Skip to content

Feat(landing zone): create guide #8133

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Jul 24, 2025
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions pages/index.md
Original file line number Diff line number Diff line change
Expand Up @@ -605,6 +605,7 @@
+ [Healthcare (HDS) compliance activation](public_cloud/public_cloud_cross_functional/activate-hds-certification)
+ [Migration](public-cloud-cross-functional-migration)
+ [Public Cloud IaaS Migration - Steps and Best Practices](public_cloud/public_cloud_cross_functional/iaas-migration-steps)
+ [Architecture Reference - Building a Landing Zone with OVHcloud Public Cloud](public_cloud/public_cloud_cross_functional/landing_zone_migration)
+ [Tutorials](public-cloud-cross-functional-tutorials)
+ [How to use Terraform](public_cloud/public_cloud_cross_functional/how_to_use_terraform)
+ [Services management](public-cloud-cross-functional-services-management)
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,184 @@
---
title: "Architecture Reference - Building a Landing Zone with OVHcloud Public Cloud"
excerpt: "A practical guide to design a secure and scalable Landing Zone on OVHcloud Public Cloud, covering networking, IAM, backups, and more."
updated: 2025-07-24
---

## Objective

This guide helps OVHcloud Public Cloud users design and deploy a secure, scalable Landing Zone by outlining key components and best practices.

It covers core networking setup (vRack, subnets, gateways, floating IPs), traffic management (load balancer), and security layers (firewall, WAAP, Bastion).

It also includes guidance on infrastructure choices, IAM, backups, logging, private connectivity, and cost-control, offering a clear foundation for production-ready cloud environments.

## Requirements

- Access to the [OVHcloud Control Panel](/links/manager).
- [Setting OpenStack environment variables](/pages/public_cloud/public_cloud_cross_functional/loading_openstack_environment_variables).
- Being familiar with [Terraform](/pages/public_cloud/public_cloud_cross_functional/how_to_use_terraform), if you intend using it.
- Basic understanding of [cloud networking concepts](/links/public-cloud/network) (e.g., subnets, gateways, Floating IPs).

## Instructions

To help you design a secure, scalable, and production-ready cloud foundation, the following diagram illustrates the key steps in building a Landing Zone on the OVHcloud Public Cloud:

![Landing zone architecture diagram](images/landing_zone_architecture.png){.thumbnail}

Each numbered step corresponds to a component or action in the setup process. Below are detailed explanations for each:

### 0. vRack setup

A vRack (Virtual Rack) is the foundational component that allows private networking between resources.

When you create a Public Cloud project, OVHcloud automatically provisions a vRack for you. This virtual layer isolates your internal communication and enables secure interconnections between services (instances, databases, gateways, etc.) across regions and even between different OVHcloud services (Bare Metal, Hosted Private Cloud).

You will use the vRack to attach all private subnets and connect public and private-facing services securely.

### 1. Create a private subnet

Inside the vRack, define private subnets to segment your network. For example, you can have separate subnets for frontend, backend, databases, and bastions.

- Subnets can be created in different regions.
- Choose appropriate CIDR blocks to avoid overlap and ease future scaling.
- Subnets can be layer 2 (flat) or layer 3 (routed with gateway).

Subnet creation is done from the OVHcloud Control Panel, via the OpenStack API, or using Terraform.

### 2. Set up a Gateway

To enable outbound or cross-zone communication for your private subnet, set up a Network Gateway for Public Cloud. It acts as a NAT device to allow traffic from your private subnet to the internet or other public resources.

- Required for downloading packages, external API calls, etc.
- You can route traffic through the gateway to a firewall or WAAP if needed.
- Each gateway is regional and connects only subnets from that region.

Follow [this guide](/pages/public_cloud/public_cloud_network_services/getting-started-02-create-private-network-gateway) to set up a gateway.

### 3. Assign Floating IPs

A Floating IP is a public IP that you can attach to a resource (usually an instance or load balancer) within a private network.

Use cases include:

- Exposing a single VM for SSH access (e.g., for a bastion)
- Public-facing applications hosted inside a private subnet
- Failover and migration between zones

Use Floating IPs to expose selected private resources (e.g., instances, services) to the public internet securely. Follow [this guide](/pages/public_cloud/public_cloud_network_services/getting-started-03-attach-floating-ip-to-instance) to link a Floating IP.

### 4. Set up a Load Balancer

An OVHcloud Load Balancer lets you distribute traffic between multiple backend instances in different availability zones.

- Choose the load balancing mode: HTTP(S), TCP, or passthrough.
- Supports health checks, SSL termination, and sticky sessions.
- Integrated with Floating IPs for public exposure or stays private.

