SWOT & sign-off

The argument for this design in one page, and a provability table that turns the deployment plan’s phase exit criteria into dated evidence — not vibes. Status as of 2026-07-10, at the Phase 2 build stage: Windows compute join is the open item. Head commit at time of writing: 5158077.

SWOT

Strengths

  • Exactly one custom component. The Host Factory KubeVirt provider is the only piece of this design nobody at Red Hat, IBM, or Microsoft supports. It targets IBM’s own documented 5-script Host Factory plug-in interface, the same interface FINOS’s Open Resource Broker (Apache-2.0, Incubating, contributed by Morgan Stanley + AWS) and Google’s symphony-gcp already implement against Kubernetes/AWS and GCE/GKE respectively — a validated integration shape, not a novel one. Every other layer (OpenShift, OpenShift Virtualization, OpenShift GitOps, OpenShift Pipelines, Symphony itself) is a vendor-supported product on its own documented path.

  • Grid unchanged from the ISV support matrix. Windows compute stays full Windows Server 2019, installed via IBM’s own MSI/silent path, exactly as IBM documents it — not repackaged into a container IBM never certified (ADR 0001).

  • VM-minutes elasticity, measured, not claimed. IPI cluster install 44m35s end to end; test VM create→Running in 18s; golden-image stage-1 bake 15m56s; compute-VM reclone reached Running in ~2-3 min and AgentConnected=True by ~5 min from delete. Real timings off the live build, not projections.

  • GitOps reproducibility. OpenShift GitOps (Argo CD) app-of-apps is Red Hat’s own blessed deployment model for OCP Virt VM fleets, so grid state is reconstructable from git, not hand-tuned per host.

  • Eval entitlement makes the PoC a $0-license exercise. Advanced Edition Evaluation (valid to 2026-12-31) gives the full product — Windows support, Host Factory — without a procurement cycle, at the cost of trial/non-production terms.

Weaknesses

  • Windows Server 2019 only, for now. WS2022 needs Fix 601711, which the eval entitlement has no Fix Central access to obtain. WS2022 is a certified OCP Virt guest since OCP 4.14, so the platform is ready — the gate is entitlement-side, closed by Advanced Edition BYOL procurement (Phase 5).

  • The one custom component is unbuilt. The Host Factory KubeVirt provider is designed (5-script interface, pattern on FINOS ORB / symphony-gcp) but not implemented — Phase 5, a genuine multi-person-month build, not a config change.

  • KEDA scale-in is not grid-aware. VirtualMachinePool exposes the standard /scale subresource so KEDA can drive it with no KubeVirt-specific integration — but neither KEDA nor KubeVirt’s own scale-in selection policy is idle/drain-aware (KubeVirt 1.6+ added ordinal SelectionPolicy — Newest/Oldest/Random — which is creation-time ordering, not workload-state awareness). Scale-in can kill a VM mid-task. This is why the KEDA path is scoped to the burst demo only; the Host Factory provider is the production path.

  • OpenShift skills are a prerequisite for a team whose operational muscle is Symphony/EGO administration, not Kubernetes.

  • Windows compute join is still open at time of writing — see the sign-off gate below; the one unproven step in an otherwise fully-verified pipeline.

Opportunities

  • FINOS Open Resource Broker as upstream landing ground. ORB is Apache-2.0, "Incubating" under FINOS governance, jointly contributed by Morgan Stanley and AWS, and already bundles a Kubernetes provider module (in maintenance mode) alongside its AWS backends. A working KubeVirt provider built to the same 5-script contract is a plausible upstream contribution, not a one-off internal tool.

  • VMware-exodus timing. Broadcom’s move to subscription-only VMware licensing has produced documented price increases up to the 150-500% range per one directly-cited source, with higher figures reported by other industry sources but not independently confirmed against a primary document in this project’s research pass — a real, if uneven, forcing function pushing VM estates off vSphere.

  • The pattern generalizes. Nothing about "full Windows Server VMs on OpenShift Virtualization, golden-image clone-to-join" is Symphony-specific — it is the correct answer for any Windows Server ISV workload that installs as a native Windows service and cannot be containerized under WMCO’s constraints.

  • Validated Pattern candidacy — with a caveat stated up front. This repo’s gitops/bootstrap structure already matches the Validated Patterns shape. But the one custom component is, by construction, not a supported Red Hat product — this design should not claim "Maintained" tier; "Sandbox" framing, with the custom provider called out explicitly as a customer-owned extension, is the honest target.

Threats

  • Symphony product-line freshness. 7.3.2 has shipped since roughly 2021; IBM’s docs redirect retired-version pages to an unpublished "8.1.0"; the only containerized Symphony artifact IBM ever shipped (IBM/ibm-spectrum-symphony-operator, Linux-only, Community-Edition PoC) is archived (2024-07-22, last code push 2021-09-17). None of this blocks the PoC — 7.3.2 Advanced Edition is the supported, licensable product today — but it is a real signal to chase before production procurement.

  • ROKS metal + VNI allowlist gate. The IBM Cloud side needs a VNI-allowlist request for OVN localnet UDN opened well before Phase 3 — explicitly the longest lead-time item in Phase 0, deliberately parked while AWS is proven first.

  • Egress economics at scale forcing multicluster. A stretched single grid pays WAN latency and double egress as it grows; multicluster federation is the documented fallback (ADR 0010), not a hypothetical — the design accepts this trade rather than hiding it.

