1 of 36

Breaking Cloud Lock-In: A Multicloud Framework for Sovereign Development with Free Software

Sergio Leal – RNP (Brazil) – sergio.fonseca@rnp.br

Good morning everyone, and thank you for the opportunity to be here today. In this session, I would like to discuss a topic that is becoming increasingly strategic not only for Brazil, but for governments, universities, and institutions all over the world: how to reduce dependency on large cloud providers while still benefiting from the scalability and innovation that cloud computing offers. The presentation is titled “Breaking Cloud Lock-In: A Multicloud Framework for Sovereign Development with Free Software,” and the central idea is that sovereignty in the digital era is not simply about infrastructure ownership. It is about maintaining the ability to decide, evolve, migrate, innovate, and govern technological ecosystems without being constrained by excessive dependency on a single vendor or platform. Throughout the presentation, I’ll share lessons from our journey at RNP, discuss cloud maturity and multicloud strategies, explore the role of free software, and finally explain how AI and autonomous agents are reshaping the future of sovereign digital platforms.

2 of 36

2

To organize the discussion, I divided the presentation into four chapters. First, we’ll establish some key concepts around sovereignty, cloud dependency, platform engineering, and open ecosystems. Then I’ll present our own journey in the cloud, including lessons learned from migration strategies, operational scaling, Kubernetes adoption, and multicloud thinking. In the third chapter, I’ll discuss the concept of the sovereign application, where applications become portable, governed, and cloud-agnostic by design. Finally, we’ll move into what I call the Agentic Age, where AI-generated software and autonomous operational agents will fundamentally change how digital platforms are designed, deployed, and governed. The progression across these chapters reflects an evolution from infrastructure dependency toward intelligent, sovereign, and adaptive digital ecosystems.

3 of 36

3

Before discussing cloud strategies, it’s important to understand the institutional context behind this work. RNP is the Brazilian National Research and Education Network, and our role extends far beyond connectivity. We operate as a national digital collaboration platform connecting universities, researchers, institutions, and innovation ecosystems across Brazil. Our mission is to promote innovation in information technology and democratize access to advanced digital services and knowledge infrastructure. We connect institutions, people, ideas, and technological capabilities across a country with continental dimensions. This perspective is important because when we talk about sovereignty, we are not discussing technology in isolation. We are discussing the ability of institutions and nations to preserve strategic autonomy while still participating in global digital ecosystems.

4 of 36

4

This slide illustrates the scale and complexity of the RNP ecosystem. What you are seeing is a nationwide infrastructure interconnecting universities, laboratories, public institutions, and research centers throughout Brazil. The map reflects not only connectivity, but also collaboration, knowledge exchange, and digital integration. This national infrastructure became the foundation for thinking about cloud sovereignty because it demonstrated that digital ecosystems are strategic national assets. Once infrastructure becomes deeply integrated into research, education, healthcare, and innovation systems, dependency on external providers can quickly evolve into institutional vulnerability. That realization strongly influenced our approach to multicloud architecture, platform engineering, and sovereign application design.

5 of 36

5

6 of 36

Breaking News (04/20/2026)

Brazil’s federal audit authority has warned that the Ministry of Education’s national education platform is overly dependent on Amazon Web Services, raising concerns about vendor lock-in, costs, and long-term flexibility. As a result, it recommended that the Ministry develop a technology portability plan to reduce the risk of disruption if a provider migration becomes necessary, including prioritizing components with the highest level of dependency.

6

This slide references a very important real-world example from Brazil. In April 2026, Brazil’s federal audit authority warned that the Ministry of Education’s national education platform had become excessively dependent on Amazon Web Services. The concern was not simply technical. The audit highlighted risks associated with vendor lock-in, operational costs, migration complexity, and long-term institutional flexibility. As a result, the Ministry was advised to develop a technology portability strategy capable of reducing dependency and enabling future migration if necessary. This example perfectly illustrates why sovereignty matters. Once systems become deeply integrated into proprietary cloud ecosystems, changing providers becomes expensive, complex, and risky. The lesson here is that convenience in the short term can create structural dependency in the long term if portability and governance are not considered from the beginning.

