Once you decide to build container infrastructure, one of the first questions is: plain Kubernetes or Red Hat OpenShift? Both are built on the same foundation, but their philosophy, cost and day-to-day experience are quite different. In this post we compare Kubernetes vs OpenShift in terms of architecture, security, developer experience, resource needs and cost, and explain in plain words which one to pick in which situation.
What Is Kubernetes? (Briefly)
Kubernetes is an open-source orchestration platform that runs containers across multiple servers, scales them and brings them back up on its own when they fail. It started at Google, is developed under the CNCF today and is completely free. But Kubernetes is a "core": you pick and install pieces like ingress, monitoring, log collection, an image registry and CI/CD yourself. If you're curious about the basics, check out our what is Kubernetes post.
What Is OpenShift?
OpenShift is Red Hat's enterprise container platform built on Kubernetes. So OpenShift isn't an alternative to Kubernetes; it's a packaged, supported distribution built on top of Kubernetes. What comes included:
- Red Hat Enterprise Linux CoreOS (RHCOS) as the OS and the CRI-O container runtime
- The OVN-Kubernetes network plugin and Route objects for exposing apps
- A built-in image registry, web console, monitoring and logging stack
- OperatorHub for installing and updating software through operators
- CI/CD components like Pipelines (Tekton) and GitOps (Argo CD)
At the time of writing the current release is OpenShift 4.22, based on Kubernetes 1.35. The free, community-developed version is called OKD; technically very similar, but without Red Hat support.
Kubernetes vs OpenShift: Overview
| Criteria | Kubernetes | OpenShift |
|---|---|---|
| License | Open source, free | Commercial subscription (OKD is free) |
| Installation | Many ways: kubeadm, k3s, RKE2 and more | Its own installer, stricter and standardized |
| Operating system | Almost any Linux distro | RHCOS required for the control plane |
| Web UI | Dashboard installed separately | Advanced web console included |
| Exposing apps | Ingress / Gateway API (controller installed separately) | Routes included, Ingress also supported |
| Image registry | None, installed separately | Built-in registry |
| CI/CD | You pick and install it | Pipelines and GitOps operators ready |
| Default security | More flexible, it's up to you | Stricter (SCC, no root) |
| Upgrades | Manual or tool-driven, version by version | One click from the console, OS included |
| Support | Community or third party | Red Hat enterprise support |
Security: The Difference You Feel Most
The first thing teams moving to OpenShift usually hit is this: an image pulled from Docker Hub runs fine on Kubernetes but keeps failing with "permission denied" on OpenShift. The reason is OpenShift's Security Context Constraints (SCC). With the default restricted-v2 constraint, containers can't run as root, they run with a randomly assigned user ID per project and privileged capabilities are off.
On Kubernetes, similar controls are done with Pod Security Admission, but they aren't enforced by default; you turn them on by labeling namespaces:
# OpenShift: list the defined security constraints
oc get scc
oc adm policy who-can use scc restricted-v2
# Kubernetes: apply a similar restriction to a namespace with Pod Security Admission
kubectl label namespace demo pod-security.kubernetes.io/enforce=restrictednginx-unprivileged instead of nginx), they'll run fine on both Kubernetes and OpenShift and you'll be in a better spot security-wise too.Developer Experience: kubectl and oc
OpenShift's command-line tool oc supports all kubectl commands and adds shortcuts on top. Deploying the same app on both sides looks like this:
# OpenShift (oc)
oc new-project demo
oc new-app --image=nginxinc/nginx-unprivileged --name=web
oc expose service/web # creates a Route for external access
oc get route web
# Kubernetes (kubectl)
kubectl create namespace demo
kubectl create deployment web --image=nginxinc/nginx-unprivileged -n demo
kubectl expose deployment web --port=8080 -n demo
kubectl create ingress web --rule="web.example.com/*=web:8080" -n demo # needs an Ingress Controller installedOn OpenShift, oc new-app sets up the deployment and service, and oc expose sets up the hostname in one go. On Kubernetes the same result takes a few steps and a pre-installed Ingress Controller. If you're new to kubectl, we collected the most used commands in our how kubectl works post.
On top of that, OpenShift's web console has a seperate view for developers: creating an app from a Git repo, following logs or opening a terminal into a pod can be done without writing YAML. On Kubernetes, extra tools like Lens or Headlamp are used for this.
Resource Requirements
| Setup type | Minimum resources | Note |
|---|---|---|
| Single-node Kubernetes (k3s, kubeadm) | 2 cores, 2–4 GB RAM | Enough for small projects and testing |
| Multi-node Kubernetes | 1+ control plane (2 cores / 2 GB+), workers as needed | 3 control planes for high availability |
| Single Node OpenShift (SNO) | 8 vCPU, 16 GB RAM, 120 GB disk | Platform services use a big chunk of the resources |
| Standard OpenShift cluster | 3 control planes + at least 2 workers | Each control plane needs serious resources too |
The takeaway is clear: since OpenShift ships with alot out of the box, it uses far more resources than Kubernetes even when idle. On a small project you feel that difference directly in the monthly bill.
