STACKIT Marketplace
STACKIT
STACKIT Services Technical Overview
Last updated on
STACKIT
STACKIT Services Technical Overview
Comprehensive trail introducing all STACKIT cloud services, covering service overviews, technical details, and known limitations.
STACKIT Marketplace
Service
Advisory marketplace saas partners procurement
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
STACKIT Marketplace connects enterprise customers with verified third-party SaaS solutions.
Service Overview
Section titled “Service Overview”- Curated Ecosystem: Access vetted partner solutions running natively on sovereign STACKIT cloud infrastructure.
- Single Billing: Consolidated invoicing — all subscribed Marketplace products appear on your central STACKIT invoice.
- Verified Sovereignty: Solutions comply with strict European data privacy standards.
Technical Details
Section titled “Technical Details”- Subscription Engine: Token validation via Marketplace public keys and automated customer account binding.
Limitations & Constraints
Section titled “Limitations & Constraints”- SaaS Focus: Standard catalog offerings focus primarily on SaaS subscription deployment models.
STACKIT Landing Zone Accelerator
Blueprint
STACKIT Landing Zone Accelerator
STACKIT
Advisory landing zone architecture terraform governance
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
The STACKIT Landing Zone Accelerator provides pre-built Terraform and OpenTofu blueprints to automate enterprise onboarding.
Service Overview
Section titled “Service Overview”- Rapid Onboarding: Reduces enterprise cloud onboarding timelines from weeks to minutes.
- Standardized Compliance: Translates enterprise security and GDPR requirements directly into policy-as-code.
- Modular Blueprint: Supports standalone, hub-and-spoke, and transit firewall topologies.
Technical Details
Section titled “Technical Details”- Declarative IaC: Built using modular Terraform/OpenTofu code components.
- Core Integrations: Pre-configured IAM models, central audit logging, and automated secrets handling.
Limitations & Constraints
Section titled “Limitations & Constraints”- IaC Dependency: Custom adjustments require maintainers to understand OpenTofu/Terraform module structures.
STACKIT Cloud Security Posture Management
Service
STACKIT Cloud Security Posture Management
STACKIT
Architecture cspm security compliance bsi c5 devsecops
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
STACKIT CSPM provides automated compliance auditing and proactive risk detection across cloud workloads.
Service Overview
Section titled “Service Overview”- 360-Degree Visibility: Aggregates vulnerability metrics and compliance standards across projects.
- Guided Remediation: Offers step-by-step resolution steps for misconfigurations.
- Auditor Reports: Instant CSV compliance export tailored for standard benchmarks (BSI C5, ISO 27001).
Technical Details
Section titled “Technical Details”- Architecture: Control-plane auditing engine inspecting project configurations via REST APIs.
- Filtering: Filters policy violations against standard baseline templates.
Limitations & Constraints
Section titled “Limitations & Constraints”- No Auto-Remediation: Identifies misconfigurations and provides guides, but does not auto-apply code fixes.
STACKIT SPC Restricted
Blueprint
STACKIT SPC Restricted
STACKIT
Architecture spc vs-nfd public sector restricted sovereign
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
STACKIT Public Cloud Restricted (SPC) delivers classified cloud infrastructure managed by STACKIT.
Service Overview
Section titled “Service Overview”- VS-NfD Classification: Enables public sector and defense organizations to run classified workloads.
- Dedicated Hardware Racks: Dedicated host compute and HSM hardware racks housed in STACKIT data centers.
- Fully Managed Infrastructure: STACKIT handles physical rack management, hardware maintenance, and updates.
Technical Details
Section titled “Technical Details”- Connectivity: Dedicated encrypted VPN connections connecting directly into STACKIT WAN/MAN backbones.
Limitations & Constraints
Section titled “Limitations & Constraints”- Shared Responsibility: STACKIT manages physical infrastructure while customers manage application configurations.
STACKIT SDC Core
Blueprint
STACKIT SDC Core
STACKIT
Architecture sdc air-gapped vs-nfd on-premise sovereign
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
STACKIT Distributed Cloud (SDC) Core brings sovereign air-gapped cloud infrastructure onto customer premises.
Service Overview
Section titled “Service Overview”- Air-Gapped Sovereignty: Operates 100% autonomously on-premises without active internet connectivity dependencies.
- VS-NfD Compliance: Engineered to satisfy BSI security standards up to “VS-NfD” (Restricted) classification.
- On-Premise Cloud Agility: Delivers cloud-native VMs, SKE Kubernetes, Object Storage, and DBaaS locally.
Technical Details
Section titled “Technical Details”- Security: Hardware Security Module (HSM) BYOK integration and Security Enforcing Services (SES).
- Billing: Fixed monthly fee over 36 or 60 months based on provided hardware capacity.
Limitations & Constraints
Section titled “Limitations & Constraints”- Manual Bundle Updates: Updates are delivered as immutable signed distribution bundles requiring customer-managed deployment.
STACKIT Access Management
Service
STACKIT Access Management
STACKIT
Architecture iam access management rbac security
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
STACKIT Access Management provides centralized authorization management across all cloud services and projects.
Service Overview
Section titled “Service Overview”- Least Privilege Access: Enables granular permission assignments to users, groups, and service accounts.
- Compliant Governance: Structured, auditable permission inheritance across organizations, folders, and projects.
- Included Core Platform: Delivered as an integral platform feature at zero additional cost.
Technical Details
Section titled “Technical Details”- Architecture: Separates authentication (IdP) from authorization (IAM).
- Role Scopes: Predefined platform standard roles alongside support for custom role definitions.
Limitations & Constraints
Section titled “Limitations & Constraints”- Top-Down Inheritance: Permission inheritance is top-down; granular sub-project denies cannot override parent grants.
STACKIT Identity Provider
Service
STACKIT Identity Provider
STACKIT
Architecture identity idp sso oidc scim authentication
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
STACKIT IdP handles central authentication across the platform, bridging enterprise identity systems with STACKIT services.
Service Overview
Section titled “Service Overview”- Centralized Single Sign-On: Seamlessly federates with corporate identity providers like Entra ID and Google Workspace.
- Automated Lifecycle: Automated user onboarding and offboarding via SCIMv2 integration.
- Keyless Automation: Workload Identity Federation (WIF) eliminates static, long-lived API keys.
Technical Details
Section titled “Technical Details”- Protocols: Supports SAML 2.0, OIDC 1.0, and SCIMv2 (RFC 7642).
- Service Accounts: Authenticated using RSA signed JWTs (Key Flow) or short-lived OIDC assertions (WIF).
Limitations & Constraints
Section titled “Limitations & Constraints”- Platform Scope Only: Provides identity management exclusively for STACKIT platform access, not for custom tenant applications.
- Federation Setup: Initial enterprise IdP federation configurations require support ticket requests.
STACKIT Secrets Manager
Service
STACKIT Secrets Manager
STACKIT
Architecture secrets vault security kms credentials
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
STACKIT Secrets Manager provides secure storage for passwords, API tokens, and certificate keys.
Service Overview
Section titled “Service Overview”- Vault API Compatibility: Drop-in replacement for workflows expecting HashiCorp Vault KV2 APIs.
- Code Decoupling: Removes sensitive hardcoded passwords and tokens from application source code.
Technical Details
Section titled “Technical Details”- Security: Secured via IP-based ACLs, KMS envelope encryption, and audit logging.
- Kubernetes Integration: Integrates directly with the Kubernetes External Secrets Operator.
Service Plans
Section titled “Service Plans”The values below come from the STACKIT documentation and update themselves.
From the STACKIT docsFeatures, use cases and service plans › Service plans
The Secrets Manager automatically scales in the number of secrets and users, there are no fixed service plans.
The following restrictions apply:
- The number of API accesses is limited to 10,000 accesses per hour per Secrets Manager.
- Up to 100 users can be created per Secrets Manager.
What is this?
This section is copied from the STACKIT docs automatically, several times a day. It cannot be changed here. Changes belong in the STACKIT docs.
Limitations & Constraints
Section titled “Limitations & Constraints”- Instance-Level ACLs: Access permissions are set per instance; individual secret-level ACLs are unsupported.
- Public API Access: Endpoint connections operate over public HTTPS (private endpoints unavailable).
STACKIT Key Management Service
Service
STACKIT Key Management Service
STACKIT
Architecture kms encryption byok security crypto
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
STACKIT KMS allows organizations to create, store, and manage cryptographic keys for cloud data encryption.
Service Overview
Section titled “Service Overview”- Envelope Encryption: Generates local DEKs protected by KMS-stored Master Keys (KEKs).
- Bring Your Own Key (BYOK): Securely import custom key pairs using wrapping key protocols.
- Sovereign Execution: Cryptographic key operations run inside certified German data centers.
Technical Details
Section titled “Technical Details”- Supported Algorithms: AES-256-GCM, RSA (2048/3072/4096), ECDSA (P256/P384/P521), and HMAC.
- Service Native: Directly integrated with STACKIT Block Storage and database encryption engines.
Algorithms
Section titled “Algorithms”The values below come from the STACKIT documentation and update themselves.
From the STACKIT docsConcepts › Algorithms
Symmetric Encrypt Decrypt
- AES 256 GCM: This will use the Advanced Encryption Standard (AES) with a 256 bit key in Galois Counter Mode (GCM)
Asymmetric Encrypt Decrypt
- RSA 2048 OAEP SHA256: This will use a 2048 bit RSA key with Optimal Asymmetric Encryption Padding (OAEP) using a SHA256 digest.
- RSA 3072 OAEP SHA256: This will use a 3072 bit RSA key with Optimal Asymmetric Encryption Padding (OAEP) using a SHA256 digest.
- RSA 4096 OAEP SHA256: This will use a 4096 bit RSA key with Optimal Asymmetric Encryption Padding (OAEP) using a SHA256 digest.
- RSA 4096 OAEP SHA512: This will use a 4096 bit RSA key with Optimal Asymmetric Encryption Padding (OAEP) using a SHA512 digest.
Asymmetric Sign Verify
- ECDSA P256 SHA256: This will use the ECDSA algorithm based on the P256 curve (a.k.a.
secp256r1). - ECDSA P384 SHA384: This will use the ECDSA algorithm based on the P384 curve (a.k.a.
secp384r1). - ECDSA P521 SHA512: This will use the ECDSA algorithm based on the P521 curve (a.k.a.
secp521r1).
Message Authentication Code
HMAC SHA256: This will use a 256 bit key using a SHA256 digest
HMAC SHA384: This will use a 384 bit key using a SHA384 digest
HMAC SHA512: This will use a 512 bit key using a SHA512 digest
Wrap Symmetric Key
RSA 2048 OAEP SHA256: This will use a 2048 bit RSA key with Optimal Asymmetric Encryption Padding (OAEP) using a SHA256 digest.
RSA 3072 OAEP SHA256: This will use a 3072 bit RSA key with Optimal Asymmetric Encryption Padding (OAEP) using a SHA256 digest.
RSA 4096 OAEP SHA256: This will use a 4096 bit RSA key with Optimal Asymmetric Encryption Padding (OAEP) using a SHA256 digest.
RSA 4096 OAEP SHA512: This will use a 4096 bit RSA key with Optimal Asymmetric Encryption Padding (OAEP) using a SHA512 digest.
Wrap Asymmetric Key
RSA 2048 OAEP SHA256 with AES 256 Key Wrapping: This will use a 2048 bit RSA wrapping key with Optimal Asymmetric Encryption Padding (OAEP) using a SHA256 digest to encrypt a temporary AES 256 symmetric key that is used to encrypt the actual key material.
RSA 3072 OAEP SHA256 with AES 256 Key Wrapping: This will use a 3072 bit RSA wrapping key with Optimal Asymmetric Encryption Padding (OAEP) using a SHA256 digest to encrypt a temporary AES 256 symmetric key that is used to encrypt the actual key material.
RSA 4096 OAEP SHA256 with AES 256 Key Wrapping: This will use a 4096 bit RSA wrapping key with Optimal Asymmetric Encryption Padding (OAEP) using a SHA256 digest to encrypt a temporary AES 256 symmetric key that is used to encrypt the actual key material.
RSA 4096 OAEP SHA512 with AES 256 Key Wrapping: This will use a 4096 bit RSA wrapping key with Optimal Asymmetric Encryption Padding (OAEP) using a SHA512 digest to encrypt a temporary AES 256 symmetric key that is used to encrypt the actual key material.
What is this?
This section is copied from the STACKIT docs automatically, several times a day. It cannot be changed here. Changes belong in the STACKIT docs.
Limitations & Constraints
Section titled “Limitations & Constraints”- No Export of Generated Keys: Keys created inside the KMS cannot be exported outside the security boundary.
- Explicit Version Targeting: Key API requests must target explicit version numbers rather than auto-resolving aliases.
STACKIT Resource Manager
Service
STACKIT Resource Manager
STACKIT
Advisory governance resource manager hierarchy organization
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
STACKIT Resource Manager provides a central tree-like hierarchy to organize cloud resources and enforce top-down governance.
