Red Hat OpenShift → k3s
What it saves, what actually moves, what you rebuild — and the thing that catches people.
What it costs, and what it saves
OpenShift is licensed per core or socket and enterprise agreements run to five and six figures annually. K3s is Apache-2.0 and free; you pay for nodes.
Moves cleanly
Standard Kubernetes manifests — Deployments, Services, ConfigMaps, Ingress.
You rebuild
Everything OpenShift-specific: Routes become Ingress, DeploymentConfigs become Deployments, BuildConfigs and ImageStreams have no equivalent, and Security Context Constraints become Pod Security Standards.
What Red Hat OpenShift costs you today
Subscription-priced by core and node, quotes only — independent 2026 TCO studies put the licensing line alone around $30k/yr for modest clusters, with all-in annual costs near $68k against ~$25k for lean open distributions.
What actually holds you in
OpenShift-specific objects — Routes, DeploymentConfigs, ImageStreams, the operator console — need translating back to vanilla Kubernetes (Ingress, Deployments, standard registries). It's real work but well-trodden; the underlying skills transfer completely.
What you are moving to
The most-adopted lightweight Kubernetes: one ~70 MB binary, a cluster in minutes, CNCF-certified conformance, and a huge community. Born for edge, now running everywhere teams decided they need Kubernetes itself rather than a platform wrapped around it.
Free, open-source; optional SUSE Rancher Prime support subscription
k3s strengths
- Single-binary install — a real cluster in minutes
- CNCF-certified conformant Kubernetes
- Massive adoption from edge to production SaaS
What you give up
- Default SQLite datastore needs an etcd swap for HA
- Fast release pace — test upgrades before rolling
- No vendor support unless you add SUSE's
The migration, step by step
- 1Inventory OpenShift-specific resources with oc get — the count tells you the size of the job
- 2Stand up K3s; a single server node with agents is enough to start
- 3Convert Routes to Ingress and pick an ingress controller, since K3s ships Traefik by default
- 4Replace BuildConfigs with an external CI pipeline that pushes images
- 5Rework SCCs into Pod Security Standards, which is stricter and less flexible
The gotcha
OpenShift's Source-to-Image builds have no K3s equivalent. Teams that adopted S2I discover their entire build pipeline was an OpenShift feature, not a Kubernetes one, and rebuilding it is often the largest part of the migration.
When to stay on Red Hat OpenShift
You need Red Hat support with an SLA, or operate in an environment where the OpenShift compliance posture is a requirement.
More Layer 3 migrations
Figures verified 2026-07-19 against vendor pricing pages. Prices change and migrations differ by estate — treat the cost delta as a starting model, not a quote. Rankings and recommendations here are merit-only; affiliate income never changes a verdict. See our methodology.