Deep Dives on Empowering European Innovation

Understanding Safespring Kubernetes Engine if you usually run Kubernetes yourself

Mon, 30 Mar 2026 00:00:00 +0000

If you already know how to run Kubernetes yourself, the useful question is not whether a managed service can create a cluster. The useful question is how the service is shaped, where the boundary sits, and which parts of the platform it already solves well.

We have written quite a bit lately about building Kubernetes platforms with Talos, OpenStack, Cluster API, Cinder CSI, and modern traffic management. That is one side of the picture.

Automating Windows Server Hardening on Safespring Compute: From Launch to Locked Down

Tue, 17 Mar 2026 00:00:00 +0000

When you spin up a Windows Server instance in a cloud environment like Safespring Compute, you get a blank slate, no password, no SSH, no remote access at all.

This post walks through the full automation chain: using cloudbase-init to bootstrap the instance at first boot, then running an Ansible playbook to apply a security baseline.

The result is a fully hardened Windows Server you can provision in one shot, hands-off, from the OpenStack CLI.

Run a local LLM on Safespring GPU infrastructure

Tue, 16 Dec 2025 00:00:00 +0000

Running an LLM locally does not have to be complicated. This post shows how to turn a GPU-enabled Ubuntu 24.04 instance in Safespring into a practical AI workstation using NVIDIA drivers, Ollama, and Open-WebUI.

We’ll start from a fresh instance, install the recommended NVIDIA server driver, verify GPU acceleration with nvidia-smi, pull a few models, and finish by deploying Open-WebUI in Docker so you can chat in your browser. Everything stays on your own instance, and we’ll use SSH forwarding for safe access.

Deploy Talos Kubernetes on OpenStack with Cluster API

Thu, 12 Jun 2025 00:00:00 +0000

A step-by-step guide to declaratively provision, configure, and manage Talos Linux Kubernetes clusters on Safespring’s OpenStack infrastructure using CAPO and ClusterResourceSets.

In this article we want to take a few steps further our investigation into Talos Linux and how we can make use of it in Safespring Compute Infrastructure (OpenStack), and at the same time have a more in depth exploration of the automate installation and make use of Kubernetes Cluster API.

Validate and upgrade Talos Linux Kubernetes on OpenStack

Wed, 09 Apr 2025 00:00:00 +0000

Use this guide to validate a Talos Linux Kubernetes cluster on OpenStack, confirm Cilium and Cinder CSI behavior, and run repeatable upgrade operations for both Talos OS and Kubernetes.

In a previous article we started to explore Talos Linux and what that could mean for us, and how we can automate the installation on Safespring OpenStack, but we wanted to go a few steps further in our investigation and look into confirming two more aspects:

Bootstrap Talos Linux Kubernetes on OpenStack

Mon, 03 Mar 2025 00:00:00 +0000

This guide walks through the first steps of bootstrapping Talos Linux Kubernetes on OpenStack, with a focus on automation, security and repeatable platform operations.

When it comes to container orchestration, Kubernetes is the de facto standard. And there are many different flavors of Kubernetes distributions and ways of provisioning them. So we started to explore what Talos Linux could mean for us.

Things we wanted to have answered while doing that:

Is it possible to replace VMware? There might be...

Thu, 20 Feb 2025 00:00:00 +0000

With Broadcom's acquisition of VMware, many companies and organizations that have built their infrastructure on VMware have faced an unpleasant surprise: a new subscription-based model and overall higher prices.

TL;DR

Broadcom’s acquisition of VMware has sparked concerns over subscription-based pricing and higher costs.
While VMware excels at on-premises virtualization, Safespring offers a cloud-native alternative based on OpenStack (virtualization), Ceph (storage), and containers.
It’s not a direct drop-in replacement; instead, Safespring enables modernization of IT infrastructure with tools for network security, resilient services (via Elastic IPs and Server Groups), and flexible VPN options like WireGuard.
Built on open-source technologies, Safespring’s solutions avoid lock-in, empower administrators with hands-on control, and ensure predictable, transparent pricing over time.

