Red Hat OpenShift: The Complete Enterprise Hybrid Cloud Architecture

Red Hat OpenShift offers a full-fledged PaaS solution that has enterprise features. While regular Kubernetes already has essential scheduling, self-healing, and scaling features, making it ready for use requires the integration of a variety of separate components that include ingress controllers, registries, CI/CD systems, monitoring, and security models. OpenShift makes it easier by having all those features built-in into one ecosystem.

The main operating system used in OpenShift is Red Hat Enterprise Linux CoreOS (RHCOS).

The RHCOS is an immutable and container-optimized operating system which is intended to prevent configuration drifts and ensure greater stability of the clusters. All updates of the operating system happen in an atomic manner which means smooth upgrades and rollbacks. For its execution layer, OpenShift uses CRI-O which is a small container runtime interface that was developed especially for Kubernetes.

The Operator Framework is a key part of OpenShift Architecture. Operators codify operational human domain expertise into software-based controllers which monitor, maintain and self-heal platform components and applications. Controlled by the Operator Lifecycle Manager (OLM), these controllers enable automation of day two activities such as patching, scaling and dependency management for the entire cluster.

OpenShift inherently includes security and governance features. Multi-tenancy is enabled by Projects, which is an abstraction layer created on top of Kubernetes namespaces. In order to ensure secure privilege levels, OpenShift implements Security Context Constraints (SCCs). SCCs control the ability of containers to operate as root user by default, user Id assignments are randomized while mandatory access control is implemented through SELinux. Role Based Access Control (RBAC) can be integrated with identity provider systems like Active Directory and LDAP.

OpenShift makes the development process faster by providing automation right out of the box. Source to Image (S2I) provides the ability to compile raw source code directly into OCI-compatible container images without needing any Dockerfile to be written. Continuous Integration and Delivery are available natively with OpenShift Pipelines (based on Tekton) and OpenShift GitOps (based on Argo CD).

The network is provisioned with OVN-Kubernetes SDN overlay, providing flat pod-to-pod connectivity in multi-node environments. The external connectivity can be managed via HAProxy-based Ingress controllers and OpenShift Routes that enable advanced TLS termination options and traffic routing for canary deployments.

Furthermore, OpenShift goes beyond the scope of microservices with converged compute. OpenShift Virtualization based on KubeVirt makes it possible to run legacy virtual machines and containers on the same physical platform sharing networking and storage resources. On the other hand, OpenShift Serverless with Knative provides event-driven computing with scale-to-zero functionality.

Finally, OpenShift has observability and enterprise storage features built-in. A built-in Prometheus and Grafana stack of tools allows monitoring the state of clusters, while OpenShift Data Foundation (ODF) ensures dynamic software-defined block, file, and object storage. Abstraction of infrastructure resources from bare metal to VMware, AWS, Azure, and Google Cloud platforms results in a hybrid cloud environment.

Transition in Architecture; Changing from Kubernetes to Enterprise Model

The OpenShift product is fundamentally structured on top of all the work done within upstream open-source projects such as Kubernetes, providing a single deployment model of the containerized application. Kubernetes provides functions for scheduling container instances, service discovery, HA, and scalability. But to run Kubernetes in a production environment within an enterprise setting, one needs to incorporate a number of additional tools like container repositories, ingress controllers, metrics gathering systems, access control solutions, and software delivery pipelines.

With these capabilities, OpenShift solves the problem of integration by bringing them into the platform itself. Standards are set by the platform with respect to the architecture so as to make it easier to provision clusters and automate processes such as patching, monitoring, and scaling. By offering a standard approach to operating that runs on physical bare metal infrastructure, private virtualization, and major cloud environments, OpenShift eliminates the need for dependency of application architecture on cloud infrastructure providers. With a structured openshift redhat training on OnlineITGuru, learning about day-two operations and enterprise management becomes easy.

Core Operating System and Runtime Environment

The dependability and reliability of an OpenShift cluster derive from the tightly integrated core operating system layer and runtime environment. This is unlike conventional Linux-based systems where the operating system management and configuration processes are separate from those of the orchestration tool.

