Rancher vs OpenShift vs Tanzu: Enterprise Kubernetes

# Rancher cluster configuration
apiVersion: provisioning.cattle.io/v1
kind: Cluster
metadata:
  name: production-cluster
  namespace: fleet-default
spec:
  kubernetesVersion: v1.28.5+rke2r1
  rkeConfig:
    machinePools:
    - name: controlplane-pool
      controlPlaneRole: true
      etcdRole: true
      quantity: 3
      machineConfigRef:
        kind: VmwarevsphereConfig
        name: controlplane-config
    - name: worker-pool
      workerRole: true
      quantity: 5
      machineConfigRef:
        kind: VmwarevsphereConfig
        name: worker-config
    networking:
      cni: canal
    services:
      etcd:
        backupConfig:
          enabled: true
          intervalHours: 6
          retention: 60

# OpenShift install configuration
apiVersion: v1
baseDomain: company.com
metadata:
  name: prod-cluster
platform:
  vsphere:
    vcenter: vcenter.company.com
    username: administrator@vsphere.local
    datacenter: Datacenter
    defaultDatastore: datastore1
    cluster: Production
networking:
  networkType: OVNKubernetes
  clusterNetwork:
  - cidr: 10.128.0.0/14
    hostPrefix: 23
  serviceNetwork:
  - 172.30.0.0/16
compute:
- name: worker
  replicas: 6
  platform:
    vsphere:
      cpus: 8
      coresPerSocket: 4
      memoryMB: 32768
      osDisk:
        diskSizeGB: 200
controlPlane:
  name: master
  replicas: 3
  platform:
    vsphere:
      cpus: 8
      coresPerSocket: 4
      memoryMB: 16384
      osDisk:
        diskSizeGB: 200

# Tanzu Kubernetes Grid cluster
apiVersion: cluster.x-k8s.io/v1beta1
kind: Cluster
metadata:
  name: prod-workload-cluster
  namespace: production
spec:
  clusterNetwork:
    services:
      cidrBlocks: ["198.51.100.0/12"]
    pods:
      cidrBlocks: ["192.0.2.0/16"]
  infrastructureRef:
    apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
    kind: VSphereCluster
    name: prod-workload-cluster
  controlPlaneRef:
    kind: KubeadmControlPlane
    apiVersion: controlplane.cluster.x-k8s.io/v1beta1
    name: prod-workload-cluster-control-plane
---
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
kind: VSphereCluster
metadata:
  name: prod-workload-cluster
  namespace: production
spec:
  server: vcenter.company.com
  thumbprint: "AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD"
  identityRef:
    kind: Secret
    name: vsphere-credentials

# Rancher Fleet GitOps deployment
apiVersion: fleet.cattle.io/v1alpha1
kind: GitRepo
metadata:
  name: production-apps
  namespace: fleet-default
spec:
  repo: https://github.com/company/k8s-apps
  branch: main
  paths:
  - production/
  targets:
  - name: production-clusters
    clusterSelector:
      matchLabels:
        env: production
  - name: development-clusters
    clusterSelector:
      matchLabels:
        env: development

# ACM ManagedCluster
apiVersion: cluster.open-cluster-management.io/v1
kind: ManagedCluster
metadata:
  name: production-east
  labels:
    environment: production
    region: east
spec:
  hubAcceptsClient: true
  leaseDurationSeconds: 60
---
# ACM Policy
apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
  name: security-baseline
spec:
  remediationAction: enforce
  disabled: false
  policy-templates:
  - objectDefinition:
      apiVersion: config.open-cluster-management.io/v1
      kind: ConfigurationPolicy
      metadata:
        name: pod-security-policy
      spec:
        severity: high
        object-templates:
        - complianceType: musthave
          objectDefinition:
            apiVersion: policy/v1beta1
            kind: PodSecurityPolicy
            metadata:
              name: restricted-psp

# TMC Workspace
apiVersion: tenancy.tanzu.vmware.com/v1alpha1
kind: Workspace
metadata:
  name: production-workspace
spec:
  description: "Production workloads workspace"
---
# TMC Policy
apiVersion: security.tanzu.vmware.com/v1alpha1
kind: SecurityPolicy
metadata:
  name: baseline-security
spec:
  workspaceSelector:
    matchLabels:
      workspace: production-workspace
  recipe: baseline
  input:
    baseline:
      requireDefaultDeny: true
      allowPrivileged: false
      allowHostNetwork: false

# OpenShift SCC for restricted workloads
apiVersion: security.openshift.io/v1
kind: SecurityContextConstraints
metadata:
  name: custom-restricted
allowHostDirVolumePlugin: false
allowHostIPC: false
allowHostNetwork: false
allowHostPID: false
allowHostPorts: false
allowPrivilegedContainer: false
allowedCapabilities: null
defaultAddCapabilities: null
requiredDropCapabilities:
- KILL
- MKNOD
- SETUID
- SETGID
runAsUser:
  type: MustRunAsRange
  uidRangeMin: 1000
  uidRangeMax: 65534
seLinuxContext:
  type: MustRunAs
volumes:
- configMap
- downwardAPI
- emptyDir
- persistentVolumeClaim
- projected
- secret

