Indeed, launching a collective project is far from being an easy task, but that precise challenge is also making the whole interest of it! At OVHcloud, and because our DNA is to focus on collective progress, our core challenge is to embark as many as possible on this long race to lead data revolution and master our digital future. Therefore, being part of Gaia-X was not even a question: it made – and still makes – pure sense.  

Aligning hundreds of players on labelling criteria is possible, and it will help the entire European market in its decision-making when it comes to cloud

When joining Gaia-X’s board, back in 2021, the very heart of the debates has been beating upon the organization’s labelling framework. Hence, even if Europe is often described as the most complex market in terms of regulations it is still surprisingly not the case when it comes to the very foundations of our digital future: the cloud. Across many codes of conducts, and self-regulations efforts, the core challenge has been to define a clear Trust Framework, backed up with strong Policy Rules that would nurture an ambitious labelling structure. And as these efforts are paying off, the full architecture of Gaia-X labels has been adopted as soon as last spring. They now guide the definition of a federated services catalogue that will be core to the Gaia-X value proposition.   

Where are these labels rooted?

They originate from the Policy Rules Document (now Policy Rules and Labelling Document) which sets a series of high-level objectives to be achieved by cloud services providers’ offerings. The labelling framework is also set on Gaia-X Trust framework which is the set of rules that define the minimum baseline to be part of the Gaia-X ecosystem. Those rules ensure a common governance and the basic levels of interoperability across individual ecosystems while letting the users in full control of their choices.

And what’s in it ?

The labels’ main objective is to provide cloud services users with transparent and trusted information to allow them to make informed choices and select the most appropriate services according to their needs. To that extent the labelling framework is composed of 62 criteria regarding contractual governance, transparency, data protection, security, portability and European control. 3 levels of labellization are offered with the highest (level 3) offering users the guarantee that the services they chose are located in the EEA but most importantly that they are protected against access from extraterritorial authorities.

Such a framework usually takes decades to define, but collectively, we did it! And guess what, we’ll do much more than setting the rules of our cloud game.

Gaia-X will not be an “Airbus-like” cloud, and we know how and why

Building on this huge milestone of Gaia-X labeling framework, dozens of developers, security experts and data scientists are already working on a dynamic catalogue, dedicated to the sorting and security stamps that each offering listed across the European market could claim.

And the first demos are already working! Because Gaia-X will never be a new cloud offering among others, but a clear decision-making support to help EU seize the full potential of its data revolution.

As such, we embarked Gaia-X federated services project: a consortium 6 of the 11 French founding members of Gaia-X including Atos, 3DS Outscale, Docaposte, OVHcloud, Institut Mines Telecom, as well as CISPE, BYO Networks, and Dawex. By working together on a project to accelerate the definition and development of Gaia-X federated services within Gaia-X governance, we all pushed so hard to pool it and lay the groundwork for an integrated Gaia-X catalogue that will stay true to Gaia-X value, all the while benefitting cloud users. In an open and completely transparent manner, the fruits of this collaboration will include documentation, specifications, architecture documents and source code.

More concretely, this catalogue will allow users to search, find and select cloud services by criteria and label levels, including data protection, cybersecurity and portability, that’s why it is so important to bring our contribution to it. The so-called GXFS-FR is the first building blocks for users to experiment and sort out services with a complete overview of the offerings they can leverage to evolve their data strategy.

Operationalization of Gaia-X is underway, and it shall come sooner than you expected

Satisfecit? Fine! But what’s next? A well-known futurist, Joel Arthur Barker, once said “a vision without action is merely a dream” so here we are, trying to change our digital future and the good news is that time for action has come.

The catalog, of which OVHcloud has been a major artisan through GXFS-FR project already encompasses more than 170 services whose compliance to Gaia-X Trust framework has been technically assessed.  As a founding member of Gaia-X, it was even more than our duty to be -once again- among the very first to bring our contribution, but this time in an operational mindset, declaring 30 of our main services that are all susceptible to be, at least, awarded a label level 1, thus providing users with the assurance that the services used comply with European regulations, and first and foremost the GDPR. We are also on track with 3 of our services which are likely to be certified at level 3 as expected based on our SecNumCloud certification, providing users with the guarantee that their data benefit from the highest level of protection, against cyber threats and access by extraterritorial authorities.

