OpenShift on VCD
Foreword: The need for a sovereign managed OpenShift
Many companies want to modernize their applications by adopting containerized architectures, without having to deal with the complexity of operating a full OpenShift platform.
Public cloud offerings do not always meet these requirements, particularly when:
- data must remain hosted in France,
- connectivity must be controlled (private, hybrid, or partitioned),
- compliance, security, and traceability requirements are high,
- applications require guaranteed and isolated performance,
- the customer wants to retain control of their OpenShift cluster while delegating part of its operation.
Orange Business meets this need with Cloud Avenue – OpenShift on VCD, a Managed OpenShift (Hypershift) service hosted on Orange Business’s IaaS (VMware Cloud Director) infrastructure.
This offering provides customers with a complete, manageable OpenShift cluster, while the control plane is fully managed and backed up by Orange Business.
Translated with DeepL.com (free version)
Overview
OpenShift on VCD is a Managed OpenShift solution based on Red Hat OpenShift 4.x in Hypershift mode (Hosted Control Plane).
Each customer has a dedicated OpenShift cluster, deployed in their VCD (Virtual Data Center VMware) tenant.
The model is based on a shared responsibility architecture:
| Componant | Operated by Orange Business | Operated by the customer |
|---|---|---|
| Control plan (API, etcd, ingress, monitoring, certs) | ✅ | |
| Saving the inspection plan (Kasten) | ✅ | |
| VMware infrastructure, NSX-T, NFS storage | ✅ | |
| Data cluster (workers) | ✅(beta deployment) | ✅ (full usage in GA) |
| Workloads, namespaces, projects | ✅ | |
| Backup of PVs / application data | ✅ |
The customer retains admin access to their cluster (API, Web Console, CLI, OperatorHub, RBAC, etc.).
Orange Business manages the orchestration, maintenance, and supervision layer of the environment.
Architecture and principles
The offering is based on a modular and standardized architecture :
- Hypershift Control Plane (HCP): hosted and managed in the Cloud Avenue Service Zone,
- Customer clusters (Hosted Clusters): deployed in VCD tenants,
- Network interconnection: NSX-T + BGP/NAT,
- Persistent storage: Local Storage Operator or NFS NetApp Cloud Avenue,
- Backup: Kasten for the control plane only,
- DNS and certificates: Bring Your Own Certificate (BYOC) model.
This approach combines:
- total isolation by customer cluster,
- centralized and automated lifecycle management,
- flexibility of full root access for the customer,
- sovereignty and compliance (100% French hosting).
Service location
OpenShift on VCD clusters are hosted in Orange Business data centers in Val-de-Reuil, within the Cloud Avenue platform.
The control plane (Service Zone) is operated in a sovereign and isolated environment, monitored 24/7.
Control plan
The Hypershift control plan (HCP) is fully managed by Orange Business and includes:
- Kubernetes and OpenShift APIs,
- etcd, ingress, scheduler, controller-manager,
- Observability (Prometheus, Grafana, Alertmanager),
- Automated TLS certificate management,
- Daily backup of the etcd database via Veeam Kasten.
🟠 Notes :
- Only the etcd database (control plane) is backed up by Orange Business.
- Persistent volumes (PVs) and application data are the responsibility of the customer.
They can use Cloud Avenue S3 Storage to back up their workloads via Velero, Kasten, or another compatible tool.
Administration interface
The customer has full access to their OpenShift environment via:
- OpenShift web console: complete management of projects, routes, operators, etc.
- Kubernetes/OpenShift API: CI/CD integration, GitOps, IaC.
- CLI (oc): for technical administrators.
Access is provided via dedicated URLs, for example:https://console.apps.<cluster>.<tenant>.kaas.cav
Authentication is provided via a dedicated OAuth provider (SSO, LDAP, etc.), configurable according to the customer’s needs.
Underlying infrastructure (VCD)
Each cluster is hosted in a customer’s VCD tenant.
This tenant contains the resources required for the cluster’s data plan:
- Compute: OpenShift worker VMs, sized according to the cluster profile,
- Network: isolated NSX-T segment, interconnected via BGP or NAT,
- Storage: local VMware datastore or NetApp NFS,
- Security: NSX-T network isolation and micro-segmentation.
🟠 Technical constraints:
- An OpenShift on VCD customer cannot host another HCP, as a Hosted Control Plane cannot manage a second one.
