Expert Services for Russian Cloud Migration and Management

When should you migrate production to a Russian cloud?

A team hits the Western cloud sanctions wall and must move a production Kubernetes cluster, managed databases, and object storage to a Russian provider within a quarter. The checklist: 152‑FZ compliance, data stays in‑country, SLA at minimum 99.9%. Each of the three major Russian clouds — Yandex Cloud, Selectel, VK Cloud — meets these requirements, but architectural decisions differ fundamentally. They affect Terraform configuration, networking setup, and traffic billing. With over 5 years on the market and 50+ completed migrations, we know the pitfalls of each platform. Contact us for a one‑day readiness assessment.

When does Yandex Managed Service for Kubernetes shine?

Yandex Cloud is the most mature managed environment among Russian clouds. Managed Service for Kubernetes has accumulated helpful integrations and non‑obvious traps.

Node Groups and Autoscaling

YC Kubernetes ties the Cluster Autoscaler to Instance Groups. You create node groups per workload type: spot (preemptible) nodes for batch jobs, standard for stateful components. Preemptible nodes are much cheaper — savings can reach 70% — but they live at most 24 hours. That fits CI runners, ML tasks, ephemeral jobs. To mix them with production services, use PodDisruptionBudget and tolerations at the Deployment level. A common gotcha: the autoscaler will not scale if pending pods fail nodeAffinity or taints. The pod stays Pending, an alert fires after 10 minutes, and the team looks at a dashboard that shows nodes exist — but the pod is not scheduled. Root cause: a missing toleration in a Helm chart or a wrong nodeSelector. Debug via kubectl describe pod <name> → Events → didn't match node selector.

Yandex Container Registry

Integrate the registry with a Service Account. You can create an imagePullSecret manually:

yc iam key create --service-account-id <sa-id> --output key.json kubectl create secret docker-registry yc-registry \ --docker-server=cr.yandex \ --docker-username=json_key \ --docker-password="$(cat key.json)" 

But it’s cleaner to assign the container-registry.images.puller role to the Service Account attached to the Node Group. Then kubelet pulls images without an imagePullSecret in every manifest.

Managed PostgreSQL in Conjunction with the Cluster

Yandex Managed PostgreSQL provides automatic failover via Patroni under the hood. Connect from Kubernetes using the cluster host service name. You must supply the TLS certificate: in DATABASE_URL use sslmode=verify-full with the Yandex CA certificate. Without it, all traffic from production pods to the database is in plain text — unacceptable for 152‑FZ.

Network Policy

Network Policy is enabled at the cluster level with --network-policy-provider=calico. By default, traffic is allow‑all. If you activate Calico without pre‑written policies, all pods keep talking freely. The correct order: write NetworkPolicy for all namespaces with deny-default first, then enable the provider. Otherwise, one cluster update leaves you with an open network model.

Selectel: Kubernetes on a Managed Platform and Bare‑Metal Economics

Selectel offers two models: Managed Kubernetes (OpenStack + Magnum) and bare‑metal rental where you build your own cluster. For teams that value cost predictability under stable load, bare‑metal often wins.

Selectel Managed Kubernetes

The API is compatible with upstream Kubernetes. Ingress via nginx or Traefik; load balancer via Octavia. Persistent volumes use the Cinder CSI driver. Default StorageClass is ceph-hdd-dp1 or ceph-ssd-dp1. For stateful services (PostgreSQL, Kafka) choose the SSD class and set volumeBindingMode: WaitForFirstConsumer — otherwise the PVC will be created in an availability zone that has no suitable node.

Network Architecture

Floating IP must be explicitly associated with an instance port via API or Terraform. When using the openstack_networking_floatingip_associate_v2 resource, maintain the depends_on order — otherwise the state diverges and terraform apply recreates existing resources.

Object Storage S3

Selectel S3 is API‑compatible with AWS S3. In applications using boto3 or AWS SDK, just override the endpoint:

s3 = boto3.client('s3', endpoint_url='https://s3.ru-1.storage.selcloud.ru', aws_access_key_id=ACCESS_KEY, aws_secret_access_key=SECRET_KEY ) 

Object versioning, lifecycle policies, pre‑signed URLs — all work like in AWS S3. Migrate from AWS to Selectel S3 with rclone sync in hours, not days.

VK Cloud: OpenStack Story with Nuances

VK Cloud (formerly Mail.ru Cloud Solutions) is a deep OpenStack platform. If your team knows OpenStack, adaptation is quick. Managed Kubernetes supports autoscaling, multiple node pools, and integration with Cloud Load Balancer. A key point: the cloud‑controller‑manager (CCM) is mandatory for Services of type LoadBalancer to automatically create real load balancers. Without a properly configured CCM, kubectl get svc shows EXTERNAL-IP: <pending> forever.

How to unify infrastructure across providers with Terraform?

Providers exist for all three Russian clouds, though maturity varies.

# Yandex Cloud terraform { required_providers { yandex = { source = "yandex-cloud/yandex" version = "~> 0.84" } } backend "s3" { endpoint = "storage.yandexcloud.net" bucket = "tf-state-prod" key = "kubernetes/terraform.tfstate" region = "ru-central1" skip_region_validation = true skip_credentials_validation = true } } 

terraform { required_providers { selectel = { source = "selectel/selectel" version = "~> 3.0" } } } resource "selectel_vpc_project" "project" { name = "production" } resource "selectel_dbaas_datastore" "pg" { project_id = selectel_vpc_project.project.id name = "postgres-prod" type = "postgresql" subnet_id = var.subnet_id }