  • Eval entitlement expiry, 2026-12-31. The PoC’s $0-license posture is time-boxed; Advanced Edition BYOL procurement is a Phase 5 gate item, not yet actioned.

PoC sign-off gate

Rows are the phase exit criteria as written in the deployment plan, turned into a provability check against what is actually logged in docs/phase-log.md and git — not vibes. Status date is when the row’s evidence was last confirmed.

# Phase / exit criterion Status What makes it provable Date

0

Prerequisites (phase0-checks.sh green, AWS scope)

✅ Met

15/17 checks green; the 2 fails are the deliberately-parked IBM-side checks, not AWS gaps. EC2 vCPU quota (1152) already >= 48 needed.

2026-07-09

1

OpenShift + OpenShift Virtualization on AWS (HyperConverged Available, test VM boots)

✅ Met

IPI install 44m35s; metal Machine provision→Ready ~20 min; HCO Available=True/Progressing=False/Degraded=False; smoke-test VM create→Running in 18s, deleted cleanly.

2026-07-09

2a

Golden Windows image pipeline (stage-1 base bake)

✅ Met

Stage-1 completed clean in 15m56s (well inside the 20-60 min documented range) after fixing a CDI StorageProfile gap, an empty-<ProductKey/> eval-license trap, and a servicing-package version red herring.

2026-07-10

2b

Golden Windows image pipeline (stage-2 Symphony install)

✅ Met

~10 failed attempts drove a strategic pivot: extract egocore-4.0.0.0.msi + soamcore-7.3.2.0.msi once, serve from installer-repo, msiexec /qn them directly — eliminates the InstallShield self-extractor’s GUI wizard from the pipeline permanently.

2026-07-10

2c

Symphony management hosts (masters)

✅ Met

Both RHEL masters alive; egosh resource rows live (not dashes) after fixing an inter-master DNS gap; EGO port matrix verified live via ss against the documented 7869-7875 block; WAN-tuning fragment applied after fixing an idempotency-guard false positive.

2026-07-10

2d

Windows compute join (egosh resource list shows Windows hosts ok)

⚠️ OPEN

Four compounding root causes fixed in commit 5158077 (no egoconfig join subcommand → direct EGO_MASTER_LIST rewrite; -NetFirewallRule/WMI dies mid-specialize → netsh advfirewall; service is named LIM not EGO; masters-at-MTU-8901-vs-Windows-at-1500 per IBM KB ibm16164145 → pinned masters to 1500). The commit message claims the join was live-proven on running clones before rebaking. But this claim is not corroborated by an egosh-output confirmation logged in docs/phase-log.md — the log’s own last entry (17:55 handoff) still shows NOT joined, plus a second, separate, still-open blocker: WinRM/NTLM rejects the win-admin password on post-re-render clones, suspected create-secrets.sh password desync. Fixed-in-code, live-proof asserted by the fixing commit, independent log confirmation absent.

2026-07-10 (commit 5158077; phase-log last entry 17:55)

2e

Workload run + VM join/leave/rejoin proof (sample app end to end)

⏳ Pending

Blocked on 2d. Once compute hosts join: submit the sample app (Linux client → Windows service instances), scale the pool down and back up, confirm clean re-join via egosh resource list — not yet attempted.

 — 

3

IBM side + interconnect (cross-cloud burst proof)

⏳ Designed, not built

ROKS Terraform not yet written; VNI-allowlist request not yet opened (deliberately parked).

 — 

4

KEDA burst demo

⏳ Designed, not built

Depends on Phase 3. symphony-metrics-shim and ScaledObject manifests not yet authored.

 — 

5

Production path (Host Factory KubeVirt provider, Direct Link, AE BYOL, WS2022)

⏳ Designed, not built

Provider is spec’d against the documented 5-script interface; none of it is implemented.

 — 

Summary. Everything through Phase 2c is proven on the live build with measured timings. Phase 2d (Windows compute join) is the hinge: four real root causes were found and fixed, but the fixing commit’s own claim of a live join is not yet corroborated by a logged egosh confirmation, and a second blocker (WinRM password desync) was still open at last log entry. Until that is closed and logged, Phase 2e and everything downstream stays blocked. Phases 3-5 are designed against IBM’s documented interfaces and Red Hat’s documented GitOps/fleet primitives but have no build evidence yet.

Documentation-discipline honesty note

docs/phase-log.md is the source of truth the sign-off table above is built from, and it is close to a complete audit trail — but not a perfect one. Two significant fixes landed directly in git without a corresponding phase-log entry, despite their own commit messages promising to log them:

  • 5158077 — the four compounding Windows-join root causes (no egoconfig join subcommand, WMI firewall provider dead mid-specialize, service named LIM not EGO*, MTU 8901-vs-1500 mismatch) and the commit’s claim of a live-proven join.

  • 8a8a79f — the CPU Manager static policy KubeletConfig required for KubeVirt’s d1. dedicated-CPU instance types (without it, every d1. VM is permanently ErrorUnschedulable), scoped to a dedicated virt-metal MachineConfigPool to avoid rolling the non-metal workers.

Both fixes are real, both are in git, and both are cited in this table from the commits themselves — but a reader treating phase-log.md alone as the complete history of what happened would miss them. This table’s ⚠️ rating on row 2d is a direct consequence of that gap: the fix exists and the commit asserts success, but the phase-log confirmation that would turn "asserted" into "logged-and-verified" was never written. Treat commit messages as supplementary evidence, not a substitute for the log — every phase step, decision, or state change should still append to docs/phase-log.md.

Continue to Components for the component-by-component detail behind every row above.