Red Hat Enterprise Linux CoreOS

OpenShift adopts Red Hat Enterprise Linux CoreOS (RHCOS) as the compulsory operating system on control plane nodes and the recommended one for worker nodes. RHCOS is an immutable operating system optimized to run containerized workloads safely. It has the following properties:

Immutable Root Filesystem: Configuration of the system and operating system binaries are made read-only to avoid any manual changes in configuration and mitigate any potential threats of unauthorized persistent changes.
Atomic Over-the-Air Upgrades: Operating system updates occur in atomic transactional updates which allow either seamless upgrades or rollbacks to a previously successful state.
Ignition-based Bootstrapping: Operating system installations and bootstrapping occur through Ignition utilities at the time of the initial boot-up.

The Container Runtime Interface and CRI-O

CRI-O acts as the default container runtime interface of OpenShift. CRI-O is a small-sized and purpose-built implementation of the Kubernetes Container Runtime Interface which has been developed specifically to run OCI-compliant containers.

Lowering Attack Surface: Since CRI-O replaces a general-purpose container runtime with a minimal engine meant only for Kubernetes workload, the unnecessary daemons and the CLI part have been stripped down.
Compliance with the OCI: Guarantee of native support for standard container images created using Podman, Buildah, or Docker.
Efficient Resource Footprint: Reduces the overhead on each cluster node in terms of memory and CPU, resulting in more pods running per node.

Control Plane Architecture and Operator Framework

The control plane is the component that controls all the work of OpenShift clusters and deals with node positioning, application state, data collection, and security policies. The OpenShift control plane is composed of dedicated master nodes and system components.

Master Nodes and System Components

The master nodes keep track of the state of the cluster and balance its operation. In order to achieve high availability, a production environment is built with a minimum of three master nodes distributed in separate fault domains.

etcd database: The database for storing the full authoritative state of the whole cluster – configurations, applications, secrets, etc.
API server: The gateway for accessing the REST API of Kubernetes/OpenShift, which processes all user requests, as well as those made by tools and agents in the cluster.
Controller manager: Checks the current state of objects in the cluster with respect to their desired state and performs automated actions on discrepancies.
Kube-scheduler: It checks the requirements, affinity, anti-affinity, as well as the whole state of nodes in order to define where the pod should be allocated.

Operator Pattern & Lifecycle Manager

One of the key features of OpenShift is the incorporation of the Operator Framework. An operator is defined as an automation software controller that encapsulates human operational domain expertise as software. It enables complex applications and platform services to self-manage.

Cluster Operators: The capabilities of OpenShift including network, storage, authentication, and ingress are managed individually as operators within the cluster.
Operator Lifecycle Manager (OLM): Internal platform catalogue that manages the installation, updates, dependency management, and roles for third-party/custom business applications.
Automation through Reconciliation: Operators monitor the resources within the system, detect any differences and initiate the process of remediation without human intervention.

Networking Architecture and Ingress Control

In the OpenShift platform, a software-defined network (SDN) overlay is employed to link container instances running on diverse physical hosts, and it offers isolation, traffic management, and access control policies.

OVN-Kubernetes SDN Overlay

The platform employs Open Virtual Network for Kubernetes (OVN-Kubernetes) as the default CNI network solution. The networking solution enforces network policies across the cluster.

Communication between Pods in a Cluster: Allocates a unique non-routable IP address to every pod within the cluster, enabling communication among pods irrespective of the worker node.
Network Policies and Egress Control: Provides an ability to set up firewall policies at the namespace level to control communication among pods as well as access to external databases.
Egress IP Allocation: Enables allocation of a static IP address to particular workloads to allow communication with the legacy corporate applications.

Routes and Ingress Controllers

Whereas plain vanilla Kubernetes has simple Ingress objects that deal with incoming external traffic, in OpenShift there is a Route object, which comes with sophisticated ingress functionality.

