# OpenShift Architecture Overview

Red Hat OpenShift is an enterprise Kubernetes platform that abstracts infrastructure complexity and delivers a self-service provisioning model across IaaS, PaaS, and container layers.

OpenShift Container Platform (OCP) is built on top of Kubernetes, adding enterprise-grade security, developer tooling, and multi-tenancy. On Sunrise infrastructure, OpenShift serves as the primary interface between raw compute resources and tenant workloads.

---

## Platform Layers

Provisioning in OpenShift follows a structured top-down hierarchy. Each layer builds on the one below it, translating raw infrastructure into isolated, governed workload environments.

```
┌─────────────────────────────────────┐
│  4. Workload Layer                  │
│     Pods, Containers, Services      │
├─────────────────────────────────────┤
│  3. Namespace Layer                 │
│     Projects / Tenants              │
├─────────────────────────────────────┤
│  2. OpenShift Cluster Layer         │
│     Control Plane + Worker Nodes    │
├─────────────────────────────────────┤
│  1. Capacity Pool Layer             │
│     Machines, Storage, Networking   │
└─────────────────────────────────────┘
```

| Layer | Description |
|---|---|
| **IaaS** | Physical or virtual machines, storage backends, and network fabric that form the raw resource foundation |
| **OpenShift Cluster** | Control plane and worker nodes that aggregate IaaS resources and expose them to the Kubernetes scheduler |
| **Namespace** | Logical tenant partitions that enforce resource quotas, RBAC policies, and cost boundaries |
| **Workload** | Pods, containers, and services deployed by users within a namespace |

---

## Key Concepts

**ResourceQuota**
A Kubernetes object assigned per namespace that caps total CPU, memory, and storage consumption for a tenant.

**LimitRange**
Sets per-pod and per-container resource defaults and maximums within a namespace, preventing any single workload from monopolising capacity within the Namespace.

**Role-Based Access Control (RBAC)**
Ensures only authorised users and service accounts can deploy into a given Namespace.

**Machine API**
OpenShift's interface for dynamically provisioning and deprovisioning cluster nodes, allowing the Capacity Pool to expand or contract based on demand.

---

## Related Pages

- [Hosted Cluster](./hosted-cluster.md)
- [IaaS Capacity and Node Provisioning](./iaas-capacity-and-node-provisioning.md)
- [Namespaces, Quotas and RBAC](./namespaces-quotas-rbac.md)
- [GPU Infrastructure](./gpu-infrastructure.md)
- [Resource Pricing](../resource-pricing.md)