# Rancher CIS scan configuration
apiVersion: cis.cattle.io/v1
kind: ClusterScan
metadata:
  name: security-baseline-scan
spec:
  clusterName: production-cluster
  scanType: cis-1.6
  cronSchedule: "0 2 * * *"  # Daily at 2 AM
---
# OPA Gatekeeper constraint
apiVersion: templates.gatekeeper.sh/v1beta1
kind: ConstraintTemplate
metadata:
  name: k8srequiredlabels
spec:
  crd:
    spec:
      names:
        kind: K8sRequiredLabels
      validation:
        properties:
          labels:
            type: array
            items:
              type: string
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8srequiredlabels
        violation[{"msg": msg}] {
          required := input.parameters.labels
          provided := input.review.object.metadata.labels
          missing := required[_]
          not provided[missing]
          msg := sprintf("Missing required label: %v", [missing])
        }

# OpenShift BuildConfig for S2I
apiVersion: build.openshift.io/v1
kind: BuildConfig
metadata:
  name: spring-boot-app
spec:
  source:
    type: Git
    git:
      uri: https://github.com/company/spring-boot-app
      ref: main
  strategy:
    type: Source
    sourceStrategy:
      from:
        kind: ImageStreamTag
        name: java:8
        namespace: openshift
  output:
    to:
      kind: ImageStreamTag
      name: spring-boot-app:latest
  triggers:
  - type: ConfigChange
  - type: GitHub
    github:
      secret: webhook-secret

# Tanzu Build Service Image
apiVersion: kpack.io/v1alpha2
kind: Image
metadata:
  name: spring-boot-app
spec:
  tag: harbor.company.com/apps/spring-boot-app
  serviceAccountName: build-service-sa
  builder:
    name: base-builder
    kind: Builder
  source:
    git:
      url: https://github.com/company/spring-boot-app
      revision: main
  build:
    env:
    - name: BP_JVM_VERSION
      value: "17"
    - name: BPL_JVM_THREAD_COUNT
      value: "250"

# Longhorn StorageClass
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: longhorn-fast
provisioner: driver.longhorn.io
allowVolumeExpansion: true
parameters:
  numberOfReplicas: "3"
  staleReplicaTimeout: "2880"
  fromBackup: ""
  fsType: "ext4"
  dataLocality: "best-effort"
---
# Longhorn backup configuration
apiVersion: longhorn.io/v1beta2
kind: BackupTarget
metadata:
  name: s3-backup
spec:
  backupTargetURL: s3://longhorn-backups@us-east-1/
  credentialSecret: s3-credentials
  pollInterval: 300

# ODF StorageCluster
apiVersion: ocs.openshift.io/v1
kind: StorageCluster
metadata:
  name: ocs-storagecluster
  namespace: openshift-storage
spec:
  arbiter: {}
  encryption:
    kms: {}
  externalStorage: {}
  managedResources:
    cephBlockPools: {}
    cephConfig: {}
    cephDashboard: {}
    cephFilesystems: {}
    cephObjectStoreUsers: {}
    cephObjectStores: {}
  mirroring: {}
  nodeTopologies: {}
  storageDeviceSets:
  - name: ocs-deviceset
    count: 3
    replica: 1
    resources:
      limits:
        cpu: "2"
        memory: "5Gi"
      requests:
        cpu: "1"
        memory: "5Gi"
    placement: {}
    preparePlacement: {}
    portable: true
    dataPVCTemplate:
      spec:
        storageClassName: gp3-csi
        accessModes:
        - ReadWriteOnce
        volumeMode: Block
        resources:
          requests:
            storage: "2Ti"

# Rancher Istio installation
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  name: control-plane
spec:
  values:
    pilot:
      env:
        EXTERNAL_ISTIOD: true
  components:
    pilot:
      k8s:
        env:
        - name: PILOT_ENABLE_WORKLOAD_ENTRY_AUTOREGISTRATION
          value: true
        - name: PILOT_ENABLE_CROSS_CLUSTER_WORKLOAD_ENTRY
          value: true
---
# Service mesh traffic policy
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: circuit-breaker
spec:
  host: payment-service
  trafficPolicy:
    circuitBreaker:
      consecutiveErrors: 3
      interval: 30s
      baseEjectionTime: 30s
      maxEjectionPercent: 50
    connectionPool:
      tcp:
        maxConnections: 100
      http:
        http1MaxPendingRequests: 50
        maxRequestsPerConnection: 10

# Rancher monitoring configuration
apiVersion: management.cattle.io/v3
kind: MonitoringInput
metadata:
  name: cluster-monitoring
spec:
  cluster: production-cluster
  prometheusConfig:
    retention: "15d"
    resources:
      limits:
        cpu: "2000m"
        memory: "8Gi"
      requests:
        cpu: "1000m"
        memory: "4Gi"
  grafanaConfig:
    persistence:
      enabled: true
      size: "10Gi"