# OpenShift Competence Center Switzerland

> VSHN is a Red Hat Premier CCSP offering managed OpenShift on public and private cloud. 24/7 operations, 99.99% SLA, fixed monthly fee for Swiss organizations.


Managed OpenShift by VSHN: upgrades, patching, monitoring, and incident response handled for you. Fixed monthly fee, 24/7 operations, SLA up to 99.99%. Red Hat Premier CCSP Partner. On public or private cloud.


## When to use this site

Use this site when the question is about OpenShift Competence Center Switzerland or the service it covers. VSHN is a Red Hat Premier CCSP offering managed OpenShift on public and private cloud. 24/7 operations, 99.99% SLA, fixed monthly fee for Swiss organizations.

Best-fit jobs:

- **OpenShift Expertise from Switzerland**: VSHN is a Red Hat Premier Certified Cloud & Service Provider (CCSP), winner of the Red Hat Partner Award 2025 for Platform Modernization of the Year, and Switzerland's first...
- **Architecture & Implementation**: We design OpenShift architectures tailored to your organization's size, compliance requirements, and infrastructure landscape.
- **Swiss Data Sovereignty & Multi-Cloud**: As HIN's CTO puts it: "No financial compensation could ever make up for leaked medical information." Data sovereignty is more than compliance: it is a strategic choice.
- **Managed Services Inside Your Cluster**: With the VSHN Application Catalog, databases and services like PostgreSQL, MariaDB, Redis, and Keycloak run directly on your OpenShift cluster, so your data never leaves your...
- **Custom Application Operations**: Beyond standard software, VSHN operates your custom applications on OpenShift: deployment automation, monitoring, incident response, and on-call coverage for your own workloads.
- **Open Source Foundation**: OpenShift is built on Kubernetes, the open-source container orchestration platform backed by the Cloud Native Computing Foundation.

How an agent should use this site:

- Read https://www.managed-openshift.ch/llms-full.txt for the full text of every page in one request.
- Request any page with `Accept: text/markdown` to get it without the page furniture, or append `.md` to a page URL.
- To reach a human: submit the form at https://www.managed-openshift.ch/#contact, or email info@vshn.ch, or call +41 44 545 53 00.
- To book a call directly: https://vshn.cal.vs.hn/openshift

Do not use this site for product documentation, incident reports, or account support: these are public marketing pages with no login, no public API, and no customer data.

## Pages

- [Homepage](https://www.managed-openshift.ch/): Managed OpenShift in Switzerland – Red Hat CCSP | VSHN
- [ROSA vs ARO vs Self-Managed vs VSHN Managed OpenShift](https://www.managed-openshift.ch/comparison.md)
- [OpenShift vs Kubernetes – Which Platform Fits You?](https://www.managed-openshift.ch/openshift-vs-kubernetes.md)
- [Partner with VSHN on Managed OpenShift Operations | VSHN](https://www.managed-openshift.ch/partners.md)
- [OpenShift Security Controls: What VSHN Actually Operates](https://www.managed-openshift.ch/security-controls.md)
- [OpenShift Sovereignty: Swiss Managed K8s Platform | VSHN](https://www.managed-openshift.ch/sovereignty.md)
- [What is OpenShift? Enterprise Kubernetes, Explained](https://www.managed-openshift.ch/what-is-openshift.md)

## Features

- **OpenShift Expertise from Switzerland**: VSHN is a Red Hat Premier Certified Cloud & Service Provider (CCSP), winner of the Red Hat Partner Award 2025 for Platform Modernization of the Year, and Switzerland's first Kubernetes Certified Service Provider (KCSP). We have been running managed OpenShift backing APPUiO.ch since January 2016, a decade of production experience. When Health Info Net needed to modernise Swiss healthcare infrastructure, VSHN deployed their OpenShift platform in 36 hours. We offer managed OpenShift on both public and private cloud with 24/7 operations, an SLA up to 99.99%, and a fixed monthly fee.

- **Architecture & Implementation**: We design OpenShift architectures tailored to your organization's size, compliance requirements, and infrastructure landscape. Whether you need OpenShift Container Platform with its full developer tooling or OpenShift Kubernetes Engine for a leaner footprint, VSHN handles the design, deployment, and configuration, from first cluster in 36 hours to full application migration, all for a fixed monthly fee.

- **Swiss Data Sovereignty & Multi-Cloud**: As HIN's CTO puts it: "No financial compensation could ever make up for leaked medical information." Data sovereignty is more than compliance: it is a strategic choice. VSHN deploys OpenShift on Swiss cloud providers such as Cloudscale and Exoscale, where your data stays in Switzerland without hyperscaler dependency. This multi-vendor approach avoids the US CLOUD Act and eliminates single-provider lock-in. VSHN is Swiss-owned with no foreign parent company, and all contracts are governed by Swiss law. We also support Google Cloud and on-premises infrastructure. You control where your data lives and who operates it. Exoscale data centers run on 100% renewable energy and provide CloudAssess automated Life Cycle Assessment data, supporting your CSRD sustainability reporting obligations. Learn more in our [sovereignty assessment](/sovereignty/).

- **Managed Services Inside Your Cluster**: With the VSHN Application Catalog, databases and services like PostgreSQL, MariaDB, Redis, and Keycloak run directly on your OpenShift cluster, so your data never leaves your environment. This is unique to Managed OpenShift: instead of connecting to an external service, your applications talk to managed services on the same cluster, reducing latency and meeting data residency requirements without exception. Available via Servala self-service or VSHN operations.

- **Custom Application Operations**: Beyond standard software, VSHN operates your custom applications on OpenShift: deployment automation, monitoring, incident response, and on-call coverage for your own workloads. Combined with managed platform services from the Application Catalog, this covers the full stack: your code, your databases, and the platform underneath, all operated by one team with 24/7 coverage.

- **Open Source Foundation**: OpenShift is built on Kubernetes, the open-source container orchestration platform backed by the Cloud Native Computing Foundation. No vendor lock-in on the orchestration layer. VSHN actively contributes to the open-source ecosystem and brings a decade of production experience to every engagement.

- **Application Modernisation & Migration**: Modernise at your own pace. Lift-and-shift existing workloads and refactor them into cloud-native applications over time. VSHN handles the migration planning, target environment build-out, and ongoing operations, from legacy estate to fully containerised production.

- **Consulting, Training & Support**: From architecture reviews and proof-of-concept builds to training delivered by specialist partners and ongoing 24/7 operational support – VSHN offers the full spectrum of OpenShift services. We help your team become self-sufficient or provide long-term operational partnership, whichever fits your needs.


## What VSHN offers for OpenShift

- Architecture design and review for OpenShift platforms
- Cluster provisioning on public cloud, enterprise private cloud, or on-premises infrastructure
- VSHN Application Catalog services (databases, caches, identity) running inside your cluster
- 24/7 operations and support with an SLA up to 99.99%
- GitOps setup with Argo CD and Project Syn
- Backup strategy with K8up and encrypted off-site storage
- Custom application operations support for your workloads
- Internal developer platform foundation: offer managed services to your development teams
- Training delivered by specialist partners for platform and development teams

## Trusted by Swiss organizations

- [Finnova](https://www.vshn.ch/en/success-stories/finnova/)
- [acrevis](https://www.vshn.ch/en/success-stories/acrevis/)
- [HRM Systems](https://www.vshn.ch/en/vshn-partner/hrm-systems/)
- [Schweizerisches Bundesarchiv BAR](https://www.vshn.ch/en/success-stories/schweizerisches-bundesarchiv-bar/)
- [HIN](https://www.vshn.ch/en/success-stories/hin-health-info-net/)
- [Taurus](https://www.vshn.ch/en/success-stories/taurus/)

## Testimonials

> With VSHN and Red Hat, we can give healthcare providers and patients a better experience and more resilient services. It was an amazing experience to switch to DevOps and empower our developers with a whole new culture.

