What is OpenShift?

OpenShift is an application platform based on Kubernetes. The software is used to build distributed, scaling application and development environments. Based on OpenShift, proprietary Platform-as-a-Service (PaaS), Software-as-a-Service (SaaS), and Containers-as-a-Service (CaaS) solutions can be implemented.

The software allows complete management of the application lifecycle, including development, rollout, operations, and maintenance. More than two thousand enterprises worldwide rely on OpenShift to host their applications in hybrid cloud environments. We will explain how OpenShift works and what makes the software special.

OpenShift is not just one single product. Rather, the Red Hat company releases several versions as open source software under the Apache license. The ‘flagship’ version is the ‘Red Hat OpenShift Container Platform’ (OCP). This is installed as a Kubernetes cluster on a company’s hybrid cloud infrastructure. A single OpenShift cluster can therefore span multiple public and private cloud environments.

In addition to the OpenShift Container Platform (OCP), there is the community version ‘OKD’, which formerly held the name ‘OpenShift Origin’. OKD is a customised Kubernetes distribution that relies on Kubernetes for cluster management and Open Container Initiative (OCI)-compliant containers. It also includes application lifecycle management capabilities and DevOps tools. Interestingly, OKD is the ‘upstream’ foundation for the development of the other OpenShift versions – similar to how the open source Chromium project serves as the foundation for development of the Chrome browser.

In addition to OCP and OKD as ‘on-premises’ solutions, which are hosted on their own infrastructure, there are a number of ‘managed’ solutions as well. These run on various public clouds from large providers, as well as on Red Hat’s cloud infrastructure. We are primarily discussing the OCP version 4.8, which is the current version at the time of writing. Let’s take an overview look at the various OpenShift versions:

OpenShift is a suite of application platforms based on Kubernetes. The software includes a handful of core components, as well as a variety of additional functionalities. OpenShift can be hosted in a wide variety of environments; including ‘bare metal’ machines, public and private clouds, and ‘edge’ devices.

OpenShift is based on a software stack, which is a stack of interconnected technologies. At the lowest level, a special Linux distribution is used as the operating system. The ‘Red Hat Enterprise Linux CoreOS’ (RHCOS) used here is installed on physical or virtualised hardware.

Building on the RHCOS operating system, Kubernetes is used as a container and cluster orchestrator. Kubernetes handles deployment, scaling and management of containerised applications. Kubernetes operators are used as the next layer in the software stack. These are pre-built, easy-to-install ‘Kubernetes-native’ applications. In addition to operators, a container registry is used when setting up and running an OpenShift cluster.

OpenShift relies on a special Kubernetes distribution, which uses CRI-O instead of Docker or containerd as the container runtime. By breaking away from Docker as the underlying technology, there are advantages in terms of security and compatibility with other container formats.

A Kubernetes operator oversees the health of an entire application. With installation, operation, and maintenance, operators cover the complete lifecycle of a Kubernetes application. In the words of the OpenShift documentation:

There is a wide range of operators on the OperatorHub platform. For example, various database systems can be seamlessly integrated into the OpenShift cluster with minimal effort. Furthermore, infrastructure operators are used to manage the cluster.

As it turns out, operators are essential to OpenShift’s functionality. A Kubernetes operator is a specialisation of the application-level Kubernetes controller. A Kubernetes controller continuously monitors the state of a resource and adjusts various parameters as needed to maintain a defined state.

A container registry contains container images that are continuously created as software is built. The images are versioned, subjected to security checks, and stored in the registry. Interestingly, within OpenShift the registry itself is implemented as an operator.

‘Quay’ is a registry developed by Red Hat with a focus on security. The images required during the installation of the OpenShift cluster are obtained from Quay. In doing so, Quay can manage other build artifacts in addition to the container images. In the words of the Red Hat documentation:

Following the tiered product model of OpenShift OCP and OKD, multiple versions of Quay exist:

OpenShift is built on top of Kubernetes as a cluster of containers. At the cluster level, OpenShift includes two tiers:

1. Control Plane

The control plane is composed of so-called ‘control plane machines’. These are also known as ‘Master Machines’ and manage the OpenShift Container Platform cluster.

1. Worker Machines

The worker machines, which are also known as ‘compute machines’, perform the actual work of the OpenShift cluster. Master machines assign tasks to the worker machines and monitor their execution.

