OpenShift Alternatives: Exit Path, Replacements and Migration

Setting up the Kubernetes platform anew after OpenShift or Rancher? WZ-IT builds and operates the target platform on Proxmox, bare metal or as hosting in Germany. Explore our Kubernetes services

Whoever leaves OpenShift rarely leaves Kubernetes, but a platform layer of operators, Routes, security context constraints, builds and registry. This guide shows how the licence quantity is counted and what published prices yield, what OpenShift brings and what must be replaced on the way out, which alternatives fit which case and what the migration path looks like. It ends in a decision table. Status October 2026.

Table of contents

• OpenShift cost and licence quantity
• What OpenShift brings and what must be replaced
• Alternatives at a glance
• Leaving Rancher
• Migration path: Routes, SCC, BuildConfigs, operators
• Decision table
• VMware alternative as a side topic
• Our approach at WZ-IT
• Status and methodology
• Further guides

OpenShift cost and licence quantity

Whether licence cost, running the platform layer or a location requirement tips the scale determines the alternative. For the cost: for self-managed OpenShift Red Hat names no amount, the pricing page says: "Pricing varies based on your sizing and subscription choices." The quantity can still be counted. According to the subscription guide a core pair is 2 physical cores or 4 vCPUs; for bare-metal servers there is alternatively a node subscription per physical server, regardless of sockets and cores. Subscriptions are needed for the compute nodes; control plane and infrastructure nodes need none as long as no applications run on them. The support SLA is Standard (8x5) or Premium (24x7).

The calculation: core pairs = sum of the vCPUs of all compute nodes divided by 4. Example: 12 workers with 16 vCPUs each are 192 vCPUs and 48 core pairs, the three control plane nodes do not count. Multiplied by the amount from your own quote this gives the annual cost.

OpenShift as a service names prices: Azure Red Hat OpenShift (prices) and Red Hat OpenShift Service on AWS (prices) charge 0.171 USD per hour per 4 worker vCPUs, on ROSA uniform across regions. Infrastructure is added, and on ROSA with hosted control planes 0.25 USD per hour per cluster; contracts of 1 or 3 years reduce the worker fee by 33 to 55 percent according to AWS. Red Hat names reserved instances from 0.076 USD per hour (4 vCPU contract, 3 years). On demand this gives per year:

Calculation: 0.171 USD × 8,760 hours = 1,497.96 USD per 4 vCPUs per year, without infrastructure and discounts, retrieved 28 October 2026. Questions for every quote, including SUSE's for Rancher Prime, whose product page names no price:

• Which nodes count, including control plane and infrastructure nodes?
• Which unit applies, with which conversion?
• Is OpenShift Kubernetes Engine enough instead of Container Platform?
• Which add-on products are in use: Advanced Cluster Management, Advanced Cluster Security, Quay, Data Foundation?
• Term, notice period and price protection on renewal?

What OpenShift brings and what must be replaced

According to the pricing page, OpenShift Kubernetes Engine provides the Kubernetes foundation on Red Hat Enterprise Linux CoreOS. Container Platform adds developer console, serverless, service mesh, pipelines and GitOps. Platform Plus adds Advanced Cluster Management, Advanced Cluster Security, Data Foundation Essentials and Quay. Pipelines and GitOps are portable: pipelines are based on Tekton, GitOps uses Argo CD. The remaining components are OpenShift-specific API objects and platform components:

DeploymentConfigs have been deprecated since OpenShift 4.14, and the documentation recommends Deployments unless a feature only DeploymentConfigs offer is needed. The conversion therefore pays off even if you stay. SCC and Pod Security Admission are two independent mechanisms in OpenShift: workloads must satisfy both.

Alternatives at a glance

Console, integrated registry and builds in the form OpenShift has come only with OpenShift itself and OKD; with the other options these tools are added or dropped. When moving from vendor support to self-operation, upgrades and the response to security vulnerabilities become your own responsibility unless a service provider takes them over. The guide k3s vs. RKE2 vs. Talos explains the choice of distribution.

Leaving Rancher

According to the documentation, Rancher Manager is a tool for deploying and running clusters at any provider, and RKE2 is the associated distribution. Both are under Apache-2.0 (Rancher, RKE2); SUSE sells the subscription as SUSE Rancher Prime. Leaving Rancher therefore does not mean rebuilding the clusters. According to the Rancher documentation, the workloads in managed clusters keep running if Rancher is deleted. Imported clusters stay reachable unchanged; for RKE2 or k3s provisioned by Rancher you need the authorized cluster endpoint and an already downloaded kubeconfig. Hosted clusters of a cloud provider stay reachable through the provider's credentials; the documentation provides no way to detach them from Rancher. Removal also removes Fleet and the Rancher webhook; CRDs and custom namespaces are removed by hand, and another tool has to take over GitOps. Whether operation without vendor support is viable is an operations question, not a licence question.