> — Mohammad Alavi, CTO, Health Info Net

> We reduced monthly incidents from twelve to zero and improved our SLA from 99% to 100%. We wanted a Red Hat partner as a single point of contact for our Red Hat technology. We had worked with VSHN before and had full trust in them.

> — Sébastien Pasche, VP Engineering, Taurus

> Providing such a scalable OpenShift platform promptly ourselves would have meant substantial pre-investment and time for building a corresponding team. For us, it has proved to be the most effective, efficient and secure way of not establishing this service in-house.

> — Daniel Bernasconi, CTO, Finnova

## Managed OpenShift FAQ

### What OpenShift services does VSHN offer?

VSHN offers fully managed OpenShift operations, consulting, architecture design, implementation, training, and support for Red Hat OpenShift. We take care of the platform operations for a fixed monthly fee with 24/7 operations and an SLA up to 99.99%. Whether you are evaluating OpenShift for the first time or running it in production on Cloudscale, Exoscale, Google Cloud, or your own private cloud and on-premises infrastructure, we bring a decade of production experience to accelerate your project.


### What is Red Hat OpenShift?

[Red Hat OpenShift](/what-is-openshift/) is an enterprise Kubernetes platform that adds developer tooling, built-in CI/CD pipelines, service mesh, serverless capabilities, and an operator ecosystem on top of Kubernetes. It is available as OpenShift Container Platform with the full feature set or as OpenShift Kubernetes Engine for organizations that need a leaner, open-source-focused distribution. VSHN helps you choose the right edition and deploy it on the infrastructure that fits your requirements.


### Why is VSHN the right partner for OpenShift in Switzerland?

VSHN is a Red Hat Premier Certified Cloud & Service Provider (CCSP), winner of the Red Hat Partner Award 2025 for Platform Modernization of the Year, and Switzerland's first Kubernetes Certified Service Provider. We have been running managed OpenShift backing APPUiO.ch since January 2016, a decade of production experience. Health Info Net, which serves over 90% of Swiss healthcare stakeholders, chose VSHN to build its sovereign cloud platform, deployed in 36 hours. We offer managed OpenShift on both public and private cloud with 24/7 operations, an SLA up to 99.99%, and a fixed monthly fee.


### Which cloud providers does VSHN support for OpenShift?

VSHN deploys OpenShift on Swiss cloud providers including Cloudscale and Exoscale, both of which operate data centers exclusively in Switzerland. We also support Google Cloud and private cloud or on-premises environments. Swiss cloud providers are the recommended choice for organizations with data residency or compliance requirements. Your infrastructure preferences are documented in the engagement scope before any work begins.


### Can I run managed databases and services on my OpenShift cluster?

Yes. This is a key differentiator of Managed OpenShift. The VSHN Application Catalog provides managed PostgreSQL, MariaDB, Redis, Keycloak, MinIO, Kafka, and more running directly inside your OpenShift cluster. Your data never leaves your environment, which eliminates external network dependencies and satisfies strict data residency requirements. VSHN operates these services with the same 24/7 coverage as the cluster itself. You can also use custom application operations support for your own software.


### How are backups handled on OpenShift clusters?

VSHN includes K8up, an open-source Kubernetes backup operator, on every OpenShift cluster. K8up is available for automated encrypted backups of application data to off-site storage. Persistent volume backups are the user's responsibility, with K8up available to help. We help you design a backup strategy that covers retention policies, disaster recovery procedures, and compliance requirements. etcd backups protect against cluster-level data corruption and are configured as part of every deployment.


### Does VSHN offer OpenShift training?

Yes. VSHN works with specialist training partners to deliver hands-on OpenShift training for platform engineers and development teams. Training covers OpenShift architecture, cluster operations, GitOps workflows with Argo CD, operator development, security hardening, and day-two operations. Sessions can be delivered on-site in Switzerland or remotely, tailored to your team's experience level and your specific infrastructure.


### Can VSHN migrate our workloads to OpenShift?

Yes. Migrating from vanilla Kubernetes, Docker Swarm, or traditional VM-based deployments to OpenShift is one of our core competencies. We assess your existing workloads, design a migration strategy, build the target OpenShift environment, and execute the migration with minimal downtime. You can modernise at your own pace, from lift-and-shift to full cloud-native refactoring. Contact us to discuss your specific migration requirements.


### How does VSHN handle security and compliance on OpenShift?

OpenShift includes built-in security features such as role-based access control, Security Context Constraints, network policies, and container image scanning. VSHN configures these security controls as part of every cluster deployment and maintains them through automated GitOps pipelines. We implement zero trust architectures with defense-in-depth network microsegmentation: Health Info Net is among the first Swiss companies to adopt this approach. For organizations with DevSecOps requirements, we integrate security into the software delivery pipeline from build to production: automated vulnerability scanning, policy enforcement, and audit logging. Combined with Swiss data residency on Cloudscale or Exoscale, this meets FINMA, GDPR, and ISO 27001 compliance requirements. The [security controls page](/security-controls/) answers a requirement catalog line by line, saying which controls are included, which are a priced add-on, and which four we do not yet answer in public.


### How do I engage VSHN for OpenShift consulting?

To start a Managed OpenShift engagement with VSHN, contact us using the form below. Describe your project: whether it is an architecture review, a proof of concept, a production deployment, or ongoing operations. We provide a written scope and CHF cost estimate within one business day. There is no commitment at the scoping stage. Engagements typically start within one to two weeks of agreement.


### How does Managed OpenShift support CSRD sustainability reporting?

Enterprises with 1000 or more employees must report the environmental impact of their cloud services under CSRD. VSHN runs Managed OpenShift on Exoscale infrastructure powered by 100% renewable energy in Switzerland and Germany. Exoscale provides CloudAssess, an automated Life Cycle Assessment tool, giving your sustainability team the verified environmental impact data CSRD requires.


### Can consulting firms use VSHN-managed OpenShift for client platforms?

Yes. Consulting firms and system integrators use VSHN-managed OpenShift to deliver container platforms for their clients. VSHN operates the cluster, handles upgrades, security patches, and 24/7 monitoring while your team focuses on application architecture and deployment. Each client can run on a dedicated cluster with full isolation, or share a multi-tenant platform with namespace-level separation. Written service agreements and transparent pricing make it easy to structure client engagements.


### We want continuous operational responsibility with as few interfaces as possible. How many parties are involved?

Two at most, and usually one that you deal with. VSHN operates the clusters, carries the SLA and by default procures the compute, storage and network they run on, so an OpenShift platform arrives as a service rather than as an assembly job. Red Hat stands behind the product as its vendor, with VSHN as a Premier Certified Cloud and Service Provider. Where a scope also covers a datacenter, a Windows estate or a WAN, VSHN says so rather than adding a party you have to coordinate.


### Can you forward platform logs to our SIEM?

Yes, as a named add-on rather than as an assumption. Cluster-internal logging is included. Shipping identity-aware flow logs into your own SIEM comes with the Isovalent Enterprise Platform, where SIEM Export is a published line item on top of the networking tier, alongside Hubble flow logs that record the policy verdict with each connection and Tetragon for correlating runtime with network events. The [security controls page](/security-controls/) sets out that split for every control a requirement catalog usually asks about.


