📣 This August, the Ænix team is bringing a series of hands-on open source private cloud workshops to four cities across Central Asia: Almaty, Bishkek, Tashkent and Astana.
The workshop focuses on moving beyond traditional virtualization and exploring cloud-native infrastructure for teams evaluating alternatives to VMware.
❓ We’ll cover:
• how a modern cloud-native private cloud is built;
• how VMware components map to an open source stack;
• where Kubernetes, KubeVirt, LINSTOR, Cilium and GitOps fit in;
• how to migrate virtual machines and introduce self-service infrastructure;
• when migration makes sense and when keeping your existing VMware environment is the better choice.
Cozystack will be used as a hands-on example of an integrated platform for testing these concepts and migration scenarios in practice.
🗣️ The workshops will be led by Timur Tukaev, COO at Ænix, the team behind Cozystack.
📍 Almaty — August 13, 10:00–14:00
📍 Bishkek — August 17, 14:00–18:00
📍 Tashkent — August 20, 15:00–19:00
📍 Astana — August 24, 14:00–18:30
All workshops are in person and follow the same program.
🔗 Choose your city and register via the link: https://u.to/VpqnIg
🙌 Know someone in Almaty, Bishkek, Tashkent or Astana who might be interested?
If you have partners, colleagues or friends working with cloud infrastructure, virtualization or Kubernetes in these cities, please share this post with them.
The workshop focuses on moving beyond traditional virtualization and exploring cloud-native infrastructure for teams evaluating alternatives to VMware.
❓ We’ll cover:
• how a modern cloud-native private cloud is built;
• how VMware components map to an open source stack;
• where Kubernetes, KubeVirt, LINSTOR, Cilium and GitOps fit in;
• how to migrate virtual machines and introduce self-service infrastructure;
• when migration makes sense and when keeping your existing VMware environment is the better choice.
Cozystack will be used as a hands-on example of an integrated platform for testing these concepts and migration scenarios in practice.
🗣️ The workshops will be led by Timur Tukaev, COO at Ænix, the team behind Cozystack.
📍 Almaty — August 13, 10:00–14:00
📍 Bishkek — August 17, 14:00–18:00
📍 Tashkent — August 20, 15:00–19:00
📍 Astana — August 24, 14:00–18:30
All workshops are in person and follow the same program.
🔗 Choose your city and register via the link: https://u.to/VpqnIg
🙌 Know someone in Almaty, Bishkek, Tashkent or Astana who might be interested?
If you have partners, colleagues or friends working with cloud infrastructure, virtualization or Kubernetes in these cities, please share this post with them.
👍4
We’ve open-sourced another tool we built: keycloak-kms-proxy.
Here’s the problem it solves.
Keycloak stores user PII, including email addresses, names and custom attributes, as plaintext in its database. Under GDPR, this is personal data and needs proper protection at rest.
Storage-level encryption or PostgreSQL-side encryption only gets you so far. The encryption key still lives close to the data, often inside the same PostgreSQL environment. Key rotation is also difficult to handle without downtime.
There are unofficial plugins that address this, such as Keycloak PII Data Encryption Provider. But they come with their own trade-offs: tight coupling to specific Keycloak versions, Java-level integration and a static encryption key passed through an environment variable.
We took a different approach. keycloak-kms-proxy is a transparent proxy that operates at the PostgreSQL wire-protocol level. It sits between Keycloak and PostgreSQL. Keycloak sees a regular Postgres database, while the proxy encrypts selected columns on write and decrypts them on read.
The design follows the same basic principles as Kubernetes KMSv2.
Every encrypted value is self-describing (
KEK rotation in Vault is fully transparent. The key version is stored alongside each wrapped DEK, so existing data remains decryptable without migrations or downtime.
In Cozystack, this is already available as an optional feature in the system Keycloak package. Enable encryption in the Helm chart and the proxy is deployed automatically. Keycloak is then reconfigured to connect through it, with no additional setup required.
Here’s the problem it solves.
Keycloak stores user PII, including email addresses, names and custom attributes, as plaintext in its database. Under GDPR, this is personal data and needs proper protection at rest.
Storage-level encryption or PostgreSQL-side encryption only gets you so far. The encryption key still lives close to the data, often inside the same PostgreSQL environment. Key rotation is also difficult to handle without downtime.
There are unofficial plugins that address this, such as Keycloak PII Data Encryption Provider. But they come with their own trade-offs: tight coupling to specific Keycloak versions, Java-level integration and a static encryption key passed through an environment variable.
We took a different approach. keycloak-kms-proxy is a transparent proxy that operates at the PostgreSQL wire-protocol level. It sits between Keycloak and PostgreSQL. Keycloak sees a regular Postgres database, while the proxy encrypts selected columns on write and decrypts them on read.
The design follows the same basic principles as Kubernetes KMSv2.
Every encrypted value is self-describing (
$KKP$...), which means the proxy can safely work with a partially encrypted database while the backfill utility gradually processes existing records.KEK rotation in Vault is fully transparent. The key version is stored alongside each wrapped DEK, so existing data remains decryptable without migrations or downtime.
