The Red Hat acquisition and how it reshaped IBM licensing.

OpenShift became the platform under the Cloud Paks

The most consequential change was structural. IBM positioned Red Hat OpenShift as the container platform beneath its Cloud Pak suite, so that running a modern IBM product increasingly means running OpenShift underneath it. Entitlement to a Cloud Pak typically carries a defined quantity of OpenShift with it, scoped to support that Cloud Pak workload rather than to license OpenShift for general use across the estate. The trap is treating the bundled OpenShift as unlimited platform capacity. Where OpenShift runs workloads beyond the entitlement that came with the Cloud Pak, the surplus is its own exposure, and an audit will look for exactly that gap between what the bundle granted and what the cluster is actually running.

The VPC metric spread across the portfolio

Red Hat and the Cloud Paks are metered in Virtual Processor Cores. Since Passport Advantage version 11, with the change reaching existing customers on May 1 2023, sub-capacity reporting and ILMT apply to VPC metered products too, and manual counting is no longer permitted. That brought a large slice of the post acquisition portfolio inside the same sub-capacity discipline that has always governed PVU products: the inventory tool has to be deployed, running continuously, and producing the quarterly evidence. A VPC product without that evidence is exposed the same way a PVU product is, and the count moves toward the full cluster rather than the cores the software uses.

Container rules raised the stakes on configuration

Containerized deployment changed what non-compliance costs. For container and Cloud Pak workloads, falling out of sub-capacity compliance does not default to the host the software happens to sit on. It defaults to every core in the cluster. A small overrun on one node, multiplied across a large OpenShift cluster, produces a finding far larger than the workload that caused it. That asymmetry is the single most important thing the acquisition changed for audit risk: the penalty for a configuration gap is now measured in cluster cores, not server cores.

Bundling rules became harder to read

The acquisition layered Red Hat entitlements, bundled OpenShift, and Cloud Pak component rights on top of an already complex catalog. Each Cloud Pak carries a set of included components with their own restricted use rights, and a bundled component used outside the scope the Cloud Pak allows looks, to discovery, like an unlicensed standalone product. The defense is the same discipline that applies to any IBM bundle: map each instance to how it was entitled, separate restricted use components from full entitlements, and refuse to let legitimate bundled use be counted as a standalone license.