Service Overview
Section titled “Service Overview”- Structured Governance: Enables transparent cost allocation and permission inheritance across organizational levels.
- Environment Isolation: Strict project-level security boundaries prevent unauthorized inter-project access.
- Free Core Service: Provided free of charge as a foundational cloud platform component.
Technical Details
Section titled “Technical Details”- Hierarchy Tree: Customer Account -> Organization -> Folders -> Projects.
- IAM Inheritance: Inherits permissions automatically from organization level down to projects.
- Landing Zone Automation: Supported natively via the STACKIT Terraform Provider.
Limitations & Constraints
Section titled “Limitations & Constraints”- Single Folder Depth: Supported folder nesting depth is limited strictly to a single folder level.
- Single Parent Relation: Each resource container belongs strictly to one parent project or organization.
STACKIT Support
Service
STACKIT Support
STACKIT
Advisory support sla enterprise 24/7 help desk
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
STACKIT Support provides tiered enterprise technical support and incident management.
Service Overview
Section titled “Service Overview”- European Support Teams: Direct technical support delivered by sovereign EU-based engineers.
- Essential Tier Included: Complimentary support coverage for non-critical development environments.
- Ultimate 24/7 SLA: Mission-critical 30-minute initial response times with dedicated escalation contacts.
Technical Details
Section titled “Technical Details”- Tiers: Essential (Included), Advanced (Business Hours / Extended), Ultimate (24/7 Critical).
- Channels: Online portal ticket tracking, real-time status monitoring, and phone hotlines.
Limitations & Constraints
Section titled “Limitations & Constraints”- Prior Verification: Customers must verify that issues do not originate within custom application code before ticket escalation.
STACKIT Cost Management
Service
STACKIT Cost Management
STACKIT
Advisory finops cost management billing governance
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
STACKIT Cost Management is an included platform service that offers real-time visibility, cost analysis, and billing governance across all STACKIT projects.
Service Overview
Section titled “Service Overview”- Complete Cost Control: Hourly-updated observability across all cost points down to single resource tags.
- Included at No Extra Cost: Available free of charge across the entire organization without consumption commitments.
- Role-Based Financial Insights: Empowers solution architects, procurement teams, and decision-makers.
- Audit-Proof Accounting: Generates GoBD-conform collective invoices and central billing management.
Technical Details
Section titled “Technical Details”- Reporting & Observability: Real-time dashboards, custom cost report generation, and exportable FOCUS reports.
- Allocation & Tagging: Cause-based cost allocation utilizing resource tags as a basis for showback and chargeback.
- Access Hierarchy: Role-based access control (RBAC) with hierarchical access inheritance for financial data.
- Integrations: REST-API and portal interfaces for exporting data directly into enterprise FinOps tooling.
Limitations & Constraints
Section titled “Limitations & Constraints”- Data Latency: Operates on hourly batch updates rather than instant millisecond streaming.
- Timezone Standardization: All timeslots and billing cycles are fixed strictly to the UTC timezone.
- Strict Project Relations: Maintains 1-on-1 project-to-invoice mappings on a strict monthly basis.
- Analytics Scope: Does not provide native AI cost forecasts; requires external BI solutions for advanced predictive modeling.
STACKIT Compute Engine
Service
STACKIT Compute Engine
STACKIT
Architecture compute iaas vm openstack infrastructure
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
The STACKIT Compute Engine delivers flexible, enterprise-grade Virtual Machines (VMs) for hosting development, testing, and production workloads.
Service Overview
Section titled “Service Overview”- Cost-Effective: Pay-as-you-go model with minute-by-minute billing precision.
- High Flexibility: Rapid automated instantiation of custom Linux and Windows machine flavors in seconds.
- Sovereign Infrastructure: GDPR-compliant operation hosted in secure, certified German data centers (BSI C5).
Technical Details
Section titled “Technical Details”- Architecture: OpenStack-based sovereign cloud infrastructure with Terraform and REST API control.
- Network & Access: Security groups for port/protocol filtering, public/private IP attachments, and central SSH key management.
- Ecosystem Integration: Native integration with STACKIT DNS, Block Storage, Backup, and STACKIT Network Areas (SNA).
- Automation: Management via STACKIT Portal, CLI, Terraform Provider, and STACKIT Server Agent (Run Command).
Limitations & Constraints
Section titled “Limitations & Constraints”- No Native Bare-Metal: Extreme workloads (>6 TB RAM) hit hypervisor limits; dedicated bare-metal instances are unavailable.
- Cross-Project Networking: OpenStack networks cannot cross project boundaries directly; require routing via STACKIT Network Areas (SNA).
- Service Account Linking: Lacks standard portal UI binding for linking IAM service accounts directly to VMs.
- Fixed Overcommit: CPU overcommitting ratios are system-fixed at 1:4 to 1:6 by default.
STACKIT Confidential Computing
Blueprint
STACKIT Confidential Computing
STACKIT
Architecture confidential compute security amd sev-snp zero-trust encryption
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
STACKIT Confidential Computing provides hardware-based isolation for sensitive workloads, guaranteeing that data remains encrypted during processing (data-in-use).
Service Overview
Section titled “Service Overview”- Technical Operator Exclusion: Cryptographic barriers prevent cloud operators and hypervisors from inspecting customer memory space.
- Compliance Alignment: Meets the stringent requirements of highly regulated industries, healthcare, and public sector workloads.
- Zero-Trust Security: Ensures cryptographic proof of environment integrity before releasing sensitive keys.
Technical Details
Section titled “Technical Details”- Trusted Execution Environments (TEE): Memory encryption powered by AMD SEV-SNP and Intel TDX at the CPU level.
- Confidential VMs (cVM): Cryptographically isolated virtual machines isolated from the underlying host hypervisor.
- Attestation Service: Validates boot measurements (firmware/runtime) and executes Key Release actions via KMS/Vault integration.
Limitations & Constraints
Section titled “Limitations & Constraints”- Roadmap Availability: Features are undergoing phased rollout (cVMs with AMD SEV-SNP Q4 2026, Intel TDX Q1 2027, GPU support H2 2027+).
- Hardware Binding: Restricted to specific confidential-capable machine types and hardware generations.
STACKIT Server Update Management
Service
STACKIT Server Update Management
STACKIT
Architecture patching maintenance compute security automation
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
STACKIT Server Update Management automates and standardizes OS patch workflows across virtual machines directly via the portal, CLI, or API.
Service Overview
Section titled “Service Overview”- Risk Mitigation: Closes security vulnerabilities quickly through automated patch compliance.
- Operational Efficiency: Eliminates tedious manual interactive logins on single server instances.
- Auditable Operations: Maintains detailed chronological logs of historical update executions.
Technical Details
Section titled “Technical Details”- Agent-Driven Execution: Uses the STACKIT Server Agent for secure, local patch execution.
- Scheduling Engine: Flexible calendar schedule creation via portal or RRULE syntax in the API.
- On-Demand Updates: Manual “Update now” override button for critical zero-day emergency patches.
- Preconfigured RHEL Support: Integrated with Red Hat Update Infrastructure (RHUI) on pay-as-you-go instances.
Limitations & Constraints
Section titled “Limitations & Constraints”- Agent Dependency: The STACKIT Server Agent must remain active; stopping the agent breaks all patch routines.
- Reboot Behavior: Patch cycles may trigger automatic VM reboots; maintenance windows must be planned carefully.
- Scope Limit: Excludes unmanaged custom compute instances or non-supported guest OS distributions.
- API Deprecation: Legacy MOSS endpoints are shut down; workflows require Server Update Management API v2.
STACKIT Server Backup Management
Service
STACKIT Server Backup Management
STACKIT
Architecture backup disaster recovery compute storage data protection
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
STACKIT Server Backup Management provides centralized orchestration for automated full and incremental volume backups with flexible retention windows.
Service Overview
Section titled “Service Overview”- Business Continuity: Ensures dependable recovery vectors during data loss or system corruption.
- Low Operational Effort: Eliminates manual backup scripting through scheduled automated policies.
- Self-Service Recovery: Enables IT teams to restore or clone volumes directly without support intervention.
Technical Details
Section titled “Technical Details”- Schedules & Customization: Granular recurrence rules, selectable start times, custom retention periods, and specific volume selection.
- Restoration Modes: Supports direct volume overwriting or restoration into a secondary volume for manual file extraction.
- Sovereign WORM Protection: Physically separated, secure storage backend with automated expiration purges.
- API & Automation: Controlled via the STACKIT Portal, Terraform Provider, CLI, and Server Backup API v2.
Limitations & Constraints
Section titled “Limitations & Constraints”- Skipped Executions: If an ongoing backup job overlaps with the next schedule window, the subsequent job is automatically skipped.
- API Migration Required: Legacy MOSS API is deprecated; automations must migrate strictly to Server Backup API v2.
- No Native S3 Offloading: Backup storage targets are fixed to managed backup pools; direct export to custom S3 buckets is unsupported.
STACKIT Object Storage
Service
STACKIT Object Storage
STACKIT
Advisory object storage s3 buckets storage worm
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
STACKIT Object Storage provides scalable S3-compliant object storage for unstructured data and backups.
Service Overview
Section titled “Service Overview”- S3 API Compatibility: Natively compatible with standard S3 SDKs, Veeam Backup, and AWS CLI tools.
- Object Lock Defense: Immutability locks protect backup datasets against ransomware deletion or alteration.
- No Egress Bandwidth Fees: Pay-as-you-go pricing based purely on stored volume without ingress/egress charges.
Technical Details
Section titled “Technical Details”- Compliance: 100% GDPR-compliant storage hosted inside German data centers (ISO 27001, BSI C5).
- Management: Bucket creation, credential generation, and lifecycle rules controlled via Portal and Terraform.
Limits and Regions
Section titled “Limits and Regions”The values below come from the STACKIT documentation and update themselves.
From the STACKIT docsLimits of Object Storage › General limits
| Limit | Value | Note |
|---|---|---|
| Max. Object size: | 5 TB | Object Storage Objects can range in size from 1 byte to 5 terabytes. |
| Max. Part Size (multipart upload) | 5 GB | Max size of one part, using multipart upload. |
| Max. number of parts (multipart upload) | 10.000 | Max number of parts, using multipart upload. |
| Max. Bucket size: | no limit | See “tenant quota” |
| Max. Versions per Object | 1000 | If object versioning is used this limitation is applied. |
| Tenant Quota | 500 TB | Can be adjusted on request. Contact our Support |
| Max. Objects per Bucket | no limit | |
| Max. Buckets per STACKIT Project | 1000 | per STACKIT project |
| Credentials Groups | 1000 | per STACKIT project |
| Max. Read/Write Requests per Second | 2500 | per STACKIT project |
| Max. Up-/Download bandwidth | 500 MB/s | per STACKIT project |
| Max. Concurrent Read/Write Requests per Second | 500 | per STACKIT project |
| Bucket Policy size limit | 20,480 Bytes | max. size of a bucket policy |
| Max. Retention for Compliance Lock | 365 days | Max. time that can be set to lock objects |
What is this?
This section is copied from the STACKIT docs automatically, several times a day. It cannot be changed here. Changes belong in the STACKIT docs.
From the STACKIT docsArchitecture of Object Storage › Regions and availability zones
The source shows pictures here that this page leaves out (1). See them in Architecture of Object Storage
Object Storage is available in dedicated regions. Within each region, your data is automatically replicated across all three Availability Zones. This replication happens transparently, you do not need to configure it.
The following diagram shows the structure of Object Storage in an example region (EU01):
Each region has a dedicated endpoint URL. You need to use the endpoint of the region where your bucket resides.
| Region | Endpoint URL |
|---|---|
| EU01 | https://object.storage.eu01.onstackit.cloud |
| EU02 | https://object.storage.eu02.onstackit.cloud |
All STACKIT Object Storage endpoints support TLS 1.3 encryption.
Buckets are region-specific. You can not move a bucket between regions after creation.
What is this?
This section is copied from the STACKIT docs automatically, several times a day. It cannot be changed here. Changes belong in the STACKIT docs.
Limitations & Constraints
Section titled “Limitations & Constraints”- Public API Endpoints Only: Access routes through public regional S3 endpoints (private SNA endpoints in development).
STACKIT File Storage
Service
STACKIT File Storage
STACKIT
Advisory file storage nfs rwx storage kubernetes
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
STACKIT File Storage provides managed NFS network file shares for multi-instance data sharing.
Service Overview
Section titled “Service Overview”- Shared Data Access: Concurrent high-performance read-write access for multiple VM instances.
- Kubernetes RWX Support: Native ReadWriteMany (RWX) volume support for STACKIT Kubernetes Engine (SKE).
- Snapshot Protection: Integrated file share snapshot routines for fast file-level recovery.
Technical Details
Section titled “Technical Details”- Access Control: IP-based export rules with Read-Write (RW) or Read-Only (RO) permissions.
Limits
Section titled “Limits”The values below come from the STACKIT documentation and update themselves.