With these first building blocks for users to experiment and sort out services thanks to the complete overview enabled through Gaia-X Federated services catalogue. IT decision makers across Europe will now see clearly the offerings they can leverage to adapt their data strategy. Gaia-X is now on the way of its operationalization, and it is only the beginning so stay tuned! The best is yet to come.

In today’s world, and now even more so with the recent quarantine measures, we rely on cloud services for running our infrastructures and storing our data.

The GAIA-X initiative is born from a need to raise data sovereignty awareness and create a federated trustworthy cloud ecosystem for Europe.

In this article, we will discuss how the GAIA-X demonstrator group – composed of 3DS OUTSCALE, Docaposte, German Edge Cloud, Orange Business Services, OVHcloud, Scaleway and T-System – created a catalogue search engine prototype.

One goal of the catalogue search engine was to enable a user to search and select the services that match their needs. The objective is to be inclusive and expose information to the user so they can make transparent, educated choices. The information described for each service includes at least all the relevant “Policy Rules” defined by the GAIA-X governance as mandatory and a set of technical descriptions. The “Policy Rules” covers a variety of domains (data protection, security, reversibility, etc.) and is developed in two documents: one for Infrastructure Policy Rules, and another for Data and Software Policy Rules.

Of course, all of these should be available in a machine readable format to enable automated service selection.

The first step is to list various infrastructure scenarios based on each of our respective customer requests and extract a semantic out of the requirements.

For example, if a customer requests “a database compliant with PCI-DSS for payment services, hosted in Germany following the CISPE Data Protection Code of Conduct”, the entities of interest are “database”, “PCI-DSS”, “Germany” and “CISPE Data Protection”.

But how do the entities relate to each other and how are they defined? And can we classify them?

One intuitive way to represent the semantics was to use graphs like the ones below:

With those various scenarios in mind, we found patterns and decided for the first release to have a simple graph database ontology (below):

This ontology is not intended to cover all future GAIA-X needs. We have more advanced ontologies we will cover in future articles.

We also defined a taxonomy to classify services and enable attributes on nodes.

The next step was to deploy a development and staging environment. We decided not have a production named environment to avoid confusion and highlight the fact that this demonstrator is an implementation of how the GAIA-X catalogue could work and not necessarily how it will be implemented later.

We used Gitlab with a managed Kubernetes cluster integration and standard CI/CD pipeline setups for deploying the micro-services. We used Neo4j graph database for storing the data.

With an ontology and taxonomy, the next step was to fill a database.

To speed-up the development, we focused on Object Storage service for the release. Each of the cloud providers working on the demonstrator filled the database with its Object Storage service description.

Finally, as one of the criteria of GAIA-X is User-Friendliness, we created an intuitive way to query the database with a classic search engine user-interface.

For advanced querying, we decided to not expose Neo4j Cypher query language but to create an even simpler parsing grammar based on the relationships between the nodes and their attributes. This allowed us to implement a free-form input field with auto-completion. We used the Parsing Expression Grammar PEG.js engine using the following grammar:

logical_and ::= expression "AND" logical_and
expression  ::= "NOT" expression / primary
primary     ::= "(" logical_or ")
              | rules
rules       ::= node relation node
              | node relation "ANY(" node+ ")"
              | node relation "ALL(" node+ ")“
              | node.property "=" value
              | node.property "!=" value
              | node.property "IN ANY(“ value+ “)"

This grammar enables the user to express more advanced queries such as:

Service IMPLEMENTS ANY('S3', 'SWIFT') AND (Service COMPLIES_WITH 'GDPR' OR Provider LOCATED_IN 'European Economic Area')

Service.type = 'object storage' AND Service LOCATED_IN ALL('France', 'Germany')

Lastly, the source code is released under the BSD-3 license and we expose OpenAPI, JSONSchema and JSON-LD specifications to facilitate interoperability and re-usability.

To conclude, we are proud to see that some of this work already landed in the GAIA-X Technical Architecture Paper and that we successfully managed to work together on a shared vision, as a European ecosystem.