Migration path: Routes, SCC, BuildConfigs, operators

The order follows the dependencies, not the number of objects. The inventory:

# Count OpenShift-specific objects
for r in routes.route.openshift.io deploymentconfigs.apps.openshift.io \
         buildconfigs.build.openshift.io imagestreams.image.openshift.io \
         subscriptions.operators.coreos.com; do
  printf "%-45s %s\n" "$r" "$(oc get "$r" -A --no-headers 2>/dev/null | wc -l)"
done

# Pods by security context constraint
oc get pods -A -o json | jq -r '.items[] | (.metadata.annotations["openshift.io/scc"] // "none")' | sort | uniq -c | sort -rn

# Routes by TLS termination and by HAProxy annotations
oc get routes -A -o json | jq -r '.items[] | (.spec.tls.termination // "none")' | sort | uniq -c
oc get routes -A -o json | jq -r '.items[] | (.metadata.annotations // {}) | keys[] | select(startswith("haproxy.router.openshift.io"))' | sort | uniq -c | sort -rn

1. Pod security. Pods under anyuid or privileged need an image that runs without root, or a justified namespace profile. Once the workloads run in a test cluster, kubectl label --dry-run=server --overwrite ns <namespace> pod-security.kubernetes.io/enforce=restricted shows which running pods violate the restricted standard (Kubernetes documentation). Done when every namespace runs without violations under its profile.
2. Routes. Sort by TLS mode: edge becomes an HTTPS listener with HTTPRoute, re-encrypt additionally a BackendTLSPolicy (standard channel since Gateway API v1.4.0), passthrough a TLSRoute (since v1.5.0). The HAProxy annotations for timeouts or HSTS have their own counterpart per implementation. The guides Gateway API vs. Ingress and ingress-nginx to the Gateway API describe the switch. Done when every Route has a counterpart with the same TLS mode.
3. DeploymentConfigs, builds, images. DeploymentConfigs become Deployments, GitOps or CI takes over the triggers. BuildConfigs move into the CI pipeline, ImageStream references become tags or digests in a registry outside the cluster. Done when no manifest refers to DeploymentConfig, BuildConfig or ImageStream any more.
4. Operators. For each Subscription there is an upstream chart or operator, installed through GitOps. Operators without an upstream counterpart decide between staying and switching. Done when every Subscription has a counterpart or is dropped on purpose.
5. Parallel run and cutover. Data, parallel run, switch and fallback path follow phases 3 to 6 of the exit guide; the backup guide describes backups with Velero.

Decision table

VMware alternative as a side topic

According to the subscription guide, Red Hat OpenShift Virtualization Engine is a bare metal only offering for VM workloads, without container applications. If you replace VMs and have no container strategy, compare Proxmox with a Kubernetes platform. WZ-IT is a Proxmox Authorized Reseller. Details: VMware alternatives, Kubernetes on Proxmox and Proxmox vs. Kubernetes.

Our approach at WZ-IT

The starting point is the inventory of the OpenShift- or Rancher-specific objects (commands in the migration path section). WZ-IT builds and operates the target platform: Managed Kubernetes on Proxmox, bare metal or as hosting in Germany costs from €590 net per cluster per month including 3 worker nodes, each additional worker node €129.90. With hosting, the cluster base from €129.90 and worker nodes from €64.90 are added. We discuss the rework of OpenShift-specific objects after the inventory. Status October 2026.

Status and methodology

Status: 28 October 2026. Licence rules, editions and prices come from the linked vendor pages and were read on that day. For self-managed OpenShift and for SUSE Rancher Prime the vendors name no prices there, so there is no calculation for them. The annual figures for ROSA and ARO are on demand in USD without infrastructure and discounts. The OpenShift documentation is version 4.22, OKD pages show the current version. The decision table is a rule for a first classification and does not replace the inventory.

Further guides

• k3s vs. RKE2 vs. Talos and Install Talos Linux on Proxmox
• Gateway API vs. Ingress and Migrate from ingress-nginx to the Gateway API
• Leaving EKS, AKS or GKE for OpenShift as a service at the hyperscalers
• Kubernetes backup and Taking over a cluster: audit checklist

Building and operating the new platform is described by our Kubernetes services. For VM workloads, Kubernetes on Proxmox is available; ongoing operations are described by Managed Kubernetes and the service levels.