack_identity_group_v3" "focis" {
          name        = "focis"
          description = "Members of the FOCIS initiative"
          domain_id   = var.alasca_id
        }
        ```

---

Tofu-based IDM

## What worked: roles & users

```text
        # Group roles
        resource "openstack_identity_role_assignment_v3" "focis_is_prod_member" {
          group_id   = openstack_identity_group_v3.focis.id
          project_id = openstack_identity_project_v3.prod.id
          role_id    = data.openstack_identity_role_v3.member.id
        }

# Users
        resource "openstack_identity_user_v3" "danielgerber" {
          name      = "daniel.gerber"
          domain_id = var.alasca_id
          enabled   = true
        }
        ```

---

Tofu-based IDM

## What doesn't work

### Quota allocation

`DomainManager` can't set or read quotas, OpenStack has no domain level quotas

➡ we request quotas for each project via mail to our CSP & track them in a spreadsheet :(

---

Tofu-based IDM

## What doesn't work

### Usage monitoring or "billing"

`DomainManager` can't read quota usage 
 & SCS has no requirements for a pricing or billing solution

➡ we use [RacStack](https://gitlab.com/pacificodigitalexplorations/raclette-applications/openstack-billingdashboard) and have a dedicated user in projects that opt-in

CI Infrastructure

ALASCA needs to provide resources for:

US governance

GitHub

Yake
Arko (moving to GitLab)

US governance

GitLab

EU governance

Codeberg/Forgejo

IXpect

GitLab Runner Manager

Scale „To infinity and beyond!”

similar to GitHub Actions but for Gitlab
Why? isolated, throw-away VMs/runners for ALASCA Community (more security)
GitLab Runner instance group autoscaler provides fleeting framework
fleeting framework: is a library that GitLab Runner uses to provide a plugin-based abstraction for a cloud provider’s instance groups.
(Sarcastic) question: Which cloud providers are supported officially?
AWS, Google Cloud, Azure
- (Even more sarcastic) question: Which community providers are documented officially?
  Yes, VMware.

GitLab Runner Manager

ALASCA FOCIS setup

we found another community project by Sardina Systems, fleeting-plugin-openstack

                flowchart LR
                  gl[GitLab] -- pending jobs --> mgr["GitLab Runner Manager<br />(docker-autoscaler + fleeting)"]
                  mgr -- create / destroy VMs --> os[(SCS OpenStack project)]
                  os -- fresh, single-use VM per job --> job[CI job runs isolated]

What does SCS/dd8a offer? Standardized set of OpenStack APIs, flavors and images
- Image upload via Glance MUST be allowed based on a fair-use policy. (scs-0104)
- Mandatory flavors (scs-0103)
- Mandatory images: SCS is missing image for CI jobs (i.e. flatcar)

GitLab Runner Manager

ALASCA FOCIS setup

Issues with upstream project
- project is ini file based and therefore hard to configure dynamically
- resource referenced by UUID (change after updates)
- manually provide and maintain build image
- not properly maintained -> move to ALASCA (supported by Helmholtz and Syseleven? 🤞)
How to DoS your cloud:
- configure runners to use ephemeral storage & start a bunch of runners 🏃‍♂️
- 🔥 No valid host was found. There are not enough hosts available. 🔥
source code of our extension is found at ALASCA GitLab group
All you need is: GitLab Runner Token, OpenStack project & application credential, Host with docker -> docker compose up -d

Get your

OWN RUNNER!

hello@alasca.cloud

<!--
 SPDX-FileCopyrightText: 2026 ALASCA e.V. <hello@alasca.cloud>

SPDX-License-Identifier: Apache-2.0
        -->

Running on open standards

## Woodpecker autoscaler

_Goal:_ Open up options to leave GitHub & GitLab.

_Problem:_ Woodpecker CI autoscaler does not support OpenStack/SCS.

_Solution:_ Implement an [OpenStack provider](https://github.com/woodpecker-ci/autoscaler/pull/682) during the ALASCA Hackathon.

---

Woodpecker autoscaler

## What worked

![](img/woodpecker-horizon.png)