## Contact us

Planning an OpenShift deployment or evaluating managed operations for your existing clusters? Book a free consultation to discuss your architecture, compliance requirements, and pricing.


Booking: #contact

---

## ROSA vs ARO vs Self-Managed vs VSHN Managed OpenShift

URL: https://www.managed-openshift.ch/comparison/

# OpenShift Deployment Options Compared

Swiss organizations running Red Hat OpenShift have four realistic paths: ROSA on AWS, ARO on Azure, self-managed on any infrastructure, or a managed service from VSHN. Each option makes different trade-offs on sovereignty, operational burden, and cost.

This page lays out the differences so you can evaluate which model fits your requirements.

## Quick comparison

| | ROSA (AWS) | ARO (Azure) | Self-Managed | VSHN Managed |
|---|---|---|---|---|
| **Operator** | AWS + Red Hat | Microsoft + Red Hat | Your team | VSHN |
| **Data location** | AWS regions (nearest: Frankfurt) | Azure regions (nearest: Zurich) | Your choice | Your choice (Swiss cloud, on-premises, hyperscaler) |
| **Governing law** | US law (CLOUD Act applies) | US law (CLOUD Act applies) | Depends on hosting | Swiss law |
| **Swiss data center** | No (Frankfurt nearest) | Yes (Zurich region) | Yes (if hosted in CH) | Yes (Cloudscale, Exoscale, on-premises) |
| **Ops responsibility** | AWS/Red Hat manage control plane; you manage workloads | Microsoft/Red Hat manage control plane; you manage workloads | Everything is yours | VSHN manages cluster + operations |
| **SLA** | 99.95% (control plane) | 99.95% (control plane) | None (your own) | Up to 99.99% |
| **Upgrades & patches** | Shared responsibility | Shared responsibility | Your responsibility | VSHN handles weekly |
| **Monitoring & incident response** | AWS CloudWatch + your tooling | Azure Monitor + your tooling | Your responsibility | 24/7 monitoring, VSHN incident response |
| **Vendor lock-in** | AWS networking, IAM, storage | Azure networking, AD, storage | None (standard OpenShift) | None (standard OpenShift, portable) |
| **Open source** | OpenShift is open; AWS infra is proprietary | OpenShift is open; Azure infra is proprietary | Fully open source stack possible | OpenShift on open-source-friendly Swiss clouds |
| **Best for** | AWS-native teams, no CH residency requirement | Azure-native teams, Zurich region available | Full control, large platform team | Swiss compliance, small-to-mid ops team |

## ROSA: Red Hat OpenShift Service on AWS

ROSA is a jointly managed OpenShift service operated by AWS and Red Hat. AWS provides the infrastructure, Red Hat provides the OpenShift layer.

**What you get:**

- AWS manages the underlying EC2, networking, and storage
- Red Hat manages the OpenShift control plane and core components
- You manage your workloads, namespaces, and application configuration
- Pay-as-you-go pricing through your AWS bill

**Limitations:**

- Nearest AWS region to Switzerland is Frankfurt (eu-central-1), so data leaves Switzerland
- US-incorporated operator, subject to the [CLOUD Act](https://en.wikipedia.org/wiki/CLOUD_Act)
- Tied to AWS infrastructure: VPC, IAM, EBS, ELB. Migrating away means re-engineering networking and storage
- You still need a team for workload operations, CI/CD, and application-level monitoring
- Pricing varies by instance type and region; no fixed monthly fee

**Consider ROSA when:** Your workloads already run on AWS, you don't need Swiss data residency, and you want to reduce cluster management overhead while staying in the AWS ecosystem.

## ARO: Azure Red Hat OpenShift

ARO is the Azure equivalent: Microsoft and Red Hat jointly operate OpenShift on Azure infrastructure.

**What you get:**

- Microsoft manages Azure networking, storage, and compute
- Red Hat manages the OpenShift control plane
- Available in the Switzerland North (Zurich) Azure region
- Integrated billing through your Azure Enterprise Agreement

**Limitations:**

- Microsoft Corporation (USA) operates the infrastructure. US law and CLOUD Act apply regardless of data center location
- Tied to Azure: VNET, Azure AD, Managed Disks. Migration requires re-engineering
- Workload operations, monitoring, and application management remain your responsibility
- Pricing is per-worker-node-hour plus OpenShift licensing; no fixed monthly fee

**Consider ARO when:** You're already invested in the Azure ecosystem, Switzerland North meets your data location needs, and you have a team to handle workload operations.

## Self-Managed OpenShift

Self-managed means your team installs, operates, and maintains OpenShift end-to-end. You choose the infrastructure: on-premises, Swiss cloud, or hyperscaler.

**What you get:**

- Full control over every layer: infrastructure, OpenShift version, upgrade timing, networking
- No dependency on a third-party operator
- Run on any certified infrastructure (bare metal, VMware vSphere, Cloudscale, Exoscale, AWS, Azure, GCP)
- Community Edition (OKD) available at no license cost

**Limitations:**

- **Operational burden is the main cost.** Running OpenShift in production requires:
  - 24/7 on-call rotation (minimum 5 engineers for true 24/7 coverage)
  - Cluster upgrades every 3-4 months (Red Hat support lifecycle)
  - Security patch management, including emergency zero-day response
  - Backup, disaster recovery, and restore testing
  - Monitoring, alerting, and incident response infrastructure
- At Swiss engineering salaries, a 24/7 OpenShift operations team costs over CHF 1M/year in personnel alone
- Even business-hours-only support (2-3 engineers) runs CHF 300,000-450,000/year
- Smaller teams consistently fall behind on upgrades and security patches

**Consider self-managed when:** Your organization has a mature platform engineering team (5+ people), you need full control over every layer, and you treat platform operations as a core competency.

## VSHN Managed OpenShift

VSHN operates your dedicated OpenShift cluster on the infrastructure of your choice. VSHN is a [Red Hat Premier Certified Cloud & Service Provider (CCSP)](https://www.vshn.ch/en/blog/vshn-is-red-hat-premier-ccsp-partner-in-switzerland/) and has been operating OpenShift clusters since 2016.

**What you get:**

- Dedicated cluster, not shared with other customers
- Choice of infrastructure: Cloudscale, Exoscale, Google Cloud, VMware vSphere, or on-premises
- Weekly maintenance: OS updates, OpenShift upgrades, zero-day patches
- 24/7 monitoring with proactive incident response
- Up to 99.99% SLA with service credits
- ISO 27001 certified operations
- Swiss company, Swiss law, no CLOUD Act exposure
- Flat monthly reference pricing by SLA (Baseline through 99.99% - 24/7) and deployment model (CSP or on-premises), the same across editions. See [current pricing](https://products.vshn.ch/openshift/pricing.html)

**Limitations:**

- You delegate cluster-level control to VSHN (by design, this is the point)
- Infrastructure (compute, storage, network) is included in the CSP reference price; VSHN procures it by default, so it reaches you on one invoice, or keep your own cloud subscription and the provider bills you directly. On-premises deployments price the managed service fee only; infrastructure is customer-provided
- Custom cluster configurations may require engineering hours billed at the [standard hourly rate](https://products.vshn.ch/openshift/pricing.html)

**Consider VSHN when:** You need Swiss data residency, your team is too small for 24/7 OpenShift operations, compliance requires ISO 27001 certified processes, or you want to free your engineers from cluster maintenance.

