A chronological content entry typically used for blog posts, news articles, or similar date-based content.

Posts

post

Projects

project

Videos

video

Podcasts

podcast

People

person

Events

event

Publications

publication

Solutions

solution

Services

service

A standalone content entry generally used for static, non-chronological content such as "About Us" or "Contact" pages.

Pages

page

Partners

partner

Case Studies

case-study

Magazine Issues

magazine-issue

Magazine Articles

magazine-article

Quotes

quote

Tabs

Default Confirmation

General Contact form

Newsletter form

Project Management Office Contact Form

Newsletter subscription

EGI DIH and Business Contact Form

Share your news

Services, Solutions and Support Team Contact Form

Communications Team Contact Form

Director Finances and HR Contact Form

Training Team Contact Form

EGI DIH Application form

Form Test

Service order form

test

EOSC DIH Tender

EGI Inspired Magazine 3

EGI Inspired Magazine 2

EGI Inspired Magazine 1

Advancing Open Science Through EGI Helpdesk Upgrade

EOSC Beyond – The CESSDA Pilot Node

AI Inference in Action: Deployment Strategies Learnt from AI4EOSC and iMagine

A CI/CD and GitOps approach for ENVRI-Hub Next Applications

Growing the AARC TREE: Advancing the AARC Blueprint Architecture for 2025

Empowering Structural Biology: Inside WeNMR’s Journey with EGI


<p>We interviewed <a href="https://www.uu.nl/staff/AMJJBonvin" target="_blank" rel="noreferrer noopener">Alexandre M. J. J. Bonvin</a>, professor of Computational Structural Biology at the University of Utrecht and coordinator of WeNMR, a worldwide infrastructure for NMR and Structural Biology.</p>



<h2 class="wp-block-heading" id="h-for-how-long-has-the-egi-federation-been-supporting-wenmr">For how long has the EGI Federation been supporting WeNMR?</h2>



<p>We started using High-Throughput or Grid Computing around 2008, thanks to a European project called Enmr. So essentially, since 2008 — or 2009 to be precise — we&#8217;ve been using EGI services without interruption. Even during funding gaps between European projects, we kept our services running, for some short periods even without external funding.</p>



<h2 class="wp-block-heading" id="h-this-makes-you-one-of-the-longest-standing-communities-supported-by-egi-given-that-time-span-what-would-you-say-are-the-most-significant-milestones-in-wenmr-s-growth">This makes you one of the longest-standing communities supported by EGI. Given that time span, what would you say are the most significant milestones in WeNMR’s growth?</h2>



<p>The most widely used service we offer is <a href="https://www.wenmr.eu/tutorials/CS-HADDOCK/" target="_blank" rel="noreferrer noopener">HADDOCK</a>, a web server for modelling biomolecular complexes. We launched it in 2008, initially running on local resources. A year later, we moved it to the grid, which allowed us to scale and support a larger user base.</p>



<p>The name “<a href="https://www.wenmr.eu/about/" target="_blank" rel="noreferrer noopener">WeNMR</a>” came from a <a href="https://cordis.europa.eu/project/id/261572" target="_blank" rel="noreferrer noopener">project</a> I coordinated in 2009, following the original Enmr project — we added the “W” for “Worldwide,” reflecting our community’s global expansion from the beginning. That branding has stuck with us across different projects over the years.</p>



<p>We&#8217;ve seen exponential growth, especially recently. Why? There hasn’t been a single big event — rather, it&#8217;s been a steady focus on user friendliness. From the start, we&#8217;ve aimed to make tools accessible even to non-experts. That ease of use has been a major draw. We&#8217;ve also invested heavily in <a href="https://www.wenmr.eu/tutorials/" target="_blank" rel="noreferrer noopener">tutorials and documentation</a>, covering everything from basic, no-command-line-needed guides to advanced workflows. User support has been a priority, answering every question, even if it&#8217;s the same one repeatedly. I’ve received emails from users saying, “Now I see why someone recommended HADDOCK — I got an answer within a day.” Promotion has played a big role too: workshops, courses, and events worldwide — some under <a href="https://www.embo.org/" target="_blank" rel="noreferrer noopener">EMBO</a>, others via EU projects. I’ve travelled a lot to promote the tools.</p>



<p>And it’s not just about software. We’re a research group at a university, so many of our software developments stem from scientific questions we’re trying to solve. Those developments often become new or improved services, and the resulting papers help bring more users to our tools.</p>



<p>Finally, we&#8217;ve been part of the <a href="https://bioexcel.eu/" target="_blank" rel="noreferrer noopener">BioExcel Center of Excellence</a> for ten years now, currently funded under <a href="https://www.eurohpc-ju.europa.eu/index_en" target="_blank" rel="noreferrer noopener">EuroHPC</a>. That funding supports software development, user support, and service improvement. Sustained funding is absolutely essential to continue growing and serving the community.</p>



<h2 class="wp-block-heading" id="h-you-mentioned-that-your-user-base-has-grown-significantly-outside-of-europe">You mentioned that your user base has grown significantly outside of Europe<strong>.</strong> </h2>



<p>Yes! We&#8217;ve had close to 66,000 registered users over the years. More than half of them come from Asia, especially India and China — those two alone make up about one-third of our user base.<br>We’re now involved in a <a href="http://ganana.eu" target="_blank" rel="noreferrer noopener">new Europe-India project</a>, funded by EuroHPC, to promote collaboration. As part of that, we’ll further develop HADDOCK and also deploy some of our services on Indian high-performance cloud infrastructure.</p>



<h2 class="wp-block-heading" id="h-so-the-indian-user-base-is-likely-to-keep-growing">So the Indian user base is likely to keep growing.</h2>



<p>Definitely. Though, if users run the services on local resources, those stats won’t show up in our web service metrics. Still, it’s clear the impact is growing. We currently have users from 174 countries — that’s pretty amazing, considering the <a href="https://research.un.org/en/unmembers/currentmembers" target="_blank" rel="noreferrer noopener">UN recognises 195 countries globally</a>.</p>


<div class="wp-block-image">
<figure class="aligncenter size-large"><img loading="lazy" decoding="async" width="1024" height="632" src="https://cdn.egi.eu/app/uploads/2025/07/Screenshot-2025-07-30-161433-1024x632.png" alt="" class="wp-image-35284" srcset="https://cdn.egi.eu/app/uploads/2025/07/Screenshot-2025-07-30-161433-1024x632.png 1024w, https://cdn.egi.eu/app/uploads/2025/07/Screenshot-2025-07-30-161433-300x185.png 300w, https://cdn.egi.eu/app/uploads/2025/07/Screenshot-2025-07-30-161433-768x474.png 768w, https://cdn.egi.eu/app/uploads/2025/07/Screenshot-2025-07-30-161433.png 1075w" sizes="auto, (max-width: 1024px) 100vw, 1024px" /></figure></div>


<h2 class="wp-block-heading" id="h-what-do-you-think-has-driven-this-exponential-growth-in-users">What do you think has driven this exponential growth in users?</h2>



<p>Several factors. Everything I mentioned earlier contributes: intuitive interfaces, strong user support, tutorials, promotion, and so on.</p>



<p>But recently, we’ve noticed a new trend: more and more use in education. We’re seeing our tools included in university curricula, and I also use them in my teaching for bachelor’s and master’s level courses. Students use our services for assignments, and often that becomes their entry point. If they move into research later, they’re likely to stick with the tools they’re already familiar with.</p>



<p>We can spot these patterns: a flood of student registrations from the same university around the same time, or professors reaching out to say they want to use the server for a course.</p>



<p>Covid also played a big role. During the pandemic, people turned to computational tools, and our usage spiked. Before Covid, we had around 300 new users per month. That jumped to 600, and since the beginning of 2025, it’s climbed again — now we’re averaging 2,000 new users per month. Part of that growth might also come from recent publications we’ve released on modelling immune complexes &nbsp;involving e.g. antibodies.</p>


<div class="wp-block-image">
<figure class="aligncenter size-large"><img loading="lazy" decoding="async" width="1024" height="385" src="https://cdn.egi.eu/app/uploads/2025/07/Screenshot-2025-07-30-162108-1024x385.png" alt="" class="wp-image-35286" srcset="https://cdn.egi.eu/app/uploads/2025/07/Screenshot-2025-07-30-162108-1024x385.png 1024w, https://cdn.egi.eu/app/uploads/2025/07/Screenshot-2025-07-30-162108-300x113.png 300w, https://cdn.egi.eu/app/uploads/2025/07/Screenshot-2025-07-30-162108-768x289.png 768w, https://cdn.egi.eu/app/uploads/2025/07/Screenshot-2025-07-30-162108.png 1118w" sizes="auto, (max-width: 1024px) 100vw, 1024px" /></figure></div>


