À compter du 1er juillet 2026, nous mettons à jour la liste des destinations incluses dans nos forfaits VoIP. Cette évolution concerne les forfaits Découverte, Entreprise et Entreprise+. Les forfaits Trunk SIP, eux, restent inchangés.

Voici, en détail, ce que cela change pour vous.

Pourquoi cette évolution ?

Un alignement avec vos usages réels

Lorsque nous analysons les communications passées via nos forfaits, une réalité s’impose : la grande majorité des appels de nos clients se concentrent sur leur pays d’origine et sur l’Europe. Maintenir au catalogue des dizaines de destinations très peu utilisées avait un sens il y a quelques années ; aujourd’hui, cela rend nos offres moins lisibles sans réel bénéfice pour la plupart des utilisateurs.

Nous préférons des forfaits plus simples à comprendre, dont chaque ligne correspond à un positionnement clair : Découverte pour le national, Entreprise et Entreprise+ pour l’Europe, Trunk SIP pour les besoins internationaux étendus.

De nouveaux accords opérateurs en Europe

Cette mise à jour s’appuie également sur de nouveaux accords noués avec nos opérateurs partenaires en Europe. Ces partenariats nous permettent d’élargir notre couverture européenne dans de bonnes conditions de qualité et de tarification. Nous pouvons ainsi intégrer 9 destinations supplémentaires à nos forfaits Entreprise et Entreprise+ sans en compromettre la performance.

« Nos forfaits VoIP doivent rester simples, lisibles et alignés avec les usages réels de nos clients. En recentrant les destinations incluses sur l’Europe, en intégrant neuf nouveaux pays grâce à nos accords opérateurs et en clarifiant le positionnement de chaque forfait, nous offrons une couverture plus pertinente, plus stable et plus en phase avec les communications passées au quotidien. » Isabelle Neau, Product Manager

Ce qu’il faut retenir pour chaque forfait

Découverte : un positionnement national

Jusqu’au 30 juin 2026, le forfait Découverte inclut les appels vers les lignes fixes nationales ainsi que vers 40 destinations internationales. À compter du 1er juillet, le forfait se recentre sur sa vocation première : les appels nationaux.

Concrètement, la définition de « national » dépend de l’origine de votre ligne :

• depuis une ligne française ou belge, les appels vers les numéros fixes en France métropolitaine et en Belgique sont inclus ;
• depuis une ligne britannique, seuls les appels vers les numéros fixes au Royaume-Uni sont inclus ;
• depuis une ligne suisse, seuls les appels vers les numéros fixes en Suisse sont inclus.

Les autres destinations, ainsi que l’ensemble des appels vers les mobiles, sont facturés à la seconde au tarif en vigueur. Ce recentrage fait du forfait Découverte une offre claire, idéale pour des usages essentiellement locaux.

Entreprise et Entreprise+ : un cap européen

Pour le forfait Entreprise et le forfait Entreprise+, trois évolutions sont à retenir.

1. Les destinations retirées

Les destinations fixes hors Europe sortent du périmètre inclus : Argentine, Australie, Brésil, Canada, Chili, Chine, Colombie, Hong Kong, Israël, Kazakhstan, Malaisie, Mexique, Nouvelle-Zélande, Panama, Pérou, Russie, Singapour, Taïwan, Thaïlande, USA, Venezuela.

Ces pays restent bien sûr joignables depuis votre service VoIP. Ils basculent vers une facturation à la seconde.

2. Les destinations maintenues

20 destinations européennes restent incluses : Allemagne, Autriche, Belgique, Chypre, Danemark, Espagne, France métropolitaine, Grèce, Hongrie, Irlande, Italie, Luxembourg, Norvège, Pays-Bas, Pologne, Portugal, Royaume-Uni, Slovaquie, Suède, Suisse.

3. Les destinations ajoutées

9 nouveaux pays européens entrent dans le périmètre inclus, grâce à nos nouveaux accords opérateurs : Bulgarie, Croatie, Estonie, Finlande, Lettonie, Lituanie, Malte, République tchèque, Roumanie.

« L’arrivée de la Bulgarie, de la Croatie, des pays baltes ou encore de la République tchèque dans nos forfaits Entreprise et Entreprise+ est une vraie bonne nouvelle pour les entreprises qui développent leur activité sur le marché européen. Sans changer de forfait ni d’usage, nos clients gagnent en couverture sur des zones où la demande progresse. » Nicolas Galdini, Product Marketing Manager

Trunk SIP : aucun changement

Si vous utilisez un forfait SIP Trunk appels illimités, rien ne change pour vous. Les 40 destinations historiques restent incluses, dans les mêmes conditions qu’aujourd’hui. Aucune démarche n’est à prévoir de votre côté.

Comment vous accompagnons-nous ?

Aucune action n’est nécessaire de votre part : vos forfaits évolueront automatiquement au 1er juillet 2026.

Nos équipes restent également disponibles pour répondre à vos questions et vous accompagner dans cette évolution. Que vous souhaitiez mieux comprendre l’impact de ces changements sur vos usages ou explorer des solutions adaptées à des besoins internationaux spécifiques, nous sommes à votre écoute pour vous orienter vers l’option la plus pertinente.

« Notre priorité, c’est que nos clients vivent cette évolution sans friction. Nos équipes sont mobilisées pour répondre aux questions, clarifier les impacts au cas par cas et accompagner ceux qui ont des besoins spécifiques sur les destinations qui sortent du périmètre inclus. » Sofiane Messarat, Product Owner Telecom

En résumé, une offre plus lisible alignée sur vos usages

Avec cette évolution, chaque forfait gagne en clarté. Le forfait Découverte se recentre sur les appels nationaux, tandis que les forfaits Entreprise et Entreprise+ renforcent leur ancrage européen avec l’ajout de 9 nouvelles destinations incluses. Les forfaits Trunk SIP conservent, quant à eux, leur couverture internationale actuelle pour les besoins les plus étendus.Notre objectif reste le même : vous proposer des offres simples à comprendre, cohérentes avec vos usages et adaptées à l’évolution de vos communications professionnelles.

As both the cyberattack cause and cure, ever-expanding AI has been transforming cybersecurity from both sides of the battlefield. Organizations increasingly use AI to detect threats and automate security operations, but just as rapidly, attackers are also adopting AI to generate malware, accelerate phishing campaigns, and probe systems at scale.

As cyber threats evolve, cybersecurity education must evolve with them. Accordingly, future security engineers need more than theoretical knowledge — they need hands-on experience building and defending modern cloud environments against increasingly intelligent attacks.

This was the exact goal of the recent OVHcloud x EPITA Rennes SecDevOps Hackathon. Students spent three days developing cloud-native security solutions designed for an AI-driven threat landscape, helping train the next generation of tech talent.

Why AI is changing cybersecurity education

Traditional cybersecurity education often focuses on known attack patterns or defensive tools in isolation. But today’s security teams are operating in a very different reality.

Analysts now work across AI-assisted detection systems, cloud-native infrastructure, threat intelligence platforms, and automated incident response workflows. At the same time, attackers are using AI to automate reconnaissance, generate convincing phishing content, and adapt their techniques faster.

