Keynote: Adventures of Building a Platform as a Service for the Gover... H.K. Flaatten & A.F. Strand

Keynote: Adventures of Building a Platform as a Service for the Gover... H.K. Flaatten & A.F. Strand

Speakers: H.K. Flaatten, A.F. Strand

Conference: KubeCon EU

YouTube: https://www.youtube.com/watch?v=DWq8UWmcRQg

Overview

This keynote presentation by H.K. Flaatten and A.F. Strand from NAV (the Norwegian Labour and Welfare Administration) chronicles their remarkable journey in building a robust Platform as a Service (PaaS) and fostering a vibrant community within the Norwegian public sector. Titled "Adventures of Building a Platform as a Service for the Gover...", the talk highlights how a grassroots initiative blossomed into a nationwide movement, transforming how government agencies develop and deploy critical public services. The speakers detail the technical evolution of their internal platform, Nice, and its subsequent offering as a managed service to other government entities, underscoring the power of open source, community collaboration, and a product-centric approach to platform engineering.

The significance of this talk lies in its demonstration of how large, complex public sector organizations can successfully embrace modern cloud-native technologies, drive digital transformation, and overcome bureaucratic hurdles. By sharing their experiences, challenges, and successes, Flaatten and Strand provide a blueprint for other governmental bodies seeking to modernize their IT infrastructure, enhance developer productivity, and deliver better public services. Their story is not just about technology, but about culture change, insourcing expertise, and building a sustainable ecosystem of shared platforms and knowledge.

Background

▶ Watch: Talk introduction and origin of the public sector community (0:00)

The genesis of this transformative journey traces back to KubeCon Europe in Berlin, eight years prior to this talk. A.F. Strand, then new to NAV and the public sector, met A. Arar, who was leading the platform team for the Norwegian tax authorities, in a queue outside the conference. This serendipitous encounter revealed a shared challenge: both were tasked with modernizing application deployment in different parts of the Norwegian government. Recognizing the immense potential for cooperation and mutual learning, they, along with others met in that same queue, embarked on building a community.

This informal network quickly evolved into Public PaaS Norway, a grassroots community dedicated to discussing and collaborating on modern application platforms. Starting with a Slack workspace and an initial meetup of 80 participants, it has since grown to over 2,000 engineers across 86 organizations, encompassing most of the Norwegian public sector. This community provides a vendor-neutral space for knowledge sharing, problem-solving, and collaboration, fostering "government efficiency before it was cool," as the speakers playfully put it. Parallel to this community building, NAV initiated a significant internal transformation. Previously relying heavily on 600-700 external consultants for development, NAV made a strategic decision to insource talent, hiring over 300 developers. To attract and retain these developers, NAV committed to using cutting-edge technologies like Kotlin, Docker, PostgreSQL, Kafka, and crucially, Kubernetes. This commitment led to the creation of their internal platform, Nice – an acronym for NAV Infrastructure and Application Infrastructure System/Service. The platform became a strong brand within NAV, complete with stickers, t-shirts, and cakes, signifying a new era of in-house software development and a commitment to open source, with NAV now boasting approximately 3,000 open-source repositories on GitHub.

Key Findings

▶ Watch: "Nice" platform: enabling insourcing and developer recruitment (3:00)

The talk presents several key findings and achievements that underscore the success of NAV's approach to platform engineering and community building. Foremost among these is the dramatic increase in deployment frequency: from a mere 4-10 production deployments per week in 2017, the Nice platform now facilitates nearly 3,000 deployments into production every week. This exponential growth highlights the platform's efficiency and enablement of rapid service delivery and modernization across NAV.

Another significant finding is the profound impact of the Public PaaS Norway community. With over 2,000 engineers from 86 organizations actively collaborating, it demonstrates the power of shared knowledge and collective problem-solving in accelerating digital transformation across an entire public sector. The community's success validated the initial hypothesis that government agencies faced similar challenges and could benefit immensely from mutual support.