<h2 class="wp-block-heading" id="h-given-this-educational-use-do-you-think-infrastructure-needs-to-adapt-to-meet-those-demands">Given this educational use, do you think infrastructure needs to adapt to meet those demands?</h2>



<p>Education typically doesn&#8217;t need massive compute power. When we run courses, we create special accounts with sampling limits to avoid wasting resources. We often provide pre-calculated results for students to analyse — it gives them the experience without burdening the system.</p>



<p>We could consider a dedicated educational interface running separately, but managing these services isn’t simple. There’s a complex backend infrastructure, including a secure frontend, job submission management, and more. That’s why we’ve kept a single entry point.</p>



<p>We use <a href="https://www.egi.eu/service/workload-manager/">EGI’s workload manager, DIRAC</a>, to distribute jobs, which helps. Technically, we could run multiple servers, but managing them all — ensuring security, maintenance — would be a significant effort.</p>



<p>We also serve pharmaceutical companies and industry partners, some of whom have asked to install HADDOCK locally to avoid sharing data over the network. We’ve had similar requests from China, where network constraints can be a challenge. But managing remote server deployments is complex, especially without root access.</p>



<h2 class="wp-block-heading" id="h-can-you-share-any-upcoming-technical-developments-or-new-features">Can you share any upcoming technical developments or new features?</h2>



<p>The HADDOCK server — currently HADDOCK 2.4, running version 2.5 of the software — accounts for all our grid and HTC computing on the EGI infrastructure. Other services, including some in Florence, run on local resources.</p>



<p>We’re now developing and recently released the next generation of our software: HADDOCK 3. It’s a complete rewrite — more modular and flexible, and better suited for cloud environments than grid systems.</p>



<p>Currently, HADDOCK runs start on our server, which sends jobs to DIRAC, and results are returned and further processed locally. With HADDOCK 3, the whole workflow will be sent to a cloud or HPC node, executed entirely there, and the results returned. That model requires cloud resources, which are currently limited in our EGI SLA.</p>



<p>As part of the <a href="https://www.egi.eu/project/eosc-data-commons/">EOSC Data Commons project</a>, we&#8217;re building the infrastructure to <a href="https://www.eosc-data-commons.eu/use-case/building-a-haddock3-service-making-use-of-eosc-cloud-resources" target="_blank" rel="noreferrer noopener">support HADDOCK 3 in a cloud environment</a>. Automation is key — the system will need to start and stop cloud instances on demand without human intervention.</p>



<p>This shift will also mean managing much larger data transfers — tens of megabytes sent out, potentially gigabytes coming back. The infrastructure must evolve to support that. Things run smoothly now, but it took years to get here, and it will take time for the new system to reach the same maturity.</p>



<h2 class="wp-block-heading" id="h-how-do-you-see-ai-and-machine-learning-playing-a-role-in-wenmr-s-future">How do you see AI and machine learning playing a role in WeNMR’s future?</h2>



<p>We’re using AI both to generate hypotheses and as part of the modelling process, then refining those models using physics-based approaches.</p>



<p>There’s been a lot of buzz around AI tools like <a href="https://alphafold.ebi.ac.uk/" target="_blank" rel="noreferrer noopener">AlphaFold</a>, it even won a Nobel Prize. I thought it might reduce our usage, but that hasn’t happened. One reason is that AI doesn’t perform well (yet) on all systems, particularly on antibodies and nanobodies. These evolve very quickly as they need to adapt to new threats, and most AI models rely on evolutionary conservation, which breaks down in those fast-evolving regions.</p>



<p>So, AI doesn’t replace us; in fact, it complements our work. Users might generate a model with AI and then turn to HADDOCK to refine it. That hybrid workflow is becoming more common and may explain the surge in users this year — though it’s also increasing the load on our servers.</p>



<p>We’ve developed AI tools ourselves, like <a href="https://deeprank.readthedocs.io/en/latest/" target="_blank" rel="noreferrer noopener">DeepRank</a> for protein-protein model quality prediction. As part of the EOSC Data Commons project, we’re launching a web service for it. The prototype is up and running, but it currently lacks GPU support, which makes it slower. Eventually, we aim to run it on GPU-enabled cloud machines.</p>



<p>We’ve also rewritten our frontend architecture as microservices, meaning services can run anywhere — locally or on EGI infrastructure — and just communicate with the main server. This should be especially useful for AI workloads.</p>



<p>We could, in principle, integrate with external databases like the AlphaFold one in the future, allowing direct upload of models. But we must be careful: if users without domain expertise misuse these tools, it can waste computing time. That’s where education plays a role again — ensuring tools are used effectively and responsibly.</p>



<p></p>



<p>NB. The statistics included above come from <a href="https://rascar.science.uu.nl/" target="_blank" rel="noreferrer noopener">this website</a>.</p>



<p><a id="_msocom_1"></a></p>


Spotlight on Research


<p>Open Science is reshaping the research landscape, fostering transparency, accessibility, and collaboration across disciplines and borders. To fully realise this vision, scientists not only need powerful computational tools but also robust support systems capable of addressing complex technical challenges. The <a href="https://www.egi.eu/service/helpdesk/">EGI Helpdesk</a>, also known as the <a href="https://helpdesk.ggus.eu/" target="_blank" rel="noreferrer noopener">Global Grid User Support (GGUS)</a>, is one such critical infrastructure that has recently undergone a major modernisation to meet the growing demands of the federated scientific community.</p>



<h2 class="wp-block-heading" id="h-the-evolution-of-the-egi-helpdesk">The Evolution of the EGI Helpdesk</h2>



<p>The original GGUS was launched over two decades ago at the Karlsruhe Institute of Technology (KIT) to support the Worldwide LHC Computing Grid (WLCG), as well as numerous other scientific research communities. It was designed to serve as a central entry point to handle inquiries, incidents, and service requests from scientific communities and to coordinate between computing centres. The GGUS was built on a proprietary backend with a custom frontend adapted to the needs of the communities. For years, over 1,300 registered GGUS supporters successfully managed an average of 500 tickets per month, providing a strong foundation for distributed user support. Yet, facing increased licensing requirements and an outdated technology stack that limited the integration capabilities, it became clear that a more modern, scalable, and interoperable EGI helpdesk was necessary.</p>



<h2 class="wp-block-heading" id="h-transition-to-a-modern-egi-helpdesk">Transition to a Modern EGI Helpdesk</h2>



<p>In response to growing challenges, the EGI Helpdesk has recently transitioned to a new platform built on Zammad, a modern, <strong>open-source helpdesk system</strong>. Zammad offers several advantages, including a contemporary, user-friendly interface, highly customisable core workflows, an actively developed tech stack, and seamless REST API integrations. Its scalability and built-in features make it an ideal foundation for a next-generation scientific support system.</p>


<div class="wp-block-image">
<figure data-wp-context="{&quot;imageId&quot;:&quot;688e587e5358b&quot;}" data-wp-interactive="core/image" class="aligncenter size-large wp-lightbox-container"><img loading="lazy" decoding="async" width="1024" height="524" data-wp-class--hide="state.isContentHidden" data-wp-class--show="state.isContentVisible" data-wp-init="callbacks.setButtonStyles" data-wp-on-async--click="actions.showLightbox" data-wp-on-async--load="callbacks.setButtonStyles" data-wp-on-async-window--resize="callbacks.setButtonStyles" src="https://cdn.egi.eu/app/uploads/2025/07/EGI-helpdesk1-1024x524.png" alt="" class="wp-image-35064" srcset="https://cdn.egi.eu/app/uploads/2025/07/EGI-helpdesk1-1024x524.png 1024w, https://cdn.egi.eu/app/uploads/2025/07/EGI-helpdesk1-300x153.png 300w, https://cdn.egi.eu/app/uploads/2025/07/EGI-helpdesk1-768x393.png 768w, https://cdn.egi.eu/app/uploads/2025/07/EGI-helpdesk1-1536x785.png 1536w, https://cdn.egi.eu/app/uploads/2025/07/EGI-helpdesk1-1200x614.png 1200w, https://cdn.egi.eu/app/uploads/2025/07/EGI-helpdesk1.png 1600w" sizes="auto, (max-width: 1024px) 100vw, 1024px" /><button
			class="lightbox-trigger"
			type="button"
			aria-haspopup="dialog"
			aria-label="Enlarge"
			data-wp-init="callbacks.initTriggerButton"
			data-wp-on-async--click="actions.showLightbox"
			data-wp-style--right="state.imageButtonRight"
			data-wp-style--top="state.imageButtonTop"
		>
			<svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" fill="none" viewBox="0 0 12 12">
				<path fill="#fff" d="M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z" />
			</svg>
		</button></figure></div>