From the STACKIT docsLimits › General limits
| Limit: | Value: | Note: |
|---|---|---|
| Min. Capacity Resource Pool | 500 GB | Min. Size of a single Resource Pool |
| Max. Capacity Resource Pool | 20 TB | Max. Size of a single Resource Pool |
| Supported NFS-Versions | NFSv3, NFSv4.1, NFSv4.2 | Supported unencrypted versions of NFS protocol |
| Max. share export policies | 200 | Max. number of share export policies per Project |
| Max. rules per share export policy | 10 | Max. rules per export policy |
| Max. shares per Resource Pool | 200 | Max. number of shares per Resource Pool |
| Expected latency | < 2 ms | Expected storage backend latency depending on the workload. Does not include network latency |
| Max. snapshots (manually) | 100 | Max. amount of snapshots of a Resource Pool that are created manually |
| Max. snapshots in schedule | 100 | Max. amount of snapshots of a Resource Pool that are created via a schedule |
| Max. Retention for Snapshot Immutability | 30 days | Max. time that can be set to lock Snapshots |
What is this?
This section is copied from the STACKIT docs automatically, several times a day. It cannot be changed here. Changes belong in the STACKIT docs.
Limitations & Constraints
Section titled “Limitations & Constraints”- No Native SMB/CIFS: Windows file share protocols (SMB/CIFS) and Active Directory joins are currently unsupported.
- No iSCSI LUNs: Delivers file-level NFS exports only; block-level iSCSI LUN provisioning is unavailable.
STACKIT Block Storage
Service
STACKIT Block Storage
STACKIT
Advisory block storage iaas volumes ssd storage
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
STACKIT Block Storage delivers persistent SSD-backed volume storage attached to Compute Engine VMs.
Service Overview
Section titled “Service Overview”- High IOPS Performance: Performance profiles delivering maximum IOPS for enterprise database workloads.
- Metro Fail-Safety: Replicated storage backend across availability zones guarantees data persistence.
Technical Details
Section titled “Technical Details”- Billing: Hourly usage billing based on provisioned volume size and selected performance profile class.
- Integrations: Fully automatable via Terraform, REST API, and STACKIT Compute Engine.
Performance Classes
Section titled “Performance Classes”The values below come from the STACKIT documentation and update themselves.
From the STACKIT docsService plans › Currently available Service Plans (performance classes)
The following table lists currently available performance classes for the EU01 region:
| Performance class | Name | Max. IOPS | Max. Throughput (MB/s) |
|---|---|---|---|
| Performance class 0 | storage_premium_perf0 | 120 | 25 |
| Performance class 1 | storage_premium_perf1 | 500 | 50 |
| Performance class 2 | storage_premium_perf2 | 1000 | 100 |
| Performance class 4 | storage_premium_perf4 | 2000 | 150 |
| Performance class 6 | storage_premium_perf6 | 5000 | 200 |
| Performance class 8 | storage_premium_perf8 | 10000 | 250 |
| Performance class 10 | storage_premium_perf10 | 15000 | 300 |
| Performance class 12 | storage_premium_perf12 | 20000 | 350 |
| Performance class 13 | storage_premium_perf13 | 20000 | 700 |
| Performance class 14 | storage_premium_perf14 | 25000 | 400 |
| Performance class 15 | storage_premium_perf15 | 25000 | 800 |
| Performance class 16 | storage_premium_perf16 | 30000 | 450 |
| Performance class 17 | storage_premium_perf17 | 30000 | 900 |
| Performance class 18 | storage_premium_perf18 | 35000 | 500 |
| Performance class 19 | storage_premium_perf19 | 35000 | 1000 |
| Performance class 20 | storage_premium_perf20 | 40000 | 550 |
| Performance class 21 | storage_premium_perf21 | 40000 | 1100 |
| Performance class 29 | storage_premium_perf29 | 60000 | 1500 |
IOPS - Input/Output Operations per second
Throughput - Throughput in Megabytes per second
Thus, the classes used can be distinguished in detail based on the naming. Example: “Block Storage Premium - Performance Class 2” corresponds to SSD hard disks with max. 1000 IOPS and max. 100 Mbyte/s throughput.
What is this?
This section is copied from the STACKIT docs automatically, several times a day. It cannot be changed here. Changes belong in the STACKIT docs.
From the STACKIT docsService plans › Single vs Metro AZ
Block Storage is offered in multiple performance classes. All of them are available both for Single Availability Zone (Single AZ) and Metro Availability Zone (Metro) setup.
Single Availability Zone (Single AZ) setup implies fixed assignment to one Availability Zone. Data in a Single AZ are not mirrored across different Availability Zones.
Metro AZ setup means fixed assignment to a region, but no fixed assignment to an Availability Zone. Data in Metro Setup are automatically mirrored across two different Availability Zones.
What is this?
This section is copied from the STACKIT docs automatically, several times a day. It cannot be changed here. Changes belong in the STACKIT docs.
Limitations & Constraints
Section titled “Limitations & Constraints”- No Volume Shrinking: Disk volumes can be expanded, but shrinking an existing volume is unsupported.
- No Multi-Attach: A block volume can be mounted to only one VM at a time (requires File Storage for multi-VM RWX).
STACKIT Backup Storage
Service
STACKIT Backup Storage
STACKIT
Advisory backup storage snapshots storage disaster recovery
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
STACKIT Backup Storage provides dedicated storage pools for backing up virtual machine volumes.
Service Overview
Section titled “Service Overview”- Crash-Consistent Backups: Captures complete volume state snapshots for reliable system restoration.
- Automated Retention: Manages deletion cycles automatically based on configured retention policies.
- Pay-As-You-Go: Billing based purely on stored backup gigabytes without upfront hardware investment.
Technical Details
Section titled “Technical Details”- Redundancy: Physically separated storage backend replicated across multiple availability zones.
- Management: Configurable directly via the STACKIT Portal, REST API, or Terraform Provider.
Limitations & Constraints
Section titled “Limitations & Constraints”- No CMK Key Rotation: Encryption uses STACKIT-managed keys (custom KMS BYOK keys currently unsupported).
- Replicated Storage Only: Single-AZ un-replicated low-cost backup tier options are unavailable.
STACKIT Archiving Storage
Service
STACKIT Archiving Storage
STACKIT
Advisory archiving worm sap compliance storage
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
STACKIT Archiving Storage provides a managed service for audit-proof data retention based on the Write Once, Read Many (WORM) principle, tailored for legally compliant enterprise archiving.
Service Overview
Section titled “Service Overview”- Legal Compliance: Fulfills strict regulatory obligations including GDPR (DSGVO) and GoBD.
- Data Integrity: Enforces cryptographic immutable object locks to eliminate data manipulation risks.
- Low Operational Overhead: Fully managed EU-hosted infrastructure with minimal maintenance effort.
- Transparent Cost Model: Fixed monthly plans (Small, Medium, Large) with predictable pricing and included quotas.
Technical Details
Section titled “Technical Details”- SAP Integration: Out-of-the-box SAP-ArchiveLink connection for 1:1 ERP synchronization.
- Dedicated Access Control: Utilizes dedicated archive credentials fully independent of standard STACKIT IAM.
- High Performance: Scalable backend architecture capable of delivering up to 1500+ TPS on the Large plan.
- Connectivity & Multi-Tenancy: HTTP/REST-based archiving endpoints operating inside multi-tenant isolated EU data centers.
Limitations & Constraints
Section titled “Limitations & Constraints”- Immutable Configurations: Retention periods can only be extended; decreasing retention duration is not supported.
- Locked Deletion: Repository deletion is blocked while active archived datasets remain inside retention windows.
- Fixed Properties: Repository names and connection routing types are immutable once created.
- No Traditional Backup: Replaces standard backups with native WORM replication; external backups are not applicable.
STACKIT Network
Service
STACKIT Network
STACKIT
Architecture networking vpc bgp direct connect sna
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
STACKIT Network provides enterprise cross-project virtual networking and hybrid cloud connectivity options.
Service Overview
Section titled “Service Overview”- Cross-Project VPC Sharing: Shares VPC networks securely across organizational project boundaries.
- Zero Bandwidth Costs: Free egress traffic within the same region and out to the public internet.
- High-Speed Direct Connect: Dedicated physical fiber connections supporting up to 100 Gbit/s bandwidth.
Technical Details
Section titled “Technical Details”- Routing: Supports BGP dynamic routing and manual static routing tables.
- Hybrid Options: Direct Connect (IEEE 802.1Q VLANs) and Partner Connect links (up to 10 Gbit/s).
Limitations & Constraints
Section titled “Limitations & Constraints”- No Native IPv6: Public and private routing operates exclusively over IPv4 networks.
- Layer 3 Boundaries: Cross-project connection operates strictly via Layer 3 routing over STACKIT Network Areas (SNA).
STACKIT MailOut
Service
STACKIT MailOut
STACKIT
Architecture email smtp rest api messaging dkim
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
STACKIT MailOut provides reliable transactional email delivery for cloud applications.
Service Overview
Section titled “Service Overview”- Secure Email Delivery: High-deliverability transactional emailing hosted in German data centers.
- Zero Server Maintenance: Fully managed relay infrastructure eliminates custom mail server operations.
- Sender Protection: Built-in DKIM, SPF, and TLS transport encryption for domain verification.
Technical Details
Section titled “Technical Details”- Interfaces: Accessible via standard SMTP relay connections or modern REST APIs.
- Billing: Consumption-based billing calculated per sent email.
Limitations & Constraints
Section titled “Limitations & Constraints”- Outbound Only: Supports transactional email sending only (inbound email reception unsupported).
STACKIT DNS
Service
STACKIT DNS
STACKIT
Architecture dns anycast networking domain
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
STACKIT DNS provides authoritative DNS hosting distributed across global Anycast name servers.
Service Overview
Section titled “Service Overview”- High Availability: Global Anycast distribution ensures ultra-low latency and DDoS resilience.
- Free Subdomains: Provides up to 5 free STACKIT subdomains per project without domain purchases.
- Automation Ready: Managed via REST API, CLI, Terraform Provider, and Kubernetes ExternalDNS.
Technical Details
Section titled “Technical Details”- Zone Types: Primary (editable) and Secondary (read-only) DNS zone hosting.
- Integrations: Integrates with STACKIT SKE clusters for automated ingress DNS creation.
Limitations & Constraints
Section titled “Limitations & Constraints”- Authoritative Only: Acts as an authoritative DNS provider; does not function as a recursive resolver.
STACKIT DNS Resolver
Service
STACKIT DNS Resolver
STACKIT
Architecture dns resolver dnssec networking doh
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
STACKIT DNS Resolver handles outbound recursive domain resolution for internal cloud workloads.
Service Overview
Section titled “Service Overview”- Sovereign Resolution: Keeps internal cloud DNS traffic inside STACKIT data center boundaries.
- Enhanced Security: Built-in DNSSEC validation and DNS over HTTPS (DoH) support prevent eavesdropping.
- Zero Cost: Provided as an integrated, free network platform component.
Technical Details
Section titled “Technical Details”- Protocols: Standard DNS over UDP/TCP (port 53) and DoH (RFC 8484).
- Deployment: Regional redundant IP endpoints with local response caching.
Limitations & Constraints
Section titled “Limitations & Constraints”- Workload Scoped: Intended strictly for internal STACKIT VM/SKE workloads; unavailable as a public resolver.
STACKIT Network Load Balancer
Service
STACKIT Network Load Balancer
STACKIT
Architecture load balancer layer-4 tcp udp high performance
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
STACKIT Network Load Balancer handles high-throughput Layer-4 TCP and UDP traffic balancing.
Service Overview
Section titled “Service Overview”- High Throughput: Capable of processing millions of raw network requests per second with minimal latency.
- TLS Passthrough: Preserves encrypted traffic streams directly down to backend target instances.
- Flexible Protocols: Supports custom TCP and UDP application protocols.
Technical Details
Section titled “Technical Details”- Features: Source IP stickiness, active TCP/UDP health checks, public and private network integration.
- Automation: Fully configurable via Terraform Provider, REST API, and STACKIT Portal.
Feature Availability
Section titled “Feature Availability”The values below come from the STACKIT documentation and update themselves.
From the STACKIT docsNLB features › Feature overview & availability
The following table outlines the specific transport layer conditions and core features available within the STACKIT Network Load Balancer (NLB):
| Feature | API | SDK | Terraform | Portal |
|---|---|---|---|---|
| Advanced active health checks (HTTP) | Available | Available | WIP | Available |
| Basic active health checks (TCP/UDP) | Available | Available | Available | Available |
| Create/delete NLB | Available | Available | Available | Available |
| Ephemeral IP | Available | Available | Available | Available |
| Idle timeout configuration | Available | Available | Available | WIP |
| L4 load balancing (TCP/UDP) | Available | Available | Available | Available |
| Logs (Loki) | Available | Available | Available | WIP |
| Manual target security groups | Available | Available | Available | Available |
| Metrics (Prometheus) | Available | Available | Available | WIP |
| Plan changes | Available | Available | Available | Available |
| Private network only deployment | Available | Available | Available | Available |
| Resource labels | Available | Available | WIP | WIP |
| Session persistence (source IP) | Available | Available | Available | Available |
| Source IP access control (ACL) | Available | Available | Available | Available |
| TCP proxy support | Available | Available | Available | Available |
| TLS passthrough | Available | Available | Available | Available |
| Update full NLB | Available | Available | WIP | WIP |
| Update target pools only | Available | Available | Available | Available |
What is this?
This section is copied from the STACKIT docs automatically, several times a day. It cannot be changed here. Changes belong in the STACKIT docs.
Limitations & Constraints
Section titled “Limitations & Constraints”- No Layer-7 Offloading: Lacks HTTP header parsing, URL path routing, or SSL/TLS certificate termination.
STACKIT Application Load Balancer
Service
STACKIT Application Load Balancer
STACKIT
Architecture load balancer layer-7 http tls offloading
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
STACKIT Application Load Balancer distributes Layer-7 HTTP/HTTPS web traffic across backend pools.
Service Overview
Section titled “Service Overview”- Layer-7 Routing: Routes requests based on URL paths, request headers, query parameters, and hostnames.
- TLS Offloading: Manages SSL/TLS termination centrally with custom certificate support.
- High Availability: Deployed in active/passive HA configurations across availability zones.
Technical Details
Section titled “Technical Details”- Features: Cookie-based session persistence, WebSockets support, and optional WAF integration.
- Capacity: Supports up to 20 listeners, 20 target pools, and 250 targets per target pool.
Feature Availability
Section titled “Feature Availability”The values below come from the STACKIT documentation and update themselves.
From the STACKIT docsALB features › Feature overview & availability
The following table outlines which STACKIT ALB features are available and which are still being developed:
| Feature | API | SDK | Terraform | Portal |
|---|---|---|---|---|
| Advanced active health checks (HTTP) | Available | Available | WIP | WIP |
| Basic active health checks (TCP) | Available | Available | Available | Available |
| Create/delete ALB | Available | Available | Available | Available |
| Ephemeral IP | Available | Available | Available | Available |
| IP block list | Available | WIP | WIP | WIP |
| L7 load balancing (HTTP/HTTPS) | Available | Available | Available | Available |
| Logs (Loki) | Available | Available | Available | WIP |
| Manual target security groups | Available | Available | Available | Available |
| Metrics (Prometheus) | Available | Available | Available | WIP |
| Plan changes | WIP | WIP | WIP | WIP |
| Private network only deployment | Available | Available | Available | Available |
| Resource labels | Available | WIP | Available | WIP |
| Routing with headers | Available | Available | Available | Available |
| Routing with host | Available | Available | Available | Available |
| Routing with path (prefix/exact) | Available | Available | Available | Available |
| Routing with query parameters | Available | Available | Available | Available |
| Session persistence (cookie) | Available | Available | Available | Available |
| Source IP access control (ACL) | Available | Available | Available | Available |
| TLS offloading | Available | Available | Available | Available |
| TLS bridging | Available | Available | Available | Available |
| Update full ALB | Available | Available | Available | WIP |
| Update target pools only | Available | Available | Available | Available |
| ALB WAF integration | Available | WIP | Available | WIP |
| WebSocket support | Available | Available | Available | Available |
What is this?
This section is copied from the STACKIT docs automatically, several times a day. It cannot be changed here. Changes belong in the STACKIT docs.
Limitations & Constraints
Section titled “Limitations & Constraints”- No TLS Passthrough: Operates at Layer 7; encrypted end-to-end TLS passthrough requires Network Load Balancers.
- No Automated Cert Rotation: Certificates attached manually must be updated before expiration.
STACKIT CDN
Service
STACKIT CDN
STACKIT
Architecture cdn edge waf ddos image optimizer
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
STACKIT CDN speeds up global content delivery while protecting origin web servers against traffic spikes.
Service Overview
Section titled “Service Overview”- Global Edge Performance: Caches static and dynamic web content across worldwide edge locations.
- Integrated WAF Security: Protects origins against SQL injection, XSS attacks, and bot networks.
- Image Optimizer: Automatically converts images to WebP format and resizes dimensions on the fly.
Technical Details
Section titled “Technical Details”- Protocols: Supports HTTP/2, HTTP/3, end-to-end TLS, and REST API cache purges.
- Billing: Pay-per-use model based strictly on egress traffic; free ingress transfers.
Log Storage
Section titled “Log Storage”The values below come from the STACKIT documentation and update themselves.
From the STACKIT docsCDN features and options › Built-in log storage
By default, STACKIT CDN stores the 10.000 most recent log entries from the past hour. You can query these logs directly via the API to perform quick troubleshooting or traffic analysis. A log entry contains the following information:
| Field | Description |
|---|---|
| Status | The HTTP status code returned to the client (e.g., 200, 404). |
| Timestamp | The exact date and time (UTC) the request was processed. |
| Remote country | The ISO 3166-1 alpha-2 country code where the request originated. |
| Cache | Indicates if the request was a HIT (served from cache) or a MISS (fetched from origin). |
| Size | The total volume of data transferred in the response, measured in bytes. |
| Data center | The identifier of the specific CDN edge location that handled the request. A list of data centers is available here. |
| Path | The URL path of the requested resource. |
What is this?
This section is copied from the STACKIT docs automatically, several times a day. It cannot be changed here. Changes belong in the STACKIT docs.
STACKIT VPN
Service
STACKIT VPN
STACKIT
Architecture vpn ipsec bgp hybrid cloud encrypted
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
STACKIT VPN establishes encrypted IPSec site-to-site tunnels connecting on-premises data centers to STACKIT.
Service Overview
Section titled “Service Overview”- Encrypted Hybrid Link: Securely bridges private corporate networks with STACKIT VPC instances.
- High Availability: Active-active gateway configurations built across distinct availability zones.
- No Egress Costs: Included tunnel bandwidth without separate ingress or egress data volume charges.
Technical Details
Section titled “Technical Details”- Protocols: IPSec with IKEv2 and Pre-Shared Keys (PSK).
- Routing: Policy-based, route-based, and dynamic BGP route propagation (up to 100 advertised routes).
Limitations & Constraints
Section titled “Limitations & Constraints”- Site-to-Site Only: Designed strictly for gateway site-to-site connections (point-to-site user VPN unsupported).
- Gateway Quota: Projects are limited to a maximum of 6 VPN gateway instances.
- Phase 2 SAs: Using identical remote addresses for both tunnels of a policy based vpn is not recommended.
STACKIT Unified Firewall
Service
STACKIT Unified Firewall
STACKIT
Architecture firewall security network least-privilege
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
STACKIT Unified Firewall simplifies security management by unifying project-wide firewall configuration interfaces.
Service Overview
Section titled “Service Overview”- Single Pane of Glass: Centralized control panel for managing security boundaries across project resources.
- Auto-Scaling Performance: Continuous rule processing engine without performance bottlenecks.
- Free Tier Model: Core firewall control capabilities included without hidden base fees.
Technical Details
Section titled “Technical Details”- Management Interfaces: Portal GUI with Smart Rule Wizard, API-first engine, and Terraform resource synchronization.
- Compliance: Operates in full compliance with European GDPR standards inside EU data centers.
Limitations & Constraints
Section titled “Limitations & Constraints”- Project Boundary Focus: Rules apply to project-attached network endpoints; global cross-org firewalling requires SNA routing.
STACKIT Run Command
Service
STACKIT Run Command
STACKIT
Architecture automation compute security devops sysadmin
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
STACKIT Run Command enables centralized, encrypted execution of administrative scripts on Linux and Windows VMs without exposing public access ports.
Service Overview
Section titled “Service Overview”- Enhanced Security Perimeter: Enables system diagnostics and maintenance without opening internet-facing SSH or RDP ports.
- Repeatable Operations: Standardizes administrative tasks using centrally maintained script templates.
- Audit Logging: Captures chronological execution history, console outputs, and exit codes centrally.
Technical Details
Section titled “Technical Details”- Agent Architecture: Relies on the STACKIT Server Agent running locally on the guest instance to process incoming API tasks.
- Execution Workflow: Select a template, pass parameter arguments, execute remotely, and view status (exit code 0 = success).
- Access Control: Scoped per project and managed through STACKIT IAM permissions.
Limitations & Constraints
Section titled “Limitations & Constraints”- No Interactive Execution: Executed in the background; interactive terminal prompts (e.g.,
sudopassword prompts) are unsupported. - Strict Template Syntax: Argument passing depends strictly on pre-defined template parameters; raw ad-hoc command strings are restricted.
- Mandatory Local Agent: Commands fail immediately if the guest STACKIT Server Agent is stopped or uninstalled.
STACKIT CLI
Software
STACKIT CLI
STACKIT
Architecture cli developer tools automation terminal
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
The STACKIT CLI provides an imperative terminal interface to create, query, and manage STACKIT cloud resources quickly without opening a web browser.
Service Overview
Section titled “Service Overview”- High Productivity: Enables swift ad-hoc administrative actions and immediate system troubleshooting.
- Script-Friendly: Supports structured
--output-format=jsonand--assume-yesflags for non-interactive execution. - Secure Local Storage: Safely stores authentication credentials within the native operating system keychain.
Technical Details
Section titled “Technical Details”- Binary Architecture: Fast, compiled Go binary executing direct REST API calls.
- Command Structure: Intuitive
stackit [service] [resource] [action]syntax (e.g.,stackit dns zone list). - Pipeline Authentication: Supports Service Account activations via
stackit auth activate-service-account.
Limitations & Constraints
Section titled “Limitations & Constraints”- Imperative Workflow: Lacks declarative state files and automatic drift detection provided by Terraform.
- No Dry-Run Engine: Does not include a preview plan feature; failed bash scripts require manual resource cleanup.
- No Native Cost Previews: Does not calculate cost projections prior to provisioning resources via command strings.
STACKIT Automation Service
Service
STACKIT Automation Service
STACKIT
Architecture automation lifecycle snapshots integration
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
STACKIT Automation Service handles automated execution of administrative cloud operations.
Service Overview
Section titled “Service Overview”- Routine Elimination: Automates recurring maintenance schedules and snapshot retention policies.
- Cost Control: Automatic expiration prevents uncontrolled snapshot accumulation and storage inflation.
- Execution History: Detailed chronological execution logs record task statuses and error details.
Technical Details
Section titled “Technical Details”- Components: Automation templates, scheduled execution rules, and execution run logs.
- Authentication: Secured via STACKIT IAM and Key-Flow service account credentials.
Core Features
Section titled “Core Features”The values below come from the STACKIT documentation and update themselves.
From the STACKIT docsCore features and use cases of the STACKIT Automation Service › Core features
Multiple recovery point options
The service provides comprehensive data protection with options tailored to different recovery time requirements:
- Snapshots: Uses volume snapshots to create high-performance recovery points for near-instantaneous state restoration.
- Backups: Stores data in dedicated, isolated storage to provide maximum protection against hardware failures with longer recovery times.
Dynamic label-based targeting
Instead of manually targeting individual resources, the automation dynamically discovers and applies policies to all volumes matching your specified labels. New resources that match your labels are covered automatically.
Flexible execution triggers
Automation tasks can be scheduled to run automatically at custom intervals or executed on demand instantly through manual triggers.
Integrated retention policies
Built-in safety guardrails automatically manage your snapshot rotations and backup lifecycles:
- Snapshot retention policy: Automatically prunes the oldest snapshots to maintain your defined volume limits and prevent creation failures.
- Daily backup retention policy: Automatically creates a daily backup of the latest available snapshot when triggered, and deletes backups automatically once the specified retention period ends.
What is this?
This section is copied from the STACKIT docs automatically, several times a day. It cannot be changed here. Changes belong in the STACKIT docs.
STACKIT Terraform Provider
Code snippet
STACKIT Terraform Provider
STACKIT
Architecture terraform iac automation developer tools hcl
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
The STACKIT Terraform Provider enables platform teams to define, provision, and maintain STACKIT cloud infrastructure using declarative HashiCorp Configuration Language (HCL).
Service Overview
Section titled “Service Overview”- Eliminates Manual Overhead: Prevents configuration drift and errors caused by manual portal interactions (“ClickOps”).
- Scalable Infrastructure: Enables modular, reusable blueprints across Dev, Test, and Production environments.
- CI/CD Integration: Connects seamlessly with pipelines like GitLab CI, GitHub Actions, and Jenkins.
Technical Details
Section titled “Technical Details”- Declarative Coverage: Supports provisioning of VMs, Kubernetes (SKE), DNS, Networks, and Managed Data Services.
- IAM & Access: Manages service accounts, API tokens, and Role-Based Access Control (RBAC) via code.
- Drift Management: Automatically detects differences between defined state and actual cloud resources during
terraform plan.
Limitations & Constraints
Section titled “Limitations & Constraints”- Day-1 Parity Gap: Newly released STACKIT Portal features may experience minor delays before becoming available in the provider.
- Complex Identity Integration: Deep cross-tenant identity federations and initial OIDC setups require portal/support interaction.
- Legacy Imports: Importing pre-existing, manually created resources into state can be complex and process-heavy.
STACKIT SDKs
Software
STACKIT SDKs
STACKIT
Architecture sdk go python java api developer tools
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
The official STACKIT SDKs provide idiomatic language bindings (Go, Python, Java) that abstract REST endpoints into clean function calls for custom software development.
Service Overview
Section titled “Service Overview”- Accelerated Tooling: Speeds up the development of custom internal developer portals, CLI utilities, and orchestrators.
- Maintained Data Models: Built directly from official OpenAPI specifications to reduce endpoint handling errors.
- Secure Authentication: Supports short-lived Workload Identity Federation (OIDC) without static API keys.
Technical Details
Section titled “Technical Details”- Language Support: Go (GA), Python (Beta), and Java (Beta).
- Package Managers: Distributed via Go Modules, PyPI (
stackit-core), and Maven Central (cloud.stackit.sdk). - Core Architecture: Features modular clients separating core authentication logic from specific cloud service packages.
Limitations & Constraints
Section titled “Limitations & Constraints”- No State File Management: Unlike Terraform, developers must manually handle state, idempotency, and rollback routines in code.
- Lifecycle Status: Python and Java packages are in Beta phase; SLAs vary compared to GA products.
- Boilerplate Overhead: Assembling full infrastructure topologies requires significantly more code than using IaC modules.
STACKIT Git
Service
STACKIT Git
STACKIT
Architecture git ci/cd devops repositories developer tools
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
STACKIT Git delivers a managed source code hosting, pull request collaboration, and CI/CD automation platform hosted within sovereign European data centers.
Service Overview
Section titled “Service Overview”- Secure Code Hosting: Protects software intellectual property on European servers under full data sovereignty.
- GitHub Actions Compatible: Uses familiar GitHub Actions YAML syntax to run CI/CD workflows natively.
- All-in-One Platform: Combines source control, issue tracking, package management, and container registries.
Technical Details
Section titled “Technical Details”- Code & Collaboration: Branch protection rules, pull request reviews, issue tracking, and integrated documentation.
- CI/CD Execution: Native pipeline engine supporting both managed STACKIT runners and self-hosted execution nodes.
- Packages & Auth: Integrated OCI container registry, Maven/npm artifact storage, and SSO/IdP integration.
The list below comes from the STACKIT documentation and updates itself.
From the STACKIT docsPlan the size of your Git Service › Plans overview
| Plan | Disk storage | Object storage | Max users |
|---|---|---|---|
| Git10 | 1 GB | 10 GB | 10 |
| Git100 | 10 GB | 122 GB | 100 |
When the storage capacity is exceeded, both disk and object storage are automatically increased to meet demand. However, user limits and base capacities remain defined by the selected plan.
What is this?
This section is copied from the STACKIT docs automatically, several times a day. It cannot be changed here. Changes belong in the STACKIT docs.
Limitations & Constraints
Section titled “Limitations & Constraints”- Network Boundaries: Instance access is controlled via IP allowlists configured through the STACKIT Cloud Portal.
STACKIT Container Registry
Service
STACKIT Container Registry
STACKIT
Architecture container registry oci docker helm security
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
STACKIT Container Registry provides secure storage and distribution for container images.
Service Overview
Section titled “Service Overview”- Zero Registry Operations: Managed registry backend eliminates self-hosted Harbor/Docker Registry maintenance.
- Vulnerability Scanning: Automated Trivy vulnerability scans inspect images upon push.
- Supply-Chain Security: Supports tag immutability policies and robot accounts for CI/CD pipelines.
Technical Details
Section titled “Technical Details”- Integrations: Native integration with STACKIT Kubernetes Engine (SKE) and standard Docker/Podman clients.
- Access Control: Scoped RBAC permissions and dedicated robot account API keys.
Limitations & Constraints
Section titled “Limitations & Constraints”- Public Endpoint Push: Pushing and pulling images routes through encrypted public HTTPS endpoints.
STACKIT Kubernetes Engine (SKE)
Service
STACKIT Kubernetes Engine (SKE)
STACKIT
Architecture kubernetes ske cncf containers runtime
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
STACKIT Kubernetes Engine (SKE) provides managed CNCF-compliant Kubernetes clusters.
Service Overview
Section titled “Service Overview”- Fully Managed Control Plane: Free high-availability control plane backed by 99.9% API availability SLA.
- Automated Lifecycle: Auto-detects and repairs unhealthy worker nodes; handles OS and K8s patch upgrades.
- Cost Savings: Scheduled auto-hibernation shuts down dev/test node pools during off-peak hours.
Technical Details
Section titled “Technical Details”- Images: Flatcar container-optimized and Ubuntu (preview) worker OS images.
- CNI Networks: Selectable Calico or Cilium container network interfaces.
Service Level
Section titled “Service Level”The values below come from the STACKIT documentation and update themselves.
From the STACKIT docsIntroduction › Service Level Agreement (SLA)
The SKE SLA is measured according to following Service Level Indicator (SLI):
- Availability of Kubernetes API Server of SKE clusters - SLA: 99,9%.
- The SLA for an SKE cluster is violated, if the API server for the cluster can’t be externally accessed.
Excluded from SLA violations are:
- Failures of Kubernetes Pods or Kubernetes nodes running in the cluster.
What is this?
This section is copied from the STACKIT docs automatically, several times a day. It cannot be changed here. Changes belong in the STACKIT docs.
Limitations & Constraints
Section titled “Limitations & Constraints”- Short-Lived Tokens: Kubeconfig authentication uses short-lived OIDC tokens requiring regular authentication renewal.
STACKIT Edge Cloud
Service
STACKIT Edge Cloud
STACKIT
Architecture edge kubernetes talos os retail logistics
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
STACKIT Edge Cloud (STEC) manages distributed Kubernetes edge clusters across remote customer facilities.
Service Overview
Section titled “Service Overview”- Remote Edge Orchestration: Centralizes control over remote edge clusters in factories and retail stores via STACKIT Portal.
- Full Offline Operation: Edge clusters continue operating locally during internet connection outages.
- Hardened Security: Immutable read-only OS image without open SSH ports reduces local attack surfaces.
Technical Details
Section titled “Technical Details”- Architecture: Powered by Talos Linux running on customer-provided hardware.
- Communication: Encrypted outbound HTTPS tunnel connecting to STACKIT APIs.
Limitations & Constraints
Section titled “Limitations & Constraints”- Customer Hardware Ops: Physical server hardware provisioning and local edge backups are managed by the customer.
STACKIT Cloud Foundry
Service
STACKIT Cloud Foundry
STACKIT
Architecture cloud foundry paas 12-factor buildpacks runtime
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
STACKIT Cloud Foundry abstracts infrastructure operations for rapid application deployment.
Service Overview
Section titled “Service Overview”- Developer Productivity: Deploy apps instantly using standard buildpacks without managing VMs or OS kernels.
- Pay-Per-Use Scaling: Auto-scales application instances and resources dynamically based on incoming traffic.
- Service Marketplace: Bind database and messaging services directly to applications.
Technical Details
Section titled “Technical Details”- Architecture: Multi-tenant open-source Cloud Foundry platform operating across multiple Availability Zones.
- Tooling: Managed via Cloud Foundry CLI (
cf push), STACKIT Portal, and Terraform Provider.
Limitations & Constraints
Section titled “Limitations & Constraints”- No OS Access: Root operating system shell access and custom kernel module installations are unsupported.
- Stateless Design: Containers are stateless; persistent application data must use external managed database services.
STACKIT Cloud Foundry Dedicated on SKE
Service
STACKIT Cloud Foundry Dedicated on SKE
STACKIT
Architecture cloud foundry ske single-tenant kubernetes runtime
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
STACKIT Cloud Foundry Dedicated on SKE delivers isolated single-tenant PaaS environments.
Service Overview
Section titled “Service Overview”- Maximum Isolation: Combines 12-Factor developer convenience with single-tenant dedicated SKE cluster isolation.
- Dedicated IP Ranges: Custom dedicated network IP ranges and custom ingress domains.
- Sovereign Security: Meets stringent enterprise privacy and compliance requirements.
Technical Details
Section titled “Technical Details”- Architecture: Single-tenant Cloud Foundry stack running on customer-dedicated SKE worker node pools.
Limitations & Constraints
Section titled “Limitations & Constraints”- Resource Billing: Costs combine underlying dedicated SKE cluster nodes alongside active PaaS resource consumption.
STACKIT Functions
Service
STACKIT Functions
STACKIT
Architecture functions serverless faas knative event-driven
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
STACKIT Functions delivers serverless event-driven execution for stateless application logic.
Service Overview
Section titled “Service Overview”- Scale to Zero: Automatically scales function instances up with incoming request volume and down to zero when idle.
- Pure Code Focus: Developers publish code snippets without managing containers or cluster nodes.
- Event-Driven: Natively triggers execution from HTTP webhooks and cloud event pipelines.
Technical Details
Section titled “Technical Details”- Architecture: Powered by Knative running on STACKIT Kubernetes infrastructure.
- Management: Managed via
sfnCLI tool and STACKIT Portal.
Limitations & Constraints
Section titled “Limitations & Constraints”- Stateless Execution: Functions must remain stateless; execution memory and temporary local files persist only per invocation.
STACKIT Observability
Service
STACKIT Observability
STACKIT
Architecture observability prometheus grafana loki metrics
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
STACKIT Observability provides a managed telemetry stack for enterprise monitoring.
Service Overview
Section titled “Service Overview”- Unified Telemetry Stack: Integrated Prometheus, Loki, Tempo, Thanos, and Grafana in a single managed service.
- Long-Term Retention: Metrics retention up to 26 months powered by Thanos backend storage.
- Open Standards: Fully compatible with OpenTelemetry (OTLP) collectors and OpenMetrics endpoints.
Technical Details
Section titled “Technical Details”- Alerting: Integrated Alertmanager supporting email and webhook notifications (Slack, PagerDuty).
- Security: Endpoint security guarded via IPv4 CIDR allowlists and TLS transport encryption.
Retention
Section titled “Retention”The values below come from the STACKIT documentation and update themselves.
From the STACKIT docsService plans of STACKIT Observability › Retention and data formats
STACKIT Observability uses open standards for telemetry collection.
All metrics, logs and traces must be transmitted in OpenTelemetry or OpenMetrics format.
Metrics
- Default retention: 90 days
- Configurable up to 780 days (26 months)
- Retention can be changed in the Observability Service Dashboard or via the Observability API
Logs and Traces
- Default retention: 5 days
- Configurable up to 30 days
- Retention can be adjusted via the Observability API
What is this?
This section is copied from the STACKIT docs automatically, several times a day. It cannot be changed here. Changes belong in the STACKIT docs.
Limitations & Constraints
Section titled “Limitations & Constraints”- Managed Grafana Plugins: Installing unverified custom third-party Grafana plugins is unsupported.
STACKIT Telemetry Router
Service
STACKIT Telemetry Router
STACKIT
Architecture telemetry opentelemetry audit logs siem otlp
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
STACKIT Telemetry Router aggregates and routes audit logs across organizational hierarchies.
Service Overview
Section titled “Service Overview”- Centralized Control: Collects and standardizes STACKIT audit logs into OpenTelemetry (OTLP) format.
- SIEM Forwarding: Routes log streams to external SIEM tools like Splunk, Elasticsearch, or S3 storage.
- 90-Day Audit View: Includes a free 90-day audit log viewing window in the STACKIT Portal.
Technical Details
Section titled “Technical Details”- Flow Control: Fail-safe retry logic prevents log drop errors during destination outages.
- Scope: Controls routing links at project, folder, or organization levels.
Scope and Limits
Section titled “Scope and Limits”The values below come from the STACKIT documentation and update themselves.
From the STACKIT docsOverview › Scope and Limitations
- Supported Data Types: Currently, the service exclusively handles Audit Logs. Customers cannot send their own custom telemetry data (application logs, metrics, or traces) to the router; only STACKIT products have this capability.
- Destination Formats: For external routing, the router currently supports Object Storage (S3) and the OTLP protocol.
- Availability: The service is Generally Available (GA) in the regions EU01 (Germany) and EU02 (Austria).
- Pricing: Routing data to both internal STACKIT services and external destinations incurs fees.
What is this?
This section is copied from the STACKIT docs automatically, several times a day. It cannot be changed here. Changes belong in the STACKIT docs.
STACKIT Logs
Service
STACKIT Logs
STACKIT
Architecture logs loki logql observability logging
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
STACKIT Logs delivers high-throughput log aggregation powered by Grafana Loki.
Service Overview
Section titled “Service Overview”- Label-Based Indexing: High-efficiency indexing minimizes storage footprint while enabling fast LogQL queries.
- Managed Operations: Handles Loki cluster scaling, maintenance, and high-availability setups automatically.
- Flexible Retention: Per-instance retention configurable between 1 and 180 days to manage storage costs.
Technical Details
Section titled “Technical Details”- Ingestion: Supports Grafana Alloy, Fluent Bit, Fluentd, Vector, and OpenTelemetry Collectors.
Limits
Section titled “Limits”The values below come from the STACKIT documentation and update themselves.
From the STACKIT docsLimits for Logs › Ingestion Limits
These limits define how much data you can send to STACKIT Logs instance and the constraints on the individual log lines.
| Limit | Value | Description |
|---|---|---|
| Ingestion Rate | 10 MB/s | The maximum amount of compressed log data allowed per second. The instance will return a 429 Too Many Requests error on exceeding the limit. |
| Max Line Size | 256 KB | The maximum size of a single log line. Lines exceeding this will be rejected. |
| Old Sample Rejection | 7 days | STACKIT Logs rejects logs with a timestamp older than 7 days relative to the current time. |
What is this?
This section is copied from the STACKIT docs automatically, several times a day. It cannot be changed here. Changes belong in the STACKIT docs.
From the STACKIT docsLimits for Logs › Metadata & Label Limits
These limits define how many labels you can attach to log lines and the constraints on them. Labels are the keys and values used to index your logs. Efficient use of labels is critical for query performance.
| Limit | Value | Description |
|---|---|---|
| Max Labels | 15 | The maximum number of unique label names allowed per log stream. |
| Label Name Length | 1024 chars | The maximum length allowed for a label name (key). |
| Label Value Length | 2048 chars | The maximum length allowed for a label value. |
Why limit labels?
STACKIT Logs is based on Loki which is designed to be “metadata light.” Unlike traditional databases, STACKIT Logs does not index the full text of logs, but only the labels. Having too many labels (high cardinality) significantly slows down the index and increases memory usage.
See the documentation for more details about labels.
What is this?
This section is copied from the STACKIT docs automatically, several times a day. It cannot be changed here. Changes belong in the STACKIT docs.
From the STACKIT docsLimits for Logs › Query Limits
These limits apply when you are retrieving log data via the STACKIT Logs API e.g. inside the Grafana dashboard.
| Limit | Value | Description |
|---|---|---|
| Max Query Range | 30 days | The maximum time window allowed for a single query (e.g., searching from now-30d to now). |
What is this?
This section is copied from the STACKIT docs automatically, several times a day. It cannot be changed here. Changes belong in the STACKIT docs.
STACKIT MariaDB
Service
STACKIT MariaDB
STACKIT
Data and AI database mariadb mysql relational dbaas
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
STACKIT MariaDB provides a managed relational database service that handles administrative patching, backups, and setup for web applications.
Service Overview
Section titled “Service Overview”- 100% MySQL Compatible: Seamlessly runs existing MySQL applications without code changes.
- Reduced DBA Overhead: Automated backups, minor updates, and OS patching.
- High Availability: Multi-AZ replication options for business-critical deployments.
Technical Details
Section titled “Technical Details”- Deployment Plans: Single Node and Replica Set options with customizable CPU/RAM flavors.
- Security: Data-at-rest encryption, SSL/TLS transport security, and CIDR IP allowlisting.
- Ecosystem: Integration with STACKIT Cloud Foundry via Service Brokers and Terraform automation.
Backups and Deployment
Section titled “Backups and Deployment”The values below come from the STACKIT documentation and update themselves.
From the STACKIT docsArchitecture of MariaDB › Backup
You manage your backups at the instance level. The system creates a backup every 4 hours. Independently, you can also schedule manual backups at any time. All backups are stored for 14 days.
What is this?
This section is copied from the STACKIT docs automatically, several times a day. It cannot be changed here. Changes belong in the STACKIT docs.
From the STACKIT docsArchitecture of MariaDB › Deployment separation
MariaDB services created through Cloud Foundry and those created via STACKIT Portal/CLI are completely separated. Services created in one environment must be managed and deleted in the same environment - cross-environment management is not supported for technical reasons.
Services must always be managed in the environment they were created in.
- Services created in the STACKIT Portal/CLI must also be managed/deleted in the STACKIT Portal/CLI. In the STACKIT Portal, some (not all) services may be displayed that were created using Cloud Foundry (esp. the Flex databases).
- Services created using Cloud Foundry must be managed/deleted using Cloud Foundry.
Services displayed in Cloud Foundry as part of an organization prefixed by stackit_portal_prod_ have been created using the STACKIT Portal/CLI and must be managed from there, even if management options are displayed in Cloud Foundry. For technical reasons it is not possible to create a service in Cloud Foundry and delete it using the STACKIT Portal/CLI, or vice versa.
What is this?
This section is copied from the STACKIT docs automatically, several times a day. It cannot be changed here. Changes belong in the STACKIT docs.
Limitations & Constraints
Section titled “Limitations & Constraints”- No BSI C5 Certification: Lacks C5 compliance certification due to third-party upstream operational dependencies.
- No Private Endpoints: Private Endpoint network options are currently not supported for this database tier.
STACKIT PostgreSQL Flex
Service
STACKIT PostgreSQL Flex
STACKIT
Data and AI postgresql database relational c5 dbaas
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
STACKIT PostgreSQL Flex provides fully managed open-source PostgreSQL instances with automated backups, extensions, and high availability across availability zones.
Service Overview
Section titled “Service Overview”- Enterprise-Ready SQL: High availability across 3 Availability Zones with automated failover handling.
- Compliance & Security: GDPR-compliant and BSI C5 certified operation with AES-256 at-rest encryption.
- DevOps Friendly: Complete Infrastructure as Code support via official Terraform and Pulumi providers.
Technical Details
Section titled “Technical Details”- Options: Single Instance and 3-Node Replica Sets across multiple Availability Zones.
- Tooling Support: Compatible with standard DBA tools like pgAdmin, DBeaver, and
psqlCLI. - Recovery Features: Automated backups with Point-In-Time Recovery (PITR) and instance cloning capabilities.
Flavors and Performance Classes
Section titled “Flavors and Performance Classes”The values below come from the STACKIT documentation and update themselves.
From the STACKIT docsFlavors and performance classes › Flavors
| Description | ID | CPU | RAM | max_connections | shared_buffers | work_mem | maintenance_work_mem | effective_cache_size |
|---|---|---|---|---|---|---|---|---|
| Small, Compute optimized | 2.4 | 2 | 4 GB | 95 | 950 MB | 14 MB | 380 MB | 2660 MB |
| Small, Memory optimized | 2.16 | 2 | 16 GB | 385 | 3950 MB | 14 MB | 1580 MB | 11060 MB |
| Medium, Compute optimized | 4.8 | 4 | 8 GB | 195 | 1950 MB | 14 MB | 780 MB | 5460 MB |
| Medium, Memory optimized | 4.32 | 4 | 32 GB | 785 | 7950 MB | 14 MB | 3180 MB | 22260 MB |
| Large, Processor optimized | 8.16 | 8 | 16 GB | 385 | 3950 MB | 14 MB | 1580 MB | 11060 MB |
| X-Large, Compute optimized | 16.32 | 16 | 32 GB | 785 | 7950 MB | 14 MB | 3180 MB | 22260 MB |
| X-Large, Memory optimized | 16.128 | 16 | 128 GB | 3170 | 31950 MB | 14 MB | 12780 MB | 89460 MB |
Notes
- CPU and RAM is always per node.
- The system uses up to 15 connections for internal essential processes such as backup, monitoring, etc. These connections will be counted towards the
max_connectionslimit.
What is this?
This section is copied from the STACKIT docs automatically, several times a day. It cannot be changed here. Changes belong in the STACKIT docs.
From the STACKIT docsFlavors and performance classes › Performance Classes
| Description | ID | Max. IOPS | Max. throughput (MB/s) |
|---|---|---|---|
| Performance class 2 | premium-perf2-stackit | 1000 | 100 |
| Performance class 4 | premium-perf4-stackit | 2000 | 150 |
| Performance class 6 | premium-perf6-stackit | 5000 | 200 |
| Performance class 8 | premium-perf8-stackit | 10000 | 250 |
| Performance class 10 | premium-perf10-stackit | 15000 | 300 |
| Performance class 12 | premium-perf12-stackit | 20000 | 350 |
Currently, we offer three types of instances. For each type there is a different set of flavors available.
What is this?
This section is copied from the STACKIT docs automatically, several times a day. It cannot be changed here. Changes belong in the STACKIT docs.
From the STACKIT docsArchitecture › Backup
You manage backups at the instance level, which includes all users and databases. Because the transaction logs are activated by default, you can use them to achieve point-in-time recovery across all available snapshots.
With instance cloning, you can replicate your existing PostgreSQL Flex instance to another instance within the same project for testing, staging, or data recovery workflows. Recovery to the existing instance is not possible yet.
What is this?
This section is copied from the STACKIT docs automatically, several times a day. It cannot be changed here. Changes belong in the STACKIT docs.
Limitations & Constraints
Section titled “Limitations & Constraints”- Immutable Storage IOPS: Storage performance profiles cannot be modified after creation; disk size can only grow.
- No Logical Replication: Logical publishing and subscribing modes are currently unsupported.
- No Custom S3 Backups: Backups are managed internally by STACKIT and cannot be exported directly to custom S3 buckets.
STACKIT SQL Server Flex
Service
STACKIT SQL Server Flex
STACKIT
Data and AI mssql sql server database alwayson microsoft
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
STACKIT SQL Server Flex delivers managed Microsoft SQL Server instances backed by enterprise AlwaysOn availability clusters.
Service Overview
Section titled “Service Overview”- Mission-Critical Performance: Enterprise-grade high availability using SQL AlwaysOn 3-node clusters.
- Reduced DBA Overhead: Automated maintenance, patching routines, and automated snapshot backups.
- Compliant Platform: Operated in BSI C5 certified German data centers with pay-per-use licensing.
Technical Details
Section titled “Technical Details”- Administrative Tooling: Native support for SQL Server Management Studio (SSMS), SQL Agent Jobs, and custom server roles.
- Backup Options: Automated PITR backups alongside manual copy-only backups to S3 object storage.
The values below come from the STACKIT documentation and update themselves.
From the STACKIT docsPlans and performance classes of SQLServer Flex › Plans
Currently we offer four different plans.
By selecting the plan, you specify the hardware specifications of the SQLServer Flex instance. The available plans depend on the instance type. You can further filter the options by defining the required amount of CPUs and RAM.
If your performance class is too small you are able to upgrade it to a bigger one.
To upgrade it please open a service request at the STACKIT Help Center.
| Service Plan | CPU | RAM | System Disk Size | Plan ID | SQL Server Edition | High Availability |
|---|---|---|---|---|---|---|
| SQLServer-Flex-4.16-Single-Standard-EU01 ( 4 vCPU 16 GB RAM ) | 4 | 16 GB | 20 GB | 4.16-Single | SQL Server Standard | None |
| SQLServer-Flex-4.32-Replica-Enterprise-EU01 ( 4 vCPU 32 GB RAM ) | 4 | 32 GB | 20 GB | 4.32-Replica | SQL Server Enterprise | 3 Way AlwaysOn Availability Group |
| SQLServer-Flex-8.64-Replica-Enterprise-EU01 ( 8 vCPU 64 GB RAM ) | 8 | 64 GB | 20 GB | 8.64-Replica | SQL Server Enterprise | 3 Way AlwaysOn Availability Group |
| SQLServer-Flex-16.128-Replica-Enterprise-EU01 ( 16 vCPU 128 GB RAM ) | 16 | 128 GB | 20 GB | 16.128-Replica | SQL Server Enterprise | 3 Way AlwaysOn Availability Group |
What is this?
This section is copied from the STACKIT docs automatically, several times a day. It cannot be changed here. Changes belong in the STACKIT docs.
Limitations & Constraints
Section titled “Limitations & Constraints”- No Storage Shrinking: Storage size reductions are blocked.
- No Manual Storage Class Changes: Storage performance tiers are permanently set at initial instance creation.
- No Automated S3 Immutable Archiving: Offloading backups to ransomware-protected immutable S3 buckets must be run manually.
STACKIT MongoDB Flex
Service
STACKIT MongoDB Flex
STACKIT
Data and AI nosql mongodb document store database iso27001
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
STACKIT MongoDB Flex is a managed NoSQL database service providing flexible schema document storage hosted in ISO/C5-certified data centers.
Service Overview
Section titled “Service Overview”- Dynamic Schema Flexibility: Stores complex JSON-like documents ideal for agile microservices and e-commerce.
- High Availability: 3-node Replica Sets with automatic failover and zero-downtime storage scaling.
- Advanced Recovery: Features Point-in-time recovery (last 30 hours) and instant live instance cloning.
Technical Details
Section titled “Technical Details”- Deployments: Single Node, 3-Node Replica Set, and 9-Node Sharded Clusters across customizable performance tiers.
- Security: Dedicated IPv4 ACL allowlists, TLS transport encryption, and Prometheus metric scraping endpoints.
Performance Classes and Limits
Section titled “Performance Classes and Limits”The values below come from the STACKIT documentation and update themselves.
From the STACKIT docsFlavors and performance classes of MongoDB Flex › Performance classes
| Description | ID | Max. IOPS | Max. throughput (MB/s) |
|---|---|---|---|
| Performance class 2 | premium-perf2-mongodb | 1000 | 100 |
| Performance class 4 | premium-perf4-mongodb | 2000 | 150 |
| Performance class 6 | premium-perf6-mongodb | 5000 | 200 |
| Performance class 8 | premium-perf8-mongodb | 10000 | 250 |
| Performance class 10 | premium-perf10-mongodb | 15000 | 300 |
| Performance class 12 | premium-perf12-mongodb | 20000 | 350 |
STACKIT offers three types of instances. For each type there are different flavors available.
If your flavor is too small, you can upgrade it to a bigger one. It is only possible to upgrade from a replica set flavor to another replica set flavor, and from a single instance flavor to another single instance flavor. It is not possible to upgrade from a single instance flavor to a replica set flavor.
MongoDB recommends the use of at least 4 GB of RAM in its Deployment prerequisites. A flavor with less than 4 GB RAM may not provide the required stability for a production system.
What is this?
This section is copied from the STACKIT docs automatically, several times a day. It cannot be changed here. Changes belong in the STACKIT docs.
From the STACKIT docsPlan your MongoDB Flex instance › Limitations
You can consult Architecture of MongoDB Flex for the limitations in flexibility. For a reference, you can consult this table:
| Parameter | Downgrade possible | Upgrade possible | Downtime |
|---|---|---|---|
| type | No | No | N/A |
| flavor | Yes | Yes | Yes |
| performance-class | Yes except single- and sharded-instances | Yes except single- and sharded-instances | Yes |
| storage-size | No | Yes | No |
| version | No | Yes | Yes |
You can make changes to ACL and backup settings without any limitations and without downtime.
What is this?
This section is copied from the STACKIT docs automatically, several times a day. It cannot be changed here. Changes belong in the STACKIT docs.
From the STACKIT docsArchitecture of MongoDB Flex › Backup
You manage your backups on the instance level. The system backups the transaction logs and creates snapshots. With the help of transaction logs you can recover every point-in-time for the last 30 hours. With the snapshots you can recover to specific consistent snapshots of your instance in the past.
Recovery Point Objective (RPO) and Recovery Time Objective (RTO) are both 6 hours for storage under 1 TB. RTO increases slightly for each additional 10 GB over 1 TB.
With instance cloning you can replicate your existing MongoDB Flex instance to another instance within the same project for testing, staging, or data recovery workflows.
What is this?
This section is copied from the STACKIT docs automatically, several times a day. It cannot be changed here. Changes belong in the STACKIT docs.
Limitations & Constraints
Section titled “Limitations & Constraints”- No Architecture Downgrades: Single-node instances cannot be upgraded in-place to Replica Sets; storage size cannot be reduced.
- Short Upgrade Downtime: Adjusting machine flavors or engine versions causes brief connection interruptions (except pure storage expansion).
STACKIT Redis
Service
STACKIT Redis
STACKIT
Data and AI redis in-memory cache database nosql
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
STACKIT Redis offers a fully managed in-memory data store designed to reduce database load and deliver sub-millisecond data caching.
Service Overview
Section titled “Service Overview”- Ultra-Low Latency: High-speed in-memory data retrieval for high-traffic caching and session stores.
- Managed Lifecycle: Automated failover, patch management, security updates, and daily backup snapshots.
- Transparent Pricing: Predictable pay-as-you-go billing model based on memory plans.
Technical Details
Section titled “Technical Details”- Architectures: Available in Single Node and High-Availability Replica deployments.
- Observability: Features an integrated Prometheus proxy endpoint for direct metric scraping into STACKIT Observability.
- Security: Access guarded via strict IP allowlists, network firewalls, and isolated project VPCs.
Limitations & Constraints
Section titled “Limitations & Constraints”- No Architecture Downgrades: Upgrading to a larger plan introduces brief downtime; scaling down to a smaller plan is unsupported.
- No BSI C5 Certification: Excludes C5 compliance certification due to upstream framework operational boundaries.
- Public Endpoint Security: Accessible via public endpoints protected by ACLs (private endpoints unavailable).
STACKIT Workflows
Service
STACKIT Workflows
STACKIT
Data and AI airflow data pipelines etl data and ai orchestration
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
STACKIT Workflows provides a managed Apache Airflow platform for orchestrating Directed Acyclic Graphs (DAGs) without managing underlying servers.
Service Overview
Section titled “Service Overview”- Noops Airflow Operations: Handles deployment, security updates, and maintenance automatically.
- Pipelines as Code: Author pipelines in Python with full Git version control integration.
- Isolated Execution: Executes pipeline tasks inside dedicated, isolated Kubernetes pods for maximum security.
Technical Details
Section titled “Technical Details”- Scaling Architecture: Automatically scales execution pods based on workload demands.
- Identity & Observability: OIDC identity provider integration and native connection to STACKIT Observability.
- Digital Sovereignty: Operates entirely within European data centers ensuring full GDPR compliance.
The values below come from the STACKIT documentation and update themselves.
From the STACKIT docsConcepts › STACKIT Portal roles
The following roles are available in the STACKIT Portal for managing Workflows instances:
- Workflows Admin: Full administrative access to all STACKIT Workflows resources.
- Workflows Editor: Permissions to create, modify, and manage STACKIT Workflows sub-resources (DAGs repository, identity provider configuration, etc.).
- Workflows Reader: Read-only access to all STACKIT Workflows resources.
These permissions are managed through the STACKIT Portal and STACKIT API.
What is this?
This section is copied from the STACKIT docs automatically, several times a day. It cannot be changed here. Changes belong in the STACKIT docs.
From the STACKIT docsConcepts › Airflow UI roles
The permissions inside the Airflow UI are separate from the access control in the STACKIT Portal. Access to the Airflow UI is managed through Role-Based Access Control (RBAC) using your connected Identity Provider (IdP).
When users log in, their roles are extracted from the authentication token provided by the IdP. These roles determine what users can access and perform within the Airflow interface. For detailed configuration instructions, see the Identity Provider section.
The following roles are available within Airflow:
- Admin: Complete access to all Airflow features, settings, and configurations.
- User: Can view and trigger DAGs, but cannot modify system settings or configurations.
- Viewer: Read-only access to view DAGs and their running statuses.
What is this?
This section is copied from the STACKIT docs automatically, several times a day. It cannot be changed here. Changes belong in the STACKIT docs.
Limitations & Constraints
Section titled “Limitations & Constraints”- Fixed Role Models: Custom internal Airflow RBAC roles cannot be defined.
- Flavor Scaling Boundaries: Task concurrency and DAG worker limits are capped by the chosen instance flavor size.
- Deployment Mechanics: Direct SSH or manual file uploads are blocked; DAG code must be synced via Git or storage.
STACKIT OpenSearch
Service
STACKIT OpenSearch
STACKIT
Data and AI search opensearch analytics logging database
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
STACKIT OpenSearch is a managed search service that abstracts the operational complexity of scaling distributed search clusters and log analytics.
Service Overview
Section titled “Service Overview”- Turnkey Search & Analytics: Rapid indexing for enterprise search, security analytics, and log collection.
- Integrated Visualization: Includes pre-installed OpenSearch Dashboards for custom data visualization.
- Automated Lifecycle: Handles cluster health checks, automated snapshots, and security updates.
Technical Details
Section titled “Technical Details”- Architecture: Single-node or high-availability multi-node cluster configurations.
- Security & Access: IP allowlisting, SSL/TLS transport encryption, and STACKIT IAM integration.
- Automation: Fully configurable via Terraform, REST API, STACKIT CLI, and Go/Python SDKs.
Backups and Network
Section titled “Backups and Network”The values below come from the STACKIT documentation and update themselves.
From the STACKIT docsArchitecture › Backup system
The integrated Backup Manager automatically creates full backups every 4 hours and retains them for 14 days. You can also trigger manual backups and restore from existing backups through the service dashboard.
What is this?
This section is copied from the STACKIT docs automatically, several times a day. It cannot be changed here. Changes belong in the STACKIT docs.
From the STACKIT docsArchitecture › Network access
STACKIT OpenSearch instances are accessible using public IP addresses, allowing integration with:
- Cloud Foundry applications
- Kubernetes workloads
- Virtual machines
- External systems
Access is secured through ACLs (Access Control Lists) and instance-level authentication.
What is this?
This section is copied from the STACKIT docs automatically, several times a day. It cannot be changed here. Changes belong in the STACKIT docs.
From the STACKIT docsArchitecture › Single Node vs. Cluster
Single Node
- Runs on a single VM
- Suitable for development and testing
- Not recommended for production use
Cluster (Replica Set)
- Consists of 3 nodes distributed across multiple availability zones
- Provides high availability and fault tolerance
- Recommended for production workloads
- Ensures service continuity even if a node or availability zone fails
What is this?
This section is copied from the STACKIT docs automatically, several times a day. It cannot be changed here. Changes belong in the STACKIT docs.
Limitations & Constraints
Section titled “Limitations & Constraints”- Broker Management Scope: Cloud Foundry-provisioned instances cannot be directly altered via the STACKIT Cloud Portal.
- Certification Boundary: Excludes BSI C5 compliance certification due to upstream framework architecture.
- Public ACL Endpoint: Connectivity relies on public endpoints guarded by strict IP allowlists (private endpoints unavailable).
STACKIT PubSub
Service
STACKIT PubSub
STACKIT
Architecture pubsub messaging event-driven kafka topics
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
STACKIT PubSub enables real-time asynchronous messaging between microservices.
Service Overview
Section titled “Service Overview”- Event-Driven Architecture: Decouples microservices through scalable publish/pull topic messaging.
- Pay-Per-Use: Billing based strictly on consumed message volume without fixed monthly base fees.
- No Lock-In: SDK abstractions enable easy migration and integration.
Technical Details
Section titled “Technical Details”- Specs: Supports messages up to 8 MB and retains unconsumed messages up to 7 days.
- Delivery: Guarantees at-least-once message delivery semantics.
Limitations & Constraints
Section titled “Limitations & Constraints”- Single Region: Currently operates within single cloud regions (multi-region replication in roadmap).
STACKIT RabbitMQ
Service
STACKIT RabbitMQ
STACKIT
Architecture rabbitmq amqp mqtt messaging broker
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
STACKIT RabbitMQ provides managed multi-protocol message queuing.
Service Overview
Section titled “Service Overview”- Multi-Protocol Support: Natively supports AMQP, STOMP, and MQTT messaging protocols.
- High Availability: Multi-node cluster replication prevents message loss during node failures.
- Automated Operations: Handles broker patching and updates.
Technical Details
Section titled “Technical Details”- Isolation: Provisioned on dedicated virtual machines within isolated project VPC networks.
- Security: Granular Access Control Lists (ACLs) enforce strict queue permissions.
Service Plans and Backups
Section titled “Service Plans and Backups”The values below come from the STACKIT documentation and update themselves.
From the STACKIT docsRabbitMQ service plans › Currently available Service Plans
STACKIT RabbitMQ
| Service Plan | High availability | Number of nodes | vCPU per node | RAM (GB) per node | Disk per node |
|---|---|---|---|---|---|
| RabbitMQ-1.2.10-Replica | yes | 3 | 1 | 2 | 10 |
| RabbitMQ-2.4.10-Replica | yes | 3 | 2 | 4 | 10 |
| RabbitMQ-2.4.50-Replica | yes | 3 | 2 | 4 | 50 |
| RabbitMQ-4.8.10-Replica | yes | 3 | 4 | 8 | 10 |
| RabbitMQ-4.8.50-Replica | yes | 3 | 4 | 8 | 50 |
| RabbitMQ-4.8.100-Replica | yes | 3 | 4 | 8 | 100 |
| RabbitMQ-8.16.50-Replica | yes | 3 | 8 | 16 | 50 |
| RabbitMQ-8.16.100-Replica | yes | 3 | 8 | 16 | 100 |
| RabbitMQ-16.32.100-Replica | yes | 3 | 16 | 32 | 100 |
| RabbitMQ-2.4.10-Single | no | 1 | 2 | 4 | 10 |
| RabbitMQ-4.8.50-Single | no | 1 | 4 | 8 | 50 |
| RabbitMQ-8.16.100-replica-HiPerf | yes | 3 | 8¹ | 16 | 100 |
| RabbitMQ-4.8.100-replica-HiPerf | yes | 3 | 4¹ | 8 | 100 |
| RabbitMQ-16.32.100-replica-HiPerf | yes | 3 | 16¹ | 32 | 100 |
^1dedicated CPU for highest performance
All service plans have SSL support. We offer up-to-date TLS v.1.3 that has removed common vulnerabilities and improved performance compared to earlier versions.What is this?
This section is copied from the STACKIT docs automatically, several times a day. It cannot be changed here. Changes belong in the STACKIT docs.
From the STACKIT docsConcepts of RabbitMQ › Backup and Recovery
Our Backup Manager is configured to perform a full backup every 4 hours and keep backups for the last 14 days.
Of course, you can manually trigger additional backups from the service dashboard, where you can also select and restore an existing backup.
What is this?
This section is copied from the STACKIT docs automatically, several times a day. It cannot be changed here. Changes belong in the STACKIT docs.
Limitations & Constraints
Section titled “Limitations & Constraints”- Private VPC Only: Accessible exclusively via private VPC networks (public endpoints unavailable).