Let's talk

The VMware Offering

For more than 20 years, VMware has been the most successful player in the market for virtualization solutions. VMware has offered flexibility (through virtualization) and other features and products to ease the workload of system administrators. Through good design choices, many customers have been able to migrate old physical systems directly into VMware. With robust monitoring, backend storage, and software-defined networking (SDN) solutions, VMware has enabled systems to be set up in a resilient and redundant way, requiring minimal changes to the actual software configuration of the systems. Additionally, VMware includes built-in network security features.

Future-Ready Automated Services in the Higher Education Sector

Thu, 21 Nov 2024 00:00:00 +0000

The higher education sector is standing at the crossroads of technology. Innovation must go on to meet new demands, but cost optimization and an ever-growing need for flexibility and security can be hard to deal with.

During a recent webinar with SIKT, “Virtualization and IT Infrastructure in the Higher Education Sector,” I had the opportunity to delve into how automation, open standards, and digital sovereignty can reshape IT operations for universities and colleges.

Escaping the VMware trap?

Fri, 30 Aug 2024 00:00:00 +0000

Broadcom's acquisition of VMware has had significant impacts on customers, causing concern and prompting some to consider alternatives. This post will address these challenges and describe one solution to the challenges.

These changes, after Broadcom’s acquisition of VMware, have led to higher long-term costs for many customers, especially smaller businesses that may see dramatic increases in their annual renewal fees.

Key effects of Broadcom's acquisition of VMware

Self-Service Access to Open Source Infrastructure using NATS & Huma

Fri, 24 May 2024 00:00:00 +0000

I recently had the opportunity to present at OpenInfra Day Sweden 2024, and I'm excited to share the insights and developments from our team at Safespring.

Over the past three months, we’ve been working on a new tool designed to enhance self-service access to open source infrastructure for our B2B and European research community customers. This tool leverages the power of NATS and Huma technologies.

Safespring’s Mission Safespring aims to become the platform of choice for European cloud computing. We are dedicated to providing secure, compliant cloud services across multiple data centers in the Nordics, including Oslo, Stockholm, and Luleå. Our offerings adhere to GDPR and European security standards, ensuring top-notch security for our users.

Kubernetes Project Onboarding Guide

Mon, 08 Apr 2024 00:00:00 +0000

Welcome to Project Onboarding - a transformative approach to simplifying namespace management in Kubernetes for multi-tenant environments.

This tool is crafted for IT architects, DevOps engineers, and technical teams eager to integrate company-specific workflows into Kubernetes, fostering a seamless, efficient namespace management system. Project Onboarding stands at the intersection of innovation and simplicity, offering a robust solution to the complexities often encountered in Kubernetes namespace management.

GitHub repository

Install the OpenStack Cinder CSI driver for Kubernetes

Wed, 13 Mar 2024 00:00:00 +0000

Have you configured your OKD or OpenShift cluster with the platform option set to "none" and, as a result, are missing the OpenStack Cinder CSI Driver Operator?

This guide is designed to help you effortlessly integrate the Cinder CSI Volume Provisioner into your OKD or OpenShift cluster. It’s designed to streamline the process, making the integration seamless and hassle-free.

Moreover, this guide is not exclusive to OpenShift or OKD environments; it can be easily adapted for use in vanilla Kubernetes setups with a simple modification. A key highlight for OKD and OpenShift users is the inclusion of Security Context Constraints (SCC) cluster role bindings in the Helm chart’s templates directory. This critical feature enables the Cinder CSI pods to run with privileged access, aligning them with OpenShift’s security practices and ensuring their optimal functionality within your cluster’s security framework.

Automating cloud resources with Python and Pulumi: Separating config from code

Tue, 19 Sep 2023 00:00:00 +0000

In infrastructure code (and other code, too) it is a good practice to separate the program logic from its input data (configuration). That way, in order to change the state of our infrastructure, we only need to change the input data and not the program unless the logic of the program changes.

In the previous blog post, we went through a basic setup of Pulumi with the Python template for using it to manage OpenStack resources in Safespring. This is a good starting point to understand the basics of how one can use Python together with Pulumi to declaratively manage infrastructure resources without having to write all resource graph management from the ground and up, which, of course, also would be possible with Python or any modern programming language for that matter.

Automating cloud resources with Python and Pulumi: Basic provisioning

Mon, 11 Sep 2023 00:00:00 +0000

Efficient consumption of cloud services is all about automating the up and down-scaling of resources according to the ever-changing needs. The list of tools, their properties and their fitness for the purpose can be daunting.

On top of that comes the changing landscape in licensing and subscription, sometimes with astonishing effects on your existing cloud strategy, recently exemplified by Hashicorp’s unexpected license change to the Business Source License (BSL). In this landscape, we must always be prepared to adapt and change, thus, it is good to have acquaintance with both old established tools and some alternatives. This post is the first in a series on how to utilize Pulumi to automate service consumption towards the Safespring cloud APIs.

Creating a multi-cloud web service from scratch

Wed, 07 Jun 2023 00:00:00 +0000

Explore the power of infrastructure as code (IAC) with this guide on creating a scalable web application using multiple OpenStack sites. Learn how to utilize Terraform for infrastructure provisioning, Ansible for system configuration, and how these tools, in combination with DNS round-robin, can offer a dynamic and scalable solution for your web services.

In previous posts, we have shown the power of combining Terraform for infrastructure provisioning and Ansible for configuring operating systems on the instances in the infrastructure. In this blog post, we take it one step further. We will show a minimal example of how to scale up web service backends across multiple sites and use an API programmable DNS servcie (Gandi) to maintain A records for those backends, effectively scaling the service by means of DNS round-robin (RR).

Automating backup node enrollment with Cloutility API-client

Wed, 26 Apr 2023 00:00:00 +0000

In this tutorial, we will explore Safespring's cloutility-backup-client library written in Go. We will write a small, easily deployable, tool to automate the enrollment procedure of backup nodes and take a deeper look at a few of the methods available in the cloutility-api-client library.

Creating an open-source backup client library

Sun, 23 Apr 2023 00:00:00 +0000

At Safespring, we are passionate about open source technologies. Our platform relies on multiple open source products, and we are committed to giving back to the community whenever possible.

Sometimes, however, we find ourselves in need of a solution that does not yet exist. As was the case when we wanted to create a tool to simplify the enrollment process for backup clients to our backup solution.

Safesprings backup solution is based on IBM Spectrum Protect fronted by Auwau’s Cloutility software. This combination provides a powerful enterprise-grade backup solution and Cloutility provides both customer portal and a rich API. However, we were unable to find an existing client library that could be used to consume the Cloutility API.

Important update regarding the EOL of the legacy platform in STO1

Tue, 18 Apr 2023 00:00:00 +0000

As the legacy platform in STO1 is reaching its end of life, we hope that you're getting along with the migration to the new platform.

According to our project tracking, most of you have already migrated to the new platform or are in the progress of doing so.

For those who haven’t started yet, we would like to encourage you to do so as soon as possible and get in touch with us if you need any assistance. All steps necessary to migrate your instances can be found in our migration guide.

Important Update Regarding Retirement of Legacy Platform in STO1

Thu, 26 Jan 2023 00:00:00 +0000

Dear valued customers, We would like to inform you that our legacy platform in sto1 will be shut down on May 1st.

You will not be able to create new instances on this platform after March 1st 2023 and there will only be best effort support available starting April 1st 2023. These are hard dates that we will be adhering to, so it is important that you take necessary steps to migrate to our new platform.

Useful (perhaps) Openstack API tricks for enabling more automation

Tue, 20 Sep 2022 00:00:00 +0000

Safespring promote as much automation as possible using standard tools like Terraform and Ansible. Sometimes, however, it is necessary to dig one step deeper in order to find some missing pieces of information in order to create a complete automation.

