OpenShift is a capable platform. But “capable” and “the right fit for a sovereign, regulated estate” are different questions. If you are running the evaluation, here is a framework that keeps it honest.
Four axes that matter in regulated environments
1. Sovereignty
Ask the sovereignty-washing questions: can you audit the source, self-host it entirely, and run with no foreign root access or vendor control point? A platform tied to a single vendor’s subscription and registry is a dependency to name explicitly.
2. Air-gap as a first-class mode
Not “supported with caveats” — genuinely disconnected install and Day-2 with no call-home. For classified and critical workloads this is a gating requirement, not a nice-to-have. (See how air-gapped Kubernetes works.)
3. Lock-in
A CNCF-conformant, upstream-aligned Kubernetes lets you import existing clusters and move workloads without rewriting around distribution-specific abstractions. Weigh how much of the platform is standard Kubernetes vs. proprietary layers you would have to unwind later.
4. Total cost and operations
Look past licence list price to the operational cost: how many people does it take to run the fleet, and does the model scale to many sites with a small (cleared) team?
An honest note
We build a Kubernetes platform, so we are not a neutral party — treat this as a framework, not a verdict. The right answer depends on your estate. What we will stand behind is the shape of the decision: for sovereign, regulated, air-gap-capable requirements, an open, CNCF-conformant, self-hosted platform is a stronger structural fit than a vendor-specific distribution.
Where we fit that framework: Secure Operations.