Preparing students for this environment means moving beyond classroom theory. They need realistic infrastructure, collaborative development, and hands-on security engineering under real technical constraints.

That is where hackathons can make the difference: they push students to solve practical cybersecurity problems in conditions much closer to the ones they will face in the field.

Building cloud-native security solutions

As part of the OVHcloud Education program, students from EPITA Rennes’ SecDevOps major were given access to OVHcloud Public Cloud infrastructure alongside AI credits and development resources. Working in teams, they designed, tested, and deployed solutions capable of addressing emerging cybersecurity challenges while operating in production-like cloud environments. Rather than focusing on theoretical concepts, every project tackled practical problems security teams increasingly encounter today.

Rethinking cyberdefense in the age of AI

Several projects reflected how defensive security is evolving alongside AI:

MIR[AI]GE: turning AI attackers against themselves

Awarded Best Technical Project, MIR[AI]GE explored a proactive approach to defending against autonomous AI attacks.

Instead of simply blocking malicious activity, the platform detects offensive AI agents and redirects them into isolated honeypot containers filled with realistic — but entirely fake — data.

The objective is not only to stop the attack but also to waste the attacker’s computing resources while gathering valuable behavioral information.

As AI-generated attacks become more sophisticated, deception technologies like honeypots are becoming increasingly valuable components of modern cyberdefense strategies.

Find out more: miraige.vercel.app

Honeymind: threat intelligence from attacker behavior

Winner of the Best Presentation Award, Honeymind focused on generating actionable threat intelligence.

The team developed an internet-facing honeypot capable of analyzing attacker requests before enriching the collected data with AI, improving deception techniques and producing insights that security operations teams could use during incident response.

Projects like this demonstrate how AI can support defenders — not only by automating analysis but by making security systems themselves more adaptive.

Discover the repository: github.com/al2al85/HoneyMind

Other innovative approaches

Other teams explored complementary security challenges:

Winnie developed a bounce honeypot that guides attackers through AI-generated environments inspired by the MITRE ATT&CK framework.

Meanwhile, SRE-squad created an assistant designed for SOC analysts, helping correlate logs with operational runbooks and prioritize alerts in environments increasingly flooded with AI-generated attack traffic.

Together, these projects illustrate how future security professionals are beginning to combine cloud infrastructure, automation, and AI into practical defensive workflows.

What organizations can learn

While the hackathon centered on students, the technologies they explored mirror challenges many organizations already face.

Modern cybersecurity increasingly relies on:

• Cloud-native security architectures
• Threat intelligence pipelines
• AI-assisted analysis
• Deception technologies such as honeypots
• Automated security operations

As these capabilities become mainstream, organizations will need engineers who understand both software development and security engineering — the core principles behind SecDevOps.

Providing students with opportunities to build these systems today helps the next generation of cybersecurity professionals prepare for tomorrow’s threats.

Supporting the next generation of security engineers

The OVHcloud Education program aims to bridge academic learning with real-world cloud engineering by giving students access to production-grade infrastructure and practical technical challenges.

The hackathon also offered members of the winning teams a fast-track interview with OVHcloud’s technical recruitment teams for their end-of-studies internships.

A special thank you goes to Gabin, Lucas, and Magali, whose mentorship and expertise helped make this year’s event a success.

If you’re ready to turn AI cybersecurity training into a career, explore opportunities on the OVHcloud Careers site. And if your institution would like to organize a hackathon with the OVHcloud Education program, we’d love to hear from you.

Docker Agent is an open-source framework for building collaborative multi-agent workflows.
Instead of one monolithic agent trying to do everything, you compose a team of specialized
agents. Each agent has a clear role, specific tools, and its own model, allowing them to
communicate and collaborate on complex, multi-step tasks.

In this post, we’ll explore how to wire up Docker Agent with OVHcloud AI Endpoints to create
a multi-agent coding assistant: one agent browses documentation, another writes the code.

Install/configure Docker Agent

All detailed instructions for installing and configuring Docker Agent can be found in
the official documentation.
Once installed, Docker Agent is available as the docker-agent or docker agent command line
tool.
⚠ Docker Agent does not need Docker engine to run. ⚠

Authenticate with AI Endpoints

To use Docker Agent with AI Endpoints, export your API key:

export OVH_AI_ENDPOINTS_ACCESS_TOKEN="your_api_key_here"

ℹ️ Docker Agent uses the token_key field in the provider configuration to know which environment variable holds the API token, here we name it OVH_AI_ENDPOINTS_ACCESS_TOKEN. ℹ️

Configure the provider and models

AI Endpoints is fully integrated in docker agents. That’s mean that the configuration is very easy as you can see in the official documentation.

One of the strengths of AI Endpoints is the ability to choose the right model for each task. This allows each agent to use a model optimized for its specific role rather than forcing a single model to handle every step of the workflow. Here we use gpt-oss-120b for the crawler, which handles documentation analysis, web browsing and reasoning, while Qwen3.5-397B-A17B is used for the coder due to its strong code generation capabilities.

Create a team of agents for coding

Let’s build a two-agent team: a crawler that fetches documentation from the web, and a coder that turns that documentation into working code.

The crawler uses the fetch toolset to read URLs and passes the extracted context to the coder via the sub_agents mechanism. The coder uses the filesystem toolset to create files and the shell toolset to execute or validate them when needed.

agents:
  crawler: 
    model: ovhcloud/gpt-oss-120b
    description: Documentation crawler
    instruction: |
      You are a documentation crawler.
      Step 1: use the fetch tool to read the URLs provided by the user and     extract the relevant information.
      Step 2: you MUST invoke the coder sub-agent tool with the full context you gathered, so it can write the code.
      Do NOT write the code yourself. Always invoke the coder agent.
    sub_agents: [coder]
    toolsets:
     - type: filesystem
     - type: fetch

coder:
  model: ovhcloud/Qwen3.5-397B-A17B
  description: Coder
  instruction: |
    Write code based on the context provided.
    Ensure code quality and maintainability.
    Save files to disk using the filesystem toolset, use the current path.
   toolsets:
    - type: filesystem
    - type: fetch
    - type: shell

As you can see using an OVHcloud model is very easy: get the model name from the catalog and add ovhcloud/ to the name in the configuration file.

Run the agents

Once your configuration file is ready, run the team with:

docker agent run ovhcloud-agent.yml

Here is the Docker Agent in action:

Conclusion

In this post, we saw how Docker Agent makes it easy to build collaborative multi-agent teams (without requiring Docker engine) and how AI Endpoints fits in naturally thanks to its full OpenAI API compatibility.

AI Endpoints gives you the flexibility to choose the right model for each agent in a multi-agent workflow, all from a single provider configuration. Rather than relying on one model for every task, you can combine specialized models for research, reasoning, coding, content generation, or data processing.

The crawler/coder example shown here is just one illustration of this approach. The same multi-agent pattern can be applied to a wide range of workflows wherein specialized agents collaborate to complete complex tasks more efficiently.

Have questions or feedback? Join the dedicated #ai-endpoints channel on our Discord server.

To learn more about AI Endpoints, please explore our previous blog posts.

