live wire
▸PLATFORM · Clang 23 bytecode interpreter cuts allocations and expands constant-expression supportRed Hat Developer▸PLATFORM · RHEL becomes first-party on OCI; OpenShift subscriptions reach Oracle MarketplaceRed Hat▸AI · vLLM-Omni merges native MOSS-Image serving with parallelism and offloadvLLM▸AI · vLLM adds System One endpoint for Decision 3.0 multimodal routing models (Oct. 15)vLLM▸SECURITY · Red Hat rates OpenShift AI 3.4.5 update Critical; advisory lists hundreds of CVEsRed Hat Product Security▸SECURITY · Red Hat’s first Security Signals report shifts focus from CVE counts to risk paths (Oct. 15)Red Hat▸PLATFORM · IBM adds non-destructive FlexVolume-to-CSI migration tool for OpenShift object storageIBM Cloud▸vLLM tests agent-built Kimi K3 decode path at up to 1.9× speedup; PR remains openvLLM▸AI · LeaderWorkerSet 1.0 changes rollout defaults for disaggregated AI workloadsKubernetes SIGs▸SECURITY · Red Hat flags active exploitation of kernel flaw affecting OpenShift CoreOS; no fix listedRed Hat Product Security▸AI · Red Hat sets Dec. 9 showcase for AI 3.6 agent governance and model servicesRed Hat▸vLLM 0.32.0 drops Python 3.10, restricts CORS defaults and adds security fixesvLLM▸SECURITY · Red Hat tracks Moderate Hono auth bypass across OpenShift AI, Dev Spaces and AnsibleRed Hat Product Security▸SECURITY · Red Hat Hardened Images fixes Moderate libpng denial-of-service flawRed Hat▸PLATFORM · Clang 23 bytecode interpreter cuts allocations and expands constant-expression supportRed Hat Developer▸PLATFORM · RHEL becomes first-party on OCI; OpenShift subscriptions reach Oracle MarketplaceRed Hat▸AI · vLLM-Omni merges native MOSS-Image serving with parallelism and offloadvLLM▸AI · vLLM adds System One endpoint for Decision 3.0 multimodal routing models (Oct. 15)vLLM▸SECURITY · Red Hat rates OpenShift AI 3.4.5 update Critical; advisory lists hundreds of CVEsRed Hat Product Security▸SECURITY · Red Hat’s first Security Signals report shifts focus from CVE counts to risk paths (Oct. 15)Red Hat▸PLATFORM · IBM adds non-destructive FlexVolume-to-CSI migration tool for OpenShift object storageIBM Cloud▸vLLM tests agent-built Kimi K3 decode path at up to 1.9× speedup; PR remains openvLLM▸AI · LeaderWorkerSet 1.0 changes rollout defaults for disaggregated AI workloadsKubernetes SIGs▸SECURITY · Red Hat flags active exploitation of kernel flaw affecting OpenShift CoreOS; no fix listedRed Hat Product Security▸AI · Red Hat sets Dec. 9 showcase for AI 3.6 agent governance and model servicesRed Hat▸vLLM 0.32.0 drops Python 3.10, restricts CORS defaults and adds security fixesvLLM▸SECURITY · Red Hat tracks Moderate Hono auth bypass across OpenShift AI, Dev Spaces and AnsibleRed Hat Product Security▸SECURITY · Red Hat Hardened Images fixes Moderate libpng denial-of-service flawRed Hat
upstreambeat.ai
guidePLATFORM

A GitOps pattern for OpenShift hosted control planes on bare metal

Red Hat combines HyperShift, OpenShift Virtualization, Advanced Cluster Management and Argo CD ApplicationSets into a cluster-as-a-service workflow.

GitOps-managed hosted control planes on bare metal.
AI-generated diagram
By The News Desk· Oct 6, 2026the quick take — two AI hosts go live when you do

A new Red Hat Developer guide turns hosted control planes on bare metal into a declarative fleet pattern. The design runs control planes as pods on a central management cluster, provisions worker nodes as OpenShift Virtualization virtual machines and uses Git as the interface for creating or changing each hosted cluster.

The useful part is not simply that HyperShift can separate control planes from workers. The guide shows how OpenShift GitOps and Advanced Cluster Management can make that topology repeatable—and where bare-metal networking, storage and deletion safety still need deliberate platform decisions.

Four layers in the management cluster

The management cluster hosts OpenShift Virtualization, Advanced Cluster Management and OpenShift GitOps. HyperShift control-plane components run in dedicated namespaces there, while KubeVirt-backed worker VMs attach to the hosted cluster.

Red Hat’s repository layout separates the workflow into three directories: Argo CD bootstrap resources under gitops, reusable Helm templates under helm, and one small values file per hosted cluster under clusters. An ApplicationSet Git file generator watches those cluster files and renders a separate Argo CD Application from the shared chart.

That makes a cluster definition the data layer rather than another copied manifest tree. Operators set the OpenShift version, worker count, compute, storage class, network ranges, VLAN and proxy values in one file; GitOps renders the HostedCluster, NodePool and Advanced Cluster Management registration resources.

Bare metal makes the prerequisites part of the design

The pattern assumes three network paths: management traffic, a dedicated high-speed live-migration network and VLAN-backed hosted-cluster traffic. Because the worker VMs bypass the default pod network, they need Multus network attachments and external DHCP. MetalLB supplies the external address for the hosted control-plane API where no cloud load balancer exists.

Storage must support ReadWriteMany if worker VMs are to move between physical nodes. Red Hat names OpenShift Data Foundation as one option and says a certified CSI driver can be used if it provides the required capabilities.

Proxy settings also need special treatment. The hosted control-plane pods physically run on the management cluster, so noProxy must include both hosted-cluster ranges and the management cluster’s machine, cluster and service networks plus its API domain. Missing those ranges can send internal control-plane traffic through the corporate proxy and break cluster communication.

Guardrails belong in the GitOps objects

Red Hat’s ApplicationSet example enables self-healing but sets prune: false to prevent removal of a cluster definition from automatically deleting the cluster. Secrets are also kept out of Git; the guide recommends injecting pull secrets and SSH keys through an external-secrets mechanism in production.

The sample NodePool uses replacement upgrades, which recreate workers during a hosted-cluster update. Platform teams that need in-place upgrades can select that behavior instead, but should make the choice explicit in the template.

The operational payoff is a narrow service interface: add or edit one values file, let Argo CD render the infrastructure and monitor the resulting control plane, worker VMs and Advanced Cluster Management registration. The pattern is most useful to teams that already operate a capable bare-metal management cluster and want cluster provisioning to behave like reviewed application delivery rather than a sequence of administrator commands.

sources

Filed by The News Desk. Corrections: desk@upstreambeat.ai · Our standards →

comments · 0

    Comments are moderated before they appear. Your email is used once to confirm it is you — never shown, never sold. Corrections and questions get an answer from the desk when we have one.

    more from the desk