## Total cost of ownership

Direct license and service fees are only part of the picture. The largest cost driver for OpenShift is people.

| Cost factor | ROSA / ARO | Self-Managed | VSHN Managed |
|---|---|---|---|
| **OpenShift licensing** | Included in service fee | Red Hat subscription required | Included |
| **Infrastructure** | Hyperscaler compute pricing | Your cloud or on-prem costs | Swiss cloud provider costs |
| **Control plane ops** | Managed by vendor | Your team | VSHN |
| **Workload ops** | Your team | Your team | Your team (or VSHN add-on) |
| **24/7 on-call** | Your team (for workloads) | Your team (for everything) | VSHN (cluster level) |
| **FTE overhead** | 1-2 for workload ops | 2-3 (BH) or 5-6 (24/7) for full stack | 0 for cluster ops |
| **Compliance documentation** | Limited (shared responsibility model) | You produce everything | VSHN provides ISO 27001 audit artifacts |

**Example: 8-worker-node cluster (OCP edition)**

| Model | Estimated monthly cost | Notes |
|---|---|---|
| ROSA / ARO | Variable (compute + per-node OCP fee) | Check [AWS](https://aws.amazon.com/rosa/pricing/) or [Azure](https://azure.microsoft.com/en-us/pricing/details/openshift/) pricing calculators; add internal ops team cost |
| Self-Managed (BH ops) | CHF 25,000-37,500+ | 2-3 FTEs at CHF 150K/yr + infrastructure + Red Hat subscription |
| Self-Managed (24/7 ops) | CHF 85,000-100,000+ | 5-6 FTEs at CHF 150-200K/yr + infrastructure + Red Hat subscription |
| VSHN Managed | A fraction of self-managed cost | See [current pricing](https://products.vshn.ch/openshift/pricing.html); the managed service fee includes operations, monitoring, incident response, upgrades, and Red Hat licensing |

Infrastructure costs are additional in every row. For VSHN Managed, VSHN procures them by default so they arrive on the same invoice; for the other models you buy them yourself.

## Sovereignty considerations

For a detailed sovereignty analysis covering CLOUD Act exposure, governing law, operational jurisdiction, and data residency, see our [OpenShift sovereignty assessment](/sovereignty/).

Key points:

- **ROSA and ARO** are operated by US companies subject to US law, including data stored in European regions
- **Self-managed** sovereignty depends entirely on your infrastructure and hosting choices
- **VSHN** is a Swiss company under Swiss law with an optional [Switzerland-only support](https://products.vshn.ch/support_plans.html#_option_switzerland_only_support) model

## Next steps

Evaluating your OpenShift deployment model? [Book an architecture review](#contact) with our OpenShift team. We'll assess your current setup and recommend the approach that fits your compliance, operational, and budget requirements.


---

## OpenShift vs Kubernetes – Which Platform Fits You?

URL: https://www.managed-openshift.ch/openshift-vs-kubernetes/

# OpenShift vs Kubernetes: What OpenShift Adds and When You Need It

OpenShift *is* Kubernetes, the same way Ubuntu *is* Linux. Kubernetes is the core technology (available on GitHub, like the Linux kernel), but nobody runs a raw kernel on their servers. Teams choose a *distribution* that bundles the kernel with the tooling they need: an installer, networking, authentication, monitoring, and upgrade mechanisms. Some distributions are slim and leave most choices to you; others come fully integrated.

OpenShift is a Kubernetes distribution by Red Hat. Every `kubectl` command and every Kubernetes manifest works unchanged. What OpenShift adds is the platform tooling around Kubernetes: developer console, CI/CD, service mesh, operator lifecycle, and a tested upgrade path, so your team does not have to assemble and maintain these components from scratch. The real question is not "OpenShift or Kubernetes" but how much tooling should come pre-integrated from the vendor vs. what your team builds and maintains itself.

This page compares all options available through VSHN: vanilla Kubernetes, Managed Kubernetes, OpenShift Kubernetes Engine (OKE), OpenShift Container Platform (OCP), and OCP+.

## The platform spectrum

VSHN offers multiple tiers to match different needs and budgets:

| | Vanilla Kubernetes | Managed Kubernetes (coming soon) | OpenShift Kubernetes Engine (OKE) | OpenShift Container Platform (OCP) | OpenShift Container Platform Plus (OCP+) |
|---|---|---|---|---|---|
| **What it is** | Open-source container orchestrator | Standardized, lifecycle-managed K8s | Enterprise Kubernetes with OpenShift operations tooling | Full OpenShift with developer and operations tooling | OCP with advanced security, compliance, and multi-cluster management |
| **Operated by** | Your team | VSHN | VSHN | VSHN | VSHN |
| **Developer console** | No (kubectl only) | No (API-first) | Admin console only | Full developer + admin console | Full developer + admin console |
| **CI/CD built-in** | No | No | No | Yes (Tekton Pipelines, Source-to-Image) | Yes |
| **Networking / Service mesh** | DIY (Istio, Linkerd) | Cilium OSS | Cilium (Isovalent Enterprise) | Cilium + OpenShift Service Mesh | Cilium + OpenShift Service Mesh |
| **Serverless** | DIY (Knative) | DIY (Knative) | DIY (Knative) | Yes (OpenShift Serverless / Knative) | Yes |
| **Logging** | DIY | Basic (logs + metrics) | Cluster monitoring | Platform logging + cluster monitoring | Platform logging + cluster monitoring |
| **Operator ecosystem** | Community operators | No OLM | OLM included | OLM + Red Hat Marketplace | OLM + Red Hat Marketplace |
| **Red Hat support** | None | None (open-source stack) | Red Hat subscription included | Red Hat subscription included | Red Hat subscription included |
| **SLA** | None (your own) | Up to 99.9% (business hours) | Up to 99.99% | Up to 99.99% | Up to 99.99% |
| **Best for** | Platform engineering teams who want full control | Cost-sensitive workloads on Swiss cloud | Enterprise K8s with 99.99% SLA at a lower price (bring your own CI/CD) | Developers build, deploy, and route through one platform without assembling separate tools | Regulated industries needing multi-cluster governance |

## When Kubernetes is enough

Plain Kubernetes is the right choice when:

- Your team has strong Kubernetes expertise (3+ engineers who manage clusters daily)
- You already run your own CI/CD pipeline (GitHub Actions, GitLab CI, Jenkins)
- You don't need Red Hat enterprise support or certified operators
- You want maximum flexibility to choose every component yourself
- Budget is the primary constraint and you can absorb the operational overhead

The trade-off: you build and maintain every layer above the orchestrator yourself, including networking policies, ingress, observability, image builds, security scanning, and upgrades.

## When you need OpenShift

OpenShift adds value when:

- **Buying is cheaper than building.** For smaller deployments (hundreds, not thousands of subscribed CPU cores), it costs less to buy the integrated services in OpenShift than to employ a platform team to assemble and maintain them from separate open-source components. This is a classic make-or-buy decision. Since OpenShift runs standard Kubernetes underneath, migrating to a self-built platform later remains straightforward once the deployment grows large enough to justify a dedicated team.
- **Red Hat enterprise support matters.** Certified operators, tested upgrade paths, and a single vendor for the entire platform stack.
- **You want a shared platform for multiple teams.** All OpenShift editions let you run multiple teams' applications on the same cluster, sharing infrastructure, security policies, and operational cost. OpenShift builds on open standards (OCI containers, Kubernetes API, Operator Framework), so teams choose their own languages, frameworks, and CI/CD tools while the platform provides the shared foundation. OCP adds more integrated developer tooling; OKE leaves that choice entirely to the teams.
- **Compliance requires a hardened platform.** OpenShift ships with Security Context Constraints (SCCs), RBAC defaults, and sandboxed containers, out of the box, not bolted on.
- **Developers need self-service.** The OCP developer console and application catalog let developers deploy without writing YAML or filing tickets.