<p class="has-text-align-center">Figure 1: A screenshot of the new EGI helpdesk</p>



<p class="has-text-align-left">The transition effort followed a structured roadmap, beginning in 2021 with an evaluation of potential replacement platforms, including OTRS, Zendesk, and ServiceNow. By 2022, the KIT team had committed to Zammad and began implementing critical GGUS workflows.</p>



<p>Key milestones of the transition to the new helpdesk included:</p>



<ul class="wp-block-list">
<li>Bidirectional synchronisation with the ServiceNow ticketing system used by key support units at CERN.</li>



<li>Synchronisation of the contact data of the support units with core infrastructure databases, such as GOCDB and OSG.</li>



<li>Integration with the EGI Check-in authentication and authorisation infrastructure, connecting the EGI helpdesk with federated identity providers for user management.</li>



<li>Implementation of the custom GGUS workflows in close collaboration with the Zammad developers, ensuring that community-specific support processes were fully preserved and integrated.</li>



<li>Transition to production and live use by January 29th, 2025.</li>
</ul>



<p>The result is a flexible, extensible platform tailored to the needs of federated infrastructures. By June 2025, over 1,500 new tickets had been created in the new system, including 600 that were migrated from the legacy platform. Over 700 supporters are currently using the system actively.</p>



<h2 class="wp-block-heading" id="h-support-infrastructure">Support Infrastructure</h2>



<p>With several hundred specialised support units, the new helpdesk system supports a vast network of EGI and WLCG communities, including national grid initiatives (NGIs), regional operations centres (ROCs), major experiments at the Large Hadron Collider, and EGI services such as operations, monitoring, authentication, and authorisation. The first level support is provided by the Ticket Process Managers (TPM), who handle general user queries or forward tickets to the appropriate experts.</p>


<div class="wp-block-image">
<figure data-wp-context="{&quot;imageId&quot;:&quot;688e587e5427e&quot;}" data-wp-interactive="core/image" class="aligncenter size-large wp-lightbox-container"><img loading="lazy" decoding="async" width="1024" height="538" data-wp-class--hide="state.isContentHidden" data-wp-class--show="state.isContentVisible" data-wp-init="callbacks.setButtonStyles" data-wp-on-async--click="actions.showLightbox" data-wp-on-async--load="callbacks.setButtonStyles" data-wp-on-async-window--resize="callbacks.setButtonStyles" src="https://cdn.egi.eu/app/uploads/2025/07/EGI-helpdesk2-1024x538.png" alt="" class="wp-image-35065" srcset="https://cdn.egi.eu/app/uploads/2025/07/EGI-helpdesk2-1024x538.png 1024w, https://cdn.egi.eu/app/uploads/2025/07/EGI-helpdesk2-300x158.png 300w, https://cdn.egi.eu/app/uploads/2025/07/EGI-helpdesk2-768x404.png 768w, https://cdn.egi.eu/app/uploads/2025/07/EGI-helpdesk2-1536x807.png 1536w, https://cdn.egi.eu/app/uploads/2025/07/EGI-helpdesk2-1200x631.png 1200w, https://cdn.egi.eu/app/uploads/2025/07/EGI-helpdesk2.png 1600w" sizes="auto, (max-width: 1024px) 100vw, 1024px" /><button
			class="lightbox-trigger"
			type="button"
			aria-haspopup="dialog"
			aria-label="Enlarge"
			data-wp-init="callbacks.initTriggerButton"
			data-wp-on-async--click="actions.showLightbox"
			data-wp-style--right="state.imageButtonRight"
			data-wp-style--top="state.imageButtonTop"
		>
			<svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" fill="none" viewBox="0 0 12 12">
				<path fill="#fff" d="M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z" />
			</svg>
		</button></figure></div>


<p class="has-text-align-center">Figure 2: Schematic view of the EGI helpdesk support unit infrastructure</p>



<p>Access to different support units is based on an improved role management system, in which roles are distributed manually by system administrators, along with the newly introduced mini-admins, who can assign roles to their collaborators. This approach reduces the dependency on the system administrator and speeds up role management.</p>



<h2 class="wp-block-heading" id="h-custom-workflows-for-complex-needs">Custom workflows for complex needs</h2>



<p>Custom workflows developed in GGUS in response to requests from user communities were successfully migrated to the new EGI helpdesk. The EGI Helpdesk workflows include:</p>



<ul class="wp-block-list">
<li><strong>Standard workflow</strong> designed for individual user queries, incident reports or service requests to particular support units.</li>



<li><strong>Team workflow </strong>marks a request as originating from a community rather than an individual, making the ticket visible to a broader audience. In some communities, team ticket updates trigger a mailing list that notifies more experts. Team tickets are primarily used by major LHC experiments, enabling the handover of tickets in the event of shift work.</li>



<li><strong>Alarm workflow</strong> triggers 24/7 on-call experts in the event of major incidents at Tier 0 and Tier 1 computing centres.</li>



<li><strong>Multisite workflow</strong> enables sending reports to multiple computing centres in the event of a widespread incident.</li>
</ul>



<h2 class="wp-block-heading" id="h-continuous-improvement">Continuous Improvement</h2>



<p>The EGI Helpdesk is evolving in a community-driven manner.&nbsp; After a smooth migration from a legacy system and achieving stable operation post-transition, the development team continues to incorporate user feedback and bug reports to refine both backend functionality and user experience. Regular updates and release notes are made public. To increase user awareness about the features of the new helpdesk, the development team also conducted training and regularly presents reports at user community meetings.</p>



<p>Looking ahead, the team is committed to deepening integration with other federated services and empowering AI support features. The prototypes of AI integration enable automatic ticket classification (e.g., assigning categories and priorities) and smart ticket routing to the appropriate support units. Further improvements include agent-assist features, such as reply suggestions.</p>



<h2 class="wp-block-heading" id="h-conclusion">Conclusion</h2>



<p>The modernisation of the EGI Helpdesk marks a significant step forward for Open Science, aligning closely with EGI&#8217;s strategic goals. With its open-source foundation and modern technology stack, the new helpdesk provides scientific communities a scalable platform with a contemporary design, greater flexibility for enhancements, and simplified integration with other federated systems. Ongoing work on integrating AI support features opens up new prospects for improving user support. Together, the improvements in the new EGI helpdesk enable faster, smarter, and more connected science across borders and disciplines.</p>



<h2 class="wp-block-heading" id="h-introduction"><strong>Introduction</strong></h2>



<p>The <a href="https://open-science-cloud.ec.europa.eu/" target="_blank" rel="noreferrer noopener">European Open Science Cloud (EOSC)</a> represents a transformative initiative aimed at creating a ‘Web of FAIR Data and Services’ by composing a unified digital environment where European researchers can access, share, and reuse research data and services across disciplinary and national boundaries. This is in stark contrast to the heterogeneous approaches (disparate National, Regional and disciplinary-specific collections of resources) that went before.</p>



<p>Building upon the foundations of EOSC, the <a href="http://eosc-beyond.eu" target="_blank" rel="noreferrer noopener">EOSC Beyond project</a> is designed to enhance the existing infrastructure by providing new EOSC Core capabilities (in particular, a network of Pilot Nodes, the Integration Suite, and the Execution Framework) to inform a more cohesive and efficient research infrastructure that serves the diverse needs of the European scientific community.</p>



<h2 class="wp-block-heading" id="h-the-eosc-beyond-framework-and-pilot-node-architecture"><strong>The EOSC Beyond Framework and Pilot Node Architecture</strong></h2>



<p>Central to the EOSC Beyond project&#8217;s methodology is the deployment of <a href="https://www.eosc-beyond.eu/pilots" target="_blank" rel="noreferrer noopener">Pilot Nodes</a>, which serve as specialised testbeds for evaluating and refining the project&#8217;s Core capabilities. These Pilot Nodes function as dynamic environments where new technologies, services, and integration approaches can be thoroughly tested before feeding through to the broader EOSC ecosystem. Each Pilot Node is designed to offer services that can be incorporated into workflows by other Nodes, creating a multiplying effect that amplifies the project&#8217;s impact across various Scientific Use Cases.</p>



<h2 class="wp-block-heading" id="h-the-cessda-pilot-node-advancing-social-science-research-infrastructure"><strong>The CESSDA Pilot Node: Advancing Social Science Research Infrastructure</strong></h2>



<p>The <a href="https://www.cessda.eu/" target="_blank" rel="noreferrer noopener">Consortium of European Social Science Data Archives (CESSDA)</a> Pilot Node represents a specialised implementation within the EOSC Beyond network, designed to address the challenges and opportunities associated with Social Science data management and accessibility.&nbsp;</p>



