Which Kubernetes distribution to choose for on-prem environments?

Most people think that Kubernetes was designed to bring more features and more abstraction layers to cloud environments. Well, I think the biggest benefits can be achieved in on-premise environments, because of the big gap between those environments and the ones that can be easily created in the cloud. This opens up many excellent opportunities for organizations which for some reasons choose to stay outside of the public cloud. In order to leverage Kubernetes using on-premise hardware, one of the biggest decisions that needs to be made which software platform to use for Kubernetes. According to the official listing of available Kubernetes distributions, there are dozens of options available. If you look closely at them, however, there are only a few viable ones, as many of them are either inactive or have been merged with other projects (e.g. Pivotal Kubernetes Service merged with VMware Tanzu). I expect that 3-5 of these distributions will eventually prevail in the next 2 years and they will target their own niche market segments. Let’s have a look at those that have stayed in the game and can be used as a foundation for a highly automated on-premise platform.

1. OpenShift

I’ll start with the obvious and probably the best choice there is – OpenShift Container Platform. I’ve written about this product many times and still there’s no better Kubernetes distribution available on the market that is so rich in features. This also comes with its biggest disadvantage – the price that for some is just too high. OpenShift is Red Hat’s flagship product that is targeted at enterprises. Of course they sell it to medium or even small companies, but the main target group is big enterprises with a big budget. It has also become a platform for Red Hat’s other products or other vendors’ services that are easily installable and available at https://www.operatorhub.io/. OpenShift can be installed in the cloud, but it’s on-premise environments is where it shows its most powerful features. Almost every piece of it is highly automated and this enables easy maintenance of clusters (installation, upgrades and scaling), rapid deployment of supplementary services (databases, service mesh) and platform configuration. There is no other distribution that has achieved that level of automation. OpenShift is also the most complete solution which includes integrated logging, monitoring and CI/CD (although they are still working on switching from Jenkins to Tekton engine which is not that feature-rich yet).

When to choose OpenShift

  • If you have a big budget – money can’t bring happiness, but it can buy you the best Kubernetes distribution, so why hesitate?
  • If you want to have the easiest and smoothest experience with Kubernetes – a user-friendly web console that is second to none and comprehensive documentation.
  • You don’t plan to scale rapidly but you need a bulletproof solution – OpenShift can be great for even small environments and as long as they won’t grow it can be financially reasonable
  • Your organization has few DevOps/Ops people – OpenShift is less demanding from a maintenance perspective and may help to overcome problems with finding highly skilled Kubernetes and infrastructure experts
  • The systems that your organization builds are complex – in cases where the development and deployment processes require a lot of additional services, there’s no better way to create and maintain clusters on on-premise environments than by using operators (and buying additional support for them if needed)
  • If you need support (?) – I’ve put it here just for the sake of providing some reasonable justification for the high price of an OpenShift subscription, but unfortunately many customers are not satisfied with the level of product support and thus it’s not the biggest advantage here

When to avoid OpenShift

  • All you need is Kubernetes API – maybe all these fancy features are just superfluous and just plain Kubernetes distribution is enough, provided that you have a team of skilled people that could build and maintain it
  • If your budget is tight – that’s obvious, but many believe they can somehow overcome the high price of OpenShift by efficiently bin packing their workloads on smaller clusters or get a real bargain when ordering their subscriptions (I guess it’s possible, but only for really big orders for hundreds of nodes)
  • Your organization is an avid supporter of open source projects and avoids any potential vendor lock-ins – although OpenShift includes Kubernetes and can be fully compatible with other Kubernetes distributions, there are some areas where a potential vendor lock-in can occur (e.g. reliance on builtin operators and their APIs)

