Red Hat OpenShift Service on AWS: Cloud Kubernetes Ledger

Part of the Managed Cloud Kubernetes Ledger (edition 2026-10-13). How the scores work: methodology.

1. Snapshot

Tier: Enterprise cloud
Owner: Red Hat, owned by IBM since 2019-07-09 (about $34 billion); ROSA sold and billed with AWS, ARO jointly operated with Microsoft
Licence model: Per-vCPU service fee on workers ($0.171 per 4 vCPU-hour on ROSA and ARO) plus cloud infrastructure; ROSA HCP cluster fee $0.25 per hour; 1- and 3-year contracts
Products scored: ROSA (hosted control planes and classic), ARO (standard; HCP in preview), OpenShift Dedicated, on OCP 4.21 and 4.22
Latest release: ROSA 4.22 (Kubernetes 1.35) on 2026-06-09; ARO 4.21 (Kubernetes 1.34) installable 2026-08-17
Next signal: ARO with hosted control planes in public preview since 2026-09, no GA date; ARO 4.22 'coming soon'
Archetype: Enterprise OpenShift as a cloud service
Evidence grade: C. Today's scores rest on ROSA and ARO release notes and life cycle pages read this run (A), but about a quarter of all scores are 2016-2022 history steps with unconfirmed facts (C).

2. Scorecard

Dimension	Score	Direction
Capability today	69.2 / 100	higher is better
Momentum since end of 2022	+10.4 points	higher is better
Credibility	17.0 / 25	higher is better
Commercial risk	6.5 / 25	lower is better
Technical lock-in	9.5 / 25	lower is better
Integrator fit	16.5 / 20	higher is better
AI leverage	10.5 / 20	higher is better
Ledger Index	67.5 / 100	balanced weights

3. Capability by domain

Scores 0 to 5 against fixed anchors; total is weighted to 100.

Domain (weight)	2016	2019	2022	Today
Versions, upgrades and support (12)	2	2.5	3	3.5
Nodes, autoscaling and compute choice (12)	2	2.5	3	4
Networking (10)	2	2.5	3	3.5
Storage and data protection (8)	1.5	2	2.5	3
Security and compliance (12)	2	2.5	3	3.5
Observability and day-2 operations (8)	1.5	2.5	3	3.5
Multi-cluster, hybrid and fleet (10)	1	1.5	2.5	2.5
Developer and app platform (8)	3	3.5	4	4
GPU and AI workloads (10)	0	0.5	2.5	3.5
Regions, sovereignty and SLA (10)	1.5	2.5	3	3.5
Total / 100	33.0	44.8	58.8	69.2

Year by year: 2016: 33.0 · 2017: 33.0 · 2018: 33.0 · 2019: 44.8 · 2020: 45.8 · 2021: 46.6 · 2022: 58.8 · 2023: 58.8 · 2024: 64.2 · 2025: 67.4 · 2026: 69.2

