Technologies and Infrastructure → Hybrid Cloud and Interoperability

Hybrid cloud and interoperability

1) What is a hybrid cloud

• compliance with data sovereignty/localization requirements;
• smooth migration and modernization of the monolith to cloud services;
• elasticity and peaks (burstable capacity) without overbuying iron;
• cost-control: constant base on-prem + variable loads in the cloud.

2) Typical scenarios (for iGaming/fintech)

Payment core/wallet on-prem (low latency to banking channels, HSM), fronts and directories - in the cloud.
Reporting and analytics: CDC from on-prem OLTP to cloud DWH/varnish house with SLO for freshness.
KYC/AML: private on-prem integrations, orchestration and scaling of checks in the cloud.
Promo/events/tournaments: elastic scaling of the public part without changing the core.
Migration "piece by piece": strangler-pattern - wrap the old APIs with a gateway and gradually bring functions to the cloud.

3) Network foundation

3. 1 Transport and topologies

IPsec VPN: fast start, higher latency/overhead.
Direct Connect/ExpressRoute: Predictable bandwidth and latency.
Hub-and-Spoke: on-prem как Hub; cloud VPC/VNet - Spoke.
Dual-hub: separate hubs in on-prem and cloud, connected by a dedicated channel.

3. 2 Address space and routing

Unified IPAM policy, exclude overlapping subnets.
SD-WAN/Cloud routers for dynamic routing and observability.
Egress control: fixed NAT-IP under the allow-list of external providers (PSP/KYC).

3. 3 Perimeter security

WAF/bot protection at the edge (cloud edge).
mTLS service-to-service via mesh/ingress-gateway.
Segmentation: separate zones for prod/stage, "warm" sandboxes.

4) Data and consistency

4. 1 Data classes

Strict consistency (wallet/balance, operations): storing and writing locally (on-prem), events - to the cloud.
Final consistency (directories, profiles, ratings): two-way replication/caching.
Sensitive data (PAN/PII): storage on-prem, in the cloud - tokens/algorithmic projections.

4. 2 Synchronization techniques

CDC from OLTP → broker/stream → cloud DWH/varnish house; SLA per lag (e.g. P95 ≤ 5 min).
Outbox/Inbox for domain events (idempotency, deduplication).
Caches and edge: near-cache/TTL, warming up before peaks.
CRDT/counters for leaderboards/statistics (with asset-to-asset reads).

5) Platform and runtime

Kubernetes-two: cluster on-prem and cluster in the cloud; GitOps (Argo/Flux) as a single delivery mechanism.
Service Mesh (multi-cluster): mTLS, retry/breaker, locality-aware routing; restrict cross-environment calls.
Serverless/Batch in the cloud: elastic functions/batches for peaks and backgrounds.
Service catalog: uniform metadata (owner, SLO, dependencies, placement).

6) Identity, access, secrets

IAM Federation via Corporate IdP (OIDC/SAML), role-mapping in both directions.
Least privilege policy: separate roles for on-prem/cloud + inter-environment translator roles.
KMS/HSM: keys in on-prem HSM, cloud KMS for cloud artifacts; never "take out" master keys.
Secret-management: synchronization of secrets through brokers/operators, audit of rotations.

7) CI/CD and Change Management

Single mono spec/mono repository with parameterization by environment.
Promotion of artifacts: dev → stage-cloud → prod-on-prem/prod-cloud (matrix).
Canary/Blue-Green separately for each medium; an SLI comparison.
Contract-tests between on-prem and the cloud (API and events).
Infra-as-Code: Terraform/Crossplane for both loops, policy-as-code (OPA).

8) Observability and SLO

9) DR strategies (for hybrid model)

Regularly conduct DR-drills: disconnection of the channel/node, verification of ranbooks.

10) Safety and compliance

Network segmentation, east-west microsegmentation, inter-environment ACL control.
Minimizing PII to the cloud: tokenization, log masking.
Immutable logs (WORM) on-prem and in the cloud, end-to-end audit of actions.
Regulatory: storage in the country, export of data on white lists, provability of SLO/SLA execution.

11) FinOps and the economic model

Base power - on-prem (predictable/cheap), peaks - cloud (variable/more expensive).
Metrics: $/RPS on Wednesdays, $/GB egress, $/min CDC delay.
Warm-pools in the cloud to peak windows (tournaments/matches).
Avoid "chat" between environments: aggregate events, make local projections.

12) Integration patterns

12. 1 Strangler-Fig (wrap around monolith)

[Client] → [API Gateway] →│→ [Cloud microservice v2]
└→ [On-prem legacy v1]

Path/version routing, telemetry and A/B for safe scumbag.

12. 2 Outbox/Inbox (idempotency)

BEGIN TX apply(domain_command)
insert outbox(event_id, aggregate_id, payload, hash)
COMMIT
// Репликатор читает outbox (on-prem), публикует в шину (cloud).
// Приемник в облаке дедуплицирует inbox по event_id/hash.

12. 3 Local-first writes

Writing critical commands locally (on-prem), to the cloud - event/projection.
Reading custom pages - from the nearest cache/projection.

13) Implementation checklist

1. Data classification (strict/final/sensitive), flow map between media.
2. Selected transport (VPN/Direct) and IPAM plan, without overlaps.
3. Mesh/mTLS, Egress control, fixed NAT-IP to providers.
4. CDC and outbox/inbox with deduplication, SLO on freshness and inter-env lag.
5. GitOps/CI pipeline for both media, canary per-env, contract-tests.
6. Unified service catalog, owners, SLO, dependencies.
7. Observability: through trails, synthetics on- prem↔cloud, alerts on channels.
8. DR drills and ranbooks, regular rehearsals for switching.
9. FinOps: egress/channel budgets, $/RPS and $/GB reports by Wednesday.
10. Security policies, audits, PII tokenization, WORM logs.

14) Anti-patterns

Synchronous inter-media hot-track calls (wallet/write) → P99 tails and fragility.
Overlapping subnets and gray routes → a debug hell.
Replication of everything without filtering → egress accounts and lags.
Secrets in environment variables, "moving" through unsafe buckets.
A single "master" database for one of the SPOF → loops via the network.

The absence of DR drills is a "plan on paper."

15) The bottom line

1. Networks and security (predictable channels, mTLS, segmentation),

2. Data and consistency (CDC/outbox, local records, caches),

3. Processes (GitOps, observability, DR-drills, FinOps).

With such a foundation, you will get a controlled evolution, withstand peaks and comply with regulatory requirements - without shock migrations and night incidents.