Skip to content

Evolving Baremetal-as-a-Service: Secure Multi-Cluster Networking and Service Identity Automation#

KubeCon + CloudNativeCon Europe 2026 digest Program Adjacent pick 23–26 March 2026

Abstract Recording

Yushiro Furukawa & Mitsuhiro Tanino, LY Corporation

Play the recording: Evolving Baremetal-as-a-Service: Secure Multi-Cluster Networking and Service Identity Automation

  • Why: A hyperscale operator describing how physical and virtual machines are operated through one consistent set of cloud-native patterns — with certificate issuance wired into baremetal provisioning, which is the detail worth stealing.
  • What: A BMaaS platform rebuilt on Kubernetes custom controllers, OpenStack Nova extensions and AthenZ-based automation.
  • How: Nova extended with Kubernetes custom controllers so baremetal provisioning and lifecycle run through declarative APIs; ACL-based access control between multiple in-house clusters, applied automatically to new pods; AthenZ issuing certificates during baremetal instance creation so inter-service communication is trusted and encrypted from birth.
  • Where applicable: Explicitly org-specific — LY Corporation's private cloud, and AthenZ is not widely deployed elsewhere. The pattern of binding identity issuance to provisioning generalizes; the stack does not.