SUSE Harvester

What is SUSE Harvester?

Moving to Kubernetes-based virtualization moves the security boundary: alongside the hypervisor you now have to protect the cluster control plane, because that is what grants access to every machine at once. We cover the consequences further down.

SUSE Harvester is an open source hyper-converged infrastructure platform that runs virtual machines as Kubernetes workloads, on ordinary server hardware, with storage and management included.

Key Functions:

• Kubernetes-native - VMs as Kubernetes workloads
• Rancher Integration - management via Rancher
• Longhorn Storage - built-in software-defined storage
• Fully open source - zero licensing costs

What problem does it solve?

flowchart LR
    subgraph Proprietary Virtualization Problem
        B --> C[Vendor lock-in]
        C --> D[Broadcom acquisition]
        D --> E[Rising costs]
    end

    subgraph Harvester Solution
        F[Harvester HCI] --> G[100% Open Source]
        G --> H[Zero licenses]
        H --> I[Kubernetes-native]
        I --> J[Future-proof]
    end

    style A fill:#dc2626,stroke:#b91c1c,color:#fff
    style B fill:#dc2626,stroke:#b91c1c,color:#fff
    style C fill:#dc2626,stroke:#b91c1c,color:#fff
    style D fill:#dc2626,stroke:#b91c1c,color:#fff
    style E fill:#dc2626,stroke:#b91c1c,color:#fff
    style F fill:#22c55e,stroke:#16a34a,color:#fff
    style G fill:#22c55e,stroke:#16a34a,color:#fff
    style H fill:#22c55e,stroke:#16a34a,color:#fff
    style I fill:#22c55e,stroke:#16a34a,color:#fff
    style J fill:#22c55e,stroke:#16a34a,color:#fff

Common Problems:

• Broadcom acquisition = rising virtualization licensing costs
• Vendor lock-in to proprietary virtualization
• Separate tools for VMs and containers
• Expensive HCI solutions (vSAN, Nutanix)
• No Kubernetes-native virtualization

Harvester Architecture

flowchart TD
    A[Rancher Management] --> B[Harvester Cluster]
    B --> C[Node 1]
    B --> D[Node 2]
    B --> E[Node 3]

    C --> F[Kubernetes]
    D --> F
    E --> F

    F --> G[KubeVirt - VM]
    F --> H[Longhorn - Storage]
    F --> I[Containers]

    style A fill:#f59e0b,stroke:#d97706,color:#fff
    style B fill:#8b5cf6,stroke:#7c3aed,color:#fff
    style C fill:#6366f1,stroke:#4f46e5,color:#fff
    style D fill:#6366f1,stroke:#4f46e5,color:#fff
    style E fill:#6366f1,stroke:#4f46e5,color:#fff
    style F fill:#22c55e,stroke:#16a34a,color:#fff
    style G fill:#22c55e,stroke:#16a34a,color:#fff
    style H fill:#22c55e,stroke:#16a34a,color:#fff
    style I fill:#22c55e,stroke:#16a34a,color:#fff

Key Features

Harvester vs vSphere vs Proxmox

Aspect	Harvester	vSphere	Proxmox VE
License	Open Source (Free)	Enterprise (expensive)	Open Source + Support
Kubernetes	Native (is K8s)	vSphere + Tanzu	None
Storage	Longhorn (built-in)	vSAN (additional license)	Ceph/ZFS
Container management	Native	Tanzu (additional)	LXC
Rancher integration	Native	None	None
Enterprise support	SUSE subscription	Broadcom license	Proxmox subscription
GPU passthrough	Yes	Yes	Yes
Live migration	Yes	Yes	Yes
Use case	Modern workloads, K8s-first	Traditional enterprise	SMB, homelab

Harvester Advantage:

• Fully open source - zero licensing costs
• Kubernetes-native - VMs and containers on one platform
• Longhorn built-in - no additional storage costs
• Rancher integration - one tool for VMs and K8s
• Edge-ready - lightweight deployment

Who is it for?

Specification

Parameter	Value
Minimum nodes	3 (HA), 1 (single node)
OS	SUSE Linux (immutable)
Hypervisor	KubeVirt
Storage	Longhorn
Networking	Canal, Multus
GPU	NVIDIA GPU passthrough
Management	Web UI, kubectl, Rancher
License	Apache 2.0 (Open Source)

The attack surface of Kubernetes-based HCI

Harvester changes more than the licensing model — it changes what you have to protect. In classic virtualization the security boundary is the hypervisor. Here the Kubernetes control plane sits next to it, and it is often the shortest path to every virtual machine at once.

What to address during deployment:

• Access to the management layer. An account with rights in Rancher or directly in the cluster API can start, clone or delete any VM. RBAC and multi-factor authentication for the console carry more weight here than hardening any single machine.
• Network isolation between workloads. Default in-cluster communication tends to be too permissive. Network policies restrict east–west traffic — exactly the traffic an attacker uses after compromising one machine.
• Images and the supply chain. Kubernetes-native means some components come from external registries. Scanning images for vulnerabilities and controlling their sources is basic hygiene, not an option.
• Data protection in Longhorn. Replication protects against disk failure, not against a volume being encrypted. Backups must be separated from the cluster.

We verify management-layer configuration and segmentation as part of security audits, and environment resilience through penetration testing.

FAQ

Is Harvester a traditional virtualization replacement? Yes for modern workloads. For legacy Windows apps vSphere may be better, but Harvester supports Windows VMs.

What does traditional virtualization migration look like? Import VMDK/OVA, bulk migration tools. Harvester can import VMs from vSphere.

Do I need Rancher? Not required, but recommended. Rancher adds multi-cluster management, RBAC, monitoring.

What about performance vs traditional virtualization? Comparable for most workloads. KubeVirt adds minimal overhead.

How does support work? Open source is free. Enterprise support via SUSE subscription.

Does nFlo deploy Harvester? Yes. Greenfield deployments and traditional virtualization migrations. Rancher integration, storage and networking configuration.