--- title: Deploying third-party applications to Red Hat OpenShift:... description: Third-party vendor applications deployed to Red Hat OpenShift repeatedly fail for the same reasons, a Red Hat consultant explains. Vendors often lift-and-shift... canonical: https://daily.dev/posts/deploying-third-party-applications-to-red-hat-openshift-common-pitfalls-and-how-to-avoid-them-i7dg4w79e twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Deploying third-party applications to Red Hat OpenShift: Common pitfalls and how to avoid them | daily.dev og:description: Third-party vendor applications deployed to Red Hat OpenShift repeatedly fail for the same reasons, a Red Hat consultant explains. Vendors often lift-and-shift... og:url: https://daily.dev/posts/deploying-third-party-applications-to-red-hat-openshift-common-pitfalls-and-how-to-avoid-them-i7dg4w79e og:image: https://api.daily.dev/og/posts/I7DG4w79E.png og:image:alt: Deploying third-party applications to Red Hat OpenShift: Common pitfalls and how to avoid them og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Deploying third-party applications to Red Hat OpenShift: Common pitfalls and how to avoid them **[Red Hat Developer](https://daily.dev/sources/rhdev)** · 11 min read · 0 upvotes · 0 comments ## Summary Third-party vendor applications deployed to Red Hat OpenShift repeatedly fail for the same reasons, a Red Hat consultant explains. Vendors often lift-and-shift VM-based apps into containers without architectural changes, causing duplicated resource overhead per pod and replica. Multi-tenancy is the biggest hurdle: vendors demand cluster-admin, wildcard RBAC, or privileged security context constraints instead of OpenShift's default restrictive-v2 SCC. Other recurring issues include lack of support for parallel non-production environments, misuse of RWX storage for static data, and manual imperative installation scripts instead of GitOps. The fix: ask vendors detailed architecture, security, storage and upgrade questions before deployment, and standardize on declarative Helm charts and OpenShift GitOps. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What SCC does OpenShift apply by default to pods and what does it restrict? OpenShift applies the restrictive-v2 security context constraint (SCC) by default, enforcing the principle of least privilege. It prevents containers from running as root or accessing host-level resources unless explicitly granted higher permissions. The privileged SCC, by contrast, is the riskiest option, allowing workloads to effectively gain cluster-administrator-level access to everything on the platform. _Teams hardening multi-tenant clusters follow SCC and RBAC guidance like this on daily.dev._ ### What is the difference between ReadWriteOnce and ReadWriteMany storage in OpenShift Data Foundation? ReadWriteOnce (RWO) delivers low-latency block storage backed by Ceph RBD, attached to a single pod, suited for databases or stateful apps with native cluster replication. ReadWriteMany (RWX) provides a resilient, cluster-wide shared filesystem backed by CephFS, letting multiple pods across different nodes read and write simultaneously without relying on unmanaged external file servers. _Architects choosing persistent volume access modes compare trade-offs like these on daily.dev._ ### Why do vendor applications lifted-and-shifted from VMs to containers cause higher resource costs on Kubernetes? Because the containerized version typically runs one pod per application instead of multiple applications sharing one server as before. The overhead of running the application server gets duplicated for every pod and replica, which inflates cluster resource consumption and drives up associated hardware and licensing costs. _Engineers evaluating vendor cloud-native claims track pitfalls like this on daily.dev._ ## Similar posts on daily.dev - [Declarative clusters: GitOps deployment of hosted control planes on Red Hat OpenShift Virtualization](https://daily.dev/posts/declarative-clusters-gitops-deployment-of-hosted-control-planes-on-red-hat-openshift-virtualization-cl5axwh9l) · Red Hat Developer · 0 upvotes · 0 comments - [Red Hat OpenShift as a Hybrid Engine for GitOps Driven Application Modernization](https://daily.dev/posts/red-hat-openshift-as-a-hybrid-engine-for-gitops-driven-application-modernization-trqeizlbv) · Container Journal · 0 upvotes · 0 comments - [Top 5 hard-earned lessons from the experts on managing Kubernetes](https://daily.dev/posts/top-5-hard-earned-lessons-from-the-experts-on-managing-kubernetes-z3wygzmpo) · CNCF · 3 upvotes · 0 