7 of 36

What’s sovereignty?

Sovereignty is the ultimate capacity to decide and act without being subject to determining external constraints

7

When we talk about sovereignty in the digital world, we are really talking about freedom of action and decision-making capacity. Sovereignty means maintaining the ability to decide and act without being constrained by external technological dependencies. In cloud computing, this includes the ability to migrate workloads, control data, govern infrastructure policies, preserve operational autonomy, and evolve architectures independently of a single provider’s roadmap. The imagery behind the slide reinforces this tension between dependence and control. Cloud services provide enormous innovation and scalability, but if institutions lose the ability to make independent strategic decisions, then technological convenience can gradually become operational dependence. Sovereignty is therefore not isolation from global technology ecosystems, but rather the preservation of strategic flexibility within them.

8 of 36

What’s sovereignty?

8

This slide presents what I consider four levels of sovereignty, moving from dependency toward true operational control. At the first level, we have direct dependency on public cloud providers, where institutions gain agility but lose significant control. The second level involves operating public cloud environments within institutional datacenters, which provides some additional governance capabilities. The third level introduces proprietary software, where lock-in risks become embedded not only in infrastructure but also in applications and operational tooling. Finally, the fourth level emphasizes open source software as the foundation for maximum sovereignty and operational flexibility. The key point is not that every organization must avoid the cloud. The point is that the level of control, portability, transparency, and governance varies dramatically depending on architectural and software choices. Sovereignty increases as interoperability and openness increase.

9 of 36

9

10 of 36

Lift and Shift

Limited value

10

Like many organizations, our first approach to cloud migration relied heavily on lift-and-shift strategies. Existing workloads were moved into cloud environments with minimal architectural changes. Initially, this seemed attractive because migration could happen quickly and operational disruption remained limited. However, over time we realized that lift-and-shift often delivers limited long-term value. Applications remain architecturally constrained by old assumptions while operational complexity and cloud costs continue to grow. In many cases, organizations simply relocate existing inefficiencies into more expensive infrastructure environments. This was an important lesson because it showed that true transformation requires more than infrastructure migration. It requires architectural evolution and operational redesign.

11 of 36

Cloud-native

at organizational scale

Re-architecting

11

12 of 36

Lock-in

technology dependency

Institutional risk

12

At the same time, another challenge became increasingly visible: lock-in and institutional dependency. As organizations adopt proprietary cloud services deeply integrated into business processes, migration complexity increases dramatically. Dependency is no longer limited to infrastructure. It extends into APIs, operational tooling, data services, identity systems, observability platforms, and automation pipelines. Over time, this creates institutional risk because strategic flexibility becomes constrained by technological coupling. The slide visually reinforces this idea by connecting cloud dependency with financial exposure, governance concerns, and operational fragility. What initially appears to be optimization can gradually become structural dependence if portability and interoperability are neglected.

13 of 36

complexity at scale

Tailor-made connectors

13

14 of 36

Reuse at scale

Platform engineering

14

This is where platform engineering became extremely important for us. Instead of allowing every team to independently solve the same infrastructure and integration problems repeatedly, we started building reusable platform capabilities that could operate consistently across on-premise environments and multiple cloud providers. Platform engineering is fundamentally about reuse at scale. It creates standardized building blocks, governance mechanisms, deployment patterns, and operational workflows that simplify application development while reducing fragmentation. By abstracting operational complexity into reusable platforms, organizations gain both efficiency and strategic flexibility. The multicloud dimension shown on the slide reinforces the idea that portability becomes much easier when standardized operational layers exist across environments.

