This migration is not about a few hosts in a closet. OpenStack only earns its keep when you have a real private-cloud estate: hundreds to thousands of VMs, multiple tenants, a platform team, and a Broadcom renewal quote that has tripled. If that is not you, stop reading and look at Proxmox or XCP-ng instead. OpenStack is an IaaS control plane you operate yourself, and that is the whole story.
What you are actually replacing
vSphere bundles compute, storage, and networking behind vCenter. OpenStack splits the same surface across discrete services, and you run each one:
- Nova replaces the ESXi scheduler and vMotion (compute).
- Neutron replaces vSphere networking and NSX (software-defined networking).
- Cinder replaces VMFS datastores for block volumes.
- Glance is the image store your VMs boot from.
- Keystone is identity, Placement tracks capacity, and Horizon is the web console.
There is no vCenter-equivalent single pane that hides all of this. You assemble it.
Converting the VMs
The workhorse is virt-v2v. It pulls a VM straight from vCenter, injects the right virtio drivers, and uploads the disk into Glance or directly to Cinder.
virt-v2v -ic 'vpx://administrator%[email protected]/DC1/Cluster1/esxi01?no_verify=1' \
-it vddk -io vddk-libdir=/opt/vmware-vix-disklib-distrib \
-o openstack -oo server-id=compute01 \
app-server-07Plan for the boot device switch: Windows guests need the virtio SCSI and network drivers present before the cutover, or they bluescreen or come up with no NIC. Linux guests usually convert cleanly, but check that fstab uses UUIDs, not /dev/sdX. Run conversions in waves and keep the source VM powered off but intact until the OpenStack copy is validated.
Mapping the infrastructure
Networking is the part teams underestimate. Each vSphere port group becomes a Neutron network plus a subnet, and VLAN-backed port groups map to provider networks:
openstack network create --provider-network-type vlan \
--provider-physical-network physnet1 --provider-segment 412 prod-app-vlan
openstack subnet create --network prod-app-vlan --subnet-range 10.40.12.0/24 prod-app-subnetFirewall rules that lived in NSX or on the perimeter become security groups, which are stateful and applied per port. Datastores become Cinder backends: point Cinder at the same array (Pure, NetApp, Ceph RBD) and you keep your existing storage investment while changing the control plane. vSphere resource pools and sizing become Nova flavors, so audit your real VM shapes first and define a tight flavor list rather than recreating hundreds of one-off sizes.
Distribution choice
Vanilla OpenStack from Git plus Kolla-Ansible gives you maximum control and zero license cost, but you own every upgrade and every broken playbook. A packaged distribution (Red Hat OpenStack, Canonical’s Charmed OpenStack, or a vendor appliance) gives you supported upgrade paths and someone to call at 3 a.m., at the price of an annual subscription and less flexibility. For a team new to OpenStack, a packaged distro is cheaper than it looks once you price in the senior engineer-months a from-scratch deployment consumes.
Migrate in waves
Do not attempt a big-bang cutover of a multi-tenant estate. Group VMs into waves by application, tenant, or blast radius, and move the lowest-risk wave first to prove the conversion pipeline end to end. For each wave: convert with virt-v2v into Glance or Cinder, boot the instance on a defined flavor and Neutron network, validate the application, then keep the source VM powered off but intact on vSphere until the OpenStack copy has passed acceptance. Capture the exact virt-v2v invocation, the flavor and network mapping, and the timing per VM so later waves become a repeatable runbook rather than a fresh investigation each time. Sequence tenants so a shared dependency (identity, DNS, a database tier) lands before the workloads that rely on it.
Before you release the source VM
Confirm the same items on every converted instance before you release the source:
- The instance boots to a login prompt on the correct firmware, and Linux guests use UUIDs in
fstabrather than/dev/sdX. - Windows guests have the virtio SCSI and network drivers present and come up with a working NIC.
- The instance is attached to the right Neutron network and subnet, with the intended security groups applied per port.
- The flavor matches the real VM shape (vCPU, RAM, disk) rather than an oversized default.
- Cinder volumes are on the intended backend and survive an instance reboot.
- The application passes its own acceptance test, not just an ICMP ping.
Where vSphere still wins
Be honest about this before you commit.
- Operational weight: vCenter plus a competent admin runs a large estate part-time. OpenStack needs a dedicated platform team, a CI pipeline for the control plane, and real expertise in Linux networking and Ceph or your storage backend.
- Maturity of tooling: DRS, Storage vMotion, and vSphere HA are battle-tested and need almost no thought. The OpenStack equivalents exist but need configuration and care.
- Small estates: under roughly 50 hosts, the labor cost of OpenStack dwarfs any license saving. Proxmox VE or XCP-ng will give you live migration and HA with a fraction of the operational surface.
- Third-party ecosystem: backup, monitoring, and security vendors still ship vSphere-first integrations.
Migrate to OpenStack for scale, tenancy, and API-driven self-service, not to save a line item.
License bill vs payroll bill
OpenStack is a genuine private cloud that frees you from per-socket licensing and Broadcom’s roadmap, but it trades a license bill for a payroll bill. The conversion work with virt-v2v is mechanical and well understood; the hard part is standing up Neutron, Cinder, and a control plane your team can actually operate at 2 a.m. Price both sides honestly: subtract the VMware renewal, then add the platform engineers, the packaged-distro subscription if you choose one, and the ramp-up months. Model that cost in the calculator above before you sign off on the move.