Architecting for maintainability: Lessons from a global multicluster platform blueprint

How can a large organization achieve 100% uptime and zero security breaches at a massive scale? It requires moving past standard management techniques and focusing on a critical metric: maintainability. At the recent Red Hat OpenShift Commons Gathering in Amsterdam, ING senior engineers Robbin Siepman and Rob de Boer revealed the maintainable architectural blueprint behind one of the financial sector's most resilient cloud-native estates.

ING is a global financial institution that serves nearly 40 million customers across 100 countries. One of the bank’s main missions is to maintain the ING Hosted Container Platform (ICHP), a massive estate of 400 servers and 23,000 physical cores, with a lean team of fewer than 30 people. Here are the four pillars of maintainability that drive the company’s strategy.

Pillar 1: Zero privilege and automated compliance

The first rule of ICHP is simple: no humans allowed.

ING has eliminated human interaction with its clusters to ensure stability. Even administrators lack permanent access; SSH is disabled across the entire estate. Instead, every change is funneled through CI/CD pipelines.

• Automated testing: Pipelines handle compliance checks and vulnerability scanning before code ever touches a namespace.
• Traceability: Every production change requires an approved change in the configuration management database (CMDB), which requires a test plan and fallback mechanisms. Resources are automatically registered in the CMDB.
• Statelessness: By keeping the clusters stateless and access-free, the team minimizes the configuration drift that often leads to outages.

Pillar 2: Namespace-as-a-Service 

ING’s sweet spot for balancing developer freedom with bank-grade security is its Namespace-as-a-Service (NaaS) model.

Developers are free to deploy what they need, within the framework of internal guardrails and 12 Factor Application principles. In particular, applications must be declarative, automated, and strictly stateless. If an application needs to persist data, it must use external services like Cassandra or object storage rather than the platform itself.

Figure 1. Robbin Siepman, DevOps Engineer with ING Bank, speaking at the OpenShift Commons Gathering in Amsterdam.

Pillar 3: Hyperscalability and automation

To manage resources across two regions and two data centers, ING custom built Quota AutoScaler.

When a team requests a namespace, ING doesn't ask them to estimate resources, which is a notoriously difficult task for developers. Instead, the system takes the following steps:

1. The orange button: During onboarding, the system performs multiple checks such as OpenShift dry run, CMDB verification, and network availability. If everything clears, the submit button turns the signature ING orange.
2. Quota scaling: The platform monitors utilization. If a namespace exceeds a certain threshold, the Quota AutoScaler automatically triggers a resizing endpoint.

By automatically scaling back quotas and lowering CPU requests for dev/test environments, ING has saved roughly 7,600 CPU cores.

Pillar 4: Gamifying the human element

"You can build the most stable cluster in the world, but if the workload on it is unstable, the user experience will be crappy," noted Rob de Boer.

Figure 2. Rob de Boer, DevOps Engineer with ING Bank, speaking at the OpenShift Commons Gathering in Amsterdam.

To improve workload quality, ING introduced the Resilience Report. This dashboard grades namespaces based on best practices:

• Replicas: Not enough replicas? You get an immediate failing grade.
• Image age: ING policy requires redeploying apps every 30 days to ensure fresh security patching. If an image is more than 40 days old, the score drops.

This dashboard didn’t create a "shame and blame" culture; instead, it sparked a healthy competition among teams to improve their marks.

Giving back to the community

ING isn't keeping these innovations locked in a vault. Much of the orchestration framework (the Neoria orchestration package), the Python-based operator framework (Neoria Skafos), and the Neoria Quota AutoScaler application are now open source. By focusing on maintainability, ING has proven that a small team can manage a global footprint without losing sleep.

• Ready to see how ING transformed its global operations? Watch the full session from OpenShift Commons Amsterdam.
• Want to build a resilient foundation like ING? Learn how Red Hat OpenShift provides the enterprise-grade security and automation needed to scale global financial operations. Explore Red Hat OpenShift solutions.