Home › Cloud › Private cloud › 101

Private cloud hosting 101

Use this guide to learn about private cloud hosting in the B.C. government and determine if it’s the right option for your product or service.

What is the Private Cloud OpenShift Platform

The B.C. Government Private Cloud Platform as a Service (PaaS) is a reliable and secure application hosting platform for deploying and running government services.

Understanding Red Hat OpenShift

Red Hat OpenShift is a platform that allows you to build and deploy applications in the cloud. It has 3 key characteristics.

Enterprise-level platform

Enterprise-level platforms provide the technology and tools required to build multiple applications and integrations across an organization. We evaluated OpenShift’s functionality to make sure it met the needs of product teams across the B.C. government. 

Container platform

OpenShift is a container platform. On this type of platform, all the code and components associated with an application are grouped into a container or unit of software. A container will include everything an application needs to run quickly and reliably from one computer system to another or through multiple deployment environments.

Kubernetes system

OpenShift is built on Kubernetes, an open-source container platform. Kubernetes helps developers manage the services and workloads associated with managing containers by automating many of the manual processes. OpenShift builds off of Kubernetes to provide additional features and functionality.

Why we chose OpenShift

When looking for a platform to host B.C. government applications in the private cloud, we wanted a solution that leveraged Agile methodology, explored new team structures, improved digital delivery and focused on enabling developers and their teams. Red Hat OpenShift delivers on these requirements and provides opportunities to expand in the cloud space.

Platform advantages

Self-serve

Provides a controlled but flexible environment that lets you focus on your build. This allows you to have control over your own applications, have more efficient deployments and deliver services sooner.

Secure

Includes a broad set of built-in security features that help protect the platform. It’s also compatible with several vulnerability scanning and monitoring tools to keep the platform secure.  

Independent

Ability to build and deploy applications without worrying about the limitations of sharing a server. Containers can perform their operations without interfering with other containers. This means your application won’t affect other teams and their applications won’t affect yours. 

Scalable

Allows for building your application to dynamically adjust computing resources and capacity as load requirements change. With automated scaling, you can be confident your application is getting the resources it needs, when it needs them.

Overview of our service

We build and maintain the B.C. Government Private Cloud PaaS. PaaS products let you develop, run and manage your cloud-native applications without having to build and maintain the infrastructure or platform.

The B.C. Government Private Cloud PaaS is powered by the Red Hat OpenShift Container Platform and is hosted in the B.C. government’s data centres in Kamloops, B.C. and Calgary, Alberta. This platform can be used by ministries, agencies and Crown corporations working with the Government of B.C.

As part of the platform, we provide platform administration and shared tools.

Platform administration

We take care of administration services that allow you to onboard and work on the platform.

This includes:

  • Approving and setting up your namespaces on the platform
  • Running the Platform Product Registry, which automates project provisioning in OpenShift
  • Maintaining the OpenShift platform
  • Providing OpenShift training for you and your team

Shared tools

We purchase, build and maintain the platform’s shared tools, which can be used in your environments.

These include:

  • Sysdig Monitor for monitoring your application
  • JFrog Artifactory, HashiCorp Vault and Repo-Mountie to improve your application security
  • Rocket.Chat and the platform newsletter for communication and platform updates

Requirements

The B.C. Government Private Cloud PaaS is offered to B.C. government ministries, agencies and Crown corporations who are interested in building open-source software for internal or citizen-facing applications. Teams who join the platform should be willing to adopt modern technology architecture and development approaches, including DevOps, Agile and continuous delivery. 

In order to use the B.C. Government Private Cloud PaaS, your team must be able to meet our requirements.

Product team requirements

Funding

It’s important that your application is monitored and maintained throughout its time on the B.C. Government Private Cloud PaaS. For this reason, only fully-funded teams are currently being accepted to work on the platform. To be considered fully-funded, your team must have a sufficient budget to support your application during development and after the initial development is complete.

Team roles

Your product team must include a product owner, DevOps lead and a technical lead.

Product owner

You must be able to identify a permanent government employee on your team who will act as the product owner of your application. 

The product owner is accountable for keeping your application’s code, libraries and supporting tools functional, current and secure. This includes responding to any changes in the platform service or its related technology or tools that may affect your application’s performance. The product owner is responsible for your application throughout its entire lifetime on the platform, including after it’s deployed.

You’ll be asked to provide the name and contact information for your application’s product owner at your initial onboarding meeting.

DevOps lead

You must have at least one person on your team with DevOps skills when you join the platform, who will act as the DevOps lead. The DevOps lead is responsible for ensuring that your application is designed for resiliency and high availability and has monitoring and alerting functionality.

Technical lead

Your team must have at least one, or up to 2, technical leads, who can be listed as primary technical contacts for your application. If a problem is detected with your application or a change in the application is required as part of the platform service updates, the Platform Operations team will contact your technical lead. Your technical lead must be able to respond to these issues or changes and update your application as required. 

The roles of technical lead and DevOps lead can be fulfilled by the same person, if they meet the knowledge and skill requirements for both roles.

Hiring contractors

Ideally, everyone on your product team should work in a B.C. government ministry, agency or Crown corporation. However, if needed, you can hire senior-level contract staff to fill DevOps and technical roles on your team. Product owners must be permanent government employees.

Product team success factors

Before building any applications on the platform, you are strongly encouraged to have the following additional recommended skills and knowledge. 

