OpenStack, OpenShift, SecNumCloud, Bleu: Design your sovereign, open-source hybrid cloud architecture. Complete guide and Smile expertise.
The majority of large French organizations will never migrate their entire information system to the public cloud. Not out of conservatism, but out of realism.
Legacy applications that cannot be containerized, data subject to strict regulatory constraints, unacceptable latencies for certain processes, or cloud costs that explode on a large scale: these realities do not disappear with a poorly calibrated "cloud first" strategy.
Hybrid cloud is the architectural answer to these constraints. It combines the best of the public cloud and on-premises infrastructure in a unified environment, managed as a single system.
This guide explains the reference architectures, available open source technologies and key decisions for building an effective hybrid strategy in France.
- 78% of French companies adopt a multi-cloud or hybrid strategy rather than a single cloud (Nutanix, Enterprise Cloud Index France, 2024)
- Hybrid cloud is among the preferred strategies of large European organizations subject to sovereignty constraints, which combine global and local providers to reconcile innovation, scalability and regulatory requirements ( IDC, Sovereign Cloud in Europe 2026 )
What is hybrid cloud?
A hybrid cloud is an IT architecture that combines a private cloud (dedicated, on-premise or hosted infrastructure), one or more public clouds (AWS, Azure, GCP) and secure connections between these environments, all managed in a unified way via common tools.
The goal is to enable each workload to run in the environment best suited to its performance, cost, security, and compliance constraints.
Private cloud vs public cloud vs hybrid cloud vs multi-cloud
Architecture | Description | Benefits | Boundaries |
Private Cloud | Dedicated infrastructure, on-premise or hosted | Total control, sovereignty | High fixed cost, limited scalability |
Public cloud | AWS, Azure, GCP | Scalability, innovation, pay-as-you-go | Publisher dependency, Cloud Act |
Hybrid cloud | Unified private and public cloud combination | Flexibility, sovereignty over sensitive data | Integration complexity |
Multi-cloud | Several public clouds | No vendor lock-in | operational complexity |
Why hybrid cloud will be the norm in France by 2026
Three structural factors explain the dominance of the hybrid model in large French organizations.
Regulation is the first. The GDPR , sector requirements (HDS for health, DORA for finance) and ANSSI recommendations impose constraints on the processing and hosting of personal and sensitive data that the American public cloud cannot guarantee alone.
Legacy applications are the second challenge. Critical systems developed over decades cannot be migrated to the cloud without a major overhaul. Hybrid cloud allows these systems to be maintained on-premises while modernizing new applications in the public cloud.
Digital sovereignty is the third. Awareness surrounding the American Cloud Act has led French organizations to seek architectures that keep strategic data beyond the reach of extraterritorial legislation.
Open source hybrid cloud architectures
OpenStack: the leading open-source private cloud
OpenStack is the open-source platform that allows you to build and operate a private IaaS (Infrastructure as a Service) cloud on your own infrastructure. It provides the same primitives as a public cloud: compute (Nova), object storage (Swift), networking (Neutron), imaging (Glance), and identity (Keystone).
This is the choice of organizations that want a fully controlled private cloud, without dependence on a proprietary vendor. Several European sovereign clouds are built on OpenStack.
OpenShift: Hybrid Enterprise Kubernetes
OpenShift is Red Hat's enterprise Kubernetes distribution. It extends Kubernetes with enterprise features: enhanced security, operator management, integrated CI/CD pipeline, and support for hybrid and multi-cloud architectures.
OpenShift can run on-premises, on any public cloud, or in a hybrid environment. It is the preferred solution for large organizations that want a unified Kubernetes platform across all their environments.
Kubernetes: the universal foundation
Kubernetes has become the common denominator of hybrid architecture. Because it works identically on-premises and in all public clouds, it allows applications to be deployed and moved between environments without rewriting.
A containerized workload deployed on an on-premises Kubernetes cluster can be migrated to AKS, EKS, or GKE with minimal modifications. This is the application portability that hybrid architecture promises.
Azure Arc and AWS Outposts: Hybrid extensions of public clouds
Azure Arc extends Azure services and governance to any infrastructure, including on-premises and multi-cloud environments. On-premises Kubernetes clusters, bare metal servers, and databases become visible and manageable from the Azure portal.
AWS Outposts brings AWS services directly into customers' data centers, in the form of hardware racks managed by Amazon. This is a different approach from Azure Arc: rather than extending the cloud control plane to on-premises, AWS physically delivers its on-premises infrastructure.
Sovereignty and hybrid cloud: the French challenge
The Cloud Act: the real legal risk
The US Cloud Act (2018) requires US companies to hand over the data they host, including data stored in Europe, to US authorities upon simple judicial request. This obligation applies to AWS, Microsoft Azure, and Google Cloud, regardless of the GDPR.
For French organizations that process personal, strategic or regulated data, this exposure is a real legal and operational risk.
SecNumCloud: the benchmark qualification
SecNumCloud is the ANSSI qualification framework for cloud service providers. It guarantees immunity from extraterritorial laws such as the Cloud Act, high security requirements, and data localization in France.
For OIVs (Operators of Vital Importance), OSEs (Operators of Essential Services) and French public administrations, using a SecNumCloud qualified cloud is an obligation or a strong recommendation.
Bleu and S3NS: the leading sovereign cloud providers
Bleu is a wholly owned joint venture between Orange and Capgemini, aiming to operate a sovereign version of Azure based on the SecNumCloud framework. Once qualified, the offering is designed to isolate French customer data from extraterritorial US laws (Cloud Act, FISA), while benefiting from Microsoft Azure services, although the underlying technology remains developed by an American company.