Introduction (Problem statement)

In the Safespring platform, the S3 compatible storage service and the OpenStack based compute service are now integrated. It means that once you have access to the compute platform you also can fetch credentials for accessing the integrated S3 service through the web GUI and/or the command line interface (CLI).

Using a jump host for persistent access to Safespring's APIs

Tue, 06 Sep 2022 00:00:00 +0000

Using a jump host is good practice for increased security and a simple solution when you don’t have a fixed IP-adress but need access to Safespring’s APIs.

Automation tools like Terraform require access to several of OpenStack’s APIs which we’re currently exposing only to whitelisted IPs for security reasons. This is a practice we share with several other small and independent cloud providers like ourselves. With many engineers working remote and not having a fixed IP, submitting a support ticket each time your public IP changes might feel tedious and unnecessary in 2022. However, using a jump host is not only a simple solution to this problem but also good practice for most automation scenarios where security is critical.

Setting up a minimal Kubernetes cluster on Safespring using Kubespray

Mon, 22 Aug 2022 00:00:00 +0000

Kubespray is a comprehensive tool that covers a lot of different use cases. In this post we will focus on the necessary config to install a minimal K8S cluster for test and experiment on Safespring.

Prerequisites

This blog post assumes that you use the open source Terraform CLI. Terraform CLI is just a binary program that you download from the releases page, for your architecture/platform. Here you also find checksums for the files to verify their integrity. There is also the official Terraform documentation.
A basic understanding of Ansible playbooks and inventories is also necessary.
Some basic usage of the OpenStack CLI will also be required.

Kubespray introduction

Kubespray is a composition of Ansible playbooks, inventory, provisioning tools, and domain knowledge for generic OS/Kubernetes clusters configuration management tasks. It is widely used, has a lot of flexibility using parameters and is actively maintained.

From zero to continuous compliance with Terraform, Ansible and Rudder

Wed, 29 Jun 2022 00:00:00 +0000

This blog post will look at how we can build even further on previously demonstrated concepts to create sets of servers that are continuously monitored and kept in compliance using Rudder, a state of the art configuration management tool.

update

Updated to fix an inconsistency on 2022-08-22

If you found this post useful, be sure to check out the rest of the series on using Terraform and Ansible for resource provisioning and compliance. In particular, you might also enjoy:

Integrating Terraform and Ansible

Mon, 23 May 2022 00:00:00 +0000

This is part three in the series about Safespring's Terraform modules. This blog post will look at how we can integrate Ansible and Terraform in order to configure services on top of the instances provisioned with Terraform, using Terraform state as Ansible inventory.

If you found this post useful, be sure to check out the rest of the series on using Terraform and Ansible for resource provisioning and compliance. In particular, you might also enjoy:

Flexible provisioning of resources with Safespring's new Terraform modules

Mon, 11 Apr 2022 00:00:00 +0000

This is part two in the series about Safespring's Terraform modules. This blog post will look at the new and more general Safespring modules for compute instances and security groups.

We will also look at how we can use it to provision sets of instances in different configurations allowing only the necessary connections using security groups. The next post will be about using Ansible and from terraform/OpenStack to configure services on the provisioned instances.

The Safespring network model explained

Thu, 24 Mar 2022 00:00:00 +0000

This blog post will explain the different aspects of the Safespring network stack from a user perspective.

If you come from other platforms that use the legacy «layer 2 bridging» approach (with software-defined switches, routers, floating IP addresses, etc.), please read the full post to understand the implications. It does not work the way you think :-). Prerequisites for understanding this post are basic knowledge of CIDR notation, IP protocols (TCP,UDP,ICMP), and IP-based access control.

SSH key best practices for OpenStack cloud instances

Thu, 17 Mar 2022 00:00:00 +0000

For Linux-/Unix-based cloud instances, the initial root access to the instances is enabled employing SSH keys. In this post, we'll go through some best practices and things to keep in mind when managing ssh-keys to enable root access to instances.

