Overview

Role in the system

The layer that turns data-centre and public-cloud capacity into governed, self-service platforms, with identity, networking, security and cost control defined once and applied consistently.

Our scope may include private cloud, public cloud, hybrid cloud and multi-environment deployment models.

Hybrid cloud with a governed landing zoneA private cloud in the data centre on the left and a public cloud landing zone on the right, joined by two secure connectivity paths. Identity federation spans both. A shared governance plane provides logging, monitoring, backup, policy and cost allocation across both environments.Identity federationone identity model and common access controls across both environmentsPrivate cloud (data centre)Self-serviceprovisioningUsage meteringand policyVirtualised infrastructureresource pools, automationContainerplatformSoftware-definednetwork and storageServers, storage, networkphysical infrastructurePrimary encrypted pathSecondary path, separate routeSecure connectivityPublic cloud landing zoneAccount orsubscription structurePolicy enforcementand resource taggingProductionNon-productionSharedservicesNetwork architecture and security controlsstandard deployment patternsCost controlsand administrative boundariesShared governance planeLogging, monitoring across environments, backup integration, common security controls, configuration consistency, cost allocation, disaster recovery
  • Data path
  • Power
  • Management path
  • Fault or alert
Hybrid environment. A private cloud and a public-cloud landing zone joined by two secure paths, under one identity model and one governance plane.

Assessment and landing zone

Placement decisions are made workload by workload, and the landing zone is built before any workload moves into it.

Cloud assessment

Assessment determines which workloads gain from a given deployment model and which are better left where they are.

Cloud assessment should cover:

  • Application architecture
  • Data sensitivity
  • Performance requirements
  • Integration dependencies
  • Regulatory constraints
  • Recovery requirements
  • Current infrastructure cost
  • Licensing implications
  • Network readiness
  • Operational skill availability

Landing-zone design

The landing zone is the governance baseline. Policy enforcement, administrative boundaries and cost controls are defined here, not retrofitted per project.

A cloud landing zone should establish:

  • Account or subscription structure
  • Identity integration
  • Network architecture
  • Security controls
  • Logging
  • Monitoring
  • Resource tagging
  • Policy enforcement
  • Backup
  • Cost controls
  • Administrative boundaries
  • Standard deployment patterns

Deployment models

Private cloud

Private cloud applies cloud operating practices — self-service, metering, automation, policy — to infrastructure the organisation keeps in its own facilities.

Private cloud capabilities may include:

  • Virtualised infrastructure
  • Self-service provisioning
  • Resource pools
  • Infrastructure automation
  • Container platforms
  • Software-defined networking
  • Software-defined storage
  • Centralised monitoring
  • Usage metering
  • Policy-based governance

Hybrid cloud

The hard part of hybrid is consistency: one identity model, one set of security controls and one view of monitoring across environments that behave differently.

Hybrid cloud design should address:

  • Secure connectivity
  • Identity federation
  • Data movement
  • Workload placement
  • Backup integration
  • Monitoring across environments
  • Common security controls
  • Configuration consistency
  • Cost allocation
  • Disaster recovery

Container platforms

A container platform is infrastructure that must be sized, backed up, monitored and upgraded like any other, not just a developer tool.

Container infrastructure may include:

  • Container orchestration
  • Cluster design
  • Control-plane redundancy
  • Worker-node sizing
  • Image repositories
  • Secrets management
  • Persistent storage
  • Service discovery
  • Ingress
  • Logging
  • Monitoring
  • Backup
  • Upgrade management

Migration and cloud operations

Workload migration

Migration is planned in groups of dependent applications, each with a defined rollback point and user validation before the source is retired.

Migration planning should include:

  • Application inventory
  • Dependency mapping
  • Data classification
  • Migration grouping
  • Downtime planning
  • Data-transfer estimation
  • Testing
  • Rollback
  • User validation
  • Post-migration monitoring

Cloud operations

Operating the environment includes watching cost and configuration drift as closely as availability and security events.

Cloud operations should include:

  • Availability monitoring
  • Performance monitoring
  • Security-event monitoring
  • Backup validation
  • Cost monitoring
  • Resource optimisation
  • Patch coordination
  • Capacity review
  • Configuration management
  • Incident management

Discuss an ICT Requirement

Describe the requirement, the locations involved and where the project stands. We will respond with the technical questions that need answering first.

Discuss an ICT Requirement