KUBECON Sovereignty was a big topic was at last week's Kubecon, and Thierry Carrez, the General Manager of the OpenInfra Foundation, shared strong feelings around it that included raising the idea that tech companies might be forced by their countries' governments to deploy "kill switches."

Even though Kubecon might almost be called AIcon, judging by the sheer number of announcements and vendors plugging the technology, there was also plenty of interest in sovereignty, despite the Kubecon organizers relegating Day 0 discussions to a hard-to-find room away from the rest of the conference.

Still, at least it was there, and there were a few nods to the subject during the second day's keynotes. A vendor at the conference explained that the topic had been a late addition, but one whose importance is set to grow.

Carrez opened the Day 0 sovereignty sessions, and we spoke to him about sovereignty and, in his words, "How much of a threat is it to have a kill switch on your critical infrastructure?"

Carrez calls this "the survival problem," and it forms part of his definition of sovereignty – digital, data, AI, and so on. He says, "A lot of people are just talking about digital sovereignty as like a catchphrase for a bunch of things.

"The way I look at it is what are we meaning? It's all about building a resilience against something, right? But what are we exactly talking about? What are the scenarios we are actually trying to address?"

There is the sovereignty that enterprises should already have, which, according to Carrez, "is mostly around which laws apply to wherever your data is stored, wherever it's processed, and who can access it."

Then there is sovereignty in the supply chain. Not just software, but also the hardware that everything runs on.

And then there is what is necessitated by the possibility of that "kill switch."

For many, a kill switch that allows a vendor or its government to shut down critical infrastructure is a hypothetical threat. Carrez acknowledges this, saying, "It's something we need to build resilience against."

"I think," he says, "that the threat is going to be leveraged more in negotiations … just like 'Agree to this, or something bad might happen to your critical infrastructure.'

It's important to note that by "negotiations," Carrez means discussions at the geopolitical level and the leverage the threat, hypothetical or not, can yield.

"Some governments already have the capability to force their companies to not collaborate with overseas organizations … It's more the potential of the threat that we need to address than necessarily surviving the action."

A longer-term problem is hardware. "It's all about having alternatives," explains Carrez, "The leverage is there if there is only one provider, and sometimes just having the ability to switch from one to another is enough.

"And so one way to build resilience against US chip vendors suddenly no longer shipping to the EU is maybe we should be exploring China-based chip vendors and see if we can use them, or build some domestic, local, regional capacity to build those chips.

"It's not that we don't have the knowledge on how to make them. It's just like it was more convenient to use Taiwan and others to build them."

Carrez, however, is pragmatic and accepts that regulation is needed to prevent enterprises from sticking with what they know. "Regulation," he says, "is going to be key because you will have to accept some difference.

"I'm not necessarily saying it's a downgrade, but it's going to be sufficiently different to have a cost in switching. And so, if that cost is not covered, companies are going to continue using what they're what they've always been using, and the vulnerability will still be there. "For certain types of workloads, there is going to have to be some mandate from at Europe level or national level that, like, it's not reasonable to run your nuclear plant maintenance systems on Amazon, you know?"

Sticking with software, Carrez also cautions against opting for an open source single vendor product: "It's vulnerable to acquisition," he said, "and so you still keep that vulnerability because you put all your eggs into one basket."

"So I think open source combined with open-governed ecosystems like the CNCF here, or OpenInfra, guarantees you some independence against a single actor."

And the timescales? "It's going to take a while," Carrez acknowledges, "but they [the users] should start.

"They should at least audit their level of reliability. Where are they running? Where are their workloads running? Which ones are critical, which ones they can't really afford to be taken hostage in some kind of geopolitical negotiation, and start moving that, thanks to some public cloud that's built here.

"And yes, it's going to have a cost, like, if they are completely tied into one of the big hyperscaler eco-systems, it's going to be costly, but they need to know their vulnerability today, and don't wait for regulation to force them to look at it.

"They should be already looking at it." ®