What is OpenShift?

OpenShift is an ap­pli­ca­tion platform based on Ku­ber­netes. The software is used to build dis­trib­uted, scaling ap­pli­ca­tion and de­vel­op­ment en­vi­ron­ments. Based on OpenShift, pro­pri­etary Platform-as-a-Service (PaaS), Software-as-a-Service (SaaS), and Con­tain­ers-as-a-Service (CaaS) solutions can be im­ple­ment­ed.

The software allows complete man­age­ment of the ap­pli­ca­tion lifecycle, including de­vel­op­ment, rollout, op­er­a­tions, and main­te­nance. More than two thousand en­ter­pris­es worldwide rely on OpenShift to host their ap­pli­ca­tions in hybrid cloud en­vi­ron­ments. We will explain how OpenShift works and what makes the software special.

OpenShift is not just one single product. Rather, the Red Hat company releases several versions as open source software under the Apache license. The “flagship” version is the “Red Hat OpenShift Container Platform” (OCP). This is installed as a Ku­ber­netes cluster on a company’s hybrid cloud in­fra­struc­ture. A single OpenShift cluster can therefore span multiple public and private cloud en­vi­ron­ments.

In addition to the OpenShift Container Platform (OCP), there is the community version “OKD”, which formerly held the name “OpenShift Origin”. OKD is a cus­tomized Ku­ber­netes dis­tri­b­u­tion that relies on Ku­ber­netes for cluster man­age­ment and Open Container Ini­tia­tive (OCI)-compliant con­tain­ers. It also includes ap­pli­ca­tion lifecycle man­age­ment ca­pa­bil­i­ties and DevOps tools. In­ter­est­ing­ly, OKD is the “upstream” foun­da­tion for the de­vel­op­ment of the other OpenShift versions – similar to how the open source Chromium project serves as the foun­da­tion for de­vel­op­ment of the Chrome browser.

In addition to OCP and OKD as “on-premises” solutions, which are hosted on their own in­fra­struc­ture, there are a number of “managed” solutions as well. These run on various public clouds from large providers, as well as on Red Hat’s cloud in­fra­struc­ture. We are primarily dis­cussing the OCP version 4.8, which is the current version at the time of writing. Let’s take an overview look at the various OpenShift versions:

OpenShift is a suite of ap­pli­ca­tion platforms based on Ku­ber­netes. The software includes a handful of core com­po­nents, as well as a variety of ad­di­tion­al func­tion­al­i­ties. OpenShift can be hosted in a wide variety of en­vi­ron­ments, including “bare metal” machines, public and private clouds, and “edge” devices.

OpenShift is based on a software stack, which is a stack of in­ter­con­nect­ed tech­nolo­gies. At the lowest level, a special Linux dis­tri­b­u­tion is used as the operating system. The “Red Hat En­ter­prise Linux CoreOS” (RHCOS) used here is installed on physical or vir­tu­al­ized hardware.

Building on the RHCOS operating system, Ku­ber­netes is used as a container and cluster or­ches­tra­tor. Ku­ber­netes handles de­ploy­ment, scaling and man­age­ment of con­tainer­ized ap­pli­ca­tions. Ku­ber­netes operators are used as the next layer in the software stack. These are pre-built, easy-to-install “Ku­ber­netes-native” ap­pli­ca­tions. In addition to operators, a container registry is used when setting up and running an OpenShift cluster.

OpenShift relies on a special Ku­ber­netes dis­tri­b­u­tion, which uses CRI-O instead of Docker or con­tain­erd as the container runtime. By breaking away from Docker as the un­der­ly­ing tech­nol­o­gy, there are ad­van­tages in terms of security and com­pat­i­bil­i­ty with other container formats.

