Competitive Differentiators
What Sets Cirrus Cloud Platform Apart
CCP presents a distinctive combination of platform capabilities, architectural decisions, and operational design choices that differentiate it from both public cloud management tools and alternative private cloud platforms.
1. Purpose-Built for Sovereign and Regulated Cloud
Most Cloud Management Platforms are designed for managing public cloud resources or extending hyperscaler services. CCP is purpose-built for the opposite use case: privately operated, locally controlled, nationally compliant cloud infrastructure.
This means:
- On-premises deployment with no external hyperscaler dependency
- Data residency controls built into the platform design
- Per-tenant Keycloak realm isolation — not shared identity tenancy
- Compliance-first architecture aligned to government and regulated industry requirements
- SAML 2.0 federation with national identity providers
- AES-256 at rest and mTLS in transit by default — no additional configuration needed
2. Unified IaaS, PaaS, and SaaS Through One Portal
CCP integrates three complementary orchestration layers into a single management surface:
- Cirrus Cloud Platform (CCP): The Cloud Management Platform — governance, IAM, metering, and self-service
- Cirrus Cloud Platform (CCP): OpenStack-based IaaS orchestration — VMs, bare metal, storage, networking
- Cloud Orbiter: Kubernetes orchestration — container workloads, application deployment, PaaS and SaaS delivery
A user in the Self-Service Console can provision a virtual machine, attach a storage volume, configure a load balancer, deploy a Kubernetes cluster, and launch a managed database — all from one interface, governed by one RBAC system, tracked by one metering engine. Most platforms require multiple tools for this breadth of capability.
3. True Multi-Tenancy with Per-Tenant Identity Isolation
Many platforms implement multi-tenancy as namespacing within a shared identity system. CCP implements multi-tenancy with a dedicated Keycloak IAM realm per tenant — a completely isolated identity domain with its own:
- Users and roles
- Authentication flows and MFA policies
- Federation configuration (one tenant can federate with ADFS, another with a different IdP)
- Session management
This is not namespace-level isolation. It is identity-domain-level isolation — the same model used by the world's largest cloud providers for their enterprise customers.
4. Fine-Grained Authorization via OpenFGA
Rather than implementing simple role-to-permission mappings, CCP uses OpenFGA — an open-source fine-grained authorization engine. OpenFGA evaluates authorization based on relationship tuples and contextual conditions, enabling:
- Pre-defined roles organized across organization-level and service-specific categories
- Principle of least privilege enforced at the resource operation level
- Context-aware authorization — the same user can have different permissions in different projects
- Auditable authorization decisions for compliance review
5. Built-In FinOps and Quota Management
CCP treats cost visibility as a first-class platform capability, not an afterthought:
- Metering and showback built into the orbiter-metering microservice
- Quota management enforced at both Tenant and project level in real time
- Resource consumption tracking across all service categories
- Usage data available for notional invoicing, internal chargebacks, and external billing integration
- Quota warnings at configurable thresholds prevent overspend before it occurs
6. Enterprise-Grade Operational Reliability
CCP is engineered for the uptime requirements of sovereign and enterprise cloud:
- Active-passive dual cluster per region with automated GSLB failover
- 2N+1 quorum detection for precise failure determination
- Kubernetes control plane per AZ for cluster-level resilience
- Incremental backup every 30 minutes; full backup every 24 hours; 3-month geo-replicated retention
- MongoDB active-active across AZs
7. Open Integration Ecosystem
CCP integrates with enterprise tools already present in most large deployments:
| Domain | Integrated Tools |
|---|---|
| IaaS | OpenStack v2023.2 |
| Storage | NetApp v11.9.0 |
| Bare Metal | MaaS v3.4.9 |
| Backup | Veritas NetBackup v10.11.2 |
| Monitoring | Zabbix v7.4.3, Prometheus & Grafana v9.4.3 |
| Identity | Microsoft ADFS, Microsoft Entra |
| VPN | Zscaler (S2S and P2S) |
| Firewall | CheckPoint, Palo Alto |
| Log Management | APM / NPM / IPM |
Platform Comparison
| Capability | Public Cloud CMP | Generic Open-Source CMP | Cirrus Cloud Platform |
|---|---|---|---|
| Sovereign / on-premises deployment | No | Partial | Yes |
| Per-tenant IAM realm isolation | Limited | No | Yes (Keycloak realm per tenant) |
| Fine-grained authorization (OpenFGA) | Proprietary | Basic RBAC | Yes (pre-defined roles) |
| IaaS + PaaS + SaaS from one portal | Limited | Complex integration | Yes (CCP + CCP + Cloud Orbiter) |
| Built-in metering and FinOps | Proprietary tools | Build yourself | Yes (orbiter-metering) |
| SAML 2.0 federation | Yes | Manual | Yes (ADFS, Entra) |
| mTLS + AES-256 by default | Yes | Manual | Yes — default, not optional |
| Active-passive HA with GSLB | Yes | Manual | Yes (automated) |
| Phased service catalogue | No | No | Yes — progressive delivery model |
| Operational overhead | Low (managed) | High (build + maintain) | Low (managed with local control) |