## OpenShift editions explained

### OpenShift Kubernetes Engine (OKE)

OKE is OpenShift without the developer tooling. You get enterprise-grade Kubernetes with automated installs, over-the-air upgrades, the admin console, Operator Lifecycle Manager, cluster monitoring, and Cilium networking (Isovalent Enterprise). It does not include the developer console, built-in CI/CD, OpenShift Service Mesh, or serverless.

OKE is a good fit when you need enterprise Kubernetes but not the full developer platform. You get Red Hat's certified upgrade paths and compatibility matrix, VSHN's operational economies of scale from running hundreds of OpenShift clusters, and pre-integrated components (Cilium, Argo CD, k8up backups, AppCat services), at a lower price than OCP. Your developers keep their existing CI/CD tooling; VSHN handles the cluster operations. OKE still qualifies for the full 99.99% SLA: the same availability guarantee as OCP, without the cost and complexity of the full platform. VSHN currently offers OKE only on request: [contact us](#contact) to scope it.

### OpenShift Container Platform (OCP)

OCP is the standard OpenShift edition. It includes everything in OKE plus the developer console, application catalog, Tekton Pipelines, Source-to-Image builds, OpenShift Service Mesh, distributed tracing, Serverless (Knative), and platform logging.

OCP is the right choice when your developers should be able to build, deploy, and route applications through a single platform, without assembling separate tools for CI/CD, container builds, service mesh, and observability. The developer console and application catalog let teams ship without writing deployment manifests or filing ops tickets.

### OpenShift Container Platform Plus (OCP+)

OCP+ includes everything in OCP plus five additional components designed for organizations that operate multiple clusters or face strict security and compliance requirements:

- **Advanced Cluster Management (ACM)**: manage the lifecycle, policies, and application deployment of multiple OpenShift clusters from a single console. Includes 60+ pre-built governance policies.
- **Advanced Cluster Security (ACS)**: Kubernetes-native security platform that covers vulnerability management, network segmentation, risk profiling, and compliance checks across the entire application lifecycle.
- **OpenShift Data Foundation Essentials**: software-defined persistent storage integrated with OpenShift. Provides block, file, and object storage without relying on cloud-provider-specific storage classes.
- **Red Hat Quay**: enterprise container registry with image scanning, geo-replication, and access controls. Acts as a single source of truth for all container images across clusters.
- **Zero Trust Workload Identity**: assigns verifiable identities to workloads across hybrid and multi-cloud environments without managing certificates manually.

Each component is also available as a standalone subscription, but the OCP+ bundle is usually more cost-effective as soon as you need two or more of them. OCP+ is common in regulated industries (finance, healthcare, government) that run multiple clusters and need centralized security policy enforcement and audit trails.

### Pricing across the editions

VSHN publishes flat reference pricing by SLA level and deployment model, not by edition or worker count:

| Deployment | Baseline | 99.9% - Business Hours | 99.9% - 24/7 | 99.99% - 24/7 |
|---|---|---|---|---|
| Cloud Service Provider (CSP) | CHF 4,900/month | CHF 5,700/month | CHF 7,500/month | CHF 10,100/month |
| On-premises (virtualized)* | CHF 3,200/month | CHF 4,200/month | CHF 6,300/month | CHF 9,300/month |
| On-premises (bare metal)* | CHF 14,300/month | CHF 15,200/month | CHF 17,300/month | CHF 24,100/month |

*On-premises reference prices cover the managed service fee only; infrastructure and compute are customer-provided. CSP reference prices include representative CSP infrastructure cost.

These are reference prices for a standard production setup (one cluster, no unusual customization), excluding VAT; final pricing depends on validated scope and worker capacity. OKE is available on request: [contact us](#contact) to scope it against OCP or OCP+. Full pricing details: [VSHN OpenShift pricing](https://products.vshn.ch/openshift/pricing.html).

## Reference pricing: self-managed vs. VSHN Managed

| Option | VSHN service fee (monthly) | What's included | What you add |
|---|---|---|---|
| **Self-managed Kubernetes** | CHF 0 (DIY) | Nothing (you run everything) | 4-6 FTEs for 24/7 ops (CHF 600K-1.2M/year) + tooling |
| **VSHN Managed Kubernetes** (coming soon) | TBD | Lifecycle management, basic monitoring, reactive support | Your CI/CD, networking policies, security tooling |
| **VSHN Managed OpenShift, CSP Baseline** | CHF 4,900/month | OCP or OKE (on request), 24/7 monitoring, Red Hat support and licensing | Your application code |
| **VSHN Managed OpenShift, CSP 99.99% - 24/7** | CHF 10,100/month | Same, at the highest availability tier | Your application code |

Infrastructure costs are additional for self-managed and VSHN Managed Kubernetes. VSHN Managed OpenShift's CSP reference price already includes representative infrastructure cost; VSHN procures it by default so it arrives on the same invoice, or your own cloud subscription is billed directly if you keep one. Self-managed OpenShift also requires Red Hat subscriptions on top of FTE costs. Self-managed vanilla Kubernetes has no license fees, but most organizations still budget for a support subscription with a vendor so there is someone to call when etcd or the control plane breaks.

## VSHN Managed Kubernetes (coming soon)

VSHN is developing a standardized Managed Kubernetes offering for organizations that need Kubernetes without the cost of an enterprise platform. Built on open-source components (Cluster API, Cilium, Rook/Ceph), it will provide:

- Lifecycle-managed Kubernetes on Swiss cloud providers
- Networking via Cilium, storage via Rook/Ceph, ingress via Gateway API
- Basic observability (logs and metrics)
- Standardized configurations for predictable pricing
- No enterprise licensing fees

This fills the gap between self-managed Kubernetes and Managed OpenShift. If you are interested, [contact us](#contact) to join the early access list.

## Feature comparison: OKE vs OCP vs OCP+

| Feature | OKE | OCP | OCP+ |
|---|---|---|---|
| Cilium networking (Isovalent Enterprise) | Yes | Yes | Yes |
| Automated installers and upgrades | Yes | Yes | Yes |
| Enterprise-secured Kubernetes | Yes | Yes | Yes |
| kubectl and oc CLI | Yes | Yes | Yes |
| Operator Lifecycle Manager | Yes | Yes | Yes |
| Admin web console | Yes | Yes | Yes |
| OpenShift Virtualization | Yes | Yes | Yes |
| Cluster monitoring | Yes | Yes | Yes |
| User workload monitoring | No | Yes | Yes |
| Platform logging | No | Yes | Yes |
| Developer web console | No | Yes | Yes |
| Developer application catalog | No | Yes | Yes |
| Source-to-Image / Tekton builds | No | Yes | Yes |
| OpenShift Pipelines (Tekton) | No | Yes | Yes |
| OpenShift Service Mesh | No | Yes | Yes |
| Distributed tracing (Jaeger) | No | Yes | Yes |
| OpenShift Serverless (Knative) | No | Yes | Yes |
| Sandboxed containers | No | Yes | Yes |
| Advanced Cluster Management (ACM) | No | No | Yes |
| Advanced Cluster Security (ACS) | No | No | Yes |
| OpenShift Data Foundation Essentials | No | No | Yes |
| Red Hat Quay (enterprise registry) | No | No | Yes |
| Zero Trust Workload Identity | No | No | Yes |

Source: [VSHN OpenShift editions](https://products.vshn.ch/openshift/index.html#_openshift_editions), [Red Hat OCP+](https://www.redhat.com/en/technologies/cloud-computing/openshift/platform-plus), [VSHN Cilium on OpenShift](https://products.vshn.ch/openshift/cilium.html)

## Next steps

Not sure which tier fits your workloads? [Book an architecture review](#contact) with our OpenShift and Kubernetes team. We assess your current setup, workload requirements, and budget, and recommend the right platform tier.