---

Woodpecker autoscaler

## What worked

![](img/woodpecker-agents.png)

---

Woodpecker autoscaler

## What doesn't work

We tried to use the SCS mandatory image (latest Ubuntu LTS) automatically

_But:_

The filter logic supplied by SCS selected a random snapshot since those inherit all metadata from their original image

➡ we additionally filter out all snapshots

➡ SCS docs or standards [need to be refined](https://github.com/SovereignCloudStack/standards/issues/1259)

Measure what you use

RacStack - Billing Dashboard for OpenStack

Why?
- ALASCA provides community resources and needs to measure them
- FOCIS looked for commercial use-cases : equipping existing heterogeneous cloud infrastructures with efficient monitoring
developed on top of racletteJS 🧀 by pacifico
source code (MIT), issues and documentation can be found at GitLab, discussions in matrix room
needs Keystone, Nova, Gnocchi, Cinder and Neutron
ideal to measure Woodpecker and GitLab CI runners

RacStack - Measure what you use

Features

Measurable OpenStack resources: Instances, Floating IPs, Volumes
Installable via docker compose
Configurable dashboard with charts and tables
Export data to XRechnung and ZUGFeRD
Project -> Customer -> System billing/pricing adjustment for OS resources

Configure your dashboard

Set prices for flavors, IPs and volumes

Get Breakdown of resources

View all resources of a project

Filter resources

Export custom formats

RacStack - Measure what you use

Issues

we have no admin priviliges in dd8a, so we are limited to single project view per RacStack instance -> application credential always project scoped
Metering only draft status within SCS (see scs-04xx) -> each CSP might have a different system
- Possibly adjust SCS IaaS Standards for metering
- Contribution to the debate: Add cloud price publication & quote interface to SCS #738

<!--
 SPDX-FileCopyrightText: 2026 ALASCA e.V. <hello@alasca.cloud>

SPDX-License-Identifier: Apache-2.0
        -->

Open Build Infrastructure for open clouds

## What does operational mean?

_Goal:_ Operational, open cloud infrastructure solutions. 
 You are not free to modify & distribute software if you can't test & build it.

_Case in point:_ The SONiC Community Build

_Solution:_ Improve transparency and reproducibility

Note:

- SONiC problems: Azure registry, build times, lack of features in CE

---

Transparency

## Document the status quo

FOCIS team will _do a test-run to document_ the build process and infrastructure for a project.

➡ _distill & refine guidelines_ on how to do that

➡ _formalize_ them as part of the TSC project guidelines

Note:

- role definitions in parallel
        - outcomes: increase trust, easier infra debugging, improved security & resilience
        - call to action: feedback & best practices

Thank you. Stay in touch.

Web

Website alasca.cloud
Summit 2026 alasca.cloud/alasca-summit-2026
Tech-Talks alasca.cloud/alasca-tech-talks
Podcast alasca.cloud/alasca-opensnac-der-podcast
GitLab gitlab.com/alasca.cloud

Community

Mastodon mastodon.social/@alasca
LinkedIn linkedin.com/company/alasca-cloud
Mailing lists lists.alasca.cloud
Matrix #ALASCA:matrix.org
YouTube youtube.com/@alasca_e.V.

Going full arctic circle:Running ALASCA on open cloud infrastructure & standards.

Shows them that you truly appreciate their hard work and dedication

1. Which dogfood do you need to eat to run ALASCA?

2. Running on open standards - what worked for us, and what did not

3. Open build infrastructure for ALASCA

Wimmelbild of 31st Chaos Communication Congress

The tip of the iceberg

Underneath the surface

The Abyss

The Abyss II

ALASCA needs to provide resources for:

GitHub

GitLab

Codeberg/Forgejo

Scale „To infinity and beyond!”

ALASCA FOCIS setup

ALASCA FOCIS setup

RacStack - Billing Dashboard for OpenStack

Features

Issues

Thank you. Stay in touch.

Web

Community

Going full arctic circle:
Running ALASCA on open cloud infrastructure & standards.