- A Hosted Cluster supports up to a maximum of 50 workers.
Persistent storage
Two types of storage are available for OpenShift workloads:
Local storage (via OpenShift Local Storage Operator)
- Persistence on disks attached to workers.
- Ideal for test environments, CI/CD, or stateless workloads.
- High performance, no network dependency.
- Not backed up by the service provider.
Cloud Avenue NFS storage (via NetApp SVM)
- Mounted from a Premium T0 via the Shared Storage Portal.
- Provides shared, durable, high-performance storage space.
- Ideal for production environments and stateful workloads.
- Option managed by Orange Business (connection, SVM, quota).
Network Exposure and Load Balancer
The OpenShift on VCD offering uses MetalLB to expose services and application routes.
Features:
- Assignment of internal IP addresses to the service zone,
- No direct public IP address in Layer 2,
- Possibility of exposure via NAT on the VCD tenant gateway,
- Possible integration with ExternalDNS,
- Native HTTPS/TLS support for OpenShift routes.
This model guarantees isolation, security, and publication flexibility.
DNS and certificates
Each customer manages their own domain and certificates according to a Bring Your Own Certificate (BYOC) model:
- Choice of internal or public DNS,
- Optional ExternalDNS for automation of registrations,
- Wildcard certificate possible,
- No certificates provided by Orange Business for application workloads,
- Control plane certificates are managed and renewed automatically by the service provider.
Backup and restore
- Orange Business only backs up the control plane (etcd) via Veeam Kasten.
- The customer is responsible for backing up PVs, images, and application data.
They can use the S3 Cloud Avenue offering or any compatible backend (MinIO, AWS S3, etc.).
This division ensures cluster recovery without interfering with customer data governance.
Sizing and scalability
Three standard profiles are available:
| Profile | Size | Description | Use |
|---|---|---|---|
| Starter | 3 workers | Petit environnement, tests | Dev / POC |
| Standard | 5–7 workers | Environnement de pré-production | Pré-prod |
| Enterprise | 10–50 workers | Production haute disponibilité | Production |
- Hot horizontal scale-out possible (addition of workers via VCD).
- Vertical scale-up (CPU/RAM) supported on each worker.
Maintenance and supervision
Orange Business supervises and maintains the control plan:
- OpenShift fixes and updates (minor & security patches),
- Certificate and component lifecycle management,
- 24/7 monitoring, alerting, metrology via Prometheus/Grafana,
- Scheduled operations with advance notification.
Customer workloads are not interrupted during standard maintenance.
Additional Services
- Zone Access Service: secure interconnection with Cloud Avenue environments.
- NetApp NFS T0 Premium: high-performance network storage.
- Cloud Avenue S3 Storage: autonomous application backup.
Pricing and support
Billing is monthly and depends on the type of cluster, the storage chosen, and the options subscribed to. It is based on the number of 4 vCPU packs used by the Worker Nodes allocated to an OpenShift cluster (cf. Fiche tarifaire Cloud Avenue).
Support includes:
- Supervision and maintenance of the control plan,
- Support hours: Monday to Friday, 9:00 a.m. to 6:00 p.m. (Paris time), excluding weekends and public holidays.
- Red Hat Premium Support included.
How to order
To initiate the creation of a cluster, the customer orders it directly from Cloud Store, with a tenant ID and an e-mail address.
Once the cluster has been provisioned and validated, the customer receives a commissioning confirmation email including the method for accessing the OpenShift portal, the VIP for exposing applications, and the URL for the cluster access API. An encrypted administrator account is also sent securely, and the cluster is then ready to host application workloads.
In short
| Item | Detail |
|---|---|
| Service type | Managed OpenShift (Hypershift-based) |
| Client type | Complet (API, Console, CLI) |
| Hébergement | VMware Cloud Director / Datacenters Orange (France) |
| Storage | LocalStorage Operator ou NFS NetApp |
| Load Balancer | MetalLB (NAT, sans IP publique directe) |
| DNS / Certificates | Bring Your Own Certificate (BYOC) |
| Backup | Kasten (control plane uniquement) |
| Backup workloads | Client side (Cloud Avenue S3, etc.) |
| Max nodes | 50 workers par cluster |
| Support | 9×5 – Orange Business + Red Hat |
| Responsabilities | Control plane : OB / Workloads : Client |