<p>Operating as a virtual entity, the <a href="https://www.eosc-beyond.eu/pilot/cessda" target="_blank" rel="noreferrer noopener">CESSDA Pilot Node</a> employs an innovative integration strategy that combines existing CESSDA services (<a href="https://datacatalogue.cessda.eu/" target="_blank" rel="noreferrer noopener">CESSDA Data Catalogue</a>, <a href="https://vocabularies.cessda.eu/" target="_blank" rel="noreferrer noopener">CESSDA Vocabulary Service</a>, <a href="https://www.cessda.eu/Training/DAG" target="_blank" rel="noreferrer noopener">Data Archiving Guide</a>, <a href="https://www.cessda.eu/Training/DMEG" target="_blank" rel="noreferrer noopener">Data Management Expert Guide</a>, <a href="https://thesauri.cessda.eu/elsst-5/en/" target="_blank" rel="noreferrer noopener">European Language Social Science Thesaurus</a>)&nbsp;with the newly developed capabilities of EOSC Beyond and established <a href="https://www.eosc-beyond.eu/services" target="_blank" rel="noreferrer noopener">EOSC Core services</a>. This hybrid approach introduces advanced functionalities that enhance data discoverability, accessibility, and interoperability across different research contexts and institutional boundaries.</p>



<p>The virtual nature of the CESSDA Pilot Node enables it to leverage distributed resources efficiently while presenting users with a unified interface for accessing Social Science data and related services, as well as resources made available by other Nodes in the network. This architecture supports use cases where researchers need to combine resources (data, compute, storage etc.) from multiple sources and collaborate with colleagues across different institutions and countries.</p>



<h2 class="wp-block-heading" id="h-technical-implementation-and-service-integration"><strong>Technical Implementation and Service Integration</strong></h2>



<p>The technical implementation of the CESSDA Pilot Node involves various service components, including metadata management systems, data discovery tools, authentication and authorisation services, and analytical platforms. The integration of these components requires careful attention to detail to ensure that researchers can access and utilise resources efficiently without encountering technical barriers. In many cases, they were not designed to work together and have different interfaces, data models etc., which require adaptation and other forms of mitigation.</p>



<h2 class="wp-block-heading" id="h-progress-and-current-status"><strong>Progress and Current Status</strong></h2>



<p>Significant progress has been achieved in establishing the foundational infrastructure for the CESSDA Pilot Node, including the successful integration of core CESSDA services with EOSC Beyond components (AAI, Monitoring, Helpdesk, Service Catalogue and Marketplace). Initial testing has demonstrated the viability of the virtual node architecture and validated several key technical approaches for federated data access and service discovery.</p>



<p>Collaboration with the broader EOSC Beyond network has facilitated knowledge sharing and accelerated the development of innovative solutions that benefit the entire research community.</p>



<h2 class="wp-block-heading" id="h-future-outlook-and-september-2025-milestone"><strong>Future Outlook and September 2025 Milestone</strong></h2>



<p>As the EOSC Beyond project approaches the conclusion of its first phase in September 2025, the CESSDA Pilot Node is expected to deliver significant value to the Social Science research community. Intended outcomes include fully operational federated services and demonstrable use cases that showcase the benefits of the integrated infrastructure.</p>



<p>The September 2025 milestone represents a stepping stone for the continued development and expansion of Open Science capabilities within the European research landscape. The lessons learned and technologies developed through the CESSDA Pilot Node will contribute to the broader evolution of EOSC and support the ongoing digital transformation of European research infrastructure.</p>



<h2 class="wp-block-heading" id="h-conclusion"><strong>Conclusion</strong></h2>



<p>The CESSDA Pilot Node contributes to the innovative approach of EOSC Beyond in creating practical, user-focused solutions for complex research infrastructure challenges. Through its successful implementation and operation, it will demonstrate the potential for collaborative, technology-driven approaches to enhance Open Science practices and support the evolving needs of the European research community.</p>



<p>The ENVRI-Hub Next project brings together 11 of Europe&#8217;s environmental research infrastructures, creating a complex ecosystem of software services. These many teams working independently create some challenges, as different development practices can result in slow progress and introduce risks. The solution? A single and automated pipeline assembling the code from the developers and carrying it into production, ensuring quality, security, and speed in this process.</p>



<h2 class="wp-block-heading" id="h-context-and-challenges">Context and Challenges</h2>



<p>In ENVRI-Hub Next, each group enjoys a healthy level of autonomy within the project. However, this may lead to the fragmentation of quality process evaluation, and modern research infrastructures live and die by the quality of their software. Different teams may follow different build processes and quality assessments; some ship their applications in Docker images, while others don’t. Each group may reach different levels of unit test coverage, and vulnerability scanning may range from &#8220;when we remember&#8221; to &#8220;never&#8221;. The resulting patchwork slows delivery and puts sensitive datasets at risk. To accelerate science without sacrificing rigorous procedures, we have designed and rolled out a single end‑to‑end pipeline based on continuous integration/ continuous delivery (CI/CD) and a GitOps approach (Figure 1), with the current setup running on CNCA infrastructure and developed in collaboration with the LIP team. Our goal is simple: every ENVRI‑Hub Next component should follow the same automated path from commit to production, with security, FAIR compliance, and reproducibility embedded from the first line of code.</p>



<h2 class="wp-block-heading" id="h-from-commit-to-production-principles-and-architecture">From Commit to Production: Principles and Architecture</h2>



<p>The proposed approach emphasises &#8220;quality from the first commit,&#8221; meaning that every code change undergoes immediate scanning. Steering to a shift-left strategy, moving testing and quality checks to the earliest possible point in development. As soon as a developer pushes new code, a continuous integration workflow kicks in to run an automated quality gate. The objective is simple: issues caught earlier are easier and cheaper to fix. To accomplish this, we enforce the usage of some tools integrated into the pipeline:</p>



<p><a href="https://github.com/SonarSource/sonarqube">SonarQube</a>: is a platform that automates source code scanning analyses for bugs, security vulnerabilities, and “code smells” (maintainability issues). It provides developers with instant feedback on the code&#8217;s health. This means that if a commit attempts to introduce a bug or something considered bad practice, Sonarqube will block that code from moving forward. SonarQube not only spots issues in the code, but it also suggests potential fixes and explanations, providing references to the risks associated. It is worth noting that SonarQube does not do everything, and practices such as peer code review and time allocation to reduce existing technical debts are still necessary. The significant advantage of using tools such as SonarQube is that it prevents the introduction of easily spotted issues into the source code and allows them to be fixed before production stages.</p>



<p><a href="https://sqaaas.eosc-synergy.eu/">SQAaaS</a> (Software Quality Assurance as a Service): developed by <a href="https://www.csic.es/en">CSIC</a>, <a href="https://www.lip.pt/">LIP</a> and <a href="https://www.upv.es/">UPV</a>, brings modern DevOps practices to research software, regardless of the developers&#8217; team expertise. It provides a ready-to-use CI/CD pipeline to help researchers/developers ensure that their software meets Open Science principles. SQAaaS workflow runs licence checks, unit-test coverage, documentation linters, vulnerability scans and FAIR-compliance checks. At the end of the assessment, a verifiable digital badge (bronze, silver or gold) is minted for proper recognition. This turns visible Quality Assurance work into a credential that funders, researchers, journals and infrastructure managers can inspect. Despite the narrower language coverage in terms of static and security analysis, overall SQAaaS complements SonarQube with policy-level checks and public recognition of software quality.</p>



<p><a href="https://everse.software/">EVERSE</a> (European Virtual Institute for Research Software Excellence): a Horizon-Europe collaboration that complements the pipeline by supplying a “knowledge layer” for software quality. EVERSE collective knowledge captured in the Research Software Quality toolkit (RSQkit) provides the community with best-practices consolidated into checklists, templates and policy guidance. In practical terms, ENVRI-Hub Next teams can decide what they want to test (e.g. citation metadata, reproducible environments, governance files). EVERSE also maintains a Network of Research Software Quality, offering software quality seminars, webinars and other events; ensuring that when the automated tools surface a problem, developers have a clear, peer-reviewed path to remediation. Together with SQAaaS, it provides guidance with early-warning systems to ensure that ENVRI-Hub Next software is secure, FAIR and reproducible.</p>



<h2 class="wp-block-heading" id="h-shipping-to-production">Shipping To Production&nbsp;</h2>



<p>For enhanced robustness, security, and efficiency of the ENVRI-Hub Next applications ecosystem, all are designed to be cloud-native following the blueprint for modern applications defined in the &#8220;Twelve Factors App&#8221; methodology. This means the applications are containerised and benefit from enhanced scalability, improved security through isolation, greater portability across different environments, among other benefits of this approach. Once the source code has successfully passed the quality gates, the pipeline proceeds with the application containerisation. For this step, we leverage rootless containerisation solutions like Kaniko and Buildah, which allow us to build Docker images securely without requiring elevated privileges on the build host, minimising potential attack surface and improving the overall system security.</p>