2. OKD

Back in the day Red Hat used upstream-downstream strategy for product development where open source upstream projects were free to use and their downstream, commercial products were heavily dependent on their upstreams and built on top of them. That has changed with OpenShift 4 where its open source equivalent – OKD – was released months after OpenShift had been redesigned, with help from guys from CoreOS (Red Hat acquired CoreOS in 2018). So OKD is an open source version of OpenShift and it’s free. It’s a similar strategy that Red Hat has been using for years – to attract people and accustom them to the free (upstream) versions and also give them a very similar experience to their paid products. The only difference is of course lack of support and few features that are available in OpenShift only. That’s what the key factors to consider are when deciding on a Kubernetes platform – does your organization need support or will it get by without it? Things got a little bit more complicated after Red Hat (who own CentOS project) has announced that CentOS 8 will cease to exist in the form that has been known for years. CentOS is widely used by many companies as a free version of RHEL (Red Hat Enterprise Linux) and it looks like it has changed and we don’t know what IBM will do with OKD (I suspect it was their business decision to pull the plug). There’s a risk that OKD will also no longer be developed, or at least it will not resemble OpenShift like it does now. As for now being still very similar to OpenShift, OKD can be also considered as one of the best Kubernetes platforms to use for on-premise installations.

When to choose OKD

  • You don’t care about Red Hat addons, but still need a highly automated platform – OKD can still brings your environment to a completely different level by leveraging operators, builtin services (i.e. logging, monitoring)
  • You don’t need support, because you have really smart people with Kubernetes skills – either you pay Red Hat for its support or build an internal team that would act as 1st, 2nd and 3rd line of support (not mentioning the vast resources available on the web)
  • You plan to run internal workloads only without exposing them outside – Red Hat brags about providing curated list of container images while OKD relies on community’s work on providing security patches and this causes some delays; for some this can be an acceptable risk, especially if the platform is used internally
  • You need a Kubernetes distribution that is user-friendly – web console in OKD is almost identical to the one in OpenShift which I already described before as second to none; it often helps less experienced users to use it and even more experienced ones can use it to perform daily tasks even faster by leveraging all the information gathered in a concise form
  • You want to decrease costs of OpenShift and use it for testing environments only – this idea seems to be reasonable from the economic point of view and if planned and executed well it makes sense; there are some caveats though (e.g. it is against Red Hat license to use most of their container images)

When to avoid OKD

  • Plain Kubernetes is all you need – with all these features comes complexity that may be just not what your organization needs and you’d be better off with some simpler Kubernetes distribution
  • You expect quick fixes and patches – don’t get me wrong, it looks like they are delivered, but it’s not guaranteed and relies solely on community (e.g. for OpenShift Origin 3, a predecessor of OKD, some container images used internally by the platform haven’t been updated for months whereas OpenShift provided updates fairly quickly)
  • You need a stable and predictable platform – nobody expected CentOS 8 would no longer be an equivalent to RHEL and so similar decisions of IBM executives can affect OKD and there’s a risk that sometime in the future all OKD users would have no choice but to migrate to some other solution

3. Rancher

After Rancher had been accquired by SUSE, a new chapter opened for this niche player on the market. Although SUSE already had their own Kubernetes solution, it’s likely that they will only have a single offering of that type and it’s going to be Rancher. Basically, Rancher offers an easy management of multiple Kubernetes clusters that can be provisioned manually and imported into the Cluster Manager management panel or provisioned by Rancher using its own Kubernetes distribution. They call it RKE – Rancher Kubernetes Engine and it can be installed on most major cloud providers, but also on vSphere. Managing multiple clusters using Rancher is very easy and combining it with plenty of authentication options makes it a really compelling solution for those who plan to manage hybrid, multi-cluster, or even multi-cloud environments. I think that Rancher has initiated many interesting projects, including K3S (simpler Kubernetes control plane targeted for edge computing) , RKE (the aforementioned Kubernetes distribution), and Longhorn (distributed storage). You can see they are in the middle of an intensive development cycle – even by looking at the Rancher’s inconsistent UI which is divided into two: Cluster Manager with a fresh look, decent list of options, and Cluster Explorer that is less pleasant, but offers more insights. Let’s hope they will continue improving Rancher and its RKE to be even more usable so that it would become an even more compelling Kubernetes platform for on-premise environments.