This is essential for creating highly available applications and distributing load intelligently.

Follow [this guide](/pages/public_cloud/public_cloud_network_services/getting-started-01-create-lb-service) to set up and use a Load Balancer.

### 5. Implement firewall rules

Although OVHcloud doesn’t provide a built-in firewall-as-a-service, you can:

- Use Security Groups on each instance (similar to AWS)
- Deploy a third-party virtual firewall like Stormshield in your vRack
- Firewall solutions should inspect north-south (ingress/egress) and east-west (internal) traffic where applicable.

Follow [this guide](/pages/public_cloud/public_cloud_network_services/tutorial-stormshield_network_security_vrack) to set up and use a Stormshield firewall.

### 6. Add WAAP protection

To protect your web and API applications, deploy a Web Application and API Protection (WAAP) service like Ubika.

- Shields against DDoS, SQL injection, XSS, and OWASP Top 10 threats
- Offers bot management, WAF, API gateway, and rate limiting
- Can be inserted transparently between your Load Balancer and backend services

Follow [this guide](/pages/public_cloud/public_cloud_network_services/tutorial-ubika_vrack) to deploy a WAAP protection with Ubika.

### 7. Configure a Bastion Host

A Bastion is a secure access point to manage instances located in private subnets. OVHcloud provides a hardened, audited open-source bastion tool for this purpose.

Use it to:

- Enforce secure, audited SSH access
- Define fine-grained user permissions (LDAP, AD, IAM)
- Monitor access logs and session replay

See [documentation about Bastion](https://ovh.github.io/the-bastion/index.html){.external} on our GitHub account.

### 8. Enable private connectivity (OCC)

If you need to connect your on-premise infrastructure or other OVHcloud services securely to the Landing Zone, use OVHcloud Connect (OCC).

- Dedicated Layer 2 or Layer 3 link between your site and OVHcloud POPs
- Bypasses the public internet, ideal for compliance and latency-sensitive apps
- Integrated into the vRack

See [this documentation](/pages/network/ovhcloud_connect/occ-direct-control-panel).

### 9. Deploy your infrastructure

With networking and security in place, deploy your core services:

- Compute: Public Cloud Instances (GP/CPU/GPU)
- Containers: Managed Kubernetes Service
- Storage:
- Block storage (via volumes)
- Object Storage (S3<sup>1</sup>-compatible)
- Public Cloud File Storage (NFSv4)
- Databases: Managed MongoDB, PostgreSQL, MySQL, Kafka

These services can be managed using the Control Panel, OpenStack CLI, or Terraform.

### 10. Set up Identity and Access Management (IAM)

IAM is essential for defining who can access what and under which conditions. With OVHcloud IAM, you can:

- Create and assign roles and policies per user/group
- Integrate with SAML, OIDC, or use native IAM
- Isolate access by project, service, or region

See the [related documentation](/pages/public_cloud/public_cloud_cross_functional/securing_and_structuring_projects).

### 11. Define backup policies

Ensure business continuity by protecting critical data and workloads:

- Snapshots: Ideal for short-term recovery or pre-update backups
- Instance backups: Full images for rollback or cloning
- Veeam Enterprise: Available for advanced backup/restore workflows

Define a backup strategy aligned with your RPO (Recovery Point Objective) and RTO (Recovery Time Objective).

### 12. Centralize logging with Logs Data Platform

Logs Data Platform (LDP) allows you to:

- Aggregate logs from apps, systems, and network devices
- Create dashboards and alerts (Kibana, Grafana-compatible)
- Retain logs based on compliance needs (GDPR, ISO 27001, etc.)

This is key for observability, security audits, and troubleshooting. Follow [this documentation](/pages/manage_and_operate/observability/logs_data_platform/getting_started_quick_start).

### 13. Implement cost control and monitoring

Keep control of your cloud spending with:

- Budget alerts and consumption dashboards
- API access to cost usage reports
- Daily/hourly resource tracking

Use tagging, IAM roles, and alerts to link costs to teams, environments, or services. For more information, read [this documentation](/pages/public_cloud/public_cloud_cross_functional/analyze_billing).

## Go Further

If you need training or technical assistance to implement our solutions, contact your sales representative or click on [this link](/links/professional-services) to get a quote and ask our Professional Services experts for assisting you on your specific use case.

Join our [community of users](/links/community) and visit our [Discord channel](https://discord.gg/ovhcloud).

<sup>1</sup>: S3 is a trademark of Amazon Technologies, Inc. OVHcloud’s service is not sponsored by, endorsed by, or otherwise affiliated with Amazon Technologies, Inc.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
id: 3a894dca-4e73-471a-887f-337ca19a7b10
full_slug: public-cloud-landing-zone