Skip to content

docs(scaleway): state of the art — capabilities, managed scope, observability - #17

Open
UlysseCarpentier wants to merge 6 commits into
mainfrom
docs/scaleway-kapsule-state-of-the-art
Open

docs(scaleway): state of the art — capabilities, managed scope, observability#17
UlysseCarpentier wants to merge 6 commits into
mainfrom
docs/scaleway-kapsule-state-of-the-art

Conversation

@UlysseCarpentier

@UlysseCarpentier UlysseCarpentier commented Sep 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

The Scaleway sprint's research, in the shape the AWS and GCP sprints used. Feeds #4. Covers three board tickets:

Board ticket Document
Kapsule : capacités et limites vs hyperscalers docs/scaleway/kapsule-capabilities.md
Périmètre managé vs à notre charge docs/scaleway/managed-scope.md
Supervision & coûts (offre B) docs/scaleway/cloud-observability.md

Plus docs/scaleway/README.md, the decision index, matching docs/gcp/README.md.

Scope note: the Scaleway sprint has no "Réseau & sécurité de base" ticket, unlike AWS and GCP. Rather than defer to a ticket that does not exist, the network baseline is decided in kapsule-capabilities.md.

The findings that changed a decision

  • Scaleway operates more of the data plane than EKS does, and gives less control over it. CoreDNS, kube-proxy, CNI and CSI are all Scaleway's, with no version field and no opt-out — so the add-on line, where an EKS estate spends its version-management effort, costs nothing here. The ops gap against AWS is almost entirely credentials: ~1.5 days/month per client.
  • Two unrelated constraints converge on one Project per environment. IAM has no per-resource conditions outside IAM, Key Manager and Secret Manager; consumption carries no tags. Access and cost have the same only boundary.
  • The Public Gateway is zoned and has no HA. Scaleway's own answer to a zone outage is several gateways on one Private Network. Full isolation in production therefore costs three gateways, not one.
  • The reference estate does not fit default quotas. POP2-HC-8C-16G is capped at 2 and production wants 4 — a support ticket before the first apply, which no module can do.
  • /federate is free today and Scaleway says it will be billed after beta, with no published rate. The one figure here that must be re-read before a client signs.

Corrections to earlier commits in this PR

  • The Private Network's /22 range is chosen, not imposed — wrong for any module that creates the network itself.
  • "No discounted capacity" was false: savings plans exist, at ~10% against three years of lock-in.

Cost

Reference estate (prod 20 vCPU / 40 GiB of requests, staging 8/16, dev 4/8): ~€1,235/month, against $1,488 for the same estate on GKE Autopilot. Supervision adds €0 today. Stated plainly rather than glossed: that sizing does not survive a zone loss — six production nodes do, +€311/month.

Test plan

  • The four documents render correctly on GitHub.
  • Figures re-checked against the linked sources (fr-par list price ex-VAT, read 14 September 2026).
  • The ~1.5 days/month ops estimate is the right order of magnitude for the offer's pricing.
  • The positions are the ones the Scaleway foundations module should inherit.
  • Confirm the network baseline belongs here rather than in a ticket to be created.

Out of scope

"Validation du pari Crossplane & couverture IaC" — the fourth Scaleway research ticket, untouched here.

🤖 Generated with Claude Code

@UlysseCarpentier UlysseCarpentier changed the title docs(scaleway): state of the art — Kapsule capabilities and limits vs the hyperscalers docs(scaleway): state of the art — capabilities, managed scope, observability Sep 14, 2026
@UlysseCarpentier UlysseCarpentier mentioned this pull request Sep 14, 2026
Open
4 tasks
@UlysseCarpentier
UlysseCarpentier added this pull request to stack #19 September 14, 2026 12:44
@UlysseCarpentier
UlysseCarpentier marked this pull request as ready for review September 14, 2026 12:44
@UlysseCarpentier UlysseCarpentier mentioned this pull request Sep 14, 2026
Draft
5 tasks
Garinlu
Garinlu reviewed Sep 15, 2026
View reviewed changes
Comment thread docs/scaleway/kapsule-capabilities.md Outdated
Comment thread docs/scaleway/managed-scope.md Outdated
Comment thread docs/scaleway/managed-scope.md Outdated
@UlysseCarpentier
UlysseCarpentier force-pushed the docs/scaleway-kapsule-state-of-the-art branch from a29a4d9 to f63b5a0 Compare September 17, 2026 09:39
UlysseCarpentier and others added 6 commits September 17, 2026 11:49
@UlysseCarpentier @claude
docs(scaleway): state of the art — Kapsule against the hyperscalers
e5902b2 
Establish what Kapsule does and does not do, measured against EKS, GKE and
AKS, and name the four limits the foundations module has to absorb: no
workload identity federation, no fully private control plane, a 55/200 MB
etcd cap, and no spot market or Karpenter.

Settle what this research can settle — Kapsule over Kosmos, a Dedicated 4
control plane in production and mutualized elsewhere, workload metrics in
the socle's own Prometheus rather than Cockpit at 2.5x the GKE rate per
sample — and record that Cilium on this cloud is Scaleway's, without
Hubble and without the kube-proxy replacement.