The ideal product team for the platform:

  • Follows an Agile methodology
  • Uses open-source code
  • Contributes to the B.C. government’s open-source community

If your team does not have these additional qualifications, you can still join the platform and engage with the platform community. There are many opportunities to learn from others and develop DevOps and Agile skills through community engagement and training. You can also get training on Agile methodology in the Exchange Lab.

Application requirements

You must be able to show that your proposed application is suitable to run within a containerized environment. Your application is considered suitable if:

  • You plan to build it using cloud-native architecture and technology stacks
  • You have endorsement from your ministry’s IMB or architecture team to host your application on the B.C. Government Private Cloud PaaS

You must also be able to build your application in an open-source environment. Your underlying code will be stored in the public bcgov organization repositories in GitHub and will be visible to everyone on the internet.

Community requirements

We follow a community-based support model that relies on the participation of all platform product teams. If you join the platform, you are expected to engage with the platform community. 

Whenever possible, you should:

  • Use Rocket.Chat to ask and answer questions and provide support to other teams
  • Attend platform community meetups to watch demonstrations from other teams, present progress or express lessons learned from your own application

Costs

Silver and Gold hosting tiers are free in the 2021/2022 and 2022/2023 fiscal years. 

A cost recovery model may be implemented in the 2023/2024 fiscal year. It hasn’t been determined if there will be a cost for product teams or what that cost would be.

You’re expected to perform resource tuning for your application, like you would with a paid service.

Security and privacy compliance

We prioritize availability, integrity and confidentiality in all aspects of the platform. We work hard to keep the platform secure and privacy compliant with government standards, so you can feel confident deploying your application on the platform. 

Security compliance

The B.C. Government Private Cloud PaaS meets government security standards for cloud services. 

Data hosting

We securely host all B.C. Government Private Cloud PaaS platform and application data in Canada. Data for applications hosted in the Silver hosting tier is stored in our Kamloops, B.C. data centre. Data for applications hosted in the Gold hosting tier is stored in the Kamloops, B.C. data centre, with a geographic failover to our Calgary, Alberta data centre.

Platform updates

We manage the platform’s operating systems and infrastructure components and regularly update the platform. These updates include new features and functions that improve platform capabilities and fix bugs that are discovered in existing features.

In addition to regular updates, we’re continuously monitoring the platform and proactively patching security vulnerabilities to keep applications secure and compliant.

Penetration tests

The platform undergoes a yearly penetration test to evaluate the security of the system and identify any vulnerabilities. 

Using a third party vendor, we run simulated attacks in the B.C. Government Private Cloud PaaS. These penetration tests, also known as pen tests, are simulated cyberattacks meant to help us identify and mitigate security risks before they are exploited.

Security Threat and Risk Assessment (STRA)

We review Red Hat OpenShift releases to ensure that they are compliant with the B.C. government’s information security policies. We complete a Security Threat and Risk Assessments (STRA) to meet the B.C. government’s STRA standard. STRAs are also performed on tools hosted on the platform.

In order to meet and maintain STRA requirements, we:

  • Completed an initial STRA during the planning, development and implementation of the platform
  • Maintain a review schedule to ensure STRA updates are conducted periodically

STRAs help us identify the platform’s criticality (confidentiality, integrity and availability needs), its information security classification and any gaps or weaknesses that should be addressed. We complete STRA analysis using a combination of tools, including:

Once a STRA is complete, a Statement of Acceptable Risk (SoAR) is completed to capture all identified security risks and recommendations. The SoAR is reviewed and signed off by the business owner, the Ministry Information Security Officer (MISO) and the Ministry Chief Information Officer (MCIO).

Privacy compliance

Information security classification

The B.C. Government Private Cloud PaaS offers application and information hosting that is suitable for most government services. The platform meets the requirements for hosting information up-to and including Protected B classification. 

Open-source development

As a product team on the B.C. Government Private Cloud PaaS, you’ll use GitHub to build your application in an open-source, public environment. Security and privacy assessments were completed for GitHub, as part of the OpenShift STRA and PIA evaluations.

Private projects

If you’d prefer to start working on your project privately, you also have the option to request a private repository for your OpenShift project in GitHub. However, this arrangement can only be temporary. You must have a plan to eventually move your project to a public repository.

Learn more about working in the open with GitHub.

Privacy Impact Assessment (PIA)

A Privacy Impact Assessment (PIA) was completed for Red Hat OpenShift. In order to meet and maintain PIA requirements, we:

  • Completed an initial PIA during the planning, development and implementation of the platform
  • Conduct additional privacy assessments as needed when changes to the platform impact the use, disclosure or collection of information

Critical Systems Standard

We are very close to obtaining Critical Systems Standard compliance. The documentation required to meet the Critical Systems Standard is in the final stages of review for submission.

Meeting the Critical Systems Standard certifies that the B.C. Government Private Cloud PaaS meets higher levels of security and reliability, to deliver critical services to citizens. 

The Critical Systems Standard:

  • Defines what systems are critical
  • Identifies the roles and responsibilities of system providers
  • Outlines the requirements for systems that provide a critical service
  • Provides guidelines on how to minimize the impact of a disruption to a critical system or service

Once the platform is compliant with the standard, it’ll undergo an annual review to ensure that it continues to meet critical service hosting requirements.

Security and privacy tools

You are responsible for ensuring that your application meets security and privacy standards. There are several tools available in OpenShift that you can use to identify vulnerabilities and keep your applications secure.

We also provide a large collection of design patterns on the platform that follow security best practices. You can use these patterns to build secure integrations between your OpenShift applications and external systems. To learn more about design patterns, post a question in the #devops-how-to Rocket.Chat channel.