In Cozystack, this is already available as an optional feature in the system Keycloak package. Enable encryption in the Helm chart and the proxy is deployed automatically. Keycloak is then reconfigured to connect through it, with no additional setup required.
🔥3❤1⚡1
Last Thursday in Almaty (Kazakhstan), a room packed with engineers spent three hours migrating VMs off VMware. Not watching a demo. Actually doing it.
Timur Tukaev aka @tym83 led the workshop: convert OVA to QCOW2, push images to S3, and boot VMs on Cozystack. Then came the ultimate time-sink: untangling the networking assumptions VMware had quietly baked into those machines over the years. Throw in PostgreSQL and Kafka, wire them together, and keep tweaking the Java app until it finally came alive.
Later that day, Timur took the stage again to talk about the future of Kubernetes. Short version: the exciting work has shifted from the cluster itself to what's being built on top of it. The full talk is going up on the Cloud Native Kazakhstan YouTube channel, alongside sessions on hiding the control plane, Kubescape, cross-account Istio on AWS, and a case study on swapping Ceph for Longhorn.
Attendees get to keep their Cozystack tenant for 30 days. No overnight resets — this is a real setup to stress-test properly. Plus, it doubles as a stepping stone toward Cozystack administrator certification.
Next up: Bishkek (Aug 17), Tashkent (Aug 20), and Astana (Aug 24). Europe in October, the US in November, and a global online session in early September.
Links and details here: aenix.io/workshops/vmware-to-cozystack
One final takeaway: the migration is the easy part. The real bottleneck is that vCenter and Veeam live in people's fingers, not in the docs. It’s 15 years of muscle memory. Nobody budgets time for unlearning — and that’s exactly what kills a pilot.
P.S. Huge thanks to the organizers, the team at QOSI (Qazaq Open Source Initiative) and everyone who came out! Appreciate the invite, your trust, and the incredible vibes.
P.P.S. A massive shout-out to Ivan Okhotnikov aka @xor_dev — a rockstar engineer on the Ænix team and an all-around awesome human. Thanks for helping pre-bake the workshop code, pulling those all-nighters, and providing real-time tech support (Google Meets and all) for our attendees while the workshop was live.
Timur Tukaev aka @tym83 led the workshop: convert OVA to QCOW2, push images to S3, and boot VMs on Cozystack. Then came the ultimate time-sink: untangling the networking assumptions VMware had quietly baked into those machines over the years. Throw in PostgreSQL and Kafka, wire them together, and keep tweaking the Java app until it finally came alive.
Later that day, Timur took the stage again to talk about the future of Kubernetes. Short version: the exciting work has shifted from the cluster itself to what's being built on top of it. The full talk is going up on the Cloud Native Kazakhstan YouTube channel, alongside sessions on hiding the control plane, Kubescape, cross-account Istio on AWS, and a case study on swapping Ceph for Longhorn.
Attendees get to keep their Cozystack tenant for 30 days. No overnight resets — this is a real setup to stress-test properly. Plus, it doubles as a stepping stone toward Cozystack administrator certification.
Next up: Bishkek (Aug 17), Tashkent (Aug 20), and Astana (Aug 24). Europe in October, the US in November, and a global online session in early September.
Links and details here: aenix.io/workshops/vmware-to-cozystack
One final takeaway: the migration is the easy part. The real bottleneck is that vCenter and Veeam live in people's fingers, not in the docs. It’s 15 years of muscle memory. Nobody budgets time for unlearning — and that’s exactly what kills a pilot.
P.S. Huge thanks to the organizers, the team at QOSI (Qazaq Open Source Initiative) and everyone who came out! Appreciate the invite, your trust, and the incredible vibes.
P.P.S. A massive shout-out to Ivan Okhotnikov aka @xor_dev — a rockstar engineer on the Ænix team and an all-around awesome human. Thanks for helping pre-bake the workshop code, pulling those all-nighters, and providing real-time tech support (Google Meets and all) for our attendees while the workshop was live.
🔥3👏3
Hi everyone, if you'd like to add anything to tomorrow's Cozystack community meeting agenda, feel free to reach out to @vsop78 or simply drop your ideas in the comments
When: Tomorrow at 18:00-19:00 (CEST) / 16:00-17:00 (UTC)
Where: Zoom
Link to join in:
https://zoom-lfx.platform.linuxfoundation.org/meeting/93845795591?password=a263fc60-ea72-41c8-84c8-a00d683ecee5
Agenda: https://docs.google.com/document/d/1YObSKsQ3Gzi1gSLPlUp-PbSYEeVkoyzY20M_hXKVhq4/edit?tab=t.0
This meeting is free and open to everyone!
Come and join us!
When: Tomorrow at 18:00-19:00 (CEST) / 16:00-17:00 (UTC)
Where: Zoom
Link to join in:
https://zoom-lfx.platform.linuxfoundation.org/meeting/93845795591?password=a263fc60-ea72-41c8-84c8-a00d683ecee5
Agenda: https://docs.google.com/document/d/1YObSKsQ3Gzi1gSLPlUp-PbSYEeVkoyzY20M_hXKVhq4/edit?tab=t.0
This meeting is free and open to everyone!