---

## Partner with VSHN on Managed OpenShift Operations | VSHN

URL: https://www.managed-openshift.ch/partners/

# Partner with VSHN on Managed OpenShift

You bring the customer relationship and OpenShift expertise: application modernisation, container migration, CI/CD design, developer onboarding. VSHN brings 24/7 managed cluster operations, Swiss data residency, and a 99.99% SLA as Red Hat Premier CCSP. Together you deliver a complete managed OpenShift solution without either side building capabilities you don't have.

## How we collaborate

**Lead Partner model.** For each project, one of us is the customer's single point of contact. Who leads depends on the project, agreed per engagement. The Lead Partner drives the project, handles invoicing, and owns first-level support.

**Joint delivery.** You handle consulting, integration, and project management. VSHN handles infrastructure operations, monitoring, backups, and SLA. Or the other way around, depending on the project. Roles are agreed per engagement, not locked into a rigid structure.

**Flexible billing.** Invoice the customer together or separately, agreed per project. Both models are supported: each party invoices their share directly, or one party invoices the full amount and redistributes.

**Protected relationships.** No undercutting. Your customer stays your customer. Existing relationships are respected on both sides, with contractual protections for both parties.

## Division of labor for Managed OpenShift

| Your role | VSHN's role |
|-----------|-------------|
| Application modernisation | OpenShift cluster operations |
| Container migration | Node management and scaling |
| CI/CD design and pipeline build | Monitoring and alerting |
| Custom operator development and infrastructure integrations | Upgrades and security patches |
| Developer onboarding and project management | SLA with 24/7 operations |

## Keep the client relationship. Hand over the cluster.

Some firms never wanted the cluster. You hold the contract for the application, the client wanted it on OpenShift, and the platform became yours to patch, upgrade and answer for at night. Every hour spent on a cluster upgrade is an hour the application contract does not pay for.

In that case you lead and we stay in the background. You remain the client's single point of contact and send the invoice, and VSHN operates the cluster around the clock under a contract with you.

**We operate what we know.** The cluster has to be set up to the VSHN standard before we can run it around the clock, because the engineer who answers at 03:00 has to know the system. An existing cluster is brought to that standard first.

## Partners delivering Managed OpenShift

**[tim&koko](https://tim-koko.ch)**. Cloud consulting firm delivering container migrations and CI/CD pipeline design on VSHN-operated OpenShift clusters.

**[Puzzle](https://puzzle.ch)**. Software company with 150+ employees. Provides cloud-native consulting and DevOps transformation alongside VSHN managed OpenShift.

**[bespinian](https://bespinian.io)**. Cloud-native consulting firm focused on Kubernetes and OpenShift application delivery.

**[Gepardec](https://www.gepardec.com)**. Java software modernization. Migrates and upgrades applications onto VSHN-operated OpenShift and keeps them maintainable afterwards.

**[acend](https://acend.ch)** is a training partner rather than a delivery partner: they teach OpenShift and Kubernetes courses, from container basics to advanced operations.

See all VSHN partners at [servala.com/partners](https://servala.com/partners/).

## Become a partner

Interested in delivering managed OpenShift together? Let's explore how we complement each other.

[Book a partnership discovery call](https://vshn.cal.vs.hn/openshift) or [start a partnership conversation](#contact).


---

## OpenShift Security Controls: What VSHN Actually Operates

URL: https://www.managed-openshift.ch/security-controls/

# Answering a platform security control catalog

Security requirements arrive as a numbered list. Someone has to say, per line, whether the platform does this, whether it is included, and what evidence comes with it. That answer usually gets rebuilt from scratch for every bid, which is slow for us and slower for the buyer waiting on it.

So here it is once, for a VSHN-operated OpenShift platform. Each control says which of three things it is: **included** in the managed platform, an **add-on** that is ordered and priced separately, or **yours**. A page that blurred those three would be useless for the purpose you are reading it for.

The last section names the controls this page does not answer yet, rather than letting silence imply a no.

## Network segmentation

**Included.** Managed OpenShift uses Cilium as its default container network interface, so network policy enforcement is part of the platform rather than something added later. Namespaces, RBAC and Security Context Constraints come from OpenShift itself.

**Add-on: [Isovalent Enterprise Platform](https://products.vshn.ch/openshift/cilium.html).** Where a requirement asks for more than policy at the network layer, this adds identity-based micro-segmentation, policy enforcement across L3, L4 and L7, transparent IPsec or WireGuard encryption between nodes, and an egress gateway for workloads that must leave the cluster from a known address.

It is priced per feature and per node capacity, in two tiers, and the [current rates](https://products.vshn.ch/openshift/cilium.html) are published rather than quoted per deal. Read them there rather than here: they are reference rates that final billing adjusts against actual consumption, and a price copied onto a second page is a price that goes stale without anyone noticing. Features Isovalent marks as beta, and non-standard configuration, are not supported by VSHN unless that is agreed explicitly.

## Administrative access

**Included, and worth reading before you write the requirement.** VSHN operates the platform with automation, which means the systems have to be reachable at all times without a person in the loop. Manual access paths are excluded by design: personal VPN clients, remote-desktop jump hosts, hardware tokens handed to an engineer, and access that depends on someone's notebook.

That is not the same as refusing your access controls. VSHN can provide the SSH and VPN jump hosts itself, and in practice complies with most customer information security policies. VSHN employee and service accounts are managed exclusively through VSHN Configuration Management, so there is a single place where access is granted and withdrawn.

The distinction that matters for your catalog: a jumphost that automation can traverse unattended works, and a jumphost that requires a human approval step for every session does not. If your requirement is the second kind, say so early. It is an architecture question, not a configuration one, and it has derailed larger infrastructure projects than this one.

## Logging, SIEM export and forensics

**Included.** Cluster-internal logging, collected and available to debug service errors.

**Add-on, in the same Isovalent platform as above.** Hubble supplies identity-aware flow logs that record the policy verdict alongside the connection, so a log line says not just what happened but which policy allowed or denied it. Hubble Timescape keeps that history for exploration after the fact. **SIEM Export** ships those events into your own SIEM, as its own line item on top of the networking tier rather than as a standalone purchase. Tetragon adds runtime security, correlating process-level events with network events, which is what a forensic question usually needs.

This is the honest shape of the answer: a SIEM feed exists, it is a named product with a published rate, and it is ordered, not included.

## Monitoring and incident handling

**Included, and the level is what you pick.** The service level profile decides it:

| | Baseline | 99.9% Business Hours | 99.9% 24/7 | 99.99% 24/7 |
|---|---|---|---|---|
| Availability target | No formal commitment | 99.9% | 99.9% | 99.99% |
| Measurement window | Not measured | Mon to Fri, 09:00 to 18:00 CET | 24/7 | 24/7 |
| Response target | Not included | 2 hours, business hours | 2 hours | 1 hour |
| Root cause analysis | Not included | On request | On request | Mandatory, within 5 days |
| Service credits | No | Yes | Yes | Yes |

VSHN monitors the platform and reacts on SLA-relevant alerts within the window you bought. Note that around-the-clock monitoring and incident handling is what the 24/7 profiles include; a named on-call engagement for your own application is a separate plan, and conflating the two is the most common mistake in reading a service level table.