Furthermore, the evolution of Nice from an internal platform to a managed service for other government agencies, despite significant non-technical hurdles (legal, commercial, inter-departmental agreements), proved its broader applicability and value. The successful adoption by Statistics Norway and the Directorate of Agriculture, with more agencies evaluating its use, showcases a scalable model for sharing platform capabilities. The realization that "the technical parts were the really easy ones" compared to "selling stuff" and navigating public sector bureaucracy was a crucial learning point, emphasizing the often-underestimated complexity of organizational and political factors in technology adoption. Finally, the talk reinforced the core principles of treating platforms as products, embracing open source, fostering community, and insourcing development as critical enablers for achieving agility and innovation in the public sector.

Technical Deep Dive

▶ Watch: Open-sourcing platform, operator pattern, and application manifest (4:00)

The Nice platform, at its core, is a sophisticated Kubernetes-native PaaS designed to provide developers with a golden path for building, running, and operating their applications. Its architecture leverages several key cloud-native principles and open-source technologies to achieve scalability, efficiency, and developer autonomy.

The primary interface for developers interacting with Nice is the Nice application manifest, a YAML-based configuration file. Introduced in 2018, coinciding with the early adoption of Custom Resource Definitions (CRDs) and Role-Based Access Control (RBAC) in Kubernetes, this manifest abstracts away the underlying infrastructure complexities. Developers simply declare their application's requirements and dependencies within this manifest, and the platform handles the provisioning and orchestration. This approach embodies the operator pattern, where custom Kubernetes controllers (operators) manage specific application types and their lifecycle. The Nice platform currently boasts 10 custom-built operators that work in concert to manage various aspects of application deployment, scaling, and dependency provisioning. This design allows NAV to "switch out implementation details underneath with few to no changes in how the application is built or deployed," offering significant flexibility and future-proofing. For instance, the platform provisions all declared dependencies such as databases, message queues (like Kafka), or caches, eliminating the need for developers to use separate infrastructure provisioning tools or engage in "click Ops."

A recent significant technical milestone highlighted in the talk is the successful migration of all teams and applications to Valky. While the talk doesn't elaborate on Valky's specific role, its mention implies a continuous evolution and modernization of the underlying platform components to enhance performance, security, or developer experience.

Security and compliance are deeply integrated into the Nice platform's workflow. As part of the application deployment process, the platform automatically generates Software Bill of Materials (SBOMs). These SBOMs serve as a comprehensive inventory of all software components and their versions contained within an application, akin to an "ingredients list." NAV utilizes these SBOMs to scan for known vulnerabilities, aiming for 100% SBOM coverage and currently achieving 93%. This proactive approach to software supply chain security is crucial for identifying and mitigating risks in a large, complex environment.

Initially, the Nice platform relied solely on APIs and CLIs for interaction. However, as the number of teams and applications scaled into the thousands, the need for a more intuitive visual interface became apparent. After a lengthy evaluation, NAV decided against using existing solutions like Backstage and opted to build their own developer portal, the Nice Console. This decision was driven by the need for a solution "tailor-made to how our application operators function." The Nice Console provides teams with a quick and easy overview of key metrics, including known vulnerabilities, resource utilization, and cost. This transparency empowers teams to improve overall application quality and reduce unnecessary spending. Crucially, the Nice Console is also fully open source and available under the Nice GitHub organization, aligning with NAV's broader commitment to open source, which includes over 3,000 public repositories on GitHub. This dedication to open source not only fosters transparency but also allows other government agencies and the wider community to inspect, learn from, and potentially contribute to NAV's platform development.

Demo / Proof of Concept

▶ Watch: Platform scale, self-service, and Software Bill of Materials (SBoM) (6:00)

While the speakers referenced a "great live demo" by Kelsey Hightower at the 2016 KubeCon, their own presentation did not include a live technical demonstration of the Nice platform in action. Instead, the talk provided a screenshot of the Nice Console, their custom-built developer portal, illustrating its user interface and the types of information it presents to developers, such as known vulnerabilities, resource utilization, and cost metrics. This visual representation served to convey the functionality and value of the portal, which is a key component of the Nice ecosystem, without a real-time walkthrough.