HAProxy Ingress Cluster: The high availability HAProxy load balancers that are operated by the Ingress Operator are used by OpenShift to terminate incoming external traffic and proxy it into the internal pod network.
Encryption Modes Available: Multiple modes are available for terminating traffic: Edge termination (where the traffic is decrypted at the router level), Re-encryption (decryption at the router and then re-encrypting towards the pod), and Pass-through (encrypted traffic is directly proxied to the container).
Traffic Shifting Capabilities: Traffic Shifting allows doing canary deployments and A/B testing by dividing incoming users’ traffic evenly between multiple backends.

Security, Multi-Tenancy and Enterprise Governance

The OpenShift architecture follows a security-first model, which is designed to meet stringent compliance standards from finance, health care and government industries. Multi-tenancy isolation is available out of the box.

Security Context Constraints (SCC) and Pod Security

Unlike standard Kubernetes platforms, which traditionally provided root access by default, OpenShift strictly controls execution policies for all applications.

Security Context Constraints (SCC): Specifies operational limitations for pods such as restricting mounting host paths, privilege escalation prevention and prohibiting access to host networking ports.
Randomized Non-Root User Ids: By default, OpenShift provides unique and random user id ranges per project namespace, requiring all application containers to execute as non-root and without access to critical host filesystems.
SELinux: SELinux labeling is applied to each container, providing Linux kernel-level process isolation even when the container escapes from its execution environment.

Multi-Tenancy Using Projects and Role-Based Access Control

The OpenShift platform packages the namespaces in Kubernetes as Projects, which provides multi-tenancy isolation in the enterprise.

Project Isolation: It provides separation of network policies, resource management, access right, and quotas of applications.
Role-Based Access Control (RBAC): The RBAC can easily integrate with business identity systems, such as Active Directory, LDAP, Keycloak, and OAuth.
Its Resource Quotas and Limit Ranges make sure that no application team consumes all of the computing resources, memory, and storage provided by the Kube cluster.

Graduates of openshift certification training with reasonable knowledge of SCCs, role-based access controls, and clusters open the door to career opportunities in the field.

Developer Experience and Application Lifecycles

In order to increase the productivity of developers, OpenShift offers tools that make interfaces developer-friendly, as well as the means to create applications and simple definitions of such applications.

Developer Perspective Console

In addition to offering a cluster administrator perspective, OpenShift provides a developer-oriented graphical web console.

Topology View: Shows visualizations of application components indicating their interdependence, current pod status, ingress routing, and consumption of resources.
One-Click Provisioning: Provides an advanced Service Catalog, which allows developers to provision databases, middleware, and runtime environments quickly based on pre-approved templates or Helm charts.
Telemetry Information: Presents log information, container metrics, and application events within the visual interface itself.

Source-to-Image (S2I) Technology

Source-to-Image is an open source technology that is embedded in OpenShift which helps create containers directly from the application source code.

Automatic Image Generation: The developers will point OpenShift to the source code hosted in Git repository; Source to Image will automatically detect the type of programming language, pull the base enterprise-approved runtime image, compile the source code and create a container image.
Separation of Concerns: The developers need only concentrate on writing business logic without having to write container specifications while the operations team manages the underlying base images.
Built-In Container Repository: The created container images are automatically saved in OpenShift's internal container repository.

Current CI/CD Models: Pipelines and GitOps

OpenShift incorporates the CI/CD capabilities that are executed on Kubernetes.

OpenShift Pipelines (Tekton)

OpenShift provides serverless and cloud-native CI/CD pipeline solutions as a result of the open-source Tekton platform.

Native Kubernetes running: Each step within the pipeline runs isolated in a container whenever it is required, thus removing the need for maintaining build servers.
Declarative Specification: Pipeline specifications get stored as a source code in Git repos the same way as application code does.
It is important to be informed about the entire process of microservices cluster and cluster management, for which one should check out the openshift online course available through OnlineITGuru.

Unified Computing: Serverless and Virtualization

Corporate IT faces the challenge of keeping the balance between legacy IT infrastructure and contemporary cloud microservices. OpenShift means integrated computing options for VM devices as well as containers and serverless applications.

OpenShift Virtualisation (Kubevirt)

This technology enables users to run both traditional virtual machines and container workloads in a single set of Kubernetes cluster nodes.