Every month, the OVHcloud Developer Advocate team creates content, shares knowledge, and connects with the tech community. Here’s a look at what we did in June 2026. 🚀

🎙️ “Tranches de Tech” – Our monthly podcast

A new episode of our French-language podcast Tranches de Tech 🥑 just dropped!

🎧 Episode 29: Dessiné c’est gagné !

This episode of “Tranche de Tech” features host Stéphane, co-host Aurélie, and guest Ane, a front-end developer at Datadog, who discuss visual thinking and sketchnoting, Ane’s experience contributing to the Chromium open-source project, and the growing impact of AI on software development practices. A significant portion of the conversation explores how AI tools are both accelerating code generation and creating challenges for open-source communities, including a flood of low-quality pull requests and security vulnerabilities being discovered (and sometimes irresponsibly disclosed) by AI systems. The episode wraps up with reflections on the instability of GitHub, the financial struggles facing tech conferences, and a shared concern about preserving the human and collaborative elements of the developer profession.

See episode shownotes

📺 Live on Twitch

We streamed live on Twitch this month! Here’s what we covered:
🎥 Stéphane Philippart discussed with Fanny Bouton about quantum computing at OVHcloud.
Catch the replay on YouTube ▶️.

🎤 Conference Talks

The team hit the road (and the stage) at several conferences this month:

🇫🇷 Paris JUG, Paris 🇫🇷

Stéphane gave a talk: Toi aussi crée ta CLI boostée à l’IA avec Picocli

🇫🇷 DevQuest Niort, Niort 🇫🇷

Aurélie Vache gave two talks:

• J’ai packagé mon application en image Docker, et maintenant ?
• Comprendre Kubernetes de manière visuelle

Stéphane Philippart gave a workshop: Développer avec l’IA : et si c’était aussi simple qu’ajouter une librairie ?

🇫🇷 BreizhCamp, Rennes 🇫🇷

Stéphane Philippart gave two talks

• JBang, un fichier Java pour les gouverner tous ? 💍
• 🧰 Les dev containers, la boîte à outils ultime pour les devs ?

🤝 Community Engagement

We connected with the community through more than just conferences:

🏫 Meetup Tech Speak’Her – June, 4 – Toulouse, France 🇫🇷

Aurélie was a member of the jury during the “Tremplin DevFest Toulouse” evening, organized by the Tech Speak’her association.

During ths “pitch contest” event, eight women from the region delivered their pitches, and the jury had the difficult task of selecting the winner. She will have the opportunity to give a talk at DevFest Toulouse, while the two runners-up will be invited to present their talks at a Tech Speak’her meetup.

📝 Our latest blog posts

Here are the articles our team published on the OVHcloud Blog this month.

📝 Secure Image Signing with Cosign and OVHcloud KMS – by Aurélie Vache

This article by Aurélie Vache explains how to use Cosign, a tool from the Sigstore project for signing and verifying OCI container images, together with the OVHcloud Key Management Service (KMS) through a dedicated plugin. It walks through the full workflow: generating a key pair stored securely in OVHcloud KMS, signing a container image, and verifying the signature. The main benefit is keeping cryptographic signing keys out of local environments and CI/CD variables, reducing secret sprawl and improving supply chain security.

📝 Terraform S3 state locking with OVHcloud Object Storage – by Aurélie Vache

This article by Aurélie Vache explains how to enable native S3 state locking for Terraform and OpenTofu using OVHcloud’s S3-compatible Object Storage, made possible by the recent addition of conditional writes support. When activated via the use_lockfile = true backend option, Terraform creates a .tflock file during an operation, preventing any concurrent apply from modifying the state file simultaneously and avoiding state corruption. The post walks through the full setup and demonstrates the locking mechanism in action with practical CLI examples.

📝 How to process large AI requests with Batch Mode on OVHcloud AI Endpoints – by Stéphane Philippart

This article by Stéphane Philippart introduces the Batch Mode feature (currently in beta) for OVHcloud AI Endpoints, which allows processing large volumes of LLM requests asynchronously by uploading a JSONL file, submitting a batch job, and retrieving results within up to 24 hours , at 50% lower cost than synchronous requests. The post walks through the full Python workflow using the OpenAI-compatible SDK: uploading the input file, creating and polling the batch, and downloading the results. It’s ideal for non-time-sensitive workloads like bulk classification, translation, or dataset generation, but not suited for real-time use cases like chatbots.

💻 Code Samples and Open Source

We regularly publish code samples and open-source projects to help you get started with OVHcloud products. Check out our public-cloud-examples repository on GitHub.

New this month:

• 🆕 New release: OVHcloud Pulumi provider v2.14.0
• 🆕 Contributions in the new Sigstore cosign plugin for OVHcloud KMS
• 🆕 Contributions in the okms-k8s-encryption-provider

🗓️ Coming up next

Here’s a sneak peek at what’s coming next.

🗓️ – July, 2 & 3 – Sunny Tech (Montpellier, France)

🎤 Aurélie Vache is giving two talks:
– Comprendre Kyverno de manière visuelle (Thursday the 2nd)
– J’ai packagé mon application en image Docker, et maintenant ? (Friday the 3rd)

🎤 Stéphane Philippart is giving one talk (Thursday the 2nd): 🧰 Les dev containers, la boîte à outils ultime pour les devs ?

🗓️ – July, 6, 7 & 8 – Riviera Dev (Sophia-Antipolis, France)

🎤 Aurélie Vache is giving two talks:
– Questions pour un conteneur – édition Supply Chain » (Tuesday the 7th)
– Comprendre Kubernetes de manière visuelle (Tuesday the 7th)

🎤 Stéphane Philippart is giving one workshop (Tuesday the 7th): Créer un assistant IA dans son terminal avec Java, Picocli et Quarkus

🗓️ – July, 8, 9 & 10 – We are developers (Berlin, Germany)

🎤 Aurélie Vache is giving one talk (Thursday the 9th): Understanding Kubernetes in a visual way

🗓️ New “Tranches de Tech” podcast episode

🎧 All episodes are available on Ausha and all your favorite podcast applications!

💬 Stay in Touch

Want to chat with us, share your thoughts, or just say hi? Here’s how to get in touch with the Developer Advocate team:

• 🟣 Discord: OVHcloud Discord server
• 🐦 X / Twitter: @OVHcloud
• 💼 LinkedIn: OVHcloud LinkedIn
• 🐙 GitHub: github.com/ovh

See you next month! 👋

Introduction

As part of the new season of OVHcloud’s Twitch channel, Rémy (Tech Evangelist) invited Charbel Harb (Containerisation Sales Specialist) to demystify Rancher, the Kubernetes cluster management platform. During their conversation, they discussed the multicloud advantages of the solution, usage modes and features, as well as potential future developments. This article summarises the key points of their discussion to help you understand how Rancher can lighten the operational load of your Kubernetes environments.

Rancher does not replace Managed Kubernetes; it overlays it

Rancher functions as a Kubernetes cluster management platform: it is installed as a layer on top of your clusters, whether they are hosted with OVHcloud, on bare metal, or with another provider. It does not replace Kubernetes; it complements the solution by providing a graphical interface that replicates actions usually performed in command lines.

“Rancher is a complete multicloud Managed Kubernetes cluster management platform. It does not replace Kubernetes – it’s an overlay.”

OVHcloud focuses on technological freedom and open source. After testing several solutions, Rancher was selected for its agnostic nature and lack of vendor lock-in. Its partnership with SUSE, a European publisher sharing the same sovereignty principles, has led to the launch of a “vanilla” version of Rancher, enriched with some interface adjustments for deploying clusters with OVHcloud.

Multicloud management and deployment flexibility

Rancher offers a single dashboard for both local and remote clusters. It centralises the management of clusters hosted on:

• OVHcloud Managed Kubernetes Service
• Public Cloud or Private Cloud instances self-managed by the client
• Other cloud providers offering a Managed Kubernetes Service

The interface lists all clusters, regardless of their location, as long as they have a public outbound IP address.

Rancher offers two entry points that are easily identifiable:

• Create a new cluster from one of the supported environments (choice of zone, number of AZs, type of nodes, enabling autoscaling)
• import an existing cluster by deploying a small Rancher agent via a kubectl command.

This duality ensures that every member of a DevOps team works in a way that’s comfortable for them, while retaining the ability to automate tasks via scripts.

User experience: GUI vs CLI

Rancher caters to both profiles:

• users who prefer clicking: creating clusters, sizing node pools, and deploying applications can be done in a few clicks, without memorising long kubectl syntaxes.
• experts who prefer the power of the terminal: the interface includes a kubectl terminal that allows commands be directly executed on the cluster, even from a bastion or a computer without local installation.

This duality ensures that every member of a DevOps team works in a way that’s comfortable for them, while retaining the ability to automate tasks via scripts.

Integrated application catalogue: monitoring, observability and security

Rancher includes a catalogue of applications (Helm charts),  including Prometheus and Grafana, that are pre-installed and free. 

In just a few clicks, you can add a monitoring layer to your cluster and immediately visualise metrics like CPU, RAM, network load and logs.

“The application catalogue is a toolbox that solves many issues.”

These tools facilitate quick debugging and provide enough visibility to initiate finops actions (scale-up/scale-down, resource optimisation) even though Rancher is not a financial management product.

Security and access control

Rancher integrates complete role-based access control (RBAC).
You can create user groups, assign them predefined roles (read, write, administration), and link them to external authentication providers such as LDAP or SSO. This granularity prevents human errors and strengthens compliance with internal policies.

Internal architecture: the brain and the agent

Rancher Manager operates within its own dedicated Kubernetes cluster, shared for all OVHcloud customers. Each managed cluster has a Rancher agent that receives instructions from the administration console. During creation, this console automatically deploys the agent. During import, the user executes the provided command to install the agent. This architecture ensures reliable communication while maintaining the isolation of client workloads.

Roadmap and development perspectives

The product is currently stable, and several areas for improvement are underway:

• support for “private” mode (clusters without public IPs) to meet the requirements of isolated networks
• integration of AI assistants to generate prompts for creating clusters or managing users, further reducing the number of clicks required.

These developments align with our goal of offering an increasingly smooth and automated experience for DevOps teams.

Conclusion

Rancher positions itself as a versatile tool for Kubernetes management: it centralises multicloud clusters, offers an intuitive graphical interface, integrates a catalogue of ready-to-use applications, and ensures granular security via RBAC.

“The first piece of advice is really to try it. Give yourself some time to measure the gain.”

If you’d like to test this solution, we are currently offering a free trial of the Managed Rancher service. Start a test cluster, explore the application catalogue, and measure how much time you save in your DevOps processes.

Over to you! Contact our team, schedule a personalised demonstration session, and discover how Rancher can transform the management of your Kubernetes environments.

Introduction

Dans le cadre de la nouvelle saison de la chaîne Twitch d’OVHcloud, Rémy (Tech Evangelist) a invité Charbel Harb (Sales Specialist en charge des offres de conteneurisation) pour décrypter Rancher, la plateforme de gestion de clusters Kubernetes. Au fil de leur échange, ils ont abordé le positionnement multicloud de l’offre, les modes d’utilisation et fonctionnalités, ainsi que les perspectives d’évolution. Cet article de blog reprend les points clés de cette discussion pour vous aider à comprendre comment Rancher peut alléger la charge opérationnelle de vos environnements Kubernetes.

Rancher : une surcouche qui ne remplace pas Managed Kubernetes

Rancher se présente comme une plateforme de gestion de clusters Kubernetes : elle s’installe sur la couche supérieure de vos clusters. Ceci, qu’ils soient hébergés chez OVHcloud, sur du bare metal ou chez d’autres fournisseurs. Elle ne remplace pas Kubernetes, elle complète la solution en proposant une interface graphique qui reproduit les actions habituellement réalisées en lignes de commande.

« Rancher est une plateforme de gestion de clusters Managed Kubernetes, multicloud, complète. Elle ne remplace pas Kubernetes, c’est une surcouche. »

OVHcloud mise sur la liberté technologique et l’open source. Après avoir testé plusieurs solutions, Rancher a été retenu pour son caractère agnostique et son absence de verrouillage propriétaire. Le partenariat avec SUSE, éditeur européen partageant les mêmes principes de souveraineté, a permis de proposer une version « vanilla » de Rancher, enrichie de quelques ajustements d’interface pour le déploiement de clusters chez OVHcloud.

Gestion multicloud et flexibilité d’implantation

Rancher propose un tableau de bord unique pour des clusters locaux, mais aussi distants. Il rend possible la centralisation de la gestion de clusters hébergés sur :

• Managed Kubernetes Service d’OVHcloud ;
• des instances Public Cloud ou Private Cloud autogérées par le client ou la cliente ;
• d’autres fournisseurs de cloud proposant Managed Kubernetes Service.

L’interface liste tous les clusters, quel que soit leur lieu d’implantation, dès lors qu’ils disposent d’une adresse IP publique de sortie.

Rancher propose deux points d’entrée, identifiables d’un seul coup d’œil :

• la création d’un nouveau cluster depuis l’un des environnements supportés (choix de la zone, du nombre d’AZ, du type de nœuds, activation de l’autoscaling) ;
• l’importation d’un cluster existant en déployant un petit agent Rancher via une commande kubectl.

L’agent, installé dans le cluster cible, établit une liaison montante vers Rancher. Aucune exposition du cluster à Internet n’est requise, seule une sortie IP suffit.

Expérience utilisateur : GUI vs CLI

Rancher répond aux deux profils :

• les utilisateurs et utilisatrices préférant le clic  : la création de clusters, le dimensionnement des pools de nœuds et le déploiement d’applications se font en quelques clics, sans mémoriser de longues syntaxes kubectl ;
• les expertes et experts qui préfèrent la puissance du terminal : l’interface intègre un terminal kubectl qui permet d’exécuter directement les commandes sur le cluster, même depuis un bastion ou un ordinateur dépourvu d’installation locale.

Cette dualité garantit que chaque membre d’une équipe DevOps trouve son confort de travail, tout en conservant la possibilité d’automatiser les tâches via des scripts.

Catalogue d’applications intégrées : monitoring, observabilité et sécurité

Rancher embarque un catalogue d’applications (Helm charts) pré-installées et gratuites : Prometheus, Grafana, etc. 