When to choose Rancher

  • If you already have VMware vSphere – Rancher makes it very easy to spawn new on-premise clusters by leveraging vSphere API
  • If you plan to maintain many clusters (all on-premise, hybrid or multi-cloud) – it’s just easier to manage them from a single place where you log in using unified credentials (it’s very easy to set up authentication against various services)
  • You focus on platform maintenance more than on features supporting development – with nice integrated backup solution, CIS benchmark engine and only few developer-focused solution (I think their CI/CD solution was put there just for the sake of marketing purposes – it’s barely usable) it’s just more appealing to infrastructure teams
  • If you really need paid support for your Kubernetes environment – Rancher provides support for its product, including their own Kubernetes distribution (RKE) as well as for custom installations; When it comes to price it’s a mystery that will be revealed when you contact Sales
  • You need a browser-optimized access to your environment – with builtin shell it’s very easy to access cluster resources without configuring anything on a local machine

When to avoid Rancher

  • You don’t care about fancy features – although there are significantly less features in Rancher than in OpenShift or OKD, it is still more than just a nice UI and some may find it redundant and can get by without them
  • You’re interested in more mature products – it looks like Rancher has been in an active development over the past few months and probably it is going to be redesigned and some point, just like it happened with OpenShift (version 3 and 4 are very different)
  • You don’t plan or need to use multiple clusters – maybe one is enough?

4. VMware Tanzu

The last contender is Tanzu from the biggest on-premise virtualization software vendor. When they announced project Pacific I knew it was going to be huge. And it is. Tanzu is a set of products that leverage Kubernetes and integrate them with vSphere. The product that manages Kubernetes clusters is called Tanzu Kubernetes Grid (TKG) and it’s just the beginning of Tanzu offering. There’s Tanzu Mission Control for managing multiple clusters, Tanzu Observability for.. observability, Tanzu Service Mesh for.. yes, it’s their service mesh, and many more. For anyone familiar with enterprise offering it may resemble any other product suite from a big giant like IBM, Oracle and so on. Let’s be honest here – Tanzu is not for anyone that is interested in “some” Kubernetes, it’s for enterprises accustomed to enterprise products and everything that comes with it (i.e. sales, support, software that can be downloaded only for authorized users, etc.). And it’s especially designed for those whose infrastructure is based on the VMware ecosystem – it’s a perfect addition that meets requirements of development teams within an organization, but also addresses operations teams concerts with the same tools that’s been known for over a decade now. When it comes to features they are pretty standard – easy authentication, cluster scaling, build services based on buildpacks, networking integrated with VMware NSX, storage integrated with vSphere – wait, it’s starting to sound like a feature list of another vSphere addon. I guess it is an addon. For those looking for fancy features I suggest waiting a bit more for VMware to come up with new Tanzu products (or for a new acquisition of another company from cloud native world like they did with Bitnami).

When to choose Tanzu

  • When your company already uses VMware vSphere – just contact your VMware sales guy who will prepare you an offer and the team that takes care of your infrastructure will do the rest
  • If you don’t plan to deploy anything outside of your own infrastructure – although VMware tries to be a hybrid provider by enabling integration with AWS or GCP, it will stay focused on on-premise market where it’s undeniably the leader
  • If you wish to use multiple clusters – Tanzu enables easy creation of Kubernetes clusters that can be assigned to development teams
  • If you need support – it’s an enterprise product with enterprise support

When to avoid Tanzu

  • If you don’t have already vSphere in your organization – you need vSphere and its ecosystem, that Tanzu is a part of, to start working with VMware’s Kubernetes services; otherwise it will cost you a lot more time and resources to install it just to leverage them
  • When you need more features integrated with the platform – although Tanzu provides interesting features (my favourite is Tanzu Build Service) it still lacks of some distinguished ones (although they provide some for you to install on your own from Solutions Hub) that would make it more appealing


I have chosen these four solutions for Kubernetes on-premise platform because I believe they provide a real alternative to custom-built clusters. These products make it easier to build and maintain production clusters, but also in many cases help to speed up the development process and provide insights for the deployment process as well. So here’s what I would do if I were to choose one:

  • if I had a big budget I would go with OpenShift, as it’s just the best
  • if I had a big budget and already existing VMware vSphere infrastructure I would consider Tanzu
  • if I had skilled Kubernetes people in my organization and I wanted to have an easy way to manage my clusters (provisioned manually) without vSphere I would choose Rancher (and optionally I would buy a support for those clusters when going to prod)
  • if I had skilled Kubernetes people in my organization and I would like to use these fancy OpenShift features I would go with OKD, as it’s the best alternative to custom-built Kubernetes cluster

That’s not all. Of course you can build your own Kubernetes cluster and it’s a path that is chosen by many organizations. There are many caveats and conditions that need to be met (e.g. scale of such endeavour, type of workloads to be deployed on it) for this to succeed. But that’s a different story which I hope to cover in some other article.


Mówiono nam, że tacy właśnie mamy być, aby odnieść sukces. Bezbłędni. Od początku w szkole i aż do pracy zawodowej. Ten artykuł poświęcam właśnie największej przeszkodzie stojącej na drodze do innowacji i sukcesu naszych firm oraz nas – niezależnie czy jesteśmy pracownikami, menedżerami, właścicielami firm czy też dopiero stawiamy pierwsze zawodowe kroki.


Obserwując nasze społeczeństwo i pamiętając jak wyglądało to jak byłem dzieckiem, później w szkole i w dalszych etapach mojego życia, mam wrażenie, że to nastawienie na błędy jest bardzo mocno zakorzenione w naszym społeczeństwie (albo przynajmniej w jego sporej części). Może to tylko moje doświadczenia, ale przeglądając internet trafiłem na ciekawy zapis jedynego źródła informacji jakie mieli nasi rodzice, dziadkowie w latach komunizmu – Dziennika Telewizyjnego (odpowiednik dzisiejszych Wiadomości). Polecam każdemu sprawdzić samodzielnie jak już wówczas społeczeństwo było nastawione na szukanie błędów. Komiczne są sytuacje, gdzie ze względu na przerwane łańcuchy dostaw i niedomagającą gospodarkę, redaktor prowadzący zaciekle szuka winy za brak chleba w sklepie u… kierowniczki tegoż. Oczywiście sytuacje takie zdarzają się również dzisiaj, ale przyzwyczajenie do szukania win zamiast rozwiązań jest z pewnością najłatwiejsze i najwygodniejsze, ale niezwykle ograniczające i nawet wręcz głupie jak się choć chwilę zatrzymać i zastanowić.


Wizją takiego świata łatwo jest zarazić swoje najbliższe otoczenie. Jest ona na tyle kusząca, że zdejmuje z nas odpowiedzialność za podejmowanie ryzyka i ciężkiej pracy. Niesie ona też poczucie ulgi, gdy to komuś się nie udało i to jego “złapano” go na błędzie. To wspaniała ucieczka przed tą ocena i narażaniem się na śmieszność, krytykę i porażkę, a tak można w zaciszu swojej strefy komfortu usiąść w loży szyderców z innymi o podobnych lękach. Byłem tam. Lubiłem moją lożę i mój wyszukany sarkazm, który jest potężną bronią i tarczą zarazem. Pomaga w utwierdzaniu się o słuszności niewychodzenia i niekonfrontowania się z brutalną niekiedy rzeczywistością, szczególnie gdy rzeczywistość ta jest złożona właśnie z innych wytykających nasze błędy i czerpiących z tego niemałą satysfakcję.


