If you tried running OpenStack a decade ago, you probably still have scars.
Back in 2014, setting up an OpenStack cluster was an exercise in extreme self-punishment. You were hand-editing thousands of lines of configuration files across raw Ubuntu boxes, wrestling with brittle Python virtualenvs, and praying your MySQL Galera cluster didn’t experience a split-brain event when a worker node sneezed. Upgrading from Icehouse to Juno wasn’t an operational maintenance task—it was a career-ending high-wire act.
Mention OpenStack to a Principal Architect today, and they will likely give you an involuntary shudder. They remember the nightmare.
The industry collective memory froze. Everyone abandoned ship for AWS or hid behind the slick, expensive curtains of VMware, trading open infrastructure for very comfortable cages.
Except OpenStack didn’t die. It evolved.
While the hype machine moved on to Kubernetes, the OpenStack ecosystem quietly gutted its own legacy architecture and rebuilt the entire platform from the ground up.
The Architecture Shift: From Bare Metal Chaos to Immutable Control Planes
The modern OpenStack footprint looks nothing like the fragile monoliths of a decade ago.
Early OpenStack failed because it ran raw systemd services directly on host operating systems. A system-level apt-get upgrade on a hypervisor could accidentally mutate a underlying Python library dependency, instantly knocking out nova-compute across an entire availability zone.
Today? Immutable containers.
Every core API service—Keystone, Nova, Cinder, Glance—is packaged into isolated container images. The base operating system on the physical host is decoupled from the cloud control plane. You can patch a Linux kernel without touching the API dependencies.
And high availability? We stopped using brittle custom Pacemaker scripts to track daemon heartbeats. We handed the control plane over to Kubernetes operators and container runtime policies.
If keystone-api crashes at 2 AM, the reconciliation loop brings up a new pod in milliseconds.
No page. No midnight SSH session. Done.
Goodbye Legacy Neutron, Hello OVN
The single biggest source of operational misery in classic OpenStack was networking.
Legacy Neutron was a sprawling, fragile spiderweb of Linux network namespaces, iptables rules, bridges, and Python L3 agents that desynchronized if you looked at them wrong. Debugging a dropped packet meant manually inspecting nested bridge interfaces across three physical hosts.
It was heavy, ugly plumbing.
Modern OpenStack threw that entire model in the garbage and standardized on Open Virtual Network (OVN).
OVN pushes state down to Open vSwitch (OVS) via a centralized, light-speed database model. It strips out the fragile L3 agents and implements Distributed Virtual Routing (DVR) natively at the hypervisor layer using Geneve encapsulation.
Virtual routing happens directly on the compute host where the packet originates. No hair-pinning traffic through dedicated, overworked network nodes.
Architecture Flow: Modern Control Plane Stack
Three Ways to Run OpenStack (Without Losing Your Mind)
You don’t need a team of 20 engineers to consume or operate OpenStack anymore. The execution model breaks down cleanly based on your tolerance for hardware management:
Public OpenStack (Zero Ops Overhead):
Don’t want to run hardware? Don’t. Providers like OVHcloud, Open Telekom Cloud, and Cleura expose pure, native OpenStack APIs over the public web. You get total data sovereignty and predictable billing without the public hyperscaler egress extortion. You run zero infrastructure.
Managed OpenStack (Low Ops Overhead):
You own or lease bare metal in a colocation facility, but you outsource the control plane to tools like Canonical Sunbeam or managed providers. They monitor hardware health, patch control planes remotely, and execute upgrades. You just consume APIs.
Self-Hosted Sovereign OpenStack (Solo-SRE Achievable):
You run the whole stack on-premise using modern Kubernetes Operators (e.g., OpenStack K8s Operators) or Kolla-Ansible. Because the control plane lives in declarative containers, a single competent SRE can comfortably manage a multi-rack deployment.
The Reality Check
The narrative that OpenStack is an unmanageable, money-burning enterprise disaster is ten years out of date.
It was true in 2015. It isn’t true today.
If you are paying astronomical billings for public cloud virtual machines or getting squeezed by VMware license restructuring, OpenStack is no longer a high-risk gamble. It is a mature, containerized, self-healing cloud control plane that actually works.