En quelques clics, vous pouvez ajouter une couche de monitoring à votre cluster et visualiser immédiatement les métriques (CPU, RAM, charge réseau, logs).

« Le catalogue d’applications, c’est une caisse à outils qui résout de nombreuses problématiques »

Ces outils facilitent le debug rapide et offrent une visibilité suffisante pour amorcer des actions de finops (scale-up/scale-down, optimisation des ressources) même si Rancher n’est pas un produit dédié à la gestion financière.

Sécurité et contrôle d’accès

Rancher intègre un contrôle d’accès basé sur les rôles (RBAC) complet. Vous pouvez créer des groupes d’utilisateurs, leur assigner des rôles prédéfinis (lecture, écriture, administration) et les lier à des fournisseurs d’authentification externes (ex. LDAP, SSO). Cette granularité évite les erreurs humaines et renforce la conformité aux politiques internes.

Architecture interne : le cerveau et l’agent

Manager Rancher tourne dans son propre cluster Kubernetes dédié, mutualisé pour toutes les clientes et clients OVHcloud. Chaque cluster géré possède un agent Rancher qui agit comme récepteur des instructions de la console d’administration. Lors d’une création, cette dernière déploie automatiquement l’agent. Lors d’une importation, l’utilisateur ou l’utilisatrice exécute la commande fournie pour installer l’agent. Cette architecture assure une communication fiable tout en maintenant l’isolation des workloads client.

Feuille de route et perspectives d’évolution

Le produit est aujourd’hui stable. En outre, plusieurs axes d’amélioration sont en cours :

• support du mode « private » (clusters sans IP publique) afin de répondre aux exigences de réseaux isolés ;
• intégration d’assistants IA pour générer des prompts de création de clusters ou de gestion d’utilisateurs, réduisant encore le nombre de clics nécessaires.

Ces évolutions s’inscrivent dans la volonté de proposer une expérience toujours plus fluide et automatisée aux équipes DevOps.

Conclusion

Rancher se positionne comme un outil polyvalent de la gestion Kubernetes : il centralise les clusters multicloud, propose une interface graphique intuitive, intègre un catalogue d’applications ready-to-use et assure une sécurité granulaire via le RBAC.

« Le premier conseil, c’est vraiment essayer. Donnez-vous un peu de temps pour mesurer le gain. »

Si vous souhaitez tester cette solution, OVHcloud propose dès maintenant un essai gratuit du service Managed Rancher. Démarrez un cluster de test, explorez le catalogue d’applications et mesurez le temps économisé dans vos processus DevOps.

À vous de jouer ! Prenez contact avec notre équipe, planifiez une session de démonstration personnalisée et découvrez comment Rancher peut transformer la gestion de vos environnements Kubernetes.

Introduction

As part of a project of mutual interest between OVHcloud and Sopra Steria, the technical teams of each company joined forces to design the deployment of a Landing Zone. Initially, the project was designed and adapted to the needs of the public sector, to be later expanded to other markets and use cases.

Why a Landing Zone?

Compliance and regulatory requirements

The starting point of the project was very specific: from day one, the Canadian government required a cloud environment that meets very strict sovereignty and security standards. Without a ready-to-use solution, each public client had to spend weeks, if not months, setting up their architecture, drafting procedures, and validating each component with the authorities. This created a bottleneck when projects were initiated.

“The lack of a process to deploy a Landing Zone that was compliant with the requirements of the Canadian public sector was a real roadblock.”

The Landing Zone was designed as a deployment that complies with a regulatory framework: the created infrastructure automatically meets the segmentation, encryption, logging, and access control requirements imposed by authorities. Clients no longer have to worry about how to prove that their environment is compliant; the compliance report is generated simultaneously with the deployment. In fact, this is the whole idea behind the solution.

Accelerating cloud adoption

Once the compliance issue is resolved, the Landing Zone proves to be a true adoption accelerator for all types of clients: startups, SMEs, large accounts, and, of course, governments.

• Automation of best practices: the tools automatically deploy private networks, subnets, firewalls, service accounts, and IAM policies.
• Standardisation: each environment follows the same architectural model, which facilitates maintenance, monitoring, and upgrades.
• Time-to-market: where a manual deployment could take several weeks of work (reading documentation, manually creating resources, compliance testing), the Landing Zone allows for an operational (and compliant) environment in less than an hour.

“In half an hour, you have something ready to use: 30 to 40% of security requirements are already automatically deployed.”

The concrete benefits for technical teams

Time saving and reproducibility

At the core of automating a Landing Zone is Infrastructure as Code (IaC). Terraform (or its fork OpenTofu) orchestrates all OVHcloud services.
Thanks to this model:

• a single script can be executed multiple times, across different accounts or regions, without changing the outcome
• human errors that occur when manually creating resources (typographical errors, configuration oversights, incorrect role assignments) are nearly eliminated
• teams move from tedious configuration to deployment validation, freeing up several days of work for each project

Governance and access management

In addition to the infrastructure, the Landing Zone incorporates a governance model: roles, policies, and safeguards are preconfigured, simplifying access management and revoking rights when someone leaves the company. This layer of abstraction addresses one of the main challenges for IT departments: visibility and control over cloud resources.

Modularity and adaptability to different profiles

The code has been designed to be modular. Three basic profiles are available: “small business”, “medium” and “government”. Each profile activates a tailored set of services in terms of cost, scalability, and compliance requirements. 

The same code base can be extended: if a client from the financial sector requires an HSM encryption module or a certified payment gateway, it is simply a matter of adding the corresponding module and rerunning the script. This flexibility allows you to reuse the same foundation for very different projects, while ensuring compliance and performance guarantees.

A solution that makes a difference

Landing Zone is more than just scripts that create networks and accounts.

It is a comprehensive set of services that covers the entire lifecycle of a cloud project: from strategic reflection to production deployment, and then to daily management administered by the client.

This dual expertise provides coverage for the entire lifecycle: strategy → deployment → operation.

Conclusion

The Landing Zone deployed on OVHcloud infrastructures addresses two major challenges: compliance  for many regulated sectors (particularly public, finance and health) and speed of adoption  for all cloud customers. By automating part of the security requirements, offering ready-to-use governance, and remaining highly modular, it frees up technical teams to focus on their business value.

Are you responsible for a cloud project and looking to reduce your production timelines while ensuring compliance? Contact OVHcloud to find out how a Landing Zone can become the foundation of your digital transformation.

Introduction

Dans le cadre d’un projet d’intérêt commun entre OVHcloud et Sopra Steria, les équipes techniques ont réuni leurs expertises pour concevoir le déploiement d’une Landing Zone (ou « zone d’accueil »). Dans un premier temps, le projet a été conçu et adapté aux exigences du secteur public et pourra ensuite être étendu à d’autres marchés/cas d’usage.

Pourquoi une Landing Zone ?

Conformité et exigences réglementaires

Le point de départ du projet était très concret : le gouvernement canadien exigeait, dès le premier jour, un environnement cloud qui respecte des standards de souveraineté et de sécurité très stricts.

Sans une solution prête à l’emploi, chaque cliente ou client public devait passer des semaines, voire des mois, à mettre en place son architecture, à rédiger des procédures et à valider chaque composant auprès des autorités. Cela engendrait un goulot d’étranglement lors de l’initialisation de projets.

« Le fait de ne pas disposer d’un processus pour déployer une Landing Zone conforme aux exigences du secteur public du Canada était un véritable bloqueur. »

La Landing Zone a été conçue comme un déploiement respectant le cadre réglementaire : l’infrastructure créée répond automatiquement aux exigences de segmentation, de chiffrement, de journalisation et de contrôle d’accès imposées par les autorités. La clientèle n’a donc plus à se soucier de la façon de prouver que son environnement est conforme. Le rapport de conformité est en effet généré en même temps que le déploiement. C’est d’ailleurs là tout l’intérêt de cette solution.

Accélération de l’adoption du cloud

Une fois le problème de conformité résolu, la Landing Zone se révèle un véritable accélérateur d’adoption pour tous types de clientes et clients : startups, PME, grands comptes et, bien sûr, les administrations.

• Automatisation des bonnes pratiques : les outils déploient automatiquement les réseaux privés, les sous-réseaux, les pare-feux, les comptes de service et les politiques IAM.
• Standardisation : chaque environnement suit le même modèle d’architecture, ce qui facilite la maintenance, le monitoring et la montée en charge.
• Time-to-market  : là où un déploiement manuel pouvait prendre plusieurs semaines de travail (lecture de la documentation, création manuelle des ressources, tests de conformité), la Landing Zone permet d’obtenir un environnement opérationnel (et conforme) en moins d’une heure.

« En une demi-heure, vous avez quelque chose de prêt à l’emploi : 30 à 40 % des exigences de sécurité sont déjà déployées automatiquement. »

Les bénéfices concrets pour les équipes techniques

Gain de temps et reproductibilité

Le cœur de l’automatisation d’une Landing Zone repose sur de l’Infrastructure as Code (IaC). Terraform (ou son fork OpenTofu) orchestre l’ensemble des services OVHcloud.
Grâce à ce modèle :

• un même script peut être exécuté plusieurs fois, dans différents comptes ou régions, sans que le résultat change ;
• les erreurs humaines liées à la création manuelle de ressources (erreurs de typographie, oublis de configuration, mauvaise attribution de rôle) sont quasiment éliminées ;
• les équipes passent de la configuration fastidieuse à la validation du déploiement, libérant ainsi plusieurs jours de travail par projet.

Gouvernance et gestion des accès

Outre l’infrastructure, la Landing Zone intègre un modèle de gouvernance : rôles, politiques et garde-fous sont préconfigurés, ce qui simplifie la gestion des accès et la révocation des droits lorsqu’une personne quitte l’entreprise. Cette couche d’abstraction répond à l’une des principales difficultés des DSI : la visibilité et le contrôle sur les ressources cloud.

Modularité et adaptabilité aux différents profils

Le code a été pensé pour être modulaire. Trois profils de base sont proposés : « small business », « medium »et « government ». Chaque profil active un jeu de services adapté (coût, évolutivité, exigences de conformité). 

Le même socle de code peut être étendu : si un client ou une cliente du secteur financier a besoin d’un module de chiffrement HSM ou d’une passerelle de paiement certifiée, il suffit d’ajouter le module correspondant et de relancer le script. Cette flexibilité permet de réutiliser la même base pour des projets très différents, tout en conservant la garantie de conformité et de performance.

Une solution qui fait la différence

Lorsque l’on parle de Landing Zone, on ne parle pas seulement de scripts qui créent des réseaux et des comptes.

Il s’agit d’un ensemble complet de services qui couvre tout le cycle de vie d’un projet cloud : de la réflexion stratégique à la mise en production, puis à la gestion quotidienne opérée par le ou la cliente.

Cette double expertise permet de couvrir l’ensemble du cycle de vie : stratégie → déploiement → exploitation.

Conclusion

La Landing Zone déployée sur les infrastructures OVHcloud répond à deux enjeux majeurs : la conformité pour de nombreux secteurs réglementés (notamment public, financier et de santé) et la rapidité d’adoption pour l’ensemble des clientes et clients du cloud. En automatisant une partie des exigences de sécurité, en offrant une gouvernance prête à l’emploi et en restant hautement modulaire, elle libère les équipes techniques pour leur permettre de se concentrer sur leur valeur métier.

Vous êtes responsable d’un projet cloud et vous cherchez à réduire vos délais de mise en production tout en garantissant la conformité ? Contactez OVHcloud pour découvrir comment la Landing Zone peut devenir le socle de votre transformation numérique.

Scaling a business is never linear. Growth brings new possibilities but also new pressures. The real test lies in staying agile while building strong technical foundations that let innovation flourish.

Across industries, ambitious teams are scaling faster and smarter with cloud infrastructures that adapt to them, not the other way around.

In this blog, two OVHcloud experts – Emma Dennard, Managing Director Corporate UK, the Netherlands, the Nordics & Canada; and Sylvie Houlière Mayca, Managing Director Corporate France Belux & MEA – share insights and examples of the scale-ups reshaping challenges into tangible success.

Whether you’re an AI innovator or digital pioneer, these are ways in which businesses can triumph when openness, scalability and transparency meet technical creativity.

Turning intelligence into impact

Emma Dennard

For many companies building AI, the biggest barrier isn’t imagination. It’s integration. Swedish scale-up Hopsworks knows that better than most. Born from a university research project, its platform helps developers speed up everything from image recognition to fraud detection and LLM training.

When Hopsworks first met OVHcloud, the team was frustrated by hyperscale tools that didn’t play well together and complex cloud pricing. What the company needed was freedom. Freedom to innovate fast, stay open and manage growth on their terms.

By joining the OVHcloud Startup Program, Hopsworks migrated its serverless offering to OVHcloud Public Cloud, using S3-compatible Object Storage and open-source frameworks to stay agile as AI evolves. The result? 62% savings on cloud costs, freeing capital for new strategic projects.

More than that, Hopsworks avoided the lock-in that can slow innovation. With OVHcloud’s predictable pricing, European Sovereignty and open standards, the company gained the flexibility to keep adapting.

Read more about how Hopsworks scales AI innovation without compromise.

Raising the AI game

Emma Dennard

Before the world was talking about generative AI, Leetify was already using machine learning to help gamers improve. Its AI coaching platform analyzes player performance in Counter-Strike: Global Offensive, giving instant feedback after each match.

That requires serious bandwidth. In 2022, Leetify was processing over two million matches every month, moving around 70TB of data in real time. Any lag, outage or DDoS attack could mean lost players. And lost trust.

By combining OVHcloud Dedicated Servers with Public Cloud, Leetify gained both reliability and flexibility: 99.99% uptime, unlimited unmetered traffic and the ability to scale instantly during peak tournaments.

This resulted in around 50% lower costs and uninterrupted performance for players worldwide. For a fast-moving team pioneering AI in gaming, that kind of stability means savings, but it also means freedom to innovate, experiment and win.

See more on how Leetify stays competitive with OVHcloud reliability.

Reinventing reliability

Sylvie Houlière Mayca

In an age of disruption, few names say trust quite like Ravensburger. The German company has been sparking creativity for over a century through games, books and puzzles that millions of families know by heart. But even tradition had to transform.

As Ravensburger’s global business grew, so did its digital footprint. The brand’s go-to-market strategy combines physical retail with a thriving e-commerce platform. Both have to perform seamlessly, all the time.

At peak moments like Christmas, or lockdowns introduced during the COVID-19 pandemic, traffic to the online store could surge overnight. The company’s on-premises infrastructure simply couldn’t keep up. The challenge was clear, deliver the same premium experience for every customer, at any hour, without interruption.

Ravensburger migrated its online business to OVHcloud Hosted Private Cloud (HPC), gaining an infrastructure built for elasticity, high availability and international reach. With compute, storage and networking resources tuned for performance, demand spikes are handled automatically.

Now, with its e-commerce foundations secured, Ravensburger’s next chapter is all about intelligence. This means using AI to better understand customer profiles and match products to children and families worldwide.

Learn more about how Ravensburger combines resilience and growth with OVHcloud.

Cultivating sustainable growth

Sylvie Houlière Mayca

Agriculture may not always be the first industry associated with AI, yet Colombian scale-up Manglar is showing how technology can meaningfully enhance and support this vital sector. Focused on agrotech innovation, the company uses drone imagery and machine learning to monitor crops, detect issues early and improve yield sustainably.

When Manglar first partnered with OVHcloud, the team needed a way to balance rapid growth with predictable costs and performance. What began as a search for efficient storage evolved into a full-scale infrastructure collaboration. By integrating OVHcloud GPU instances for training and inference, and storage servers for data processing, Manglar now runs high-performance image analysis that delivers real-time insights to farmers across Colombia, Mexico and Brazil. But the company isn’t stopping there, with plans to expand to the US and Argentina next.

For a business working at the intersection of technology and the environment, reliability and governance are everything. OVHcloud’s transparent pricing, open architecture and dedicated local support have helped Manglar optimize resources, maintain investor confidence and grow responsibly – both technically and financially. 

Behind the success is a team of builders who blend data science with purpose. These engineers have fine-tuned inference models to deliver faster, more accurate predictions, while leadership focuses on scaling impact on economic and environmental levels. It’s a model for how innovation can help drive sustainability, not strain it. 

Next steps for Manglar include the full migration of its ML and inference workloads to OVHcloud, requiring H100 or H200 GPU availability. This will allow for more efficient scaling while improving processing speed. Part of the OVHcloud difference is the ability to turn infrastructure into a growth engine while keeping governance and impact front of mind.

Scale smarter – 6 inspiring use cases

1. Rebuilding for agility

Webmecanik transformed its monolithic infrastructure into a distributed platform to better support growing demand. By adopting OVHcloud’s Kubernetes solution, the company gained scalability, enhanced performance and improved reliability. Webmecanik’s commitment to customer-centric automation means it delivers marketing solutions that can adapt to client needs dynamically.

Discover how Webmecanik scaled up for success, here.

2. Mastering momentum

Programmatic advertising requires speed, precision and reliability. Nexx360 leveraged OVHcloud’s Kubernetes infrastructure to scale its advertising platform globally, maintaining high performance even during spikes in ad delivery. The team’s innovative use of automation in campaign optimisation makes them stand out as builders transforming digital marketing operations.

Learn how Nexx360 stays flexible and cost-efficient in the cloud, here.

3. Enhancing user experience

CUX.io, a platform for UX automation, required tailored hosting to manage unique workloads and deliver consistent user experiences. OVHcloud provided customised cloud solutions that ensured stability and performance. CUX.io’s dedication to measuring every interaction to optimize UX demonstrates the creative thinking behind technical scaling.

See how CUX.io optimized user experience across multiple platforms, here.

4. Setting new boundaries

Floatplane’s hybrid cloud approach combines bare-metal servers with Managed Kubernetes, enabling rapid scaling while maintaining low latency for its video streaming service. What differentiates Floatplane is its focus on community-driven content delivery, ensuring that both creators and viewers benefit from a seamless experience, even as the platform grows.

Learn how Floatplane keeps viewers engaged, here.

5. Leading with clarity

Lota.cloud aims to become a leader in FinOps and opted for OVHcloud’s managed services to streamline operations while ensuring regulatory compliance. By embracing scalable cloud solutions, Lota.cloud can support complex financial processes without sacrificing speed or flexibility. The company’s dedication to transparent, data-driven decision-making highlights the careful planning to builders navigating high-stakes sectors.

Learn how Lota.cloud scaled its logistics platform effortlessly, here.

6. Growing responsibly

As a leading provider of healthcare analytics, IAMDS relies on OVHcloud to manage sensitive patient data securely while scaling services across multiple regions. By combining secure infrastructure with flexible cloud solutions, IAMDS ensures compliance with strict regulations while enabling real-time analytics that drive better patient outcomes.

Find out how IAMDS delivers secure, scalable digital solutions, here.

Driving growth and impact with confidence

Companies thrive when their infrastructure is flexible, reliable, transparent and cost-predictable. Whether powering AI platforms, enabling global e-commerce, or supporting high-performance gaming, OVHcloud equips teams to focus on what matters most: innovation, growth and tangible results.

The right cloud partner provides the technology you need. That much is clear. But it also lays the foundation for strategic decision-making, international expansion and long-term success. With robust infrastructure, open standards and responsive support, companies can scale with confidence and absorb peak demand while builders invest energy into advancing their vision rather than managing technical hurdles.

Explore how OVHcloud can help your business scale with confidence here.

Building a real-time data pipeline used to mean months of infrastructure work. Here is what the modern stack looks like in 2026.

Your database is doing its job. It records every transaction, every event, every state change your application produces. The data is reliable, consistent, and safely stored.

But a database is a starting point, not a destination. The question is what happens after the write. Does that data stay in storage, answering application queries, while the insights it could generate stay locked in place? Or does it flow downstream, in real time, to the systems built to make sense of it?

Building that downstream pipeline used to be a serious infrastructure project. Kafka clusters to provision and tune, ZooKeeper ensembles to manage, connectors to configure, sinks to wire up, and a schema registry to operate. A team could spend weeks on the scaffolding before the first event reached an analytics engine.

In 2026, the pipeline architecture has not changed. But the operational weight has. Managed services handle provisioning, replication, failover, and upgrades. What used to take a dedicated platform team now takes an afternoon. This article walks through what a complete real-time data pipeline looks like, how each layer connects, and what it takes to build one without building the infrastructure underneath it.

The four layers

A modern real-time data pipeline has four layers. Each has a distinct job, and none of them are optional if you want data to move continuously from storage to insight.

Storage

Where your data originates. A relational database like PostgreSQL handles transactions, enforces consistency, and serves your application. It is your source of truth. Every insert, update, and delete is recorded with precision. That write log is also the starting point for everything downstream.

Streaming

How data moves. Apache Kafka captures changes from your database the moment they happen and distributes them to downstream consumers as events. Every row-level modification becomes a structured message that other systems can act on in real time. Kafka’s core design principle is decoupling: producers write events without knowing who will consume them, and consumers read events without touching the source system. This means you can add new downstream use cases – a new analytics engine, a new alerting system, a new data warehouse – without modifying the database or the application above it.