Cost
Kubernetes is free as software; what you pay for is servers and the effort spent on installing, upgrading and monitoring it. With OpenShift you pay an annual subscription on top of that. Licensing is usually based on 2-core (or 4 vCPU) units and only worker nodes that run applications are counted. Red Hat doesn't publish self-managed OpenShift prices openly; the price depends on the edition (Kubernetes Engine, Container Platform, Platform Plus), support level and the deal, so we recommend not relying on numbers you see online before getting a quote. Managed cloud options (ROSA on AWS, Azure Red Hat OpenShift, OpenShift Dedicated) are billed hourly and by usage.
| Cost item | Kubernetes | OpenShift |
|---|---|---|
| Software license | None | Core-based annual subscription |
| Infrastructure | Low (you can start small) | High (higher minimum requirements) |
| Setup and integration effort | High (you pick the pieces) | Low (everything comes ready) |
| Day-to-day operations | Medium–high, depends on the team | Medium, automatic upgrades make it easier |
| Support | Community or paid consulting | Included in the subscription |
In short, in large organizations OpenShift's license cost can pay for itself by saving engineering time on setup and integration. In small teams that equation usually favors Kubernetes.
Which One When?
| Situation | Our pick | Why? |
|---|---|---|
| Startup, small team, limited budget | Kubernetes | Free, starts with few resources, flexible |
| Learning, testing, personal projects | Kubernetes (k3s or a ready cluster) | Quick to set up, runs on a cheap server |
| Regulated industries like banking or healthcare | OpenShift | Strict default security, certifications, enterprise support |
| Organizations already on Red Hat (RHEL, Ansible) | OpenShift | Same ecosystem and support agreement |
| Many dev teams, self-service platform | OpenShift | Ready console, project isolation, CI/CD |
| Hybrid or multi-cloud, freedom of tooling | Kubernetes | Managed versions on every cloud, no lock-in |
Moving from Kubernetes to OpenShift (or Back)
Good news: since OpenShift is a certified Kubernetes, standard manifests like Deployment, Service and ConfigMap and most Helm charts work on both. Things to watch out for:
- Images running as root: they get blocked by SCC on OpenShift; fix the image or grant a suitable SCC to the service account.
- Route and ImageStream: OpenShift-specific objects. When going back to Kubernetes, use Ingress instead of Route and a direct image reference instead of ImageStream.
- Fixed UID expectations: apps that set file permissions for a specific user ID can have issues with OpenShift's random UID.
If you want to stay portable, writing with standard Kubernetes objects (Ingress, Deployment) is the safest way.
Kubernetes and OpenShift with VECDC
If you want a Kubernetes environment quickly, our Kubernetes Server plans start at $6/month (K8S-1: 2 Core, 8 GB RAM, 40 GB NVMe) and are ready with your kubeconfig in about 5 minutes with automated setup; you can choose the location when ordering. If you'd like to learn to build the cluster yourself, our how to install a Kubernetes server post walks through it step by step.
If you want to try OKD or OpenShift you'll need at least 8 vCPU and 16 GB RAM; VPS-5 with 8 Core and 32 GB RAM works for that, or for bigger setups our dedicated servers delivered within 24 hours. If you need help with architecture, installation or migration, our Kubernetes consulting service can help.
Frequently Asked Questions
Is OpenShift free?
Red Hat OpenShift is a commercial subscription licensed annually per core. Free options include the community version OKD, OpenShift Local that runs on your own computer and the time-limited Developer Sandbox; these don't come with Red Hat enterprise support.
Is OpenShift a Kubernetes?
Yes. OpenShift is a certified Kubernetes distribution; it adds an OS, networking, an image registry, a web console, CI/CD and stricter security settings on top of Kubernetes. Standard Kubernetes manifests work on OpenShift too.
Does kubectl work on OpenShift?
Yes. OpenShift's oc tool supports all kubectl commands, and you can also use kubectl directly against an OpenShift cluster. On top of that, oc adds OpenShift-specific shortcuts like new-project, new-app and expose.
Kubernetes or OpenShift for a small project?
For small projects Kubernetes usually makes more sense: there's no license fee and it can start with 2 cores and a few GB of RAM. OpenShift needs at least 8 vCPU and 16 GB RAM even as a single node and shows its real advantages in large, regulated environments.
In Short
Kubernetes is a free, flexible and lightweight core; OpenShift is a paid platform that adds security, a UI, a registry, CI/CD and enterprise support on top of that core. For small teams, startups and people who want to learn, Kubernetes usually makes more sense; in regulated industries and large organizations with many teams, everything OpenShift ships with can justify its license cost. If you can't decide, drop us a message and lets look at your needs together.