A Compliance-Aware Cyber Range Framework: An Ephemeral Dual-Cluster Architecture on OpenStack and Kubernetes

Security-testing platforms that rely on public clouds create tensions with data-protection requirements and digital-sovereignty objectives, yet existing cyber range (CR) architectures rarely address regulatory compliance by design. This paper proposes a reusable, compliance-aware CR method comprising a five-step process—gap analysis, principle selection, regulatory mapping, architectural instantiation, and principle-driven validation—together with five technology-agnostic design principles: sovereignty, ephemeral data minimisation, isolation at the infrastructure boundary, infrastructure-as-code (IaC)-driven reproducibility, and continuous monitoring. The method is instantiated as a vendor-agnostic dual-cluster Kubernetes architecture on on-premise OpenStack infrastructure: a persistent Red cluster hosts the offensive tooling (Kali Linux, OWASP ZAP) and a GitLab CI/CD runner, while an ephemeral Blue cluster hosts the target application together with its security-monitoring stack and is provisioned via Ansible at the start of each audit cycle and destroyed at its conclusion, so that target data does not persist beyond the audit window. A proof-of-concept deployment with a deliberately vulnerable web application (ten seeded flaws) exercises the lifecycle end to end. Isolation holds at the OpenStack Security Group layer; the Kubernetes NetworkPolicies are specified but not enforced by the CNI used in the prototype. A mapping of the framework’s principles to specific articles of the GDPR, Cyber Resilience Act, and NIS2 Directive identifies which obligation each architectural property supports. The mapping is not a determination of compliance.