<p>After the containerisation step, it is almost imperative to perform some container security vulnerability scanning against the produced Docker image. Tools such as <a href="https://github.com/aquasecurity/trivy">Trivy</a>, a comprehensive and easy-to-use open-source scanner, allow the inspection of the resulting Docker image. This tool scans for known vulnerabilities (CVEs) in the operating system packages and application dependencies. It also identifies bad practices within the resultant Docker image, such as secrets stored in the image&#8217;s file system, undefined non-root users, or other misconfigurations. If Trivy finds critical vulnerabilities either on the base image or the produced image, it halts the pipeline, preventing the insecure image from ever being published or deployed. </p>



<p>Container vulnerability scanning is a crucial security measure for the entire cluster. Given that all applications share the same Kubernetes cluster (with multi-tenancy in place), it minimises the potential for vulnerable containers to compromise individual applications or the broader cluster environment.</p>



<h2 class="wp-block-heading" id="h-the-deployment-pipeline-a-gitops-approach">The Deployment Pipeline: A GitOps Approach</h2>



<p>The images validated and secure are versioned and published to GitLab&#8217;s integrated Container Registry. From there, deployment is managed entirely through a GitOps workflow, using a combination of <a href="https://helm.sh/">Helm</a> and <a href="https://argoproj.github.io/cd/">ArgoCD</a>. Helm packages all the necessary Kubernetes manifests into a version-controlled chart, allowing us to template configurations for different environments. Then ArgoCD acts as the GitOps agent, continuously monitoring the Git repository containing the Helm charts. When a change is detected, ArgoCD automatically synchronises it to the target Kubernetes cluster, preventing configuration drift, ensuring that the live state always matches the desired state defined in Git. However, an additional value of ArgoCD is that it empowers development teams, as they can manage their services through the ArgoCD web interface without needing direct cluster credentials.</p>


<div class="wp-block-image">
<figure data-wp-context="{&quot;imageId&quot;:&quot;688e587e5cfcc&quot;}" data-wp-interactive="core/image" class="aligncenter size-large wp-lightbox-container"><img loading="lazy" decoding="async" width="1024" height="343" data-wp-class--hide="state.isContentHidden" data-wp-class--show="state.isContentVisible" data-wp-init="callbacks.setButtonStyles" data-wp-on-async--click="actions.showLightbox" data-wp-on-async--load="callbacks.setButtonStyles" data-wp-on-async-window--resize="callbacks.setButtonStyles" src="https://cdn.egi.eu/app/uploads/2025/07/ENVRI-Hub-NEXT_magazine1-1024x343.png" alt="" class="wp-image-35084" srcset="https://cdn.egi.eu/app/uploads/2025/07/ENVRI-Hub-NEXT_magazine1-1024x343.png 1024w, https://cdn.egi.eu/app/uploads/2025/07/ENVRI-Hub-NEXT_magazine1-300x100.png 300w, https://cdn.egi.eu/app/uploads/2025/07/ENVRI-Hub-NEXT_magazine1-768x257.png 768w, https://cdn.egi.eu/app/uploads/2025/07/ENVRI-Hub-NEXT_magazine1-1536x514.png 1536w, https://cdn.egi.eu/app/uploads/2025/07/ENVRI-Hub-NEXT_magazine1-2048x686.png 2048w, https://cdn.egi.eu/app/uploads/2025/07/ENVRI-Hub-NEXT_magazine1-1200x402.png 1200w" sizes="auto, (max-width: 1024px) 100vw, 1024px" /><button
			class="lightbox-trigger"
			type="button"
			aria-haspopup="dialog"
			aria-label="Enlarge"
			data-wp-init="callbacks.initTriggerButton"
			data-wp-on-async--click="actions.showLightbox"
			data-wp-style--right="state.imageButtonRight"
			data-wp-style--top="state.imageButtonTop"
		>
			<svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" fill="none" viewBox="0 0 12 12">
				<path fill="#fff" d="M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z" />
			</svg>
		</button></figure></div>


<h2 class="wp-block-heading" id="h-security-always-as-a-priority">Security Always As A Priority</h2>



<p>Security is not a single step but a continuous flow throughout the entire life cycle. HashiCorp Vault provides a centralised and secure way to manage all secrets, from database passwords to API keys, ensuring they are never hard-coded in Git repositories. And security doesn&#8217;t stop at deployment. Using tools such as <a href="https://github.com/falcosecurity/falco">Falco</a> for real-time threat detection based on application behaviour, alerting to any suspicious activities like unexpected shell access or file system modifications. Complementing this, <a href="https://github.com/aquasecurity/trivy">Trivy</a> appears again to continuously scan running workloads, ensuring that it can detect vulnerabilities that might emerge after deployment as new CVEs are discovered.</p>



<h2 class="wp-block-heading" id="h-our-motto">Our Motto</h2>



<p>In essence, the quality of software and security is a fundamental aspect for modern research infrastructures like the ones collaborating in the ENVRI-Hub Next project. Managing a distributed ecosystem with multiple institutions and repositories clearly highlights the need for a unified approach to ensure consistency and reliability across all components.</p>



<p>Our solution, built on top of a CI/CD pipeline and following a GitOps approach (Figure 1), directly attempts to address this challenge, making sure every ENVRI-Hub Next component follows an automated and rigorous path from the very first line of code to production. Embracing a strategy to catch issues earlier in the source code.</p>



<p>Ultimately, we intend not only to accelerate the delivery of high-quality software but also ensure that the best practices are followed through every stage of the development life-cycle. We aim to give the developers ease of mind to deploy with the same confidence on a Friday afternoon as they would do on a Monday morning.</p>



<h2 class="wp-block-heading" id="h-introduction">Introduction</h2>



<p>Research collaborations increasingly rely on seamless, secure access to services and data across institutional and national boundaries. To meet these evolving needs, the <a href="https://aarc-community.org/" target="_blank" rel="noreferrer noopener">AARC TREE</a> project is modernising the foundational framework for Authentication and Authorisation Infrastructures (AAIs) used by research collaborations. By refining both the AARC Blueprint Architecture (AARC BPA) and the Policy Development Kit (PDK), AARC TREE empowers infrastructures of all sizes to adopt interoperable, scalable, and policy-aligned AAI models.</p>



<p>The project’s name &#8211; AARC TREE (Technical Revision to Enhance Effectiveness) &#8211; reflects its ambition to enable a sustainable ecosystem for trusted collaboration.</p>



<h2 class="wp-block-heading" id="h-modernising-the-aai-architecture">Modernising the AAI Architecture</h2>



<p>The AARC Blueprint Architecture has served as a reference model for enabling federated access for research collaboration since its original release. The initial revision of AARC-BPA-2025 (<a href="https://aarc-community.org/guidelines/aarc-g080/">AARC-G080</a>) is the result of extensive community input, including in-depth interviews with Research Infrastructures (RIs). With AARC-BPA-2025, AARC TREE introduces an evolution of this model—one that reflects real-world deployments and enables a more flexible, layered approach to identity and access management.</p>



<p>While the five architectural layers remain unchanged (see Figure 1), the initial revision of AARC-BPA-2025 introduces targeted refinements to improve clarity and reflect current practices. Component names have been generalised—such as renaming the Community Attribute Services Layer to Attribute Services Layer and the Community Authorisation Policy Repository to Authorisation Policy Repository—to better reflect their broader applicability. Protocol support has been streamlined: whereas earlier versions supported both SAML2 and OIDC at the proxy interface, AARC-BPA-2025 now focuses on OpenID Connect and OAuth 2.0 to align with emerging standards for token-based access.</p>


