We built Skill Radar’s new architecture on UpCloud’s managed services: Managed Kubernetes as the container platform, Managed PostgreSQL for the database, Managed Load Balancer for load balancing and Managed Object Storage for log storage.
Where UpCloud did not offer an equivalent managed service, we used established, platform-independent solutions: Bitbucket Packages for Docker images, External Secrets Operator with AWS Parameter Store for secrets management, and kube-prometheus-stack (Prometheus, Grafana, Loki, Alloy) for metrics and logs. These are widely used Kubernetes components that work on any platform.
| Purpose |
AWS equivalent |
UpCloud solution |
Status |
| Container platform |
ECS |
Managed Kubernetes |
✓ Managed service |
| Database |
RDS PostgreSQL |
Managed PostgreSQL |
✓ Managed service |
| Load balancing + SSL |
ALB |
Managed Load Balancer |
✓ Managed service |
| Object storage / logs |
S3 |
Managed Object Storage |
~ Partial S3 support |
| Docker registry |
ECR |
Bitbucket Packages |
✗ No UpCloud service |
| Secrets management |
Parameter Store |
AWS Parameter Store + External Secrets Operator |
✗ No UpCloud service |
| Monitoring & logging |
CloudWatch |
Prometheus + Grafana + Loki + Alloy |
✗ No UpCloud service |
| DNS |
Route 53 |
Route 53 (retained on AWS) |
✗ No DNS service |
UpCloud offers a narrower range of managed services than the hyperscalers. Take this into account early when you plan the architecture and allocate resources.
Responsibilities in a Kubernetes environment
UpCloud maintains the Managed Kubernetes control plane and provides version upgrades. Data plane updates can run automatically or be scheduled manually to suit your own timetable. The operator remains responsible for the lifecycle of application-level add-ons such as the ingress proxy (Traefik), External Secrets Operator and kube-prometheus-stack. That covers their installation, configuration and updates. This is standard Kubernetes practice on any platform, but it needs to be resourced from the outset.
→ Lesson learned
Plan resources for add-on lifecycle management from the start. Every add-on needs ongoing monitoring of its security updates and its compatibility with Kubernetes versions.
Access management
UpCloud’s identity model differs from those of the hyperscalers. Usernames are globally unique across the whole ecosystem, and one username cannot be used across multiple accounts. In practice, each purpose needs its own credentials: console login, API tokens, Object Storage keys and Kubernetes certificates. Each of these has its own lifecycle.
→ Lesson learned
Plan credential management and rotation processes at the start of the project. Agreeing on responsibilities early makes day-to-day management straightforward.
Object Storage: S3 compatibility in practice
UpCloud’s Object Storage uses the S3 API, but the implementation is only partial. Among other things, we ran into Terraform provider bugs and unreliable versioning, which meant we had to introduce lifecycle configurations. The management console is minimal, and versioning status and lifecycle configurations are not directly visible.
→ Lesson learned
Test S3 integrations and versioning features thoroughly before going into production.
Production migration on 15 June 2026
The migration took place during a controlled maintenance window outside office hours. We migrated the database using a PostgreSQL dump, deployed the application to the Kubernetes cluster and routed traffic to UpCloud’s Load Balancer. The whole operation fitted comfortably within the planned eight-hour window, and a rollback plan was ready throughout.