Summary (TL;DR)

The poorly named “OpenStack keypair” contains no secrets, only an SSH pubkey.
SSH keypairs are not the same as an OpenStack keypair.
SSH keypairs should be created in a trusted environment on the user’s computer. It should be of type RSA. The private key should be kept in an encrypted secret store and never be exposed outside the user’s local site/environment.
An “OpenStack keypair” is tied to the user creating it, not a specific project.
Nobody cares about SSH host keys, but they should.

Background

When you provision instances in any cloud platform, you get a virtual server with a base operating system like Centos, Ubuntu, Debian, FreeBSD, etc., based on which cloud image the instance is provisioned from. You can use images available in the Infrastructure as a Service (IaaS) platform or upload your own, as long as the image is prepared for being used with the IaaS-platform you use. In Safespring’s case, the image must be made for the OpenStack IaaS.

CPU performance improvement on Windows

Thu, 17 Feb 2022 00:00:00 +0000

In this blog post, we'll go through some virtual machine optimizations. We optimized CPU performance improvement on Windows due to poor application performance for one of our customers.

Background

We were recently contacted by a client using Windows 2019 server operating system. They experienced higher CPU load and slower response times when using our platform than other IaaS-solutions.

Our general internal experience with Windows is that it had stable performance across compute/hypervisor hosts and that it got better performance when we installed newer hardware (as expected). We had never tested against other cloud providers. Thus, we were unaware of the problem.

Dead easy provisioning using the Safespring Terraform modules

Mon, 10 Jan 2022 00:00:00 +0000

In this blog post, we'll showcase just how easy it is by the example of our community Terraform modules.

It has never been easier to provision compute and block storage resources in Safespring’s infrastructure platform. Modules can be sourced directly from GitHub using a minimum of Terraform code.

If you found this post useful, be sure to check out the rest of the series on using Terraform and Ansible for resource provisioning and compliance. In particular, you might also enjoy:

Security advisory regarding the Log4j critical vulnerability

Mon, 13 Dec 2021 00:00:00 +0000

A vulnerability in Log4j Log4j is a small internal module that handles logging for Java programs. was announced on the 10th of December 2021. Reports worldwide show that the vulnerability is used actively and successfully in attacks.

Log4j is a Java-based logging utility widely used in popular software systems.

Key Takeaways

This has no consequences for Safesprings systems.
Safespring customers should stop their services that might be affected.

What we’ve done so far

Fortunately, this has no consequences for our systems, and no services are down.

Changing the host and domain name for the Support & Backup Service

Tue, 07 Jan 2020 10:16:45 +0100

Read the English version

14 January

The domain name change took place on 2020-01-14. This means the host name and DNS should be updated immediately. Once you make the changes (new DNS name and add the extra root CA certificate), the service will work 100% as before and you can perform backups and restores exactly as expected. Read more under “Technical details”.

We constantly work to improve and clarify our services. Part of this effort is phasing out our former parent company’s brand, IPnett, from our services.

We’ve created a guide to help you choose a backup service.

Mon, 22 Jan 2018 00:00:00 +0000

Our backup services are available in three different versions, and the guide helps you decide when each is the best fit from a cost perspective.

Additionally, as of this fall, Safespring is a partner with Microsoft, enabling us to offer images with the Windows Server operating system on the Compute platform.

Safespring Backup

We offer three versions of Backup:

Large
Small
On-Demand

Together with Sikt, we have created a guide that provides guidance on which service fits best depending on your needs.

Upgrade of Safespring's Compute platform

Mon, 28 Aug 2017 00:00:00 +0000

In line with Safespring’s goal to keep pace with OpenStack’s official releases (with a three-month delay to ensure stability), the work to upgrade to the latest release, Ocata, is now well underway.

The upgrade is expected to improve integration with the Ceph storage platform, which will make a number of disk-dependent operations faster.

Details about the upgrade can be found at https://status.safespring.com.