What moved the score

Year	Domain	Change	Points	Trigger
2019	Developer and app platform	3 → 3.5	+0.8	OCP 4 OperatorHub and developer console
2019	GPU and AI workloads	0 → 0.5	+1.0	No GPU node offering confirmed for OSD or ARO
2019	Multi-cluster, hybrid and fleet	1 → 1.5	+1.0	OpenShift Cluster Manager lists OSD and self-managed clusters
2019	Networking	2 → 2.5	+1.0	OpenShift SDN with network policies and cloud load balancers on OSD and ARO
2019	Nodes, autoscaling and compute choice	2 → 2.5	+1.2	OSD 4.x and ARO 3.11 with OCP machine sets; limits not confirmed
2019	Observability and day-2 operations	1.5 → 2.5	+1.6	OCP 4 built-in Prometheus and alerting on OSD 4.x
2019	Regions, sovereignty and SLA	1.5 → 2.5	+2.0	ARO GA with a 99.9% SLA in seven Azure regions
2019	Security and compliance	2 → 2.5	+1.2	ARO with Azure AD integration at 2019 launch
2019	Storage and data protection	1.5 → 2	+0.8	EBS, Persistent Disk and Azure Disk volumes; snapshots not confirmed
2019	Versions, upgrades and support	2 → 2.5	+1.2	OSD on OCP 4.1 from 2019-06-11 with about five months per minor; ARO 3.11 GA 2019-05-07
2020	Regions, sovereignty and SLA	2.5 → 3	+1.0	OSD and ARO SLA raised to 99.95% on 2020-10-07; ARO Azure Government announced 2021
2021	Developer and app platform	3.5 → 4	+0.8	OpenShift GitOps and Pipelines operators included; managed API and data-science add-ons for OSD and ROSA
2022	GPU and AI workloads	0.5 → 2.5	+4.0	GPU instance types on ROSA with the certified NVIDIA GPU Operator; Data Science add-on in field trial
2022	Multi-cluster, hybrid and fleet	1.5 → 2.5	+2.0	Same OpenShift on AWS, Azure, Google Cloud, IBM Cloud and on-premises; ACM is a separate customer-run product
2022	Networking	2.5 → 3	+1.0	ROSA PrivateLink clusters, ARO private clusters; OVN-Kubernetes reached ARO with 4.11 in 2023-02
2022	Nodes, autoscaling and compute choice	2.5 → 3	+1.2	ROSA machine pools with cluster autoscaler on many EC2 families
2022	Observability and day-2 operations	2.5 → 3	+0.8	User workload monitoring, log forwarding and Insights recommendations
2022	Security and compliance	2.5 → 3	+1.2	ROSA with AWS STS short-lived credentials; ARO in Azure Government from 2021
2022	Storage and data protection	2 → 2.5	+0.8	EBS and EFS CSI on ROSA, Azure Disk and File on ARO
2022	Versions, upgrades and support	2.5 → 3	+1.2	ROSA GA 2021-03-24; minors supported about 14 to 16 months; ARO installs months behind OCP
2024	Nodes, autoscaling and compute choice	3 → 3.5	+1.2	ROSA Graviton Arm and 500-node clusters in Q3 2024; ARO 250 nodes
2024	Regions, sovereignty and SLA	3 → 3.5	+1.0	ROSA in 32 AWS regions plus GovCloud with FedRAMP High; ARO in US Gov Arizona and Texas 2025; no EU sovereign variant
2024	Security and compliance	3 → 4	+2.4	ROSA GovCloud FedRAMP High 2024-01-18, external OIDC and Approved Access Q2 2024
2024	Storage and data protection	2.5 → 3	+0.8	OADP (Velero) documented for ROSA, configurable disks up to 16 TiB; no managed backup service
2025	GPU and AI workloads	2.5 → 3	+1.0	Trainium and Inferentia types Q2 2025; capacity reservations and Capacity Blocks for ML Q4 2025
2025	Networking	3 → 3.5	+1.0	ROSA egress zero (Q1 2025) and shared VPC (Q3 2025); ARO egress IP, UDN with 4.18; mesh only as customer-installed operator
2025	Versions, upgrades and support	3 → 3.5	+1.2	18 months per minor plus included 6-month EUS Term 1 on even minors from 4.16 (ARO 2025-10); ROSA median lag 185 days, ARO 380
2026	GPU and AI workloads	3 → 3.5	+1.0	G7e and P6-B300 instances and scale-to-zero GPU pools Q2 2026; no managed GPU sharing or DRA feature found
2026	Nodes, autoscaling and compute choice	3.5 → 4	+1.2	ROSA Spot, Windows License Included pools, scale-to-zero and Red Hat build of Karpenter in 2026; no serverless nodes
2026	Observability and day-2 operations	3 → 3.5	+0.8	ROSA platform monitoring via Cluster Monitoring Operator Q1 2026, ARO Resource Health and persistent Prometheus; no cost allocation in service
2026	Security and compliance	4 → 3.5	-1.2	4.5 for FedRAMP High on HCP, FIPS clusters, ARO managed identity and confidential containers, less 1.0 for CVE-2024-25131 and CVE-2026-56160

4. Direction, 2023 to 2026

Each item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).

Date	Item	Theme	Driver
2024-01	ROSA GovCloud FedRAMP High authorization	D10 Sovereignty and regions	C
2024-01	ROSA with hosted control planes GA, new $0.25 per hour cluster fee	D12 Packaging and pricing	C
2024-09	ROSA Graviton Arm nodes and 500-node clusters	D2 Compute and autoscaling	C
2025-03	ROSA egress zero clusters GA	D4 Networking	C
2025-05	OpenShift Lightspeed GA, half a year after the promised date	D7 AI-assisted operations	V
2025-10	Included EUS Term 1 on ARO and ROSA even minors	D1 Versions and lifecycle	C
2025-11	ARO OpenShift Virtualization and confidential containers GA	D9 Security	P
2025-12	Capacity Blocks for ML on ROSA	D13 Accelerators	M
2026-02	ARO managed identity clusters GA	D9 Security	C
2026-05	OpenShift MCP server technology preview	D7 AI-assisted operations	M
2026-06	Red Hat build of Karpenter and Spot on ROSA	D2 Compute and autoscaling	U
2026-09	ARO with hosted control planes public preview	D1 Versions and lifecycle	C

Centre of gravity: Compute and autoscaling (2), AI-assisted operations (2), Versions and lifecycle (2)
Driver mix: Vision 8%, Customer need 58%, Market window 17%, Upstream 8%, Portfolio 8%

5. Credibility: 17.0 / 25

Criterion	Score	Basis
Cadence	4	OCP minor every four months; ROSA quarterly and ARO monthly dated release notes, published life cycle tables
Roadmap transparency	3	Dated release notes and press releases; no public roadmap board for ROSA or ARO
Say-do	3	4 of 6 resolved promises shipped within about 12 months; Lightspeed promised for late 2024 shipped 2025-05-20
Velocity	3.5	Several ROSA features most quarters in 2025-26: egress zero, capacity blocks, Karpenter, Spot; ARO slower
Lifecycle stability	3.5	18 months per minor plus included EUS on even minors; forced upgrades at end of life; ARO installs four to eight months late

Say-do record, 2023 to 2026: 8 items 2023-2026: 4 shipped within about 12 months (ROSA HCP, ARO confidential containers, ARO managed identity, ARO OpenShift Virtualization), 1 slipped (OpenShift Lightspeed, promised late 2024, GA 2025-05-20), 1 overdue (Lightspeed cluster interaction preview since 2025-05), 2 pending (OpenShift MCP server preview, ARO HCP preview). First-pass ledger of 11 shipped items removed: 7 were routine version releases, ARO HCP was never GA in 2024.