15 of 36

between on-premise and cloud

Kubernetes narrowed the gap

15

One of the most transformative technologies in this journey was Kubernetes. Kubernetes significantly narrowed the operational gap between on-premise environments and public cloud infrastructure. Before Kubernetes, applications were often tightly coupled to specific infrastructure environments. Kubernetes introduced a more portable operational abstraction layer capable of standardizing deployment, orchestration, scaling, automation, and observability across environments. This became strategically important because it reduced provider-specific operational dependency and enabled organizations to think more realistically about multicloud portability. Kubernetes did not eliminate complexity, but it created a common operational model that made infrastructure environments more interoperable and portable.

16 of 36

16

17 of 36

no longer as disruptive

Cloud has matured, but it is

17

18 of 36

public cloud optimizes speed

On-premise optimizes control

18

19 of 36

in the AI age

Free software

At this point in the journey, free software becomes strategically important again, especially in the AI era. For many years, open source was primarily associated with cost reduction or community-driven innovation. Today, however, it has become deeply connected to sovereignty, transparency, auditability, and operational independence. In the AI age, where software can increasingly generate software, the ability to inspect, validate, modify, and govern code becomes even more critical. Free software allows institutions to preserve control over infrastructure and operational logic rather than becoming entirely dependent on opaque proprietary ecosystems. The imagery in this slide intentionally combines AI, security, and open source because these themes are now inseparable. The future of sovereign infrastructure will depend heavily on open ecosystems capable of evolving collaboratively while remaining transparent and governable.

20 of 36

"The specific run that found the bug cost under $50.”

“two carefully crafted network packets sent to any OpenBSD server could crash it completely.”

This slide presents a fascinating and very important example involving AI and open source security. An AI system was able to identify a twenty-seven-year-old bug hidden inside OpenBSD, and the cost of the specific run that discovered the issue was reportedly under fifty dollars. Even more concerning, the vulnerability could allow two carefully crafted network packets to crash an OpenBSD server completely. This example illustrates both the enormous potential and the enormous risks introduced by AI-driven software analysis. AI systems are becoming capable of reviewing code bases at unprecedented scale and speed. In open source ecosystems, this can significantly improve security by identifying vulnerabilities that humans may have overlooked for decades. At the same time, it also means malicious actors can leverage the same technologies to accelerate offensive security analysis. The AI era fundamentally changes the economics and dynamics of software security.

21 of 36

"Open source code is basically like handing out the blueprint to a bank vault, and now there are 100× more hackers studying the blueprint."

This slide presents an opposing perspective that is becoming increasingly common in discussions around AI and open source. The quote compares open source software to handing out the blueprint of a bank vault while exponentially increasing the number of actors capable of studying it. The concern here is that AI dramatically amplifies the ability to analyze software systems, identify vulnerabilities, and exploit architectural weaknesses. This raises an important strategic question: does open source become safer because more people can inspect the code, or more dangerous because AI accelerates vulnerability discovery? My perspective is that openness alone is neither good nor bad. What matters is governance, operational maturity, review processes, security practices, and institutional capacity. In the AI era, transparency remains essential, but it must be combined with strong engineering discipline and operational governance.

22 of 36

22

23 of 36

23

One of the first capabilities required for sovereign applications is automated architecture validation. In this example, the slide references ArchUnit as part of an architecture governance workflow. The key idea is that architectural rules should not exist only in documentation or human memory. They should become executable and continuously validated. Every code change can trigger automated verification processes capable of identifying architectural violations before they reach production environments. This is extremely important in large-scale distributed systems because architectural drift tends to increase over time as complexity grows. By embedding validation directly into development workflows, organizations preserve consistency, maintain governance standards, and reduce long-term operational fragmentation.

24 of 36

24

This slide expands the discussion into CI/CD pipelines and operational automation. Modern sovereign applications depend heavily on automated delivery pipelines capable of managing build processes, testing, containerization, deployment, monitoring, and operational feedback loops. The architecture represented here combines Docker Compose environments, containerized services, deployment automation, and runtime observability into a unified operational pipeline. The important point is that automation becomes part of governance and scalability. As applications grow across multicloud environments, manual operations become unsustainable. Sovereign platforms therefore require reproducible pipelines, operational consistency, and continuous visibility into infrastructure behavior. Automation is no longer optional. It becomes a prerequisite for resilient and portable software ecosystems.

