A distribution you adopt, or standard Kubernetes you keep
OpenShift is a complete enterprise Kubernetes product. It includes its own installer and operating system, a security model, registry, router, developer console and a large operator ecosystem, all backed by Red Hat support. OpenShift 5 became generally available on 9 November 2026, with an in-place update from OpenShift 4. You can run it yourself, or buy it as a managed service on AWS and Azure that Red Hat operates jointly with Amazon and Microsoft.
Ankra keeps Kubernetes standard. It builds kubeadm or k3s clusters on Hetzner, OVHcloud, UpCloud, DigitalOcean, AWS EC2 and Proxmox VE, creates EKS, GKE, AKS, DOKS, OVHcloud MKS and UpCloud UKS, or imports a cluster you already run. Scaleway Kapsule and Ankra Cloud Kubernetes, control planes on Ankra Cloud, Ankra’s own EU cloud, are in closed beta. Then Ankra runs delivery, security, cost and AI operations on top.
The decision is whether you want one vendor’s distribution end to end, or an operating platform over standard Kubernetes on the infrastructure you choose.
Who does the platform work
OpenShift reduces work compared with assembling everything yourself, but on a self-managed install your team still owns upgrades, operator lifecycles, capacity and security settings, and that work needs people who know OpenShift. OpenShift 5 helps: Lightspeed checks upgrade risk before you start, and the standard lifecycle grows from 18 to 24 months, with up to five years on extended releases from 5.2. ROSA, ARO and OpenShift Dedicated move cluster operations to Red Hat and its partners, while your team runs everything on the cluster.
Ankra’s control plane is a hosted service in the EU by default, and Enterprise customers can run Ankra self-hosted, including air-gapped, as an Enterprise add-on. On clusters it builds, it handles upgrades, node groups and power schedules and, on the five public clouds, rolling OS security patching one host at a time and node autoscaling. Platform add-ons live in stacks that set install order, and stack profiles carry a proven setup to each new environment.
Red Hat now competes on sovereignty too. Its Confirmed Sovereign Support offers support from EU-based staff across the 27 member states. Ankra’s control plane, databases and secret store run in Finland.
From a repository to a release
OpenShift ships the parts. OpenShift GitOps 1.22 and Pipelines 1.24 bring Argo CD and Tekton as operators, with multistage promotions in Technology Preview, and your team designs the flow that connects them.
Ankra ships the flow. Applications analyse your GitHub repository and open a setup pull request with build files, or keep the CI you already run in GitHub Actions, GitLab CI, Bitbucket Pipelines or CircleCI. Ankra Pipelines run tests, rootless image builds and Semgrep, Checkov and Trivy scans in your own cluster, and only the image that passed the gate is published. A merge train on GitHub tests each pull request as the exact squash it will merge, and deploy provenance can refuse images your gate did not sign. Ankra’s own deployment engine applies changes without an Argo CD to operate.
Some limits apply. Pull-request previews work for GitHub Applications only, and Ankra’s docs say not to rely on them yet while a known bug is open. Several documented pipeline stage kinds, including in-pipeline approval, do not run yet. Check both against your process.
Security, cost and recovery
OpenShift is hardened by default, and OpenShift 5 adds post-quantum cryptography for control-plane traffic. Advanced Cluster Security 4.11 adds runtime detection, admission control and vulnerability management, and Red Hat Trusted Profile Analyzer has exploit intelligence in Technology Preview. ROSA on GovCloud is FedRAMP High.
Ankra’s Security Center focuses on what to fix first. It ranks vulnerabilities in running workloads by CISA’s Known Exploited Vulnerabilities catalogue and FIRST’s EPSS scores, shows the fixed version for each, and offers optional SBOMs. Compliance Management scores Pod Security Standards, and CIS and NSA/CISA where those inputs are enabled. It produces evidence that feeds an ISO 27001 management system, such as pre-approved standard changes. Ankra’s security and compliance status is on its trust page. If you need a certified vendor today, that matters.
Cloud Cost estimates spend per namespace and stack from list prices and reprices a cluster on other providers. Backups write volumes and database dumps to a bucket you own and restore them in place. CloudNativePG and Percona databases are captured, but restoring them in place is not available yet.
How the AI helps
OpenShift Lightspeed is available with every self-managed edition. In OpenShift 5 it is an agent: it analyses symptoms, traces the root cause, proposes a fix with exact commands and, once you approve, applies it in a sandbox and checks the result. It also assesses upgrade risk. OpenShift 5’s MCP server is read-only by default and enforces Kubernetes RBAC. You supply the model, which can be self-hosted.
Ankra’s AI covers more of the delivery path. AI Insights analyses every firing alert and can also run scheduled health scans. The AI Gateway reviews pull requests on GitHub, GitLab and Bitbucket Cloud, and Ankra AI commits fixes to failing pull requests, including merge conflicts and failed tests. It also drafts stacks from a description. Writes from Ankra’s own AI wait for a person by default, under autonomy controls you set. Ankra’s MCP server audits every write, and your MCP client decides how writes are confirmed. You can bring your own model here too, including a self-hosted endpoint.
When to choose Ankra, and when to choose OpenShift
Choose Ankra when you want production Kubernetes on infrastructure you pick, including European providers, with delivery, security ranking, cost and backups in one product and no distribution-specific skills to hire for.
Choose OpenShift when
- you are standardising on Red Hat and want one vendor accountable from the operating system to the console
- you need IBM Z, Power or FedRAMP High environments, or a long support lifecycle
- you are moving off VMware with OpenShift Virtualization
- you want a jointly managed service inside your AWS or Azure bill
- you have, or plan to hire, OpenShift-skilled platform engineers
Compare the work that remains
- Create the foundation. Record the work outside the product, and the people needed to run it.
- Ship a release. Include tests, scans, a staging deploy and a rollback.
- Handle an incident. Note who finds the cause and how the fix reaches the cluster and Git.
- Investigate a vulnerability. Find every affected workload and release the fix.
- Compare total cost. Include subscriptions, infrastructure and the specialist team.
OpenShift self-managed is quoted per subscription. Ankra has a free tier with 30 worker vCPU, then €0.01 per worker vCPU-hour (about €7.20 a month) on Startup, and your provider bills the servers. See Ankra’s pricing.
Reviewed 9 November 2026 against OpenShift’s documentation and pricing. Product scope and plans can change.