Unified Infrastructure Management: There’s no requirement for management of diverse environments related to virtualization and container deployments.
Network and Storage Utilization: Conventional virtual machines make use of the same OVN-Kubernetes network and store the persistent disks on the native cluster storage systems, making application refactoring easier.
Live Virtual Machine Migration: Permits live transfer of live virtual machines between the nodes of the cluster with no impact on the applications.

OpenShift Serverless (Knative)

OpenShift Serverless supports an event-driven architecture for applications using the Knative open source platform.

Zero-to-Scale: Automatically scales containers when required to meet demands and scales down to zero during off-times in order to reduce cost associated with cloud infrastructure.
Event-Driven Architecture: Uses Knative Eventing in order to deliver events generated from various sources such as Kafka streams, changes to object storage, or webhooks to the application handlers.
Outsourced Infrastructure Management: Developers can create stateless functions and leave their container deployment and auto-scaling behind them.

Company Storage and Data Services

Enterprise applications such as transactional DBs, analytical apps and AI tasks require strong, dependable and scalable long-term storage that performs very well.

OpenShift Data Foundation (ODF)

OpenShift Data Foundation (formerly known as Red Hat OpenShift Container Storage) is software-defined storage provided natively on the platform using Ceph, Rook, and NooBaa storage architectures.

Unified Storage Endpoints: Offers persistent file (POSIX), block, and object (S3-compliant) storage classes using Kubernetes Persistent Volume Claims (PVC).
Automatic Provisioning: Provides automatic provisioning of persistent volumes based on application demand without any manual interaction by the storage administrators.
Data Resiliency and Encryption: Offers data replication across multiple sites and data-at-rest encryption for protecting enterprise data.

OpenShift Deployment Models and Multi-Cloud Topology

OpenShift provides support for deployment models that allow enterprises to design consistent hybrid cloud topology based on regulatory requirements, architectural considerations, and financial constraints.

Self-Managed OpenShift

The self-managed OpenShift Container Platform is available for deploying on bare-metal hardware, VMware vSphere, Nutanix, and custom clouds.

Total Control of Administration: Offers total control of control plane configurations, system customizations, and network topologies.
Air-Gapped and Disconnected Support: Installation is possible even in the totally disconnected and highly secured environment not connected to the Internet.

Fully Managed Public Cloud Services

To minimize the operational effort, Red Hat collaborates with leading public cloud providers to provide fully managed OpenShift services:

Red Hat OpenShift Service on AWS (ROSA): Jointly managed OpenShift service available through the AWS management console and billing system.
Azure Red Hat OpenShift (ARO): Jointly developed enterprise OpenShift service available in the native form on Microsoft Azure cloud.
Red Hat OpenShift Dedicated: Managed OpenShift cluster offered by Red Hat on AWS or Google Cloud Platform.

Distributed Computing and Edge Computing

In case of special needs for industrial, retail, and telecommunication facilities, OpenShift provides small-scale deployment strategies as follows:

Single Node OpenShift (SNO): Combines both the control plane and worker functionality on a single physical machine.
Remote Worker Nodes: Facilitates the hosting of local workloads on edge sites while being connected to a centralized control plane in a regional data center.

Strategic Value and Enterprise Adoption

Using Red Hat OpenShift is strategically beneficial for enterprise IT because of several key reasons. In particular, OpenShift creates an abstraction layer across public cloud vendors and private data centers and does not create any lock-ins with a specific cloud provider. Enterprises can have 100% application portability and run workloads depending on their performance requirements, regulations or economic reasons.

Also, OpenShift guarantees operational consistency. Platform teams control all aspects of operations including security policies, automatic updates, networking and access controls through standardized declarative tooling. For developers, it means that time-to-market cycles will be collapsed because developers will receive a self-service platform with automated build tools, CI/CD pipelines and observability tools.

Through the convergence of containers, virtual machines, serverless computing, and data services within a unified governance layer, OpenShift facilitates the process of modernizing legacy software while developing cloud-native applications. For individuals interested in acquiring mastery in these topics, enrolling in the openshift full course provided by OnlineITGuru is the best way to go.

WEEKEND SPECIAL - UPTO 60% OFF