Come and join us!
Ænix.io
Photo
We just wrapped up the same setup in Bishkek 🇰🇬 on August 17th. Technically, it was the exact same deep dive as in Almaty 🇰🇿, but with a twist: no sponsors, no external organizers.
It was a purely DIY effort — we ran the whole show ourselves.
And here is the absolute best part: every single attendee made it to the finish line and successfully completed the migration. 100% completion rate. That’s massive for a hands-on workshop!
Huge thanks to the Bishkek tech community for the incredible energy, focus, and drive. You came to build, not just to watch.
💡 Want us to bring this workshop to your city?
If your local community or engineering team wants to learn how to ditch VMware and experience Cozystack hands-on, just drop a comment below or shoot @vsop78 a DM. Let’s make it happen!
Next stops on the tour: Astana (August 24th) and Tashkent (August 26th)
It was a purely DIY effort — we ran the whole show ourselves.
And here is the absolute best part: every single attendee made it to the finish line and successfully completed the migration. 100% completion rate. That’s massive for a hands-on workshop!
Huge thanks to the Bishkek tech community for the incredible energy, focus, and drive. You came to build, not just to watch.
💡 Want us to bring this workshop to your city?
If your local community or engineering team wants to learn how to ditch VMware and experience Cozystack hands-on, just drop a comment below or shoot @vsop78 a DM. Let’s make it happen!
Next stops on the tour: Astana (August 24th) and Tashkent (August 26th)
👍1
Catch you at the 71st Cozystack community meeting today!
When: Today at 18:00-19:00 (CEST) / 16:00-17:00 (UTC)
Where: Zoom
Link to join in:
https://zoom-lfx.platform.linuxfoundation.org/meeting/93845795591?password=a263fc60-ea72-41c8-84c8-a00d683ecee5
This meeting is free and open to everyone!
Come and join us!
Minutes:
https://docs.google.com/document/d/1YObSKsQ3Gzi1gSLPlUp-PbSYEeVkoyzY20M_hXKVhq4/edit?tab=t.0#heading=h.ygb3chatmgn2
📢 Agenda and Notes:
- Cozystack 1.7 in preparation
- Windows guests in VMs
- Move to CNCF Incubation: currents steps
- Marketplace service in details
🎤 Open Floor:
- Baremetal provisioning via tinkerbel and a real use case for talos-meta-tool from Mickaël Canévet, Senior Systems & Reliability Engineer @ ProtonMail (To Be Confirmed)
-Test flakiness and platform stability: catching component conflicts earlier, isolating tests from external factors
- Discussion of versioning and release process
- Release frequency, semver vs calver and
- Backport strategy discussion
- Design proposal review: open proposals on GitHub https://github.com/cozystack/community/pulls
- Viewing backup process events in the web dashboard
🗓️Do not miss Cozystack community meetings:
https://webcal.prod.itx.linuxfoundation.org/lfx/lfsixxnFWxbvsyEuC2
https://zoom-lfx.platform.linuxfoundation.org/meetings/cozystack?view=month
💡Have a feature idea or design proposal for Cozystack?
Submit your Pull Request here: https://github.com/cozystack/community/pulls 🚀
When: Today at 18:00-19:00 (CEST) / 16:00-17:00 (UTC)
Where: Zoom
Link to join in:
https://zoom-lfx.platform.linuxfoundation.org/meeting/93845795591?password=a263fc60-ea72-41c8-84c8-a00d683ecee5
This meeting is free and open to everyone!
Come and join us!
Minutes:
https://docs.google.com/document/d/1YObSKsQ3Gzi1gSLPlUp-PbSYEeVkoyzY20M_hXKVhq4/edit?tab=t.0#heading=h.ygb3chatmgn2
📢 Agenda and Notes:
- Cozystack 1.7 in preparation
- Windows guests in VMs
- Move to CNCF Incubation: currents steps
- Marketplace service in details
🎤 Open Floor:
- Baremetal provisioning via tinkerbel and a real use case for talos-meta-tool from Mickaël Canévet, Senior Systems & Reliability Engineer @ ProtonMail (To Be Confirmed)
-Test flakiness and platform stability: catching component conflicts earlier, isolating tests from external factors
- Discussion of versioning and release process
- Release frequency, semver vs calver and
- Backport strategy discussion
- Design proposal review: open proposals on GitHub https://github.com/cozystack/community/pulls
- Viewing backup process events in the web dashboard
🗓️Do not miss Cozystack community meetings:
https://webcal.prod.itx.linuxfoundation.org/lfx/lfsixxnFWxbvsyEuC2
https://zoom-lfx.platform.linuxfoundation.org/meetings/cozystack?view=month
💡Have a feature idea or design proposal for Cozystack?
Submit your Pull Request here: https://github.com/cozystack/community/pulls 🚀