25 of 36

Generate most of the code

25

Another major transformation introduced by AI is software generation itself. Increasingly, AI systems are capable of generating large portions of application code across backend, frontend, and mobile environments. This creates enormous productivity opportunities because development cycles become dramatically faster. AI-assisted coding can accelerate prototyping, automate repetitive implementation tasks, improve consistency, and reduce operational friction for development teams. However, it also introduces important governance questions. If AI generates most of the code, then organizations must ensure the resulting systems remain secure, auditable, portable, maintainable, and aligned with architectural standards. The future challenge will not only be generating software quickly, but governing AI-generated software responsibly at scale

26 of 36

Generate most of the code

26

This slide illustrates how AI-assisted development can interact with structured application architectures. Here we see layered application design, including presentation, application, domain, infrastructure, and external integration layers. The AI system assists developers by generating business logic while preserving architectural separation and governance patterns. This is extremely important because without strong architectural boundaries, AI-generated software could quickly create chaotic and unmaintainable ecosystems. Sovereign applications require disciplined architecture even when AI participates heavily in software generation. In practice, this means combining AI acceleration with strong engineering principles such as domain-driven design, layered architecture, governance validation, and operational observability.

27 of 36

27

28 of 36

28

29 of 36

29

30 of 36

31 of 36

32 of 36

33 of 36

To conclude, this final slide summarizes the broader vision behind the Agentic Age. AI systems are evolving from passive tools into reasoning systems capable of understanding, analyzing, planning, and executing operational workflows directly inside business applications. This changes the role of software fundamentally. Applications become dynamic ecosystems where autonomous agents continuously interact with operational data, infrastructure, users, and governance policies. The future challenge will not simply be building AI systems, but governing them responsibly while preserving sovereignty, transparency, portability, and institutional control. Ultimately, breaking cloud lock-in is not only about infrastructure portability. It is about creating digital ecosystems capable of evolving intelligently without sacrificing long-term autonomy and governance.

34 of 36

35 of 36

35

To organize the discussion, I divided the presentation into four chapters. First, we’ll establish some key concepts around sovereignty, cloud dependency, platform engineering, and open ecosystems. Then I’ll present our own journey in the cloud, including lessons learned from migration strategies, operational scaling, Kubernetes adoption, and multicloud thinking. In the third chapter, I’ll discuss the concept of the sovereign application, where applications become portable, governed, and cloud-agnostic by design. Finally, we’ll move into what I call the Agentic Age, where AI-generated software and autonomous operational agents will fundamentally change how digital platforms are designed, deployed, and governed. The progression across these chapters reflects an evolution from infrastructure dependency toward intelligent, sovereign, and adaptive digital ecosystems.

36 of 36

Breaking Cloud Lock-In: A Multicloud Framework for Sovereign Development with Free Software

Sergio Leal – RNP (Brazil) - sergio.fonseca@rnp.br

Good morning everyone, and thank you for the opportunity to be here today. In this session, I would like to discuss a topic that is becoming increasingly strategic not only for Brazil, but for governments, universities, and institutions all over the world: how to reduce dependency on large cloud providers while still benefiting from the scalability and innovation that cloud computing offers. The presentation is titled “Breaking Cloud Lock-In: A Multicloud Framework for Sovereign Development with Free Software,” and the central idea is that sovereignty in the digital era is not simply about infrastructure ownership. It is about maintaining the ability to decide, evolve, migrate, innovate, and govern technological ecosystems without being constrained by excessive dependency on a single vendor or platform. Throughout the presentation, I’ll share lessons from our journey at RNP, discuss cloud maturity and multicloud strategies, explore the role of free software, and finally explain how AI and autonomous agents are reshaping the future of sovereign digital platforms.