6. Commercial risk: 6.5 / 25 (lower is better)

Criterion	Score	Basis
Price and licence volatility	1.5	ROSA classic $0.03 cluster fee dropped and ROSA HCP $0.25 per hour cluster fee added around 2024-01; worker fee unchanged since 2021
Purchase constraints	2	Pay as you go through AWS or Azure, but no free tier and a per-vCPU service fee on every worker
Channel and access	0.5	Self-service in AWS and Azure consoles, public docs and pricing, about 32 AWS regions
Owner stability	1	Red Hat under IBM since 2019, stable; service depends on joint operation with AWS and Microsoft
Cost of staying supported	1.5	18 months per minor with EUS included, in-place upgrades free; forced upgrades at end of life

Security record of the product itself: Two managed-service flaws counted: CVE-2024-25131 (OSD/ROSA must-gather-operator privilege escalation to cluster-admin and the AWS account, Red Hat public 2024-06-03, fixed in the operator) and CVE-2026-56160 (ARO improper authorization, CVSS 9.1, NVD 2026-07-24, fixed by Microsoft as a hosted service); 1.0 deducted. CVE-2024-25133 (Hive) listed, not counted.

7. Technical lock-in: 9.5 / 25 (lower is better)

Criterion	Score	Basis
Formats	2.5	Certified Kubernetes, but many workloads use OpenShift Routes, ImageStreams and security context constraints
Export path	2	OADP (Velero) documented; egress at AWS or Azure rates; no free leaver egress found
Stack coupling	2	AWS STS roles or Entra identities, cloud load balancers and storage classes, with OpenShift layers above them
Hardware / cloud coupling	0.5	Same OpenShift runs self-managed on-premises, on IBM Cloud and on other clouds
Skills and tooling coupling	2.5	OpenShift-specific oc, operator and rosa CLI skills; widely taught but not plain kubectl

8. Integrator fit: 16.5 / 20

Criterion	Score	Basis
Partner programme openness	4.5	Red Hat partner ecosystem plus AWS and Microsoft channels; launch partners Accenture, Cognizant, Persistent
Multi-tenancy and self-service	3.5	Hybrid Cloud Console organisations, billing accounts and projects; multicluster only through separately licensed ACM
API and infrastructure-as-code	4	Partner Terraform provider rhcs with about 1.0M downloads, ARO in the Azure provider, rosa CLI and OCM API
Skills and certification	4.5	Red Hat OpenShift certifications are widely held; certification details not re-checked this run

9. AI leverage: 10.5 / 20

Strand	Today	Latest step
AI workload support	2	2025: Capacity Blocks for ML and Trainium and Inferentia instance types on ROSA
AI platform stack	2.5	2023: Red Hat OpenShift AI announced 2023-05-23, runs on ROSA and ARO as a separate subscription
AI-assisted operations	3	2025: OpenShift Lightspeed GA 2025-05-20, natural-language console assistant; cluster interaction still preview
Agent openness	3	2026: MCP server for OpenShift in technology preview 2026-05-05, read-only default with OIDC and RBAC

AI say-do: 3 announced, 1 GA (Lightspeed, about six months late), 2 preview pending (cluster interaction, MCP server), 0 dropped; AI work is a bring-your-own-model console assistant plus OpenShift AI sold separately.

10. Reading

Red Hat sells the same OpenShift platform as a managed service on AWS, Azure and Google Cloud, moving ROSA to hosted control planes and adding Karpenter, Spot and GPU capacity options. The record shows steady quarterly ROSA delivery with versions about six months behind upstream, while ARO trails by about a year and only reached hosted control planes in preview in 2026. Buyers gain one platform across clouds and on-premises with long included support, at the price of per-vCPU fees and OpenShift-specific skills and APIs.

11. Open questions and evidence caveats

ARO install availability lags OCP GA by four to eight months; budget upgrades around the ARO calendar, not the OCP one.
Two managed-service privilege-escalation flaws (2024 OSD/ROSA, 2026 ARO) were fixed by the providers; details of the ARO fix date are not published.
Only one ROSA incident found (2026-02-05, upgrade scheduling blocked for about 8.5 hours); older incidents and ARO incidents were not searched.
SLA credit terms sit in Red Hat Enterprise Agreement Appendix 4, not opened in this run.
Red Hat build of Karpenter support status (GA or technology preview) is not stated in the ROSA release notes.