A working machine runs the following services and is thus included in the OpenShift cluster:

• CRI-O, as a container runtime environment,
• Kubelet, as a service that accepts and processes requests to start and stop workloads,
• a service proxy, which handles communication between work machines.

The further specialisation of the working machines results from the state of the running containers and the software they contain.

Let’s take a detailed look at the structure of the control plane below. We distinguish between components of the Kubernetes implementation and the OpenShift-specific components:

The OpenShift-specific control plane components are implemented as operators:

The OpenShift Container Platform is primarily used to build application and development environments. This allows company-proprietary PaaS, SaaS, and CaaS solutions to be implemented. Due to the power and complexity of the software, OpenShift is primarily used for long-lived projects of large organisations.

OpenShift users include government and research institutions on a national level, as well as internationally active companies such as banks and insurance companies. The aforementioned user groups all benefit from hybrid cloud deployments. Deployment across private and public cloud boundaries allows parts of the infrastructure to be hosted according to local compliance requirements.

Another important aspect that speaks for the use of OpenShift is its high level of security. Preventing cyber intrusions and data leaks is essential for large, international companies. Security breaches can result in lasting damage to the company’s image and substantial financial penalties.

The functionalities included in OpenShift allow fast development workflows. This leads to radically reduced development times in the field; in-house software teams can comfortably manage their resources themselves and continuously drive development forward.

If a company uses one of the available Managed OpenShift offerings, it eliminates the need for administration of servers and operating systems. Instead of worrying about updates and backups, the company can focus on the essentials: Innovating and creating value for customers.

Certainly, OpenShift is not suited for small businesses or individual developers. To meet their needs, it’s better to reach for one of the available OpenShift alternatives or Kubernetes alternatives.

A major advantage of OpenShift over ‘bare’ Kubernetes are the out-of-the-box convenience features. These go beyond the mere cluster management of Kubernetes. Among other things, OpenShift includes functionalities for:

• Software-defined networking (SDN)
• Routing
• Authentication
• Monitoring and logging

To manage the platform, OpenShift includes a powerful web interface in addition to the obligatory command line tools. Development and DevOps workflows are accelerated by using ‘Red Hat OpenShift Pipelines’. The open source Tekton framework for ‘Continuous integration’ / ‘Continuous development’ (CI/CD) is used. In addition to containerised applications, modern ‘serverless’ approaches based on ‘Serverless Kubernetes’ (Knative) can be used.

Another focus of OpenShift is on the provision of distributed microservice architectures. Also known as ‘Red Hat Service Mesh’, this application pattern is based on the ‘Istio’ open source project. To deal with the complexity associated with microservice architectures, OpenShift includes a number of other tools: ‘Prometheus’ is used to manage monitoring and notifications, whereas ‘Jaeger’ allows tracking of transactions. ‘Kiali’ is used to visualise the service mesh.

One of the biggest advantages of using OpenShift is being able to run the software in a hybrid cloud environment. Here, a single OpenShift cluster spans the boundaries of multiple private and public clouds. OpenShift clusters that use Red Hat Enterprise Linux CoreOS (RHCOS) as their sole operating system benefit from automated processes when updating and upgrading.

The integrated Red Hat technology and management tools and processes built into the platform result in a high user experience. The open source development model and built-in DevOps functionalities allow rapid development processes. The increased use of operators as a universal application format contributes to standardisation and simplifies previously complex customisations.

The use of CRI-O as a container runtime instead of Docker leads to increased security of the platform. The user-friendly web interface is considered more powerful and clearer than the comparable Kubernetes dashboard. OpenShift also excels on the command line with the oc command, which makes the platform easier to use.

Of course, the aforementioned special features of OpenShift also cause some disadvantages. For one, die-hard Kubernetes users miss the powerful Helm charts, which describe the infrastructure setup. Furthermore, not all Docker Hub containers can be used under OpenShift due to the strict security settings. The focus on Red Hat’s own Linux distribution Red Hat Enterprise Linux CoreOS (RHCOS) also has a limiting effect; Kubernetes is more flexible in this regard.

OpenShift can be run on just about any level of compute infrastructure, from ‘bare metal’ machines in your own data centre, to virtualised hardware in private and public cloud environments, to edge devices. We distinguish between ‘managed’ solutions, where the management of the OpenShift platform is handled by the vendor, and customer-administered ‘self-managed’ installations: