Choosing the services
To build a truly sovereign European cloud stack, we needed a provider that could compete with the feature sets of US tech giants while keeping data strictly within European borders. We chose Scaleway as our foundation.
To create a highly available, production-ready environment, we selected the following core services:
- Containers: Managed Kubernetes (Kapsule) to handle orchestration effortlessly, backed by their own Container Registry to store Docker images.
- Database: Managed PostgreSQL to ensure data persistence with automated backups.
- Storage: S3-compatible Object Storage for static assets and secure backups.
- Networking: VPCs and Private Networks to ensure isolated, secure communication between resources without exposing them to the public internet — with a ssh-bastion service out of the box!
- Domains & Web Hosting: DNS management for easy access to our publicly exposed services, with the option to acquire additional domains natively.
Challenges and our solutions
No cloud provider is perfect, and moving away from AWS or GCP comes with specific engineering challenges. US hyperscalers offer highly specific, fully managed niche services that Scaleway does not yet provide. We choose to default to open-source self-hosted tools on Kubernetes. For example, instead of relying on a proprietary AWS-managed service, we will use containerized alternatives directly on our Kubernetes cluster.
Here are the major tradeoffs we encountered and how we solved them.
1. AWS Loadbalancer Controller
The Challenge: AWS EKS comes with a dozen of add-ons and helm charts that integrate seamlessly out of the box. In our EKS stack, we heavily depend on the AWS Loadbalancer controller, so we needed to find a suitable sovereign alternative.
Our Solution: Kubernetes Gateway API with Envoy Gateway
+------+ +---------+ +-------------------+ +-------------+ +------+
| DNS | -> | AWS LB | -> | K8S Ingress | -> | K8S Service | -> | Pods |
| | | | | (annotations) | | | | |
+------+ +---------+ +-------------------+ +-------------+ +------+
+------+ +---------+ +--------------------------------------+ +------+
| DNS | -> | SCW LB | -> | K8S GATEWAY API (Envoy Gateway) | -> | Pods |
| | | | | (Unified Routing & SecurityPolicies) | | |
+------+ +---------+ +--------------------------------------+ +------+
With the official Kubernetes Ingress NGINX retirement we decided to implement the modern Gateway API straight away. On top of that we also had to choose for an implementation. For our implementation, we chose Envoy Gateway because it is feature-complete and industry-recognized. It gives us a great open-source alternative to AWS vendor lock-in. A major bonus is that we can now attach application-specific SecurityPolicies. This yields two massive advantages: first, it lowers the need to spin up extra cloud load balancers, directly decreasing cost; second, it shifts security left to the application layer, granting us fine-grained control.
Key Takeaway: We reduced cost and vendor lock-in while gaining increased application control and security.
2. AWS Certificate Manager
The Challenge: AWS Certificate Manager supports DNS approval with autorenewal.
Our Solution: Certmanager with Letsencrypt certificates
In our current AWS EKS setup we have a strict separation between application development and certificate management. While the latter remains an ops responsibility it collides with our shift left principles. We could just ignore that and move on with the Let’s Encrypt integration Scaleway offers out of the box. Unfortunately it lacks DNS validation and here’s the tradeoff. ACME HTTP-01 validation takes time, which can cause issues during service migrations. On the other hand DNS-01 validation has an ops dependency/bottleneck. Therefore we choose to implement Cert Manager for Kubernetes.
Key Takeaway: We empowered developers with Cert-Manager while keeping DNS control gated for complex migrations.
Coding the infrastructure
To make this proof of concept repeatable, auditable, and cost-effective, we strictly adhered to Infrastructure as Code (IaC). Hand-clicking in a console is fine for a quick test, but production requires automation.
Terraform (cdktf): We used the official Scaleway Terraform provider to declare our VPCs, Kubernetes clusters, and managed databases.
OpenTofu & Pulumi: Since HashiCorp officially deprecated CDKTF in late 2025, evaluating the future of our IaC framework is on the horizon. While we are sticking with our current CDKTF setup for this PoC, the deprecation offers a perfect opportunity to reconsider the broader ecosystem and evaluate options like Pulumi or OpenTofu—but that is a subject for a whole separate blog post.
Leaning on open source frameworks has huge benefits when it comes to migrations. For us, it meant we could smoothly re-use our Kubernetes External Secrets Operator setup, making it easy to plug into our existing 1password integration. Of course, 1Password is not a European entity, but since their main headquarters is located in Canada, they are not subject to the US CLOUD Act. If we want to strictly sovereignize this later, we can switch to Scaleway’s native Secret Manager without hassle using their off-the-shelf Scaleway Provider.
Plugging in CI/CD
Once infrastructure was deployed we could start deploying workload.
Since our applications share the same reusable kubectl templates and helm charts, it was merely a small configuration exercise. Only a few modifications to our pipelines to manage authentication and authorization with our new Scaleway project were needed. Then we simply had to add new deployments with the appropriate configuration values in our Bitbucket pipelines and we could spin up our applications.
Last (but not least) bit in this exercise was migrating the data. However with our knowledge and experience, it was just a matter of a couple of CLI commands to push data from one S3 bucket to another and export-import a couple of databases.
Wrapping up
This proof of concept illustrates that European cloud sovereignty is no longer just a theoretical ideal or a compliance checkbox. It is a highly practical, cost-effective reality. By accepting a few engineering tradeoffs and leaning heavily into open-source tooling, we successfully built a first-class hosting environment capable of standing toe-to-toe with US hyperscalers.
The European cloud ecosystem is moving fast. While we initially bypassed queuing, IoT, and serverless options during our scoping phase, Scaleway’s rapid portfolio expansion means these services are already mature enough for production consideration today. Migrating away from the US tech giants no longer means compromising on engineering standards. It means taking control of your stack, shifting security left, and ensuring absolute data sovereignty on European soil.