Analytics

Where data becomes answers. Two distinct engines cover the two main post-storage use cases. ClickHouse handles OLAP workloads: fast columnar queries, real-time aggregations, time-series analysis, and dashboards over millions of rows per second. OpenSearch handles full-text search, log analytics, and observability: complex queries across weeks of event data, anomaly detection, distributed tracing, and alert rules over live event streams. Both engines are designed for reads at scale, not for transactional consistency: this is exactly the trade-off you want after Kafka.

Visualisation

How the answers reach people. Grafana connects to both ClickHouse and OpenSearch, pulling from live data to power dashboards, alert panels, and operational monitors. It is the layer that makes the pipeline visible across the organisation – to the product team checking feature adoption, to the security team watching for anomalies, and the platform team tracking infrastructure health.

Two paths through the same architecture

The topology is consistent regardless of your use case: source database, Kafka as the streaming backbone, one or both analytics engines, and Grafana on top. How you build it depends on what your team needs first.

The real-time analytics path

PostgreSQL + Kafka + ClickHouse + Grafana is the right starting point when the primary need is fast, flexible querying. Product analytics, business intelligence, time-series reporting, funnel analysis, A/B test results in real time: these all call for ClickHouse. It ingests directly from Kafka topics, materialises views that dashboards query in milliseconds, and handles aggregations over hundreds of millions of rows without breaking a sweat. The SaaS company that needs to see feature adoption as it happens, the fintech tracking transaction volumes by the minute, the e-commerce platform running live inventory analytics – these all follow this same path.

The search and observability path

PostgreSQL + Kafka + OpenSearch + Grafana is the right starting point when the primary need is full-text search, log aggregation, or system-wide observability. OpenSearch indexes events as they arrive, enabling complex searches across months of structured and semi-structured data with sub-second response times. The security team correlating events across distributed services, the platform team centralising logs from dozens of microservices, the SRE team building alerts on top of live event streams – these all follow this path.

How the data moves

The connection between your database and Kafka starts with change data capture. CDC is the mechanism that reads your database’s internal write log and turns each modification into a stream of structured events.

In PostgreSQL, this works through logical replication. The write-ahead log records every change made to the database, at the row level. With logical replication enabled, a connector can read that log and emit each change as a structured event with the full before and after state of the row. Kafka Connect is the integration layer that runs these connectors. Debezium, configured as a source connector within Kafka Connect, reads the PostgreSQL WAL and publishes each change to a dedicated Kafka topic. From there, sink connectors route events to ClickHouse, OpenSearch, or both.

One technical development worth understanding for anyone building on Kafka in 2026: Kafka 4.0 removes ZooKeeper entirely. ZooKeeper was the external service Kafka relied on to manage cluster metadata, leader election, and coordination. It was a separate system to deploy, configure, monitor, and upgrade alongside the Kafka brokers. Kafka 4.0 replaces it with KRaft, Kafka’s native Raft-based consensus protocol. Cluster metadata is now managed internally by Kafka itself. The result is a single, self-contained system with fewer components, fewer failure modes, and faster recovery. For anyone who operated a Kafka cluster under the ZooKeeper model, this is a material simplification. For anyone running Kafka as a managed service, the transition is mostly invisible: what you get is a faster, more resilient cluster with one less operational surface.

OpenSearch 3.0 is also a meaningful release for anyone building observability pipelines. The upgrade to Apache Lucene 10 delivers up to 60 per cent lower search latency, with the largest gains on vector search, KNN, and neural search workloads. Star-tree indexing reduces query work for heavy aggregations by up to 100 times. And OpenSearch 3.0 adds native MCP protocol support, which means it integrates directly with AI agents and LLM-based tooling. For teams building observability pipelines that feed into AI-driven incident investigation or alerting workflows, this is a capability that was unavailable even twelve months ago.

Why managed matters

The first thing most teams underestimate about this stack is not the initial setup: it is the ongoing operational surface.

On Kafka, the harder work starts after launch. Partition leader rebalancing when a broker restarts under load. KRaft controller quorum recovery after a node failure. Consumer group offset management when a sink connector falls behind and you need to replay events without duplicating records downstream. JVM heap tuning as throughput grows. Connector worker restart policies that do not lose in-flight events. On OpenSearch, add shard allocation decisions during cluster scaling, index lifecycle management policies to control storage costs as event volumes grow, and JVM tuning for the ML nodes that power vector and neural search. On ClickHouse, merge tree settings and partition pruning strategy matter from day one: getting these wrong early means rewriting table schemas under load.

Managed services absorb this operational surface. Rolling upgrades run without downtime because the service handles leader migration before taking a node offline. Connector workers are monitored and restarted automatically. Failover is handled at the infrastructure level across availability zones. Index lifecycle policies are configurable through the console rather than through manually applied configuration files. Analytics engineers already spend up to 40 per cent of their time on infrastructure maintenance rather than delivering insights. The managed services model moves that complexity to a layer you do not have to own.

For teams in Europe, there is a second dimension. Hyperscaler deployments in EU regions run on infrastructure governed by U.S. law, which means the legal framework around who can access your data, and under what circumstances, is not straightforward. Running on OVHcloud means the infrastructure is European, operational control is European, and the jurisdiction governing data access is unambiguous. For teams in regulated industries, or for any team that fields GDPR compliance questions from customers or auditors, that is a material difference from a cloud region that happens to be located in Europe.

Pricing is the third dimension. Hyperscaler bills can be opaque: data transfer costs between services, storage billed separately from compute, egress fees that compound as event volumes grow. OVHcloud pricing includes IOPS, traffic, and backups. You see the cost before you provision. There are no surprises when your Kafka throughput increases.

Building it on OVHcloud

OVHcloud runs all four layers as managed services, deployed and monitored from a single console.

Provision Managed Kafka, pick your region, and your cluster is ready in minutes. Kafka 4.0 with KRaft means no ZooKeeper to configure or monitor. Add Managed Kafka Connect and configure your PostgreSQL source connector, with optional Debezium CDC for full row-level change capture. Then provision Managed ClickHouse and add a sink connector to start routing events from your Kafka topics into ClickHouse tables, or provision Managed OpenSearch and route events there instead. Add Managed Grafana to connect to both engines and begin building dashboards on live data.

The full stack is five managed services on one platform: PostgreSQL, Kafka, ClickHouse or OpenSearch (or both), and Grafana. One console for provisioning and monitoring. One bill. One support team that understands the full pipeline, not just individual components in isolation.

Start with one layer

You do not have to build the whole pipeline on day one. The most common starting point is Kafka: get your data flowing before you decide where it is going. Once events are moving through Kafka topics, adding ClickHouse or OpenSearch is a connector configuration, not a re-architecture.

The pipeline you build this way is modular by design. Each layer adds independent value. The team that starts with Kafka and adds ClickHouse six months later has not wasted anything in between. The Kafka layer was already doing its job. The pipeline grew without disrupting what was already working.

The infrastructure is managed. The data stays in your hands. The pricing is transparent. The pipeline you need already exists on one stack.

Explore the OVHcloud managed data pipeline