Full profile detail, including how availability is measured and how credits are calculated: [VSHN service levels](https://products.vshn.ch/service_levels.html).

## Backups

**Included.** Backups run daily. The default retention keeps the last seven daily backups plus four weekly ones, and a different schedule, including multiple runs per day, is available as an option. Data is encrypted on the client before it leaves the machine and then transferred over a TLS connection to an off-site target in Swiss datacenters, selected by VSHN. Custom locations are available on request.

**The part worth asking every provider about:** backup success is itself monitored. Days without a successful backup is a tracked indicator with a threshold of one day on the higher service profiles and three on Baseline, which means a silently failing backup surfaces as an incident rather than as a discovery during a restore.

**Yours.** Your retention and classification policy, and the recovery point your business actually requires, which is an input to the design rather than an output of it.

## Operating system hardening

**Included.** The machines underneath the platform are hardened by configuration, not by a one-time checklist: SSHd configuration, IPtables as a local firewall, sudo restrictions, enforced package repositories, NTP and DNS resolvers, semi-automated weekly package updates, and 0-day mitigation outside that cycle when it is needed. Because it is configuration management rather than a build step, drift is corrected continuously and the state is reported.

## Four controls that are not cluster-level

The rest of a typical catalog asks for things a platform cannot answer on its own, because they are properties of your architecture rather than of a cluster. Naming which ones, and why, saves an argument later in the evaluation.

**Disaster recovery, and a stated RPO and RTO.** Whether you need cold, warm or hot standby follows from your overall architecture, not from the cluster underneath it. A published recovery point would therefore be wrong for most readers of this page, so the concept is designed per customer instead. What can be said before that design exists is what constrains it: a Swiss provider's own replication limits usually decide the answer, and georedundancy across two sites is built rather than ordered.

**Four-eyes and segregation of duties.** Enforced at the source level, through merge request approval, rather than on the platform. That is deliberate rather than a gap. Nothing on a VSHN-operated platform should be changed by hand, so a platform-side approval gate would guard a path nobody is supposed to use, while the change that actually reaches production passes beside it. The control belongs where the change is authored.

**Central log storage across clusters.** Also an architecture question rather than a cluster one. Where logs are aggregated, how long they are kept and under whose retention rules depends on what else you run, so it is designed with you rather than shipped as a default.

**Cloud security posture management, and integration with your own PKI or certificate authority.** Built per customer. Both are real and neither is part of the standard package, which is a distinction worth having in writing before a contract rather than after.

If your catalog includes any of these, [ask](#contact). The answer is an architecture conversation, and a short one.

Related: [what VSHN operates and what stays with you](https://www.appcat.ch/operating-model/), and [sovereignty](/sovereignty/) for jurisdiction, ownership and the CLOUD Act.


---

## OpenShift Sovereignty: Swiss Managed K8s Platform | VSHN

URL: https://www.managed-openshift.ch/sovereignty/

# OpenShift & Kubernetes Sovereignty: Platform Choice Matters

Your container platform hosts every application, every deployment pipeline, and every secret. The sovereignty of your platform determines the sovereignty of everything running on it.

Hyperscaler Kubernetes services (GKE, EKS, AKS) run on US-owned infrastructure under US law. Even "Swiss region" deployments are operated by US companies subject to the [CLOUD Act](https://en.wikipedia.org/wiki/CLOUD_Act). Managed OpenShift services from Red Hat or IBM are governed by US law as well.

VSHN offers both **OpenShift** and **vanilla Kubernetes** on Swiss infrastructure, operated by a Swiss team under Swiss law.

## Platform sovereignty compared

| Dimension | GKE (Google) | EKS (Amazon) | AKS (Microsoft) | ROSA (Red Hat/AWS) | VSHN Managed K8s/OpenShift |
|-----------|-------------|-------------|-----------------|-------------------|--------------------------|
| **Ownership** | Google (USA) | Amazon (USA) | Microsoft (USA) | Red Hat/IBM (USA) | VSHN AG (Switzerland) |
| **Governing law** | US law | US law | US law | US law | Swiss law |
| **CLOUD Act** | Exposed | Exposed | Exposed | Exposed | Not exposed |
| **Data location** | Configurable | Configurable | Configurable | Configurable | Switzerland by default |
| **Platform source** | Proprietary (K8s core open) | Proprietary (K8s core open) | Proprietary (K8s core open) | Open source (OKD) | Open source (K8s or OKD) |
| **Vendor lock-in** | GKE-specific APIs, Anthos | EKS-specific, Fargate | AKS-specific, Arc | Red Hat subscription | Standard K8s APIs, portable |
| **Staff access from abroad** | Maintenance and support staff in 30+ countries, including USA and India | Support staff worldwide, including USA and India | Teams worldwide; remote access from outside EU and EFTA for repairs | Red Hat follow-the-sun support, plus AWS support worldwide | VSHN Canada for night-time scheduled work; none with the [Swiss-only option](https://products.vshn.ch/support_plans.html#_option_switzerland_only_support) |

## OpenShift vs vanilla Kubernetes: a sovereignty perspective

VSHN offers both platforms. The sovereignty trade-off:

**Vanilla Kubernetes**, maximum sovereignty:

- No non-Swiss vendor dependency
- CNCF-governed, community-maintained
- All VSHN managed services available
- Swiss-only operations with no foreign corporate chain

**Red Hat OpenShift**, strong sovereignty with one nuance:

- OpenShift source code is open (OKD)
- Red Hat (IBM subsidiary, US) provides certified images and subscription entitlements
- Red Hat offers [EU Sovereign Support](https://www.redhat.com/en/about/press-releases/red-hat-introduces-confirmed-sovereign-support-european-union) as an option
- Day-to-day operations are fully independent by VSHN

For customers where the Red Hat corporate chain is a concern, vanilla Kubernetes provides the same managed services with no non-Swiss dependencies.

## VSHN sovereignty self-assessment

We applied the EU's [Cloud Sovereignty Framework](https://commission.europa.eu/document/09579818-64a6-4dd5-9577-446ab6219113_en) (v1.2.1, October 2025) to our own services. This framework was used to score providers in the EU's [EUR 180M sovereign cloud tender](https://ec.europa.eu/commission/presscorner/detail/en/ip_26_833) in April 2026. Three pure-European providers achieved SEAL-3, while a consortium involving Google Cloud scored only SEAL-2.