STACKIT Intake
Service
STACKIT Intake
STACKIT
Data and AI streaming kafka ingestion iceberg data and ai
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
STACKIT Intake simplifies real-time data ingestion by accepting Apache Kafka protocol streams and automatically writing them to Apache Iceberg lakehouse tables.
Service Overview
Section titled “Service Overview”- Automated Lakehouse Streaming: Ingests high-volume streams into structured Iceberg tables without manual ETL code.
- Protocol Compatibility: Uses standard Apache Kafka interfaces, allowing existing producers to connect seamlessly.
- Resilient Ingestion: Buffers incoming data up to 24 hours during downstream target processing outages.
Technical Details
Section titled “Technical Details”- Architecture: Managed runner infrastructure with auto-scaling capabilities.
- Lakehouse Bridge: Automatically syncs incoming streams into the STACKIT Dremio catalog and Iceberg storage.
- Security: Secured via technical user credentials and Personal Access Tokens (PAT).
How Intake Works
Section titled “How Intake Works”The values below come from the STACKIT documentation and update themselves.
From the STACKIT docsArchitecture › Intake
An Intake represents a complete data ingestion pipeline into a single Apache Iceberg table. It ingests data in JSON format and periodically flushes it to the corresponding Dremio table, ensuring each message is inserted exactly once. Flushing introduces a delay of around 5 minutes before messages appear in the table.
An Intake can either write to an existing table or dynamically create one, inferring the schema from the first message it receives. To handle potential downstream outages, such as Dremio maintenance, Intakes buffer messages for up to 24 hours.
An Intake is defined by:
- Dremio Instance Parameters & User Credentials: URLs for the Iceberg REST Catalog and authentication endpoint, along with a Dremio Personal Access Token (PAT) for user authentication.
- Iceberg Table Definition: The namespace and name of the target table. If not provided, a default namespace and an auto-generated name are used.
- Partitioning Information: The option to partition the Iceberg table based on a field in the JSON message or automatically by ingestion date using the automatically added
__intake_tscolumn. If no partition option is given, an Intake will not create any partitions in the result table.
Each Intake provides two Kafka protocol topics for communication:
- Intake Topic: The primary topic for sending messages to be ingested.
- Dead Letter Queue (DLQ) Topic: A topic where undeliverable messages (e.g., non-JSON messages) are temporarily stored for debugging purposes.
What is this?
This section is copied from the STACKIT docs automatically, several times a day. It cannot be changed here. Changes belong in the STACKIT docs.
Limitations & Constraints
Section titled “Limitations & Constraints”- Fixed Sink Target: Currently supports STACKIT Dremio (Apache Iceberg tables) as the sole sink destination.
- JSON Payload Requirement: Schema derivation requires incoming stream messages to be valid JSON structures.
- Flush Latency: Features an intentional micro-batching flush delay of approximately 5 minutes before data is visible in tables.
STACKIT Dremio
Service
STACKIT Dremio
STACKIT
Data and AI data lakehouse dremio sql analytics data and ai
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
STACKIT Dremio is a managed Data Lakehouse engine that provides high-speed SQL analytics directly on cloud object storage using Apache Arrow technology.
Service Overview
Section titled “Service Overview”- ETL-Free Virtualization: Eliminates time-consuming data copies by querying underlying data sources in place.
- Sub-Second Analytics: Accelerates slow BI dashboards using advanced Data Reflections™ acceleration technology.
- Unified Semantic Layer: Delivers a consistent, governed catalog view across diverse enterprise data sources.
Technical Details
Section titled “Technical Details”- Performance Engine: Built on Apache Arrow for fast columnar in-memory query processing.
- Governance: Granular column- and row-level access security policies integrated with STACKIT IAM.
- BI Connectivity: Native connectors for BI tools including Tableau, PowerBI, and standard JDBC/ODBC clients.
Engine Sizes
Section titled “Engine Sizes”The values below come from the STACKIT documentation and update themselves.
From the STACKIT docsCompute resources for Dremio › Available engines for STACKIT Dremio
On creation or editing, you can choose CPU and memory of your Dremio engine. Due to a limitation in Dremio, the UI doesn’t reveal the real allocation of vCPUs configured for that size. To mitigate the possibility of creating an invalid configuration, only the 28C-CPU-option is exposed in the UI. You define the real CPU count with the configuration of the size:
| Size | CPU (UI) | vCPUs (applied) | Memory (GiB) | Instance Count | Availability |
|---|---|---|---|---|---|
| STACKIT 2XS | 28C | 7 | 28 | 1 | |
| STACKIT XS | 28C | 14 | 56 | 1 | |
| STACKIT S | 28C | 28 | 112 | 1 | with General Availability |
| STACKIT M | 28C | 28 | 112 | 2 | with General Availability |
| STACKIT L | 28C | 28 | 112 | 4 | with General Availability |
CPU or memory combinations that aren’t listed will be discontinued on August 26, 2026. This means that existing engines of those combinations won’t start and that you can not order new engines of that type.
If you have issues migrating to new engines, check our Dremio FAQ.
What is this?
This section is copied from the STACKIT docs automatically, several times a day. It cannot be changed here. Changes belong in the STACKIT docs.
Limitations & Constraints
Section titled “Limitations & Constraints”- Reflections Storage Cost: Data Reflections generate physical acceleration indexes that consume additional Object Storage.
- Metadata Sync Delays: Source metadata updates follow scheduled polling intervals (typically 15 to 60 minutes).
- UI Upload Capping: Direct file uploads through the Dremio user interface are capped at 50 MB per file.
STACKIT Notebooks
Service
STACKIT Notebooks
STACKIT
Data and AI jupyter data science python data and ai analytics
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
STACKIT Notebooks delivers ready-to-use JupyterHub/JupyterLab environments for data engineering, interactive analytics, and prototyping.
Service Overview
Section titled “Service Overview”- Zero Administrative Setup: Provision pre-configured Python environments in minutes.
- Isolated Pod Execution: Each session runs inside a secure, dedicated Kubernetes pod.
- Integrated Tooling: Pre-built support for Git integration, Spark jobs, and data science libraries.
Technical Details
Section titled “Technical Details”- Access Control: Role-based authentication integrated via OIDC.
- Persistence: Workspaces mount persistent storage volumes to preserve code and custom packages across sessions.
- Data Sovereignty: Operated inside certified German data centers in accordance with GDPR.
Identity Provider
Section titled “Identity Provider”The values below come from the STACKIT documentation and update themselves.
From the STACKIT docsCreate and manage instances for Notebooks › External Identity Provider (IdP)
As for now, Notebooks depends on an external Identity Provider for authentication, authorization and single-sign-on. It uses the OpenID Connect protocol. The following IdPs are supported:
- Azure
- Okta
- AWS Cognito
- Keycloak
To integrate an IdP, you need to provide the Client ID, the Client secret, the Scope and the Discovery Endpoint. You need to get these values from the respective provider.
The values for Scope are in most cases openid email, for EntraID it is openid email User.Read.
The format for a Discovery Endpoint is https://\<provider-domain\>/.well-known/openid-configuration.
What is this?
This section is copied from the STACKIT docs automatically, several times a day. It cannot be changed here. Changes belong in the STACKIT docs.
Limitations & Constraints
Section titled “Limitations & Constraints”- Restart Required for Scaling: Changing instance sizes or attached GPUs requires stopping and restarting the notebook instance.
- Ephemeral Root Storage: Files saved outside the mounted persistent volume directory are erased upon pod restart.
- No Headless Background Execution: Sessions automatically shut down during inactivity, terminating long-running background training scripts.
STACKIT AI Model Experiments
Service
STACKIT AI Model Experiments
STACKIT
Data and AI mlops mlflow ai data and ai model registry
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
STACKIT AI Model Experiments delivers a fully managed MLflow environment to track training runs, record metrics, and manage model registries without infrastructure overhead.
Service Overview
Section titled “Service Overview”- Central MLOps Hub: Eliminates fragmented local tracking setups by centralizing artifacts, prompts, and parameters.
- Seamless Integrations: Natively compatible with standard frameworks like PyTorch, TensorFlow, and LangChain.
- Sovereign Execution: Hosted in German data centers with full GDPR compliance and encrypted TLS connections.
Technical Details
Section titled “Technical Details”- Architecture: Managed MLflow service using STACKIT IAM/SSO for web UI access and token-based SDK/API authentication.
- Storage Separation: Metadata resides in a high-availability database; heavy model artifacts are stored in STACKIT Object Storage.
- GenAI Tracing: Full support for tracing LLM execution steps, prompts, and evaluation metrics.
Storage and Access
Section titled “Storage and Access”The values below come from the STACKIT documentation and update themselves.
From the STACKIT docsArchitecture of AI Model Experiments › Artifact storage
Unlike the metadata, artifacts (models, images, large datasets) are stored within the user’s own STACKIT project space.
Sovereignty: You retain ownership and control over your binary data.
Access: The MLflow™ UI and SDK communicate directly with your storage bucket to upload and retrieve these files.
What is this?
This section is copied from the STACKIT docs automatically, several times a day. It cannot be changed here. Changes belong in the STACKIT docs.
From the STACKIT docsArchitecture of AI Model Experiments › Authentication & security
Security is managed through a combination of STACKIT permissions and application-level tokens:
Management: Admins create and manage the instances and access tokens and set access roles via the STACKIT Portal or API.
Logging data: Engineers use tokens to authenticate the Python SDK against the specific instance URI to log their training data.
UI access: Each instance UI is accessible via a unique URI. Access is restricted via the STACKIT authentication and the roles of the user.
What is this?
This section is copied from the STACKIT docs automatically, several times a day. It cannot be changed here. Changes belong in the STACKIT docs.
Limitations & Constraints
Section titled “Limitations & Constraints”- Coarse Token Scoping: Service tokens offer full workspace access; fine-grained read-only API roles are unavailable.
- Project Scope: Tracking instances and linked object storage buckets are strictly bound to a single STACKIT project.
- No Native In-UI Backup: Soft-deleted experiments are retained for 30 days before purge; point-in-time database restoration is not exposed in the UI.
STACKIT AI Model Serving
Service
STACKIT AI Model Serving
STACKIT
Data and AI ai llm data and ai openai inference
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
STACKIT AI Model Serving gives developers turnkey access to hosted open-source Large Language Models (e.g., Llama 3, Mistral, Qwen, Gemma) using OpenAI-standard REST APIs.
Service Overview
Section titled “Service Overview”- Sovereign GenAI: Fully European-hosted AI execution keeping sensitive prompt data private and GDPR-compliant.
- Cost Efficiency: Pay-per-token pricing models eliminate the high cost of maintaining idle GPU hardware.
- Drop-In Compatibility: Zero code refactoring for applications built on OpenAI API structures.
Technical Details
Section titled “Technical Details”- Deployment Options: Shared Model Serving (cost-optimized, multi-tenant) and Custom Model Serving (dedicated, predictable performance).
- Managed Scaling: Auto-scaling inference infrastructure managing underlying NVIDIA GPU resources natively.
Available Models
Section titled “Available Models”The list below comes from the STACKIT documentation and updates itself.
From the STACKIT docsAvailable Shared Models of STACKIT AI Model Serving
| Model | Capabilities | Context | Max. output | Status |
|---|---|---|---|---|
| Text models | ||||
| Qwen3-VL 235B | Chat, Vision | 200K | 16,384 | Supported |
| Qwen3.8 27B | Chat, Vision, Reasoning | 262K | 16,384 | Supported |
| Qwen3.6 27B | Chat, Vision, Reasoning | 262K | 16,384 | Deprecated |
| Llama 3.3 70B | Chat | 128K | 4,096 | Supported |
| GPT-OSS 120B | Chat, Reasoning | 131K | 8,192 | Supported |
| Gemma 3 27B | Chat, Vision | 131K | 4,096 | Deprecated |
| Gemma 4 31B | Chat, Vision, Reasoning | 256K | 4,096 | Supported |
| GPT-OSS 20B | Chat, Reasoning | 131K | 8,192 | Supported |
| Embedding models | ||||
| E5 Mistral 7B | Embedding | n/a | n/a | Supported |
| Qwen3 Vision-Language Embedding | Embedding | n/a | n/a | Supported |
What is this?
This section is copied from the STACKIT docs automatically, several times a day. It cannot be changed here. Changes belong in the STACKIT docs.
Limitations & Constraints
Section titled “Limitations & Constraints”- Coarse Token Permissions: API tokens grant access to all available shared models; fine-grained model-level access is unsupported.
- Stateless Endpoint: The API stores no session state or conversation context; context history must be sent with each request.
- Shared Cluster Variance: Shared tier latency fluctuates based on multi-tenant cluster demand and strict RPM/TPM rate limits.
Trail historyActive 1 of the last 12 weeks?UpdatedNo updates · 1 bar = 1 week i
Maintainers
- ?Name not public?Name not publicThe Cloud Framework team knows who this is. The name is not shown on the site.
??Name not publicThe Cloud Framework team knows who this is. The name is not shown on the site.Contributed in STACKIT