<div class="wp-block-image">
<figure data-wp-context="{&quot;imageId&quot;:&quot;688e587e616cb&quot;}" data-wp-interactive="core/image" class="aligncenter size-large wp-lightbox-container"><img loading="lazy" decoding="async" width="1024" height="739" data-wp-class--hide="state.isContentHidden" data-wp-class--show="state.isContentVisible" data-wp-init="callbacks.setButtonStyles" data-wp-on-async--click="actions.showLightbox" data-wp-on-async--load="callbacks.setButtonStyles" data-wp-on-async-window--resize="callbacks.setButtonStyles" src="https://cdn.egi.eu/app/uploads/2025/07/AARC_BPA_component-layers-1024x739.png" alt="" class="wp-image-35031" srcset="https://cdn.egi.eu/app/uploads/2025/07/AARC_BPA_component-layers-1024x739.png 1024w, https://cdn.egi.eu/app/uploads/2025/07/AARC_BPA_component-layers-300x216.png 300w, https://cdn.egi.eu/app/uploads/2025/07/AARC_BPA_component-layers-768x554.png 768w, https://cdn.egi.eu/app/uploads/2025/07/AARC_BPA_component-layers-1200x866.png 1200w, https://cdn.egi.eu/app/uploads/2025/07/AARC_BPA_component-layers.png 1307w" sizes="auto, (max-width: 1024px) 100vw, 1024px" /><button
			class="lightbox-trigger"
			type="button"
			aria-haspopup="dialog"
			aria-label="Enlarge"
			data-wp-init="callbacks.initTriggerButton"
			data-wp-on-async--click="actions.showLightbox"
			data-wp-style--right="state.imageButtonRight"
			data-wp-style--top="state.imageButtonTop"
		>
			<svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" fill="none" viewBox="0 0 12 12">
				<path fill="#fff" d="M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z" />
			</svg>
		</button></figure></div>


<p><em>Figure 1: Component layers of the AARC Blueprint Architecture (AARC-BPA-2025 – Initial Revision)</em></p>



<p>The updated architecture also introduces capabilities (see Figure 2), including the Identity capability, which encompasses functions such as identifier management, identity assurance, and identity linking. This shift reflects the growing prominence of national systems like EDU-ID and anticipated developments such as the EU Digital Identity Wallet (EUDI), which contribute foundational identity services in the evolving ecosystem. The Collaboration Management capability replaces the older notion of a “Community AAI.” This change clarifies architectural roles by distinguishing between identity services and collaboration functions—such as group enrollment and role management—accommodating both structured and more agile, project-based collaborations.</p>


<div class="wp-block-image">
<figure data-wp-context="{&quot;imageId&quot;:&quot;688e587e61f10&quot;}" data-wp-interactive="core/image" class="aligncenter size-full wp-lightbox-container"><img loading="lazy" decoding="async" width="591" height="621" data-wp-class--hide="state.isContentHidden" data-wp-class--show="state.isContentVisible" data-wp-init="callbacks.setButtonStyles" data-wp-on-async--click="actions.showLightbox" data-wp-on-async--load="callbacks.setButtonStyles" data-wp-on-async-window--resize="callbacks.setButtonStyles" src="https://cdn.egi.eu/app/uploads/2025/07/AAR_BPA_capabilities.png" alt="" class="wp-image-35032" srcset="https://cdn.egi.eu/app/uploads/2025/07/AAR_BPA_capabilities.png 591w, https://cdn.egi.eu/app/uploads/2025/07/AAR_BPA_capabilities-286x300.png 286w" sizes="auto, (max-width: 591px) 100vw, 591px" /><button
			class="lightbox-trigger"
			type="button"
			aria-haspopup="dialog"
			aria-label="Enlarge"
			data-wp-init="callbacks.initTriggerButton"
			data-wp-on-async--click="actions.showLightbox"
			data-wp-style--right="state.imageButtonRight"
			data-wp-style--top="state.imageButtonTop"
		>
			<svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" fill="none" viewBox="0 0 12 12">
				<path fill="#fff" d="M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z" />
			</svg>
		</button></figure></div>


<p><em>Figure 2: Functional Capabilities of the AARC Blueprint Architecture 2025 (AARC-BPA-2025 – Initial Revision)</em></p>



<p>Lastly, the authorisation model continues to rely on group- and role-based entitlements, with support for token-based access control across infrastructures. This includes the emerging OAuth 2.0 Proxied Token Introspection mechanism (<a href="https://aarc-community.org/guidelines/aarc-g052/" target="_blank" rel="noreferrer noopener">AARC-G052</a>), which extends standard introspection to support secure validation of tokens issued by different trusted infrastructures.</p>



<p>These refinements make AARC-BPA-2025 more applicable across diverse research environments, while preserving continuity with previous implementations.</p>



<h2 class="wp-block-heading" id="h-a-trust-framework-for-real-world-operations">A Trust Framework for Real-World Operations</h2>



<p>A modular trust framework that serves as the foundation for the forthcoming Policy Development Kit version 2 (PDK v2) is defined in <a href="https://aarc-community.org/guidelines/aarc-i082/">AARC-I082</a>. This framework clarifies how responsibilities and trust relationships can be structured across diverse organisations and roles. At the heart of the framework is a clear distinction between policies and the procedures that implement them. Policies describe high-level, stable commitments, such as who may access services or how data protection is ensured, that typically require formal approval. They are intentionally independent of specific technologies and tend to remain stable over time. Procedures, on the other hand, are more adaptable, evolving in response to operational changes, emerging risks, or new requirements.</p>



<p>The framework introduces five key stakeholder audiences—Research Governance, Users, Authentication Sources, Collaboration Management, and Service and Infrastructure Providers—and maps their responsibilities across various protection domains. This structure is illustrated in Figure 3, which highlights how different roles contribute to protecting collaboration participants, infrastructure services, and (sensitive) research data.</p>


<div class="wp-block-image">
<figure data-wp-context="{&quot;imageId&quot;:&quot;688e587e62706&quot;}" data-wp-interactive="core/image" class="aligncenter size-large wp-lightbox-container"><img loading="lazy" decoding="async" width="1024" height="545" data-wp-class--hide="state.isContentHidden" data-wp-class--show="state.isContentVisible" data-wp-init="callbacks.setButtonStyles" data-wp-on-async--click="actions.showLightbox" data-wp-on-async--load="callbacks.setButtonStyles" data-wp-on-async-window--resize="callbacks.setButtonStyles" src="https://cdn.egi.eu/app/uploads/2025/07/AARC_BPA-trust-framework-1024x545.png" alt="" class="wp-image-35033" srcset="https://cdn.egi.eu/app/uploads/2025/07/AARC_BPA-trust-framework-1024x545.png 1024w, https://cdn.egi.eu/app/uploads/2025/07/AARC_BPA-trust-framework-300x160.png 300w, https://cdn.egi.eu/app/uploads/2025/07/AARC_BPA-trust-framework-768x409.png 768w, https://cdn.egi.eu/app/uploads/2025/07/AARC_BPA-trust-framework-1200x638.png 1200w, https://cdn.egi.eu/app/uploads/2025/07/AARC_BPA-trust-framework.png 1410w" sizes="auto, (max-width: 1024px) 100vw, 1024px" /><button
			class="lightbox-trigger"
			type="button"
			aria-haspopup="dialog"
			aria-label="Enlarge"
			data-wp-init="callbacks.initTriggerButton"
			data-wp-on-async--click="actions.showLightbox"
			data-wp-style--right="state.imageButtonRight"
			data-wp-style--top="state.imageButtonTop"
		>
			<svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" fill="none" viewBox="0 0 12 12">
				<path fill="#fff" d="M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z" />
			</svg>
		</button></figure></div>


<p><em>Figure 3: Trust Framework and structure of the AARC Policy Development Kit (PDK) version 2.0</em></p>



<p>Within this structure, Snctfi version 2 defines a focused and assessable trust baseline specifically for proxy operators. It brings together requirements around operational security, data protection, incident response, attribute authority management, and privacy notice handling. These draw on widely adopted community practices, including <a href="https://refeds.org/sirtfi">Sirtfi</a>, the <a href="https://refeds.org/category/code-of-conduct/v2">REFEDS Data Protection Code of Conduct v2</a>, Guidelines for Secure Operation of Attribute Authorities (<a href="https://aarc-community.org/guidelines/aarc-g071/">AARC-G071</a>), Guidance for Notice Management (<a href="https://aarc-community.org/guidelines/aarc-g083/">AARC-G083</a>), and the Security Operational Baseline (<a href="https://aarc-community.org/guidelines/aarc-g084/">AARC-G084</a>).</p>



<p>By offering a common baseline, Snctfi v2 enables proxy operators to assert their conformance with clearly defined expectations. This helps relying parties identify trustworthy providers—especially important in ecosystems where most communities depend on external proxies rather than running their own. The Snctfi profile, together with the structure provided by AARC-I082, will guide the development of reusable policies and procedures in PDK v2, making it easier for infrastructures to implement consistent and interoperable trust frameworks.</p>



<h2 class="wp-block-heading" id="h-real-world-validation-and-tooling">Real-World Validation and Tooling</h2>