A Ku­ber­netes operator oversees the health of an entire ap­pli­ca­tion. With in­stal­la­tion, operation, and main­te­nance, operators cover the complete lifecycle of a Ku­ber­netes ap­pli­ca­tion. In the words of the OpenShift doc­u­men­ta­tion:

There is a wide range of operators on the Op­er­a­torHub platform. For example, various database systems can be seam­less­ly in­te­grat­ed into the OpenShift cluster with minimal effort. Fur­ther­more, in­fra­struc­ture operators are used to manage the cluster.

As it turns out, operators are essential to OpenShift’s func­tion­al­i­ty. A Ku­ber­netes operator is a spe­cial­iza­tion of the ap­pli­ca­tion-level Ku­ber­netes con­troller. A Ku­ber­netes con­troller con­tin­u­ous­ly monitors the state of a resource and adjusts various pa­ra­me­ters as needed to maintain a defined state.

A container registry contains container images that are con­tin­u­ous­ly created as software is built. The images are versioned, subjected to security checks, and stored in the registry. In­ter­est­ing­ly, within OpenShift the registry itself is im­ple­ment­ed as an operator.

“Quay” is a registry developed by Red Hat with a focus on security. The images required during the in­stal­la­tion of the OpenShift cluster are obtained from Quay. In doing so, Quay can manage other build artifacts in addition to the container images. In the words of the Red Hat doc­u­men­ta­tion:

Following the tiered product model of OpenShift OCP and OKD, multiple versions of Quay exist:

OpenShift is built on top of Ku­ber­netes as a cluster of con­tain­ers. At the cluster level, OpenShift includes two tiers:

1. Control Plane

The control plane is composed of so-called “control plane machines”. These are also known as “Master Machines” and manage the OpenShift Container Platform cluster.

1. Worker Machines

The worker machines, which are also known as “compute machines”, perform the actual work of the OpenShift cluster. Master machines assign tasks to the worker machines and monitor their execution.

A working machine runs the following services and is thus included in the OpenShift cluster:

• CRI-O, as a container runtime en­vi­ron­ment,
• Kubelet, as a service that accepts and processes requests to start and stop workloads,
• a service proxy, which handles com­mu­ni­ca­tion between work machines.

The further spe­cial­iza­tion of the working machines results from the state of the running con­tain­ers and the software they contain.

Let’s take a detailed look at the structure of the control plane below. We dis­tin­guish between com­po­nents of the Ku­ber­netes im­ple­men­ta­tion and the OpenShift-specific com­po­nents:

The OpenShift-specific control plane com­po­nents are im­ple­ment­ed as operators:

The OpenShift Container Platform is primarily used to build ap­pli­ca­tion and de­vel­op­ment en­vi­ron­ments. This allows company-pro­pri­etary PaaS, SaaS, and CaaS solutions to be im­ple­ment­ed. Due to the power and com­plex­i­ty of the software, OpenShift is primarily used for long-lived projects of large or­ga­ni­za­tions.

OpenShift users include gov­ern­ment and research in­sti­tu­tions on a national level, as well as in­ter­na­tion­al­ly active companies such as banks and insurance companies. The afore­men­tioned user groups all benefit from hybrid cloud de­ploy­ments. De­ploy­ment across private and public cloud bound­aries allows parts of the in­fra­struc­ture to be hosted according to local com­pli­ance re­quire­ments.

Another important aspect that speaks for the use of OpenShift is its high level of security. Pre­vent­ing cyber in­tru­sions and data leaks is essential for large, in­ter­na­tion­al companies. Security breaches can result in lasting damage to the company’s image and sub­stan­tial financial penalties.

The func­tion­al­i­ties included in OpenShift allow fast de­vel­op­ment workflows. This leads to radically reduced de­vel­op­ment times in the field; in-house software teams can com­fort­ably manage their resources them­selves and con­tin­u­ous­ly drive de­vel­op­ment forward.

If a company uses one of the available Managed OpenShift offerings, it elim­i­nates the need for ad­min­is­tra­tion of servers and operating systems. Instead of worrying about updates and backups, the company can focus on the es­sen­tials: In­no­vat­ing and creating value for customers.

