Cloud-Native Architecture for Government Platforms in Africa

Government technology infrastructure in Africa has historically been characterised by on-premises deployments, single-vendor lock-in, and long refresh cycles that leave agencies running critically outdated systems. The shift to cloud-native architecture — containerised applications, infrastructure-as-code, declarative configuration management — offers African governments a path to more resilient, scalable, and cost-effective infrastructure.

However, cloud-native adoption in government contexts presents specific challenges that are more acute in Africa than in high-income country deployments. Bandwidth constraints affect the viability of multi-region architectures. Procurement frameworks designed for capital expenditure are poorly suited to cloud's operational expenditure model. In-house technical capacity to operate Kubernetes clusters is scarce. And data residency requirements — increasingly important as African governments develop data sovereignty frameworks — limit the use of global cloud regions.

Despite these challenges, TNG has found that a well-designed cloud-native architecture consistently outperforms on-premises alternatives on the dimensions that matter most for government platforms: availability, security posture, and the speed at which new features can be deployed and rolled back.

For the Lagos State AI platform, TNG designed a production Kubernetes architecture on AWS EKS using Auto Mode — the managed compute layer that provides serverless node provisioning without requiring manual EC2 fleet management.

The cluster is deployed across three availability zones in the AWS us-east-2 region (Ohio), with a VPC structured to provide complete network isolation between the public-facing application tier and private compute and data layers. All inter-service communication uses VPC endpoints for S3 and ECR to eliminate NAT gateway costs on data-intensive workloads.

We use two custom NodePools to provide workload isolation. The General NodePool handles web applications, APIs, and administrative services on C and M instance families (generation > 4), with spot instances in the staging environment and on-demand in production. The Translation Service NodePool is dedicated to AI inference workloads and uses a NoSchedule taint — preventing non-translation workloads from landing on inference nodes — with instance limits sized for burst capacity during peak processing periods.

IAM Roles for Service Accounts (IRSA) provides fine-grained, pod-level identity without storing static credentials anywhere in the cluster. Every service account has a dedicated IAM role with the minimum permissions required for its function. KMS encryption is applied to all EKS secrets at rest. CloudWatch logging captures control plane audit, API, and authentication logs.

For a government platform, auditability of deployments is as important as the deployments themselves. Every change to the production environment must be traceable: who requested it, who approved it, when it was applied, and what the previous state was.

We achieve this through ArgoCD, a declarative GitOps continuous delivery tool for Kubernetes. All application manifests, ConfigMaps, secrets references, and infrastructure configuration are stored in a Git repository. ArgoCD continuously reconciles the cluster state against the repository state — any drift is detected and flagged, and all changes require a Git commit (with review and approval) before reaching production.

This architecture provides several properties especially valuable for government: a complete audit trail of every configuration change; the ability to roll back any deployment to any previous state in seconds; and a clear separation between the infrastructure team (who control the GitOps repository) and the application teams (who make merge requests but cannot directly modify production).

Government cloud budgets are constrained and scrutinised. Cost optimisation is not optional — it is a requirement for sustainability and for building the political case for cloud-native adoption.

Our primary cost levers are: Spot instances for staging and non-critical production workloads (60-80% cost reduction vs on-demand); VPC endpoints for S3 and ECR (eliminating NAT gateway data processing costs, which on data-intensive AI workloads can be substantial); aggressive node consolidation policies in the NodeClass (30-second consolidation window that terminates underutilised nodes rapidly); and right-sized instance selection using Karpenter's instance flexibility, which allows the provisioner to select from a broad range of instance types rather than being locked to a specific family.

On a typical month, these optimisations reduce compute costs by approximately 45% compared to a naive on-demand, single-instance-family deployment, with no degradation in performance or availability for production workloads.

Nigerian data protection law (NDPR 2019 and the Data Protection Act 2023) imposes requirements on the storage and processing of personal data. For a government platform handling citizen data, compliance with these requirements is non-negotiable.

The current AWS Africa region (Cape Town, af-south-1) is viable for South African data residency requirements but does not fully satisfy Nigerian regulatory preference for in-country data storage. Until an AWS Nigeria region is available — which AWS has publicly indicated is under consideration — we advise government clients on the regulatory position and implement the strongest available technical controls: encryption of all data at rest and in transit using customer-managed KMS keys; detailed access logging; and data processing agreements with AWS that meet NDPR requirements for transfer of data to third-party processors.