Defensive Implications

▶ Watch: Migration to Valkyrie and building a custom developer portal (6:40)

The design and operation of the Nice platform inherently incorporate several robust defensive implications, crucial for securing critical public sector applications. The platform's commitment to a golden path approach significantly enhances security by guiding developers towards secure configurations and best practices from the outset. By abstracting away complex infrastructure details and providing pre-vetted, secure templates via the application manifest, Nice reduces the surface area for misconfigurations and common vulnerabilities.

A cornerstone of Nice's defensive posture is the automated generation and utilization of Software Bill of Materials (SBOMs). Achieving 93% SBOM coverage and aiming for 100% demonstrates a strong commitment to software supply chain security. SBOMs enable continuous scanning for known vulnerabilities within all application components, allowing NAV to proactively identify and address security risks. This capability is vital for managing the security posture of thousands of applications, ensuring that any newly discovered vulnerability in an open-source library or dependency can be quickly identified and remediated across the entire application portfolio.

The Nice Console, their custom developer portal, also plays a critical defensive role by providing teams with immediate visibility into key security metrics, including known vulnerabilities associated with their applications. Empowering developers with this information directly within their operational workflow fosters a "security-by-design" culture, encouraging teams to take ownership of their application's security posture and make informed decisions that reduce risk. Furthermore, the offering of Nice as a service to other government agencies emphasizes strong isolation principles; each instance of Nice is "completely isolated from other instances, sharing no resources, networks, or accounts." This architectural decision is fundamental for multi-tenancy in government, preventing cross-tenant data leakage or security breaches. Finally, NAV's overarching commitment to open source for much of its platform code, including the Nice Console, enhances security through transparency. Open-sourcing allows for community scrutiny, potentially revealing vulnerabilities that might be missed in a closed-source environment, thereby strengthening the platform's overall resilience.

Key Takeaways

• Treat Platforms as Products: Successful platforms are built by focusing on solving user problems, not just internal technical challenges. This product-centric approach drives adoption and value.
• Embrace Open Source and Community: Fostering a grassroots community like Public PaaS Norway and open-sourcing platform components (e.g., Nice Console) accelerates learning, collaboration, and transparency, especially within the public sector.
• Insourcing is Key for Ownership and Innovation: Bringing development in-house, rather than relying solely on external consultants, builds expertise, fosters a strong developer culture, and enables the creation of shareable, high-quality products like Nice.
• Simplify Developer Experience with a Golden Path: Providing developers with a self-service, opinionated "golden path" via tools like the Nice application manifest and operator pattern dramatically increases productivity and reduces operational friction.
• Prioritize Software Supply Chain Security: Implementing automated SBOM generation and vulnerability scanning (achieving 93% coverage) is critical for managing risk in a complex application landscape.
• Overcome Bureaucratic Hurdles for Broader Impact: While technical challenges exist, the most significant obstacles to sharing platforms across government agencies often lie in legal, commercial, and inter-departmental agreements. Successfully navigating these "red tape" issues is essential for scaling impact.

About the Speaker(s)

A.F. Strand (Adun) is a key figure in the modernization of the Norwegian public sector's IT landscape. His journey began at KubeCon Berlin eight years ago, marking his first KubeCon and his entry into public sector work at NAV. He was instrumental in establishing Public PaaS Norway, a thriving grassroots community for platform engineers across government agencies. His insights into community building and the initial vision for Nice were pivotal in NAV's transformation.

H.K. Flaatten (Hristian) became involved early in the Public PaaS Norway community and later played a significant role in the technical development and scaling of the Nice platform at NAV. Together, both speakers represent the driving force behind the platform's evolution from an internal tool to a managed service for other government organizations, sharing their deep experience in both technical implementation and navigating the complexities of public sector innovation.