comments - [Red Hat Expands OpenShift Application Development Environment](https://daily.dev/posts/red-hat-expands-openshift-application-development-environment-9febxassl) · Cloud Native Now · 1 upvotes · 0 comments - [How to Support Your App on Kubernetes Environments You Don’t Control](https://daily.dev/posts/how-to-support-your-app-on-kubernetes-environments-you-don-t-control-m2xxilefm) · Fairwinds Blog · 3 upvotes · 0 comments --- Tags: [#kubernetes](https://daily.dev/tags/kubernetes), [#openshift](https://daily.dev/tags/openshift), [#gitops](https://daily.dev/tags/gitops), [#multi-tenancy](https://daily.dev/tags/multi-tenancy) [View this post on daily.dev](https://daily.dev/posts/deploying-third-party-applications-to-red-hat-openshift-common-pitfalls-and-how-to-avoid-them-i7dg4w79e) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Deploying third-party applications to Red Hat OpenShift: Common pitfalls and how to avoid them","url":"https://daily.dev/posts/deploying-third-party-applications-to-red-hat-openshift-common-pitfalls-and-how-to-avoid-them-i7dg4w79e","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/deploying-third-party-applications-to-red-hat-openshift-common-pitfalls-and-how-to-avoid-them-i7dg4w79e"},"datePublished":"2026-10-27T13:37:40.476Z","dateModified":"2026-10-27T13:40:25.823Z","description":"Third-party vendor applications deployed to Red Hat OpenShift repeatedly fail for the same reasons, a Red Hat consultant explains. Vendors often lift-and-shift...","image":"https://media.daily.dev/image/upload/s--CxzD6vbw--/f_auto/v1722860399/public/Placeholder%2005","thumbnailUrl":"https://media.daily.dev/image/upload/s--CxzD6vbw--/f_auto/v1722860399/public/Placeholder%2005","isAccessibleForFree":true,"articleSection":"Red Hat Developer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Red Hat Developer","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/2a8895f3216c4900bdc455585a4ad3e4","url":"https://daily.dev/sources/rhdev"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/deploying-third-party-applications-to-red-hat-openshift-common-pitfalls-and-how-to-avoid-them-i7dg4w79e","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"kubernetes,openshift,gitops,multi-tenancy","timeRequired":"PT11M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Red Hat Developer","item":"https://daily.dev/sources/rhdev"},{"@type":"ListItem","position":3,"name":"Deploying third-party applications to Red Hat OpenShift: Common pitfalls and how to avoid them"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/deploying-third-party-applications-to-red-hat-openshift-common-pitfalls-and-how-to-avoid-them-i7dg4w79e#faq","mainEntity":[{"@type":"Question","name":"What SCC does OpenShift apply by default to pods and what does it restrict?","acceptedAnswer":{"@type":"Answer","text":"OpenShift applies the restrictive-v2 security context constraint (SCC) by default, enforcing the principle of least privilege. It prevents containers from running as root or accessing host-level resources unless explicitly granted higher permissions. The privileged SCC, by contrast, is the riskiest option, allowing workloads to effectively gain cluster-administrator-level access to everything on the platform. Teams hardening multi-tenant clusters follow SCC and RBAC guidance like this on daily.dev."}},{"@type":"Question","name":"What is the difference between ReadWriteOnce and ReadWriteMany storage in OpenShift Data Foundation?","acceptedAnswer":{"@type":"Answer","text":"ReadWriteOnce (RWO) delivers low-latency block storage backed by Ceph RBD, attached to a single pod, suited for databases or stateful apps with native cluster replication. ReadWriteMany (RWX) provides a resilient, cluster-wide shared filesystem backed by CephFS, letting multiple pods across different nodes read and write simultaneously without relying on unmanaged external file servers. Architects choosing persistent volume access modes compare trade-offs like these on daily.dev."}},{"@type":"Question","name":"Why do vendor applications lifted-and-shifted from VMs to containers cause higher resource costs on Kubernetes?","acceptedAnswer":{"@type":"Answer","text":"Because the containerized version typically runs one pod per application instead of multiple applications sharing one server as before. The overhead of running the application server gets duplicated for every pod and replica, which inflates cluster resource consumption and drives up associated hardware and licensing costs. Engineers evaluating vendor cloud-native claims track pitfalls like this on daily.dev."}}]} ```