<p>AARC TREE is firmly grounded in practical, real-world validation to ensure that its outputs address the operational needs of research infrastructures. As part of this effort, the project conducted 23 in-depth interviews with Research/e-Infrastructures to capture current practices and key requirements. These insights directly informed the revision of both the architecture and the trust framework. In parallel, pilot implementations are testing core components of the guidance, including the attribute profile defined in <a href="https://aarc-community.org/guidelines/aarc-g056/">AARC-G056</a> and the layered notice management approach introduced in <a href="https://aarc-community.org/guidelines/aarc-g083/">AARC-G083</a>. To support adoption and self-assessment, an online validation platform is under development, building on the NFDI Attribute COnformity Checker (<a href="https://cvs.data.kit.edu/~naco/">naco</a>) and the Compliance Assessment Tool (<a href="https://fc4e-cat.github.io/fc4e-cat-doc/">CAT</a>). This platform aims to streamline conformance checks against AARC guidelines. Continuous feedback from the AARC Engagement Group for Infrastructures (<a href="https://aarc-community.org/about/aegis/">AEGIS</a>) and the EOSC AAI Working Group ensures that the evolving specifications remain aligned with community priorities and implementation realities.</p>



<h2 class="wp-block-heading" id="h-what-s-next">What’s Next?</h2>



<p>AARC TREE will finalise the updated AARC Blueprint Architecture (AARC-BPA-2025) and the structure of the Policy Development Kit version 2 (PDK v2), laying the foundation for seamless, policy-aligned access across infrastructures. Looking ahead, the project will work toward developing a compendium of best practices to support sustainable adoption, while also exploring synergies with emerging digital identity ecosystems, including eIDAS 2.0, the EU Digital Identity Wallet, and decentralised identity technologies.</p>



<p>As AI is becoming more integrated in research and industry, one key question arises: how do we deploy AI models at scale, efficiently and reliably? While training models is often in the spotlight, it&#8217;s the inference phase (the step when a model is used to make predictions on new data) that defines how useful and usable that AI truly is.</p>



<h2 class="wp-block-heading" id="h-the-ai-inference-challenge">The AI Inference Challenge</h2>



<p>Deploying AI models into production at scale isn’t easy. It requires powerful, adaptable infrastructure that can respond to varying demand, handle complex workloads, and integrate seamlessly with different computing environments.</p>



<p>Inference needs to be:</p>



<ul class="wp-block-list">
<li><strong>Scalable</strong>: Systems must automatically adapt to workload demand &#8211; scaling up when usage spikes and scaling down to save resources when resources are not needed.</li>



<li><strong>Flexible</strong>: The environment should be able to run across different cloud platforms and computing architectures (from CPUs to GPUs to HPC systems), covering the computing continuum.</li>



<li><strong>Efficient</strong>: Optimising both cost and energy consumption is essential, especially for large-scale or real-time applications.</li>



<li><strong>Composable</strong>: users should have the ability to create inference pipelines, allowing models to be easily connected, extended, or reused.</li>
</ul>



<p>The <a href="https://ai4eosc.eu/" target="_blank" rel="noreferrer noopener">AI4EOSC</a> and <a href="https://www.imagine-ai.eu/" target="_blank" rel="noreferrer noopener">iMagine</a> projects, both funded under the Horizon Europe programme, shared their experience addressing this challenge <a href="https://indico.egi.eu/event/6638/contributions/20438/" target="_blank" rel="noreferrer noopener">during EGI2025</a>. On the one hand, AI4EOSC provides a user-friendly <a href="https://dashboard.cloud.ai4eosc.eu/" target="_blank" rel="noreferrer noopener">workbench</a> and a toolbox, called <a href="https://github.com/ai4os" target="_blank" rel="noreferrer noopener">AI4OS</a>, of practical, scalable, and user-friendly solutions for developing and running AI models. On the other hand, iMagine is exploiting the AI4EOSC solutions to empower researchers in aquatic sciences with open access to a diverse set of tools and services to turn AI innovation into operational services for marine and freshwater research.</p>



<h2 class="wp-block-heading" id="h-from-theory-to-practice-use-cases-that-shaped-the-approach">From Theory to Practice: Use Cases That Shaped the Approach</h2>



<p>These capabilities weren’t developed in a vacuum—they’ve been shaped through a range of real-world use cases from the AI4EOSC (see more info about AI4EOSC use cases <a href="https://doi.org/10.5281/zenodo.7635453" target="_blank" rel="noreferrer noopener">here</a>) and iMagine (see more info about iMagine use cases <a href="https://doi.org/10.5281/zenodo.11520845" target="_blank" rel="noreferrer noopener">here</a>) projects. From marine species detection to thermal image processing, the technical team has worked hand-in-hand with end-users to understand what their needs are, what works and what doesn’t for each individual use case, and how to improve the existing solutions.</p>


<div class="wp-block-image">
<figure data-wp-context="{&quot;imageId&quot;:&quot;688e587e67c8e&quot;}" data-wp-interactive="core/image" class="aligncenter size-large wp-lightbox-container"><img loading="lazy" decoding="async" width="1024" height="576" data-wp-class--hide="state.isContentHidden" data-wp-class--show="state.isContentVisible" data-wp-init="callbacks.setButtonStyles" data-wp-on-async--click="actions.showLightbox" data-wp-on-async--load="callbacks.setButtonStyles" data-wp-on-async-window--resize="callbacks.setButtonStyles" src="https://cdn.egi.eu/app/uploads/2025/07/images_EGI_Inspired_magazine-1-1024x576.png" alt="" class="wp-image-35045" srcset="https://cdn.egi.eu/app/uploads/2025/07/images_EGI_Inspired_magazine-1-1024x576.png 1024w, https://cdn.egi.eu/app/uploads/2025/07/images_EGI_Inspired_magazine-1-300x169.png 300w, https://cdn.egi.eu/app/uploads/2025/07/images_EGI_Inspired_magazine-1-768x432.png 768w, https://cdn.egi.eu/app/uploads/2025/07/images_EGI_Inspired_magazine-1-1200x675.png 1200w, https://cdn.egi.eu/app/uploads/2025/07/images_EGI_Inspired_magazine-1.png 1280w" sizes="auto, (max-width: 1024px) 100vw, 1024px" /><button
			class="lightbox-trigger"
			type="button"
			aria-haspopup="dialog"
			aria-label="Enlarge"
			data-wp-init="callbacks.initTriggerButton"
			data-wp-on-async--click="actions.showLightbox"
			data-wp-style--right="state.imageButtonRight"
			data-wp-style--top="state.imageButtonTop"
		>
			<svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" fill="none" viewBox="0 0 12 12">
				<path fill="#fff" d="M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z" />
			</svg>
		</button></figure></div>


<p>As depicted in the picture above, each of these use cases calls for different infrastructure solutions. That’s why no single inference method works for everyone, and why the AI4EOSC toolbox supports a wide range of strategies. One principle is clear: users should not adapt to the platform; the platform should be adapted to the users.</p>



<h2 class="wp-block-heading" id="h-serverless-inference-with-oscar">Serverless Inference with OSCAR</h2>



<p>At the heart of AI4EOSC’s inference engine is <a href="https://oscar.grycap.net/" target="_blank" rel="noreferrer noopener">OSCAR</a>, an open-source, serverless computing framework used for scalable AI model execution. It allows AI models, packaged in Docker containers, to automatically respond to events; for example, triggering a model when a new file is uploaded to an object-storage solution (what we know as <em>asynchronous invocations</em>).</p>



<p>OSCAR runs on top of an elastic Kubernetes cluster, allowing the system to auto-scale based on demand, saving both costs and energy. It is cloud-agnostic and easy to deploy thanks to the <a href="https://im.egi.eu/" target="_blank" rel="noreferrer noopener">Infrastructure Manager</a> (IM). Moreover, it supports ARM-based low-power devices such as Raspberry PIs, enabling serverless computing at the Edge and composing workflows along the computing continuum. Next, you can find the architecture diagram of OSCAR:</p>


<div class="wp-block-image">
<figure data-wp-context="{&quot;imageId&quot;:&quot;688e587e68692&quot;}" data-wp-interactive="core/image" class="aligncenter size-large wp-lightbox-container"><img loading="lazy" decoding="async" width="1024" height="625" data-wp-class--hide="state.isContentHidden" data-wp-class--show="state.isContentVisible" data-wp-init="callbacks.setButtonStyles" data-wp-on-async--click="actions.showLightbox" data-wp-on-async--load="callbacks.setButtonStyles" data-wp-on-async-window--resize="callbacks.setButtonStyles" src="https://cdn.egi.eu/app/uploads/2025/07/images_EGI_Inspired_magazine-2-1024x625.png" alt="" class="wp-image-35046" srcset="https://cdn.egi.eu/app/uploads/2025/07/images_EGI_Inspired_magazine-2-1024x625.png 1024w, https://cdn.egi.eu/app/uploads/2025/07/images_EGI_Inspired_magazine-2-300x183.png 300w, https://cdn.egi.eu/app/uploads/2025/07/images_EGI_Inspired_magazine-2-768x469.png 768w, https://cdn.egi.eu/app/uploads/2025/07/images_EGI_Inspired_magazine-2.png 1072w" sizes="auto, (max-width: 1024px) 100vw, 1024px" /><button
			class="lightbox-trigger"
			type="button"
			aria-haspopup="dialog"
			aria-label="Enlarge"
			data-wp-init="callbacks.initTriggerButton"
			data-wp-on-async--click="actions.showLightbox"
			data-wp-style--right="state.imageButtonRight"
			data-wp-style--top="state.imageButtonTop"
		>
			<svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" fill="none" viewBox="0 0 12 12">
				<path fill="#fff" d="M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z" />
			</svg>
		</button></figure></div>


