Red Hat OpenShift Virtualization is built on Red Hat OpenShift, so you manage both containers and virtual machines (VMs) on a single, hardening-ready platform. This lets you apply the same security policies and governance model across all workloads instead of maintaining separate toolchains.

Key ways it supports consistent security:

• Common control plane: VMs are managed as Kubernetes objects, so you can use the same policies, automation, and workflows you already use for containerized applications.
• Compliance Operator: Administrators can define the required compliance state of a cluster, see where there are gaps, and get guidance on how to remediate them. This helps you standardize compliance across environments.
• Platform hardening options: You can disable nonessential feature gates, enforce trusted container registries with TLS, and restrict GPU and USB pass-through to approved devices to reduce exposure to unverified images, misconfigurations, and risky hardware access.

By bringing VMs and containers onto one platform, OpenShift Virtualization helps you rethink how you enforce security baselines and compliance, while reducing the operational overhead of managing separate stacks.

OpenShift Virtualization lets you manage VMs with the same Kubernetes-native controls you use for containers, which helps you tighten governance and reduce operational risk.

Capabilities that support stronger access control include:

• Role-based access control (RBAC): You can define fine-grained permissions for who can create, modify, or interact with VMs, aligning them with your existing Kubernetes RBAC model.
• Consistent audit policies: The same audit and logging policies that apply to containerized applications can be applied to VMs, giving you a unified view of changes and access attempts.
• Restricted high-privilege operations: You can limit executive access, VNC console access, and live migration operations to approved administrators, reducing the risk of unauthorized changes or data exposure.
• Resource isolation settings: Disabling guest-memory overcommit and shareable disks where they are not needed helps reduce resource contention between tenants and limits the blast radius if a single workload is compromised.
• Error-handling and validation policies: Enforcing consistent error-handling and validation for critical workloads helps avoid silent failures or data corruption across environments.

In practice, this means your VM governance can be aligned with your container governance, helping you reimagine access control as a single, policy-driven model across your hybrid cloud.

OpenShift Virtualization extends security controls into both networking and storage, so you can manage these layers consistently for VMs and containers.

Network security and segmentation

• Unified microsegmentation: Network policies apply at both the container and VM levels, so you can keep a consistent microsegmentation model across all workloads.
• VLAN-based isolation: Using VLANs, you can isolate tenant or application traffic to reduce the risk of lateral movement between network segments.
• MAC spoof filtering and multinetwork policies: For sensitive workloads, you can apply MAC address spoof filtering and multinetwork policies to help prevent identity spoofing and keep high-value application traffic isolated.
• Controlled secondary networks: You can define clear boundaries for secondary networks (such as SR-IOV interfaces) and map them to specific workloads or tenants so that traffic that bypasses the virtual switch remains controlled and auditable.

Storage security and data integrity

• Centralized storage policies: Encryption, access controls, and replication policies can be applied across both virtualized and containerized workloads, simplifying compliance and recovery planning.
• DataVolume (DV) controls: Restricting DV cloning across namespaces helps keep sensitive datasets within approved boundaries and avoids unintended propagation of regulated or high-risk information.
• Disk sharing controls: Disabling unnecessary shareable disks reduces unintended data sharing between workloads and lowers the risk of corruption from concurrent writes.
• Predictable failure handling: Validating errorPolicy settings and storage permissions for critical data helps ensure failed storage operations are handled predictably and that only authorized workloads can read or write sensitive volumes.

By bringing network and storage security into the same management plane as compute, OpenShift Virtualization helps you reshape how teams collaborate on policies, making it easier for storage, security, and platform teams to align and audit controls over time.