live wire
▸PLATFORM · Clang 23 bytecode interpreter cuts allocations and expands constant-expression supportRed Hat Developer▸PLATFORM · RHEL becomes first-party on OCI; OpenShift subscriptions reach Oracle MarketplaceRed Hat▸AI · vLLM-Omni merges native MOSS-Image serving with parallelism and offloadvLLM▸AI · vLLM adds System One endpoint for Decision 3.0 multimodal routing models (Oct. 15)vLLM▸SECURITY · Red Hat rates OpenShift AI 3.4.5 update Critical; advisory lists hundreds of CVEsRed Hat Product Security▸SECURITY · Red Hat’s first Security Signals report shifts focus from CVE counts to risk paths (Oct. 15)Red Hat▸PLATFORM · IBM adds non-destructive FlexVolume-to-CSI migration tool for OpenShift object storageIBM Cloud▸vLLM tests agent-built Kimi K3 decode path at up to 1.9× speedup; PR remains openvLLM▸AI · LeaderWorkerSet 1.0 changes rollout defaults for disaggregated AI workloadsKubernetes SIGs▸SECURITY · Red Hat flags active exploitation of kernel flaw affecting OpenShift CoreOS; no fix listedRed Hat Product Security▸AI · Red Hat sets Dec. 9 showcase for AI 3.6 agent governance and model servicesRed Hat▸vLLM 0.32.0 drops Python 3.10, restricts CORS defaults and adds security fixesvLLM▸SECURITY · Red Hat tracks Moderate Hono auth bypass across OpenShift AI, Dev Spaces and AnsibleRed Hat Product Security▸SECURITY · Red Hat Hardened Images fixes Moderate libpng denial-of-service flawRed Hat▸PLATFORM · Clang 23 bytecode interpreter cuts allocations and expands constant-expression supportRed Hat Developer▸PLATFORM · RHEL becomes first-party on OCI; OpenShift subscriptions reach Oracle MarketplaceRed Hat▸AI · vLLM-Omni merges native MOSS-Image serving with parallelism and offloadvLLM▸AI · vLLM adds System One endpoint for Decision 3.0 multimodal routing models (Oct. 15)vLLM▸SECURITY · Red Hat rates OpenShift AI 3.4.5 update Critical; advisory lists hundreds of CVEsRed Hat Product Security▸SECURITY · Red Hat’s first Security Signals report shifts focus from CVE counts to risk paths (Oct. 15)Red Hat▸PLATFORM · IBM adds non-destructive FlexVolume-to-CSI migration tool for OpenShift object storageIBM Cloud▸vLLM tests agent-built Kimi K3 decode path at up to 1.9× speedup; PR remains openvLLM▸AI · LeaderWorkerSet 1.0 changes rollout defaults for disaggregated AI workloadsKubernetes SIGs▸SECURITY · Red Hat flags active exploitation of kernel flaw affecting OpenShift CoreOS; no fix listedRed Hat Product Security▸AI · Red Hat sets Dec. 9 showcase for AI 3.6 agent governance and model servicesRed Hat▸vLLM 0.32.0 drops Python 3.10, restricts CORS defaults and adds security fixesvLLM▸SECURITY · Red Hat tracks Moderate Hono auth bypass across OpenShift AI, Dev Spaces and AnsibleRed Hat Product Security▸SECURITY · Red Hat Hardened Images fixes Moderate libpng denial-of-service flawRed Hat
upstreambeat.ai
newsPLATFORM

Azure Red Hat OpenShift moves hosted control planes into public preview

The HyperShift-based option removes control-plane compute from customer subscriptions, separates control-plane and worker upgrades, and starts with CLI deployment.

Hosted control plane moves out of customer subscription, leaving workers behind.
AI-generated illustration
By The News Desk· Sep 17, 2026the quick take — two AI hosts go live when you do

Azure Red Hat OpenShift has opened a public preview of hosted control planes, moving the Kubernetes control plane out of the customer’s Azure subscription and into a dedicated Azure service account managed by Red Hat.

The deployment model is based on the upstream HyperShift project. In the standard Azure Red Hat OpenShift architecture, three dedicated master nodes and the workers run in the customer subscription. The preview removes that control-plane compute and storage footprint from the customer account, leaving the customer to pay for the worker-side compute, networking and storage.

A smaller, decoupled cluster footprint

Red Hat says the minimum infrastructure footprint falls from six nodes to two. It estimates an average infrastructure-cost reduction of as much as fourfold, although that figure comes from a 2026 internal study and will depend on worker sizing and workload shape.

The control plane and worker nodes also gain separate upgrade schedules. Red Hat SREs handle control-plane patching, upgrades and multi-availability-zone placement, while customers can update worker nodes independently. Authentication is limited to managed identities and workload identities; the hosted option does not support service principals.

Red Hat reports provisioning-time reductions of up to 55%. Microsoft’s preview documentation says a typical deployment takes 15 to 20 minutes after the required network, identities, role assignments and encryption resources are prepared.

CLI first, portal later

Preview clusters are created from the command line with an Azure CLI extension or from a Bicep file. The setup is not a one-command abstraction: Microsoft’s guide requires at least 20 cores of quota, a delegated virtual-network integration subnet, a set of user-assigned managed identities and role assignments, and customer-managed encryption for etcd data.

The cluster command exposes public or private visibility for both the API server and application ingress. It also supports public or private Azure Key Vault access for the customer-managed key. A separate command creates the worker node pool after the hosted cluster resource is ready.

Red Hat says an Azure portal workflow is planned for general availability. No GA date is given.

For platform teams, the preview’s main trade is explicit: a smaller customer-side footprint and independently managed control plane in exchange for a newer architecture whose provisioning workflow still exposes substantial Azure identity, networking and key-management detail. Teams evaluating it should validate those prerequisites and preview support limits before treating the cost estimates as a production baseline.

sources

Filed by The News Desk. Corrections: desk@upstreambeat.ai · Our standards →

comments · 0

    Comments are moderated before they appear. Your email is used once to confirm it is you — never shown, never sold. Corrections and questions get an answer from the desk when we have one.

    more from the desk