*This is a self-assessment, not a formal SEAL certification. We publish it for transparency so customers can evaluate our sovereignty profile using the same structured criteria the EU uses.*

| # | Dimension | Weight | Assessment | Evidence |
|---|-----------|--------|-----------|----------|
| SOV-1 | Strategic | 15% | **Strong** | Swiss AG, no foreign parent, all shareholders Swiss citizens ([Commercial Register](https://zh.chregister.ch/cr-portal/auszug/auszug.xhtml?uid=CHE-275.566.226)) |
| SOV-2 | Legal | 10% | **Strong** | Swiss law ([GTC](https://products.vshn.ch/legal/gtc_en.html)), no CLOUD Act, [EU adequacy decision](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en) |
| SOV-3 | Data & AI | 10% | **Strong** | Swiss DCs by default. Sovereign key management via [Managed OpenBao](https://www.openbao.ch) + [Swiss HSM](https://cloud.securosys.com/cloudhsm) |
| SOV-4 | Operational | 15% | **Strong** | Swiss 24/7 ops, [Swiss-only support option](https://products.vshn.ch/support_plans.html#_option_switzerland_only_support). All services on vanilla Kubernetes |
| SOV-5 | Supply Chain | 20% | **Strong** | Infrastructure-agnostic; [customer chooses provider](https://servala.com/providers/). Open-source software |
| SOV-6 | Technology | 15% | **Strong** | 100% open source. VSHN contributes to [K8up](https://github.com/k8up-io) (CNCF Sandbox) and maintains [Project Syn](https://github.com/projectsyn) |
| SOV-7 | Security | 10% | **Strong** | [ISO 27001](https://www.vshn.ch/wp-content/uploads/2026/08/ISO-27001-certificate-VSHN-2026.pdf), ISAE 3402 Type II, Swiss SOC. [FINMA-regulated customers](https://www.vshn.ch/en/solutions/solutions-for-banks-and-financial-service-providers/) |
| SOV-8 | Environmental | 5% | **Moderate** | DC operators: Green Datacenter AG (ISO 22301/27001/27701), [Exoscale sustainability](https://www.exoscale.com/sustainability/). [VSHN CSR policy](https://handbook.vshn.ch/corporate_social_responsibility_policy.html) |

**Overall: SEAL-3 equivalent**, the same level achieved by the winners of the EU's own sovereignty tender. No bidder in the EU's own tender reached SEAL-4: it requires complete EU control with no critical non-EU dependencies, and every cloud provider depends on hardware made in Asia and the US and on open-source projects governed by US-based foundations such as the Linux Foundation and CNCF.

Try Swiss infrastructure: [APPUiO](https://www.appuio.ch) (managed Kubernetes, free trial), [Exoscale]({{partner:exoscale.signup_url}}) (Swiss IaaS). Want help choosing? [Contact us](#contact).

## Get a sovereignty assessment for your platform

Running containers on a hyperscaler and evaluating sovereign alternatives? We assess your sovereignty profile against the EU framework and plan a migration to Swiss-operated OpenShift or vanilla Kubernetes.


---

## What is OpenShift? Enterprise Kubernetes, Explained

URL: https://www.managed-openshift.ch/what-is-openshift/

# What is OpenShift?

OpenShift is Red Hat's enterprise Kubernetes platform. Kubernetes is inside it, and around that Red Hat has assembled the components a production platform needs and Kubernetes deliberately leaves out: developer tooling, CI/CD pipelines, service mesh, serverless, monitoring, an integrated registry, and an operator ecosystem for running software on top.

The one-line version: if Kubernetes is a kernel, OpenShift is a distribution built around it, sold with a support contract. The [Kubernetes explainer](https://www.kubernetes-experten.ch/what-is-kubernetes/) sets out why that gap exists at all.

## What Red Hat actually adds

Plain Kubernetes gives you a cluster and nothing else. Everything a platform needs, you select, install, integrate, secure and upgrade yourself, each piece with its own release cycle and its own compatibility matrix.

OpenShift ships those choices already made and already integrated:

- **Build and deploy tooling**, so source code can become a running container without assembling a pipeline first.
- **An integrated registry**, monitoring stack and logging stack, rather than three separate projects to run.
- **Stricter defaults.** Containers do not run as root unless you allow it. This catches people migrating from plain Kubernetes, and it catches them because their images were doing something they should not have been.
- **Operators** for installing and maintaining software on the cluster in a supported way.
- **A support contract**, which for many buyers is the actual product.

## The editions, which is a real decision

**OpenShift Kubernetes Engine** is the leaner, open-source-focused edition: the platform and the core, without the full developer tooling layer.

**OpenShift Container Platform** is the complete feature set.

The distinction matters commercially, because a team that wants supported enterprise Kubernetes and already has its own CI/CD may be buying capabilities it will not use. Establishing which edition fits belongs early in the conversation, and the pricing difference is not small.

## Make or buy

Strip the branding away and this is a make-or-buy decision about the same set of components.

**Making it** means choosing, installing, integrating, securing and upgrading ingress, monitoring, logging, the registry, CI and the rest yourself, on top of a cluster you also run. That is months of work before anything is in production, and then it is permanent: each of those components has its own release cycle, its own compatibility matrix and its own security advisories, forever.

**Buying it** means the same set arrives assembled, tested together and supported, and the ongoing integration work is someone else's.

What decides it is that the two costs scale differently. Building is mostly a fixed cost in engineering time, and it does not shrink because your cluster is small. Buying is metered: OpenShift is priced by SLA level and worker capacity, so the bill scales with the cluster and the chosen availability tier.

The consequence is the one people get backwards. **Below the point where you are counting cores in the tens of thousands, buying is usually the cheaper answer**, because the fixed cost of building lands on a small cluster just as heavily as on a large one. The scale at which building starts to pay is large, and most organizations asking this question are nowhere near it. Above that point, the per-core meter starts to dominate and the arithmetic can reverse.

So the honest test is not "are we an enterprise". It is: how many worker cores, and what would the engineering time cost to build and keep the same thing running.

## When OpenShift is the right answer

- **A support contract is a requirement.** Regulated organizations frequently cannot run critical infrastructure without a vendor behind it. This is the most common honest reason, and it is sufficient on its own.
- **You want the platform decisions made for you.** Assembling ingress, monitoring, logging, registry and CI on plain Kubernetes is months of work and then a permanent maintenance obligation. Buying that assembled is a legitimate trade.
- **Security posture out of the box.** The stricter defaults are the sort of thing that is easy to configure on plain Kubernetes and easy to forget.
- **A large organization with many teams**, where the multi-tenancy and governance features earn their place.

## When plain Kubernetes is enough

**A capable platform team that has already made these choices** may find OpenShift's opinions constrain more than they help. Migrating a working platform onto it to gain features you already built is expensive.

**Small deployments.** OpenShift has a resource floor. A cluster running a handful of services pays a meaningful overhead for the platform components themselves.

**Cost-sensitive workloads where support is not required.** The license is the point of the product; if you would not use the support, you are paying for it anyway.

If you are weighing exactly this, our [OpenShift versus Kubernetes comparison](/openshift-vs-kubernetes/) goes through it in detail, including the editions and the pricing shape.

## What running it involves

Everything on the [Kubernetes](https://www.kubernetes-experten.ch/what-is-kubernetes/) list still applies. OpenShift changes who does some of it, not whether it happens.

- **Upgrades are supported, and still yours to run.** Red Hat provides the path and the tooling. Someone still has to schedule it, test it and be there.
- **Node and operating system lifecycle.** The nodes underneath remain infrastructure with a lifecycle.
- **Capacity and quota.** The platform components consume real resources, and sizing for them is part of the design rather than an afterthought.
- **The support contract is not an operations team.** It answers questions about the product. It does not watch your cluster at three in the morning.

That last point is the one most often misunderstood at purchase, and it is the gap a managed service fills.

## Where VSHN fits

VSHN is a Red Hat Premier CCSP partner in Switzerland and has operated OpenShift since 2016, on Cloudscale, Exoscale, private cloud and on-premises infrastructure, with CSP reference pricing from CHF 4,900 per month, up to 99.99% SLA.

The first useful conversation is usually which edition fits, and whether OpenShift is the right shape at all, because for some teams the honest answer is plain Kubernetes and a smaller bill.

[Get a cost comparison](#contact)