O jak wygodnie jest być w miejscu, gdzie jedynym wysiłkiem jest szukanie wad i błędów u innych! A to, bądźmy tutaj szczerzy, jest dość łatwe. Tkwiąc w tej sytuacji tracimy olbrzymią część naszego potencjału. Przekierowujemy naszą energię nie tam gdzie powinniśmy. Unikamy ryzyka, nawet gdy jest ono niewielkie. Jesteśmy ciągle w pozycji obronnej i ważymy nasze decyzje, aby tylko nie popełnić błędu, który będzie nam wytknięty. W naszych głowach świat tylko czyha na nasze potknięcie i pokazanie nam naszej nieudolności. Ciągła pozycja obronna nie daje nam możliwości na atak. Taka ofensywa związana z arsenałem jakim dysponujemy teraz albo arsenał jakiego nam brakuje, aby wyjść z okopów i zmierzyć się ze światem takim jakim on jest. Zobaczyć, że poza okopami jest wielu ludzi, którzy też z nich wyszli i zmierzają się ze swoimi słabościami oraz bronią się dzielnie również przed atakami tych, którzy z tych okopów nigdy nie wyjdą, ale z zaciekłością ich ostrzeliwują.


Poza cytatem Teodora Roosvelta, w którym porównuje on tą walkę do wyjścia na ring, bardzo utwkił mi cytat Thomasa Watsona, dawnego szefa IBM. Zapytany czy zwolni pracownika, którego błąd kosztował firmę $600k, odpowiedział, że właśnie wydał te $600k na przeszkolenie tego pracownika i dziwi się jak mógłby tak wyszkolonego pracownika zwolnić. To wymaga radykalnej wręcz zmiany wizji świata. To wymaga akceptacji świata takim jakim jest. Wiem, to brzmi jak banał, ale pomaga wyjść z okopów. Jesteśmy tylko ludźmi i stworzeniami niedoskonałymi z założenia. Nawet natura popełnia błędy – w końcu sama ewolucja to pasmo prób i błędów. Wciąż zdarzają się potknięcia, choroby, katastrofy i rzeczy, na które nie mamy wpływu. Akceptujemy to jakim jest i szukamy rozwiązań, aby przeciwdziałać kataklizmom albo przynajmniej zminimalizować ich skutki. Dlaczego więc nie mielibyśmy postępować podobnie w przypadku, gdy mamy większy wpływ? Bo czyż nie jesteśmy sami w sobie taką małą ewolucją tylko o ograniczonym czasowo działaniu?

Konstruktywna krytyka, a oderwanie od rzeczywistości

Jak odróżnić krzyki narzekaczy od zgłaszanych faktycznych problemów związanych z naszą działalnością? Łatwo jest wszakże uznać, że każda krytyka jest bezpodstawna, a stoi za nią zawiść i inne emocje niekoniecznie związane z faktami. Tutaj pomocnym wydaje się zdrowe podejście związane z wiarygodnością źródła takich opinii. Zdecydowanie bardziej wiarygodni będą ci, którzy już są na ringu od wielu lat i przeżyli wiele bitew zdobywając więcej doświadczenia. Warto mieć grupę takich osób, które bez ogródek sprowadzą nas na ziemię kiedy trzeba i podpowiedzą rozwiązania, gdy faktycznie jest potrzebne działanie korygujące. Gorzej jest z krzykaczami i hejterami. Ich wiarygodność jest niska, ale zaangażowanie niezwykle wysokie. Ich działalność to ekstremalny przykład ludzi, którzy nigdy nie zamierzają wyjść i spróbować swoich sił, gdyż są za słabi. Wierzę jednak i widzę po różnych przykładach, że ich głos jest ledwo słyszalny gdy nie ma podstaw merytorycznych. Stąd warto skupiać się na dialogu z tymi, którym zależy na tym co tworzymy i słuchać ich głosu, szczególnie gdy nasze usługi adresowane są do szerszego grona odbiorców. Dobry produkt obroni się sam.

Nasze miejsce jest na ringu

Zawsze będą tacy co wybiorą lożę szyderców będą podśmiewywać się z potknięć i upadków innych. Pozwólmy im tam zostać, a sami wyjść na ring, bo tam jest nasze miejsce. Tam czekają wzloty i upadki, ale to też tam marzenia są przekładane na rzeczywistość. Podziwiam tych co wychodzą codziennie na ring i używają swojej energii na tworzenie wartości. Trzymam kciuki, aby było nas coraz więcej!