S3NS is the equivalent for Google Cloud, a subsidiary majority-owned by Thales in partnership with Google Cloud. Its PREMI3NS offering obtained SecNumCloud 3.2 qualification in December 2025.
The sovereign hybrid cloud: the pragmatic answer
Sovereign hybrid cloud combines on-premises or SecNumCloud-certified sovereign cloud infrastructure for the most sensitive data with a public cloud for workloads without specific constraints. This architecture simultaneously meets the requirements of compliance, performance, and innovation.
Designing a hybrid cloud architecture
The 5 key decisions
- Define the criteria for workload placement : which applications remain on-premise, which migrate to the public cloud, and which are hybrid? The criteria are data sensitivity, latency requirements, cost, and migration complexity.
- Choosing the unified control plane : how to manage the entire infrastructure from a single interface? OpenShift, Azure Arc, Anthos (GCP) or an open source Kubernetes stack are the main options.
- Designing network connectivity : site-to-site VPN, ExpressRoute (Azure), Direct Connect (AWS), or dedicated connections between the data center and the cloud. The latency and bandwidth of this connection determine the performance of the hybrid architecture.
- Unifying identity management : a central identity directory (Active Directory, Keycloak, FreeIPA) that manages access both on-premises and cloud is essential to maintain a consistent security posture.
- Implementing unified observability : metrics, logs, and traces from all environments must converge into a common platform. Prometheus and Grafana for metrics, Loki for logs, and Jaeger for traces are the leading open-source stack.
IaC for hybrid infrastructure
Terraform/OpenTofu is the leading tool for provisioning hybrid infrastructure. Its providers cover AWS, Azure, GCP, OpenStack, VMware, and most on-premises platforms. A single Terraform codebase can manage on-premises and public cloud resources, with a unified state that reflects the complete state of the hybrid infrastructure.
Migrating to a hybrid architecture: steps and pitfalls
Where to begin
The migration to a hybrid architecture begins with an audit of existing workloads. Each application is evaluated according to four criteria: dependence on sensitive data, latency requirements, containerization complexity, and expected benefit of cloud migration.
We start with workloads without any particular constraints (collaborative tools, development environments, public websites) to validate architectural patterns and train teams before tackling critical applications.
Common mistakes
Underestimating the cost of network connectivity is the most common mistake. Data transfers between the public cloud and on-premises are billed by volume. A poorly designed hybrid architecture can generate network costs that exceed any savings.
Neglecting identity management is the second mistake. Without a unified identity directory, each environment develops its own accounts and access policies, creating security vulnerabilities and unmanageable operational complexity.
The role of the integrator
An expert hybrid cloud integrator brings three key added values. They master the open-source and proprietary technologies necessary for a coherent hybrid architecture. They are familiar with French regulatory constraints and the available sovereign solutions. And they support the organizational transformation that accompanies the technical transformation.
Smile and the open source hybrid cloud
At Smile, we have been designing and deploying hybrid cloud architectures since the model first existed. Our expertise covers OpenStack for private clouds, OpenShift and Kubernetes for hybrid orchestration, Terraform for unified provisioning, and sovereign clouds (Blue, SecNumCloud) for organizations with strict sovereignty requirements.
Our open-source positioning sets us apart from proprietary cloud integrators. We are not tied to a single cloud provider. We recommend the architecture that best meets the organization's actual needs, whether it's a full public cloud, a full on-premises solution, or a hybrid one.
Our expertise in digital sovereignty is recognized in the public, health and defense sectors, where compliance requirements are the strictest.
Looking to define your hybrid cloud strategy? Discover our expertise in open source hybrid cloud .
Frequently asked questions about hybrid cloud
What is the difference between hybrid cloud and multi-cloud?
Hybrid cloud combines a private cloud or on-premises infrastructure with one or more public clouds, managed in a unified manner. Multi-cloud refers to the use of several public clouds in parallel (AWS and Azure, for example), without necessarily including private infrastructure. The two approaches can be combined: an organization can have a hybrid multi-cloud architecture that combines on-premises, Azure, and AWS.
Is OpenStack still relevant in 2026?
Yes, in specific contexts. OpenStack remains the benchmark for organizations that want a fully controlled, open-source IaaS private cloud, without dependence on a proprietary vendor. Several European sovereign clouds are built on OpenStack. Its operational complexity is real and requires a dedicated team. For organizations without this capacity, simplified distributions like OpenStack Yoga or alternatives like Proxmox are more accessible options.
How to manage billing for a hybrid infrastructure?
Hybrid billing is one of the most underestimated operational challenges. Costs are split between on-premises infrastructure (amortized CAPEX), cloud services (pay-as-you-go OPEX), and connectivity costs (data transfers). FinOps tools like CloudHealth, Apptio Cloudability, or the open-source Infracost help unify cost visibility across the entire hybrid infrastructure and identify optimization opportunities.
Is SecNumCloud mandatory for all French organizations?
No, but the mandatory scope expanded in 2026. SecNumCloud is now a full legal obligation for central government departments, their operators, six designated public interest groups, and some public healthcare facilities, insofar as they process particularly sensitive data. For Operators of Vital Importance (OIVs) and Operators of Essential Services (OSEs), the constraint remains indirect, driven in particular by NIS2 and DORA, without a direct and general legal obligation. For other organizations, it is a signal of maturity and reliability, but not a legal obligation. A GDPR impact assessment (PIPA) is the best tool to determine whether your organization's sovereignty constraints justify using a SecNumCloud-qualified cloud.