Certainly, OpenShift is not suited for small busi­ness­es or in­di­vid­ual de­vel­op­ers. To meet their needs, it’s better to reach for one of the available OpenShift al­ter­na­tives or Ku­ber­netes al­ter­na­tives.

A major advantage of OpenShift over “bare” Ku­ber­netes are the out-of-the-box con­ve­nience features. These go beyond the mere cluster man­age­ment of Ku­ber­netes. Among other things, OpenShift includes func­tion­al­i­ties for:

• Software-defined net­work­ing (SDN)
• Routing
• Au­then­ti­ca­tion
• Mon­i­tor­ing and logging

To manage the platform, OpenShift includes a powerful web interface in addition to the oblig­a­tory command line tools. De­vel­op­ment and DevOps workflows are ac­cel­er­at­ed by using “Red Hat OpenShift Pipelines”. The open source Tekton framework for “Con­tin­u­ous in­te­gra­tion” / “Con­tin­u­ous de­vel­op­ment” (CI/CD) is used. In addition to con­tainer­ized ap­pli­ca­tions, modern “server­less” ap­proach­es based on “Server­less Ku­ber­netes” (Knative) can be used.

Another focus of OpenShift is on the provision of dis­trib­uted mi­croser­vice ar­chi­tec­tures. Also known as “Red Hat Service Mesh,” this ap­pli­ca­tion pattern is based on the “Istio” open source project. To deal with the com­plex­i­ty as­so­ci­at­ed with mi­croser­vice ar­chi­tec­tures, OpenShift includes a number of other tools: “Prometheus” is used to manage mon­i­tor­ing and no­ti­fi­ca­tions, whereas “Jaeger” allows tracking of trans­ac­tions. “Kiali” is used to visualize the service mesh.

One of the biggest ad­van­tages of using OpenShift is being able to run the software in a hybrid cloud en­vi­ron­ment. Here, a single OpenShift cluster spans the bound­aries of multiple private and public clouds. OpenShift clusters that use Red Hat En­ter­prise Linux CoreOS (RHCOS) as their sole operating system benefit from automated processes when updating and upgrading.

The in­te­grat­ed Red Hat tech­nol­o­gy and man­age­ment tools and processes built into the platform result in a high user ex­pe­ri­ence. The open source de­vel­op­ment model and built-in DevOps func­tion­al­i­ties allow rapid de­vel­op­ment processes. The increased use of operators as a universal ap­pli­ca­tion format con­tributes to stan­dard­iza­tion and sim­pli­fies pre­vi­ous­ly complex cus­tomiza­tions.

The use of CRI-O as a container runtime instead of Docker leads to increased security of the platform. The user-friendly web interface is con­sid­ered more powerful and clearer than the com­pa­ra­ble Ku­ber­netes dashboard. OpenShift also excels on the command line with the oc command, which makes the platform easier to use.

Of course, the afore­men­tioned special features of OpenShift also cause some dis­ad­van­tages. For one, die-hard Ku­ber­netes users miss the powerful Helm charts, which describe the in­fra­struc­ture setup. Fur­ther­more, not all Docker Hub con­tain­ers can be used under OpenShift due to the strict security settings. The focus on Red Hat’s own Linux dis­tri­b­u­tion Red Hat En­ter­prise Linux CoreOS (RHCOS) also has a limiting effect; Ku­ber­netes is more flexible in this regard.

OpenShift can be run on just about any level of compute in­fra­struc­ture, from “bare metal” machines in your own data center, to vir­tu­al­ized hardware in private and public cloud en­vi­ron­ments, to edge devices. We dis­tin­guish between “managed” solutions, where the man­age­ment of the OpenShift platform is handled by the vendor, and customer-ad­min­is­tered “self-managed” in­stal­la­tions: