Best OpenStack distribution for Constellation

[gonzalez-cy]

Hi,

I'm looking for an OpenStack distribution to build a private cloud platform on top of which I will test to deploy Constellation. I've heard that Canonical's Charmed OpenStack is one of the most popular options. However, I wonder if someone has some informed opinion about this specifically in regards to using OpenStack with Constellation. I assume that all OpenStack distributions can be used, but maybe I'm missing something and that's why I decided to ask. Any feedback would be very well appreciated.

[msanft]

Hey @gonzalez-cy,

You're right. Constellation should work with any OpenStack distribution as long as the underlying infrastructure requirements (e.g. availability of confidential VMs) are met. You might need to make some distribution-specific adaptions though, as we currently only test Constellation on STACKIT's OpenStack, and can thus only guarantee it to work there without any changes. We would love to hear back about your endeavours for integrating Constellation with Charmed OpenStack, and whether you face any challenges in the process.

Let me know if you have any further questions.

Best Regards,
Moritz

[gonzalez-cy]

Hi @msanft ,

I talked with a sales person from STACKIT in regards to their "confidential kubernetes" product and this is the reply that I got:

"Confidential Kubernetes is developed by our partner, Edgeless Systems, and utilizes confidential VMs to establish a Kubernetes cluster. This setup operates independently, hosted on the customer's infrastructure, and is not managed by us."

From that, I understood that Constellation isn't managed by STACKIT and isn't deployed in the cloud infrastructure of STACKIT neither. This is confusing, who is managing those deployments and which kind of infrastructure is used?

Regarding my tests with Charmed Openstack, I will be happy to provide feedback about my findings.

Regards,
Antonio Gonzalez

[msanft]

Hey @gonzalez-cy,

when you create a Constellation cluster on STACKIT, the cluster runs on STACKIT's infrastructure. However, you will need to create the infrastructure (on STACKIT) yourself, or let the STACKIT Terraform provider do the job for you. So in that sense, it can be seen as the "customer's" infrastructure.

Compared to AKS / EKS / GKE, etc., it would not make sense to run Constellation in a fully-managed environment, as this would mean inherently trusting the (potentially malicious) CSP, which is why you (i.e. the cluster admin) manage the cluster, and not the CSP.

Let me know if there are any further questions.

Best Regards,
Moritz

[gonzalez-cy]

Hi again, Oh, okay, there was a misunderstanding before then. And in regards to the maintenance of the constellation kubernetes cluster, who manages it? I mean, let's imagine that I deploy constellation kubernetes by myself in the openstack cloud. Once it's deployed, what's the difference between managing it myself as well by using the "confidential server" product vs getting the "confidential kubernetes server" product? Sent with [Proton Mail](https://proton.me/mail/home) secure email.

…

On Tuesday, October 15th, 2024 at 12:47 PM, Moritz Sanft ***@***.***> wrote: Hey ***@***.***(https://github.com/gonzalez-cy), when you create a Constellation cluster on STACKIT, the cluster runs on STACKIT's infrastructure. However, you will need to create the infrastructure (on STACKIT) yourself, or let the STACKIT Terraform provider do the job for you. So in that sense, it can be seen as the "customer's" infrastructure. Compared to AKS / EKS / GKE, etc., it would not make sense to run Constellation in a fully-managed environment, as this would mean inherently trusting the (potentially malicious) CSP, which is why you (i.e. the cluster admin) manage the cluster, and not the CSP. Let me know if there are any further questions. Best Regards, Moritz — Reply to this email directly, [view it on GitHub](#3409 (reply in thread)), or [unsubscribe](https://github.com/notifications/unsubscribe-auth/BL3FR3KIRGM5IADYC6TC45LZ3TXE7AVCNFSM6AAAAABP2KXU4OVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTAOJUGY2DMNQ). You are receiving this because you were mentioned.Message ID: ***@***.***>

[thomasten]

Hi @gonzalez-cy,

The Constellation node images hosted at STACKIT are only licensed for use with the STACKIT Confidential Kubernetes product. This product also includes basic support for Constellation.

If you would like to use Constellation on STACKIT Confidential Server, you'd need to build and upload your own image and there's no support.

[gonzalez-cy]

@thomasten Alright, now I understand it, thank you very much for the feedback. I assume that the basic support for Constellation in the STACKIT Confidential Kubernetes product is provided by Edgeless Systems, am I right? Is it possible to buy a enterprise license for an entire kubernetes cluster at a fixed cost independently of the number of nodes or each node in the cluster needs its own license? Is there any features that aren't available with the community license in comparison with the enterprise license or the only difference is the support?

I opened another discussion this morning that could be closed once those last questions are answered as well #3419 . I'll copy paste all the information that you provided there =) Thanks again for the information

[thomasten]

The support is provided by STACKIT, and Edgeless Systems is involved on demand.

The main differences of Enterprise compared to Community are:

• No restrictions regarding commercial use (see https://docs.edgeless.systems/constellation/overview/license for restrictions of the Community License)
• Different support packages, depending on your need
• Priority feature requests

For more info on the Enterprise packages, or to discuss the other licensing options that you asked for, please contact our team at: https://www.edgeless.systems/enterprise-support