Azure Red Hat OpenShift with hosted control planes is now available in public preview

Azure Red Hat OpenShift with hosted control planes is now in public preview. This new architecture can improve operational efficiency, increase cost savings, and accelerate deployment by having the control plane managed in an Azure account for your Azure Red Hat OpenShift service rather than your own Azure account.

Azure Red Hat OpenShift provides a comprehensive application platform designed to accelerate application delivery, but that's not all it does. Azure Red Hat OpenShift provides a robust foundation to build, deploy, and manage applications at scale, to improve operational efficiency, reduce complexity with a unified platform, offload ongoing infrastructure management to a team of Red Hat site reliability engineers (SREs), and manage different workloads such as AI-enabled applications alongside VMs and containers.

In this blog, we discuss hosted control planes in detail, the differences between Azure Red Hat OpenShift (standard architecture) clusters and Azure Red Hat OpenShift with hosted control planes clusters, and the benefits of Azure Red Hat OpenShift with hosted control planes.

Architectural overview: Standard architecture and hosted control planes

Let's take a closer look at the differences in architecture for Azure Red Hat OpenShift (standard architecture) and Azure Red Hat OpenShift with hosted control planes.

Azure Red Hat OpenShift (standard architecture)

When deploying an Azure Red Hat OpenShift (standard architecture) cluster, it requires deploying 3 master nodes dedicated to the control plane. In Azure Red Hat OpenShift (standard architecture), both the control plane and worker nodes run within your Azure subscription. Additionally, the cluster API server is published through an Azure network interface card (NIC), allowing a Red Hat SRE to establish secure access to the cluster environment through a private network. This allows a Red Hat SRE to automate Day 2 operations, such as monitoring, maintenance, updating, patching, and more, which frees up time for your teams to focus on other core business functions instead of managing the underlying infrastructure.

Azure Red Hat OpenShift with hosted control planes (new architecture)

Hosted control planes, based on the HyperShift project, is a new deployment model in Azure Red Hat OpenShift that helps optimize costs, increase flexibility and improve efficiency. With this new deployment model, you no longer need to host the control plane within your individual Azure account. Rather, the control plane is hosted and managed in a dedicated Azure service account, which allows for faster provisioning, seamless autoscaling of the control plane, and more efficient use of resources.

Control plane location

• Standard architecture: Customer's Azure subscription
• Hosted control planes: Red Hat managed Azure service account

Infrastructure footprint

• Standard architecture: Customer pays for control plane compute and storage
• Hosted control planes: Reduced footprint; no control plane compute in customer account

Upgrade management

• Standard architecture: Control plane and workers upgraded together
• Hosted control planes: Control plane can be upgraded independently of worker nodes

Authentication model

• Standard architecture: Managed identities and workload identities, Service Principals
• Hosted control planes: Managed identities and workload identities only

Provisioning speed

• Standard architecture: Standard cluster deployment time
• Hosted control planes: Accelerated cluster provisioning and deployment

Benefits of hosted control planes

As a comprehensive, managed application platform, Azure Red Hat OpenShift with hosted control planes can help you accelerate application development and delivery in the cloud with increased cost savings, improved operational efficiency, greater flexibility and an enhanced security posture.

Cost optimization

Today, Azure Red Hat OpenShift gives you multiple ways to optimize costs with pay-as-you-go pricing, reserved instances, and the ability to draw down on your Microsoft Azure Consumption Commitment (MACC). Azure Red Hat OpenShift with hosted control planes helps you further optimize costs by removing the control plane nodes from your Azure subscription. Azure Red Hat OpenShift with hosted control planes reduces your infrastructure footprint so you pay only for the compute, networking, and storage required to run your worker nodes. With a smaller footprint (minimum of 2 nodes instead of 6), Azure Red Hat OpenShift with hosted control planes can significantly reduce cloud infrastructure expenses on your Azure bill up to 4x on average (based on a 2026 Red Hat internal study).

Increased operational efficiency and reliability

Because Azure Red Hat OpenShift with hosted control planes architecture decouples the control plane from worker nodes, it gives you the flexibility to upgrade your worker nodes independently from the control plane on your own schedule. Red Hat SREs manage Day 2 control plane operations—including patching, upgrades, and multi-availability zone distribution—which reduces administrative overhead for your IT Ops team to focus on other core business areas.

Greater agility

The decoupled control plane architecture reduces cluster provisioning times by up to 55%, allowing development and operations teams to quickly spin up, scale, or tear down environments on demand as business requirements change. In public preview, users can deploy an Azure Red Hat OpenShift with hosted control planes cluster from the CLI. We are currently working on making the Azure portal experience available upon general availability.

Enhanced security posture

The Azure Red Hat OpenShift with hosted control planes architecture is designed with a security-first approach, and includes key differences between the standard architecture and HCP deployments. Azure Red Hat OpenShift with hosted control planes architecture reduces the potential attack surface of the environment by restricting direct access to the cluster. Additionally, Azure Red Hat OpenShift with hosted control planes will only support managed identities and workload identities instead of Service Principals, providing more secure authentication with short-term credentials and more granular access control. Managed identities and workload identities with hosted control planes helps minimize risk for security breaches and reduces operational overhead for periodic secret rotation.

Building on the robust, layered security features within Azure Red Hat OpenShift, the hosted control planes architecture provides enhanced protection against vulnerabilities and security threats by enabling:

• Bring your own keys (BYOK) for full control in managing and storing keys
• etcd encryption for protecting data at rest and adhering to strict compliance standards
• Support for hardware security modules (HSM) to store, manage and encrypt keys in dedicated hardware

Get started with Azure Red Hat OpenShift with hosted control planes

To learn more about Azure Red Hat OpenShift, check out:

• Learn how to deploy an Azure Red Hat OpenShift with hosted control planes cluster in public preview
• Azure Red Hat OpenShift learning hub
• Azure Red Hat OpenShift deployment interactive experience
• Azure Red Hat OpenShift product page