Price the sprint's reference estate at ~EUR 1,140/month, against the
$1,488 the same estate costs on GKE Autopilot.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@UlysseCarpentier @claude
docs(scaleway): the cluster's /22 range is chosen, not assigned
73ed5fa 
A pre-created Private Network carries its own CIDR and the cluster uses it;
only the /22 size is Kapsule's. The earlier wording claimed the prefix was
imposed, which is wrong for any module that creates the network itself.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@UlysseCarpentier @claude
docs(scaleway): decide the network, and price the gateways it needs
4357d49 
No ticket in the Scaleway sprint owns network and security — AWS and GCP
each have one, Scaleway does not — so the deferral this document carried
pointed at nothing. Decide it here instead.

Full isolation in every environment, so dev and staging exercise the egress
path production uses. That costs Public Gateways, and the Public Gateway is
zoned with no HA: Scaleway's own answer to a zone outage is several
gateways on one Private Network, each advertising a default route. So three
in production, one each in dev and staging — EUR 95/month, now in the
estate, which lands at ~EUR 1,235.

Also decided: an allowed-IP list required with no default, since the
control plane cannot be made private and 0.0.0.0/0 is what ships; a
security group per cluster, because the default one is shared between
clusters; one VPC per environment; and a placement group per pool.

State plainly that the sized estate does not survive a zone loss, and what
it costs to make it (+EUR 311).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@UlysseCarpentier @claude
docs(scaleway): managed scope and cloud observability
2af371d 
Two research documents, closing the two sprint tickets that the state of
the art had reached into.

managed-scope.md — the AWS gap grid, and its conclusion is the opposite of
the expected one: Scaleway operates more of the data plane than EKS does
(CoreDNS, kube-proxy, CNI, CSI, no version exposed, no opt-out), so the
add-on line costs nothing. The gap is almost entirely credentials, at
~1.5 days/month per client. Load balancers delegated to the CCM,
DNS and certificates to External-DNS and Scaleway's cert-manager webhook,
LB-terminated TLS refused. OpenTofu state on Object Storage with native
conditional-write locking — no second service, as on AWS.

cloud-observability.md — read Scaleway's free data through Cockpit's
/federate endpoint rather than the product APIs, and never push workload
metrics into it. Alerting stays ours. Cost attribution runs on the
consumption API, which returns resource-level lines but carries no tags,
so the Project is the only attribution axis.

Both arrive independently at one Project per environment: IAM has no
per-resource conditions outside IAM, Key Manager and Secret Manager, and
consumption has no tags.

Record that the reference estate does not fit default quotas —
POP2-HC-8C-16G is capped at 2 and production wants 4 — and correct the
state of the art, which claimed no discounted capacity exists: savings
plans do, at ~10% against three years of lock-in.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@UlysseCarpentier @claude
docs(scaleway): answer autoscaling, instance types and GPU
ec3f7f6 
The capabilities ticket asked three questions the document had left open:
whether the native cluster-autoscaler is enough, which instance types are
relevant and where, and GPU.

Autoscaling — no Karpenter provider exists for Scaleway, so there is
nothing to install. What is actually lost is consolidation, not spot: the
autoscaler never replaces a running node with a cheaper one, and that
repacking is Karpenter's main saving on a pure on-demand estate. Scale to
zero does work. Make expander = least_waste a module default, because
Scaleway ships random and the estate runs several pools.

Instance types — and this is the finding that moves the estate. The
Instances API shows the current Zen 5 generation (COMPUTE3, BASIC3) and the
previous one (POP2, PRO2) never share an Availability Zone. fr-par and
nl-ams carry the modern range in two zones and the older one in the third;
only pl-waw can run a homogeneous three-zone cluster. Scaleway's own
documentation contradicts this and is wrong. So the default is COMPUTE3-X
across fr-par-1 and fr-par-2 — two zones, not three — with pl-waw on
POP2-HC as the option when three are required. BASIC3-X is refused for
nodes: shared vCPU, 99% SLO.

Reprice on COMPUTE3-X: ~EUR 1,317. Two zones make zone-loss survival cost
double (+EUR 684) where three would cost half that (+EUR 311) — zone count,
not node price, is what resilience costs here.

GPU is delegated: Scaleway installs the NVIDIA operator on every GPU pool.

Also correct the savings plan rate, which is bracketed and unpublished
rather than a flat 10%, and note that the quota table has no figure at all
for the Zen 5 generation.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@UlysseCarpentier @claude
docs(scaleway): cut the four documents to the decisions
e6506ca 
931 lines to 570, in the shape docs/gcp and docs/aws use: a position table
at the top, one bold decision per section, cost, module specification,
sources.

What went: the cluster-autoscaler tunables list, the zone-by-zone instance
matrix (its conclusion stays), GPU quotas, Cockpit ingestion caps, the
per-service Cockpit coverage table (the gaps stay), the consumption API's
paging behaviour, and the alert manager's rule limits — detail a reader can
get from the linked source when they need it.

The comparisons against other clouds went too. "The gap against AWS" is
removed outright: what lands on the factory is a Scaleway fact and reads as
one. The remaining cross-cloud references are kept only where they carry a
decision — one Alertmanager for four clouds, one External-DNS, Velero
everywhere.

No position changed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@UlysseCarpentier
UlysseCarpentier force-pushed the docs/scaleway-kapsule-state-of-the-art branch from 36c52d9 to e6506ca Compare September 17, 2026 09:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Garinlu Garinlu Garinlu left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@UlysseCarpentier @Garinlu