V-ICT-OR delivers innovative Flemish government services with Azure Container Apps

When Flemish citizens need services from local government offices, the necessary technology support is often provided by the Vlaamse ICT Organisatie (V-ICT-OR). As a consortium of municipalities in Flanders, Belgium, the organization empowers its members with information and communications technologies (ICT). As a result, even small agencies with minimal IT expertise can deliver digital services, whether their citizens live in the village of Donk, home to fewer than 1,000 residents, or among Kortrijk’s 80,000. 

Andreas Nikolakopoulos, Chief Operations Officer at V-ICT-OR, says, “We put local governments in the driver’s seat and think together with them about technology. They don’t have the time or people to do the business analysis, so they need us to be a partner, helping them choose the best, most efficient solutions.”

While members fund their own business apps for services ranging from address lookups to payment processing,​ they share a Microsoft Azure infrastructure managed by V-ICT-OR. Until recently, the consortium used a monolithic app platform to maintain and enrich the shared resources. Prompted by technology deprecation and projected growth, V-ICT-OR made a strategic decision to modernize its app platform with containers. The goal was to increase flexibility and scalability as the region’s 280 municipalities increasingly rely on V-ICT-OR support.

Enabling a more modular architecture

Working with longtime partner Inetum in Belgium, V-ICT-OR selected and deployed Azure Container Apps to create a cloud-native microservices infrastructure on a fully managed, serverless platform while upgrading an aging .NET framework to .NET 8. ​A hub-and-spoke architecture incorporates the municipalities and includes private network API hosting, with mid-office application processing—primarily for Dynamics 365 modules—performed at the municipality level. Azure Service Bus serves as a communication interface between the central hub and app processing, performing integration logic. APIs are hosted centrally, with interconnectivity handled locally.

“It’s simple, and it became more simple by the fact that we could put it in separate modules,” says Koen Van Oost, Senior Solution Architect with Inetum. “Azure Container Apps gives you everything a container landscape can offer, and you don’t have to bother yourself about how everything is working together. It just works. It’s easy to use and you can do all kinds of stuff with it. Why would you consider something else?”

Connectivity between the microservices, and between the various agencies, is managed through an API gateway. Although Dynamics 365 is the primary API consumer, the architecture supports consumption by other apps too, helping individual municipalities retain the freedom to use additional solutions or resources that meet their needs without barriers or data silos. Azure Application Gateway performs load balancing and web application firewall (WAF) services. Azure Key Vault manages certificates and other sensitive data, strengthening V-ICT-OR’s existing security. By enabling private endpoints, the architecture brings services within the private virtual network so traffic can be routed within the network without using public IP addresses. An identity and authentication management solution provided by the Flanders Region was easily incorporated with the built-in authentication and authorization features of Container Apps. Jointly, this solution relieves V-ICT-OR of authentication responsibility and delivers single sign-on convenience to municipal staff.

Application Insights, a feature of Azure Monitor, provides traffic observability. While the platform automatically scales and allocates resources, traffic visibility helps V-ICT-OR assess performance, identify risks, troubleshoot, and spot use patterns that might prompt the development of new features for members. Configurations reside in Azure SQL Database. Storage options include Azure Blob Storage and Azure Table Storage.

The best practices, reference architectures, and other guidance available in the Azure Container Apps landing zone accelerator helped implementation move quickly through stack modeling and implementation planning. It also enabled the deployment team to rapidly roll out basic development, testing, and production environments they could then customize. The landing zone accelerator also supported use of infrastructure as code (IaC) to further speed deployment and increase reusability for greater efficiency. Subsequent testing could be highly selective, examining one microservice without disrupting others. The most time-consuming tasks were refactoring some code for desired functionality and addressing shifts in dependencies. 

Unburdening IT and users alike

Production deployment is still underway, with municipality onboarding expected by the end of 2024. The monolithic system will run in parallel temporarily to ensure apps perform seamlessly through every possible request and the modernization remains transparent to users and Flemish citizens.

“We’re doing this in such a way that they don’t have to bother with it a lot,” says Nikolakopoulos. He notes that municipal members have been able to continue business as usual during implementation, only running an occasional test on request. “We have a word for it in Dutch: ontzorgen,” he says. “We unburden them and just ensure that everything keeps working.”

The serverless solution unburdens V-ICT-OR staff too. As an abstraction layer, it eliminates the infrastructure maintenance otherwise required for a self-managed container environment. Azure Container Apps automatically handles traffic management, scaling, and provisioning of basic core and security services. Changes to the environment can be readily performed by replacing images, and if a change has any unintentional effect, quick reversions limit downtime. Nikolakopoulos says load and functional testing is easier than with the organization’s previous infrastructure. Finally, because backup tasks are handled within individual applications and member-specific tools, V-ICT-OR’s disaster recovery responsibilities are limited to environment redeployment and restoration of logs from storage.

Empowering developers to innovate

The shift to Container Apps saves effort for V-ICT-OR developers, who can now adopt built-in components such as Distributed Apps Runtime (Dapr) and Kubernetes Event-driven Autoscaling (KEDA) for use along with their Azure DevOps pipelines and tools. As a result, they can spend more time understanding member needs and innovating. They also can tailor functionality in more modular fashion because the microservices architecture effectively grants each service and message processor its own software development lifecycle, easing deployment planning. Nikolakopoulos explains, “It allows us higher velocity to make new things available and keep them evolving.” 

Increasing flexibility and extensibility

Nikolakopoulos calls the new architecture more flexible and elegant to work with. It should reduce costs because microservices offer more granular scalability for different service use rates. Moreover, third parties can now contribute functionality to expand the services municipalities offer. Nikolakopoulos explains, “All our municipalities, even the small ones, get a professional environment, a public and private ecosystem where every partner can put their tools.”

This extensibility and interoperability represent a big change. “That’s a problem the members ran into every day,” he says. “All their tools were in silos, so it was quasi-impossible to work on the data. With this solution, we make that possible.”

Discover more about V-ICT-OR on Facebook, LinkedIn, X/Twitter, and YouTube.