<p>In addition to event-driven inference, OSCAR supports programmatic access to trigger the inference of AI models. This is what we call <em>synchronous invocations</em>, and are scalable HTTP-based endpoints for AI models with user-defined configurable elasticity boundaries. Also, some AI models are better suited to be exposed as REST APIs, or the models even offer their own UI (for example, LLMs). OSCAR supports this too, making it easy to turn an AI model into a web-accessible service that can be called by apps, websites, or even other AI models.</p>



<p>However, inference isn’t always real-time. Many researchers need to process huge volumes of historical data, like the <a href="https://github.com/grycap/oscar-batch" target="_blank" rel="noreferrer noopener">EMSO OBSEA use case</a> from iMagine has (~900.000 images). That’s where <a href="https://github.com/grycap/oscar-batch">OSCAR Batch</a> comes in. This is an open-source extension for OSCAR designed to perform batch-based processing using the serverless approach. OSCAR Batch is designed for parallel, efficient processing of large datasets. It optimises CPU and memory usage across OSCAR Kubernetes clusters. This solution is perfect for one-off bulk inference tasks on large historical datasets.</p>



<h2 class="wp-block-heading" id="h-graphical-ai-pipelines-with-ai4compose">Graphical AI Pipelines with AI4Compose</h2>



<p>Workflows allow AI scientists to automate inference tasks using serverless computing. For non-experts or multidisciplinary teams, visual tools are essential, because they make this process more accessible and efficient. In this direction, AI4EOSC has developed <a href="https://github.com/ai4os/ai4-compose/" target="_blank" rel="noreferrer noopener">AI4Compose</a>, a solution that simplifies workflow creation through an intuitive, low-code interface, reducing the complexity of managing inference pipelines.</p>



<p>AI4Compose supports two different main tools (<a href="https://nodered.org" target="_blank" rel="noreferrer noopener">Node-RED</a> and <a href="https://elyra.readthedocs.io/" target="_blank" rel="noreferrer noopener">Elyra</a>) for composing AI inference pipelines graphically, using a simple drag-and-drop interface. This allows researchers to build, connect, and experiment with different models and data flows &#8211; no deep coding required.&nbsp;</p>


<div class="wp-block-image">
<figure data-wp-context="{&quot;imageId&quot;:&quot;688e587e6911c&quot;}" data-wp-interactive="core/image" class="aligncenter size-large wp-lightbox-container"><img loading="lazy" decoding="async" width="1024" height="576" data-wp-class--hide="state.isContentHidden" data-wp-class--show="state.isContentVisible" data-wp-init="callbacks.setButtonStyles" data-wp-on-async--click="actions.showLightbox" data-wp-on-async--load="callbacks.setButtonStyles" data-wp-on-async-window--resize="callbacks.setButtonStyles" src="https://cdn.egi.eu/app/uploads/2025/07/images_EGI_Inspired_magazine-3-1024x576.png" alt="" class="wp-image-35047" srcset="https://cdn.egi.eu/app/uploads/2025/07/images_EGI_Inspired_magazine-3-1024x576.png 1024w, https://cdn.egi.eu/app/uploads/2025/07/images_EGI_Inspired_magazine-3-300x169.png 300w, https://cdn.egi.eu/app/uploads/2025/07/images_EGI_Inspired_magazine-3-768x432.png 768w, https://cdn.egi.eu/app/uploads/2025/07/images_EGI_Inspired_magazine-3-1200x675.png 1200w, https://cdn.egi.eu/app/uploads/2025/07/images_EGI_Inspired_magazine-3.png 1280w" sizes="auto, (max-width: 1024px) 100vw, 1024px" /><button
			class="lightbox-trigger"
			type="button"
			aria-haspopup="dialog"
			aria-label="Enlarge"
			data-wp-init="callbacks.initTriggerButton"
			data-wp-on-async--click="actions.showLightbox"
			data-wp-style--right="state.imageButtonRight"
			data-wp-style--top="state.imageButtonTop"
		>
			<svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" fill="none" viewBox="0 0 12 12">
				<path fill="#fff" d="M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z" />
			</svg>
		</button></figure></div>


<p>Why support two different solutions? Because we have learned during the projects that there is no solution that fits all the use cases&#8217; needs. Meanwhile, Elyra is designed for data scientists who work within JupyterLab, providing a structured way to integrate Python notebooks and scripts into machine learning workflows; Node-RED is designed for rapid deployment, event-driven workflows, making it ideal for quick prototyping and demonstration purposes.</p>



<p>Moreover, AI4Compose offers several customised nodes and examples that integrate models in the AI4EOSC Catalogue with OSCAR. For Node-RED, they are published in this <a href="https://flows.nodered.org/collection/4pW6ET9DMHs0" target="_blank" rel="noreferrer noopener">Node-RED Library collection</a>. For Elyra, they are available in the AI4Compose <a href="https://github.com/ai4os/ai4-compose/tree/main/elyra" target="_blank" rel="noreferrer noopener">Github repository</a>. Thus, AI4Compose lowers the barrier to deploying multi-stage AI pipelines for a wide scientific community.</p>



<h2 class="wp-block-heading" id="h-beyond-serverless-other-flexible-deployment-options">Beyond Serverless: Other Flexible Deployment Options</h2>



<p>Due to the wide variety of disciplines developing and using AI models, not every use case fits in the serverless model. Some require access to specific computing resources, like GPUs, or use case owners need to control the whole computing environment where their models are being executed. That’s why AI4EOSC platform also offers more traditional deployment options:</p>



<ul class="wp-block-list">
<li>The Federated Nomad Cluster that supports mainly training, can be also used to support deploying models for inference. The cluster is distributed across 5 data centres across 4 countries. The main advantage is access to GPU-equipped nodes (also supported by OSCAR, but the deployments for the projects did not have this kind of nodes), and it is also a good option for low-latency inference, although it comes at the cost of constant resource use.</li>



<li>The Infrastructure Manager is also integrated into the platform, and it allows full control over deployment, because users can deploy AI models directly onto cloud-based virtual machines (VM), choosing the VM characteristics, its location, and configuration. This option is slower to launch (the VM needs to be created and properly configured), but offers maximum flexibility.</li>
</ul>



<p>Finally, models in the AI4EOSC Catalogue can also be deployed directly on the <a href="https://open-science-cloud.ec.europa.eu/" target="_blank" rel="noreferrer noopener">EOSC EU Node</a>, making it easier to integrate with broader European Open Science Cloud services and resources. More info <a href="https://docs.ai4os.eu/en/latest/howtos/deploy/eosc-node.html" target="_blank" rel="noreferrer noopener">here</a>.</p>



<p><a href="https://docs.ai4eosc.eu/en/latest/howtos/deploy/overview.html" target="_blank" rel="noreferrer noopener">All these options</a> provide researchers with a full spectrum of options depending on their workload and goals.</p>



<h2 class="wp-block-heading" id="h-final-considerations-for-efficient-ai-model-execution">Final considerations for efficient AI Model Execution</h2>



<p>As AI continues to move from the lab to real-world applications, flexible and efficient inference solutions will be one of the keys. Thanks to AI4EOSC and iMagine, we now have a flexible, open toolbox that offers exactly that. Whether you need event-driven predictions, GPU-powered inference, batch processing of legacy datasets, or an easy-to-use visual interface, there’s a solution ready to go.</p>



<p>The bottom line? You don’t need to be an infrastructure expert to put your AI models to work. The AI4EOSC platform, together with the AI4OS software stack, is offering researchers a powerful toolbox for bringing their AI models into production across multiple clouds, platforms, and environments.</p>



<p><strong>The future of AI isn’t just about smarter models. It’s about smarter deployments.</strong></p>


Contributions From EGI2025 

<p><a href="https://www.egi.eu/terms-of-use/">terms of use</a>  |  <a href="https://www.egi.eu/privacy-notice/">data protection</a> | <a href="https://www.egi.eu/egi-foundation/certifications">certifications </a><u></u></p>
