OpenShift

Deploying the NeMo Helix chart on Red Hat OpenShift requires security context overrides and images and storage that support the assigned identities. OpenShift’s restricted and restricted-v2 Security Context Constraints (SCCs) use MustRunAsRange: when runAsUser is omitted, admission assigns a UID from the namespace’s allocated range. An explicit UID must be in that range; do not hard-code 1000 or PostgreSQL’s 999 for these SCCs. Group IDs such as fsGroup must also satisfy the SCC.

See OpenShift SCC management for UID and group allocation rules.

Values

You can override the default values for NeMo Helix chart to make it compatible with OpenShift.

Create the OpenShift values file. Save the following as openshift-values.yaml:

# openshift-values.yaml
# Leave runAsUser and fsGroup unset so SCC admission can assign them.
podSecurityContext:
  runAsNonRoot: true
  seccompProfile:
    type: RuntimeDefault
securityContext:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
      - ALL
# Remove component-level fsGroup defaults so they do not override SCC allocation.
api:
  podSecurityContext:
    fsGroup: null
core:
  controller:
    podSecurityContext:
      fsGroup: null
envoyProxy:
  podSecurityContext:
    fsGroup: null

Remove any fixed runAsUser, runAsGroup, or fsGroup overrides from your other values files, including PostgreSQL overrides. Verify that each enabled image supports an arbitrary non-root UID and that mounted directories are writable by the SCC-assigned UID or group. These security settings alone do not guarantee image or storage compatibility. If an image requires a fixed UID, use an image compatible with your namespace allocation or consult your cluster administrator about a suitably scoped SCC; do not grant anyuid as a blanket workaround.

Install with your custom values and the OpenShift overrides (order matters; later files override earlier). Complete the Prerequisites and follow Install, using the provided OpenShift values file.

helm upgrade --install "$NHX_HELM_RELEASE" nemo-helix/nemo-helix \
  --version "$NHX_HELM_CHART_VERSION" \
  --namespace "$NHX_NAMESPACE" \
  --create-namespace \
  -f values.yaml \
  -f openshift-values.yaml

Ingress

You can expose the API using the following methods:

Kubernetes Ingress - supported by OpenShift’s default IngressController; set ingress.enabled: true and ingress.defaultHost as in Ingress.
Gateway API HTTPRoute - optional; configure httpRoute in values. See Gateway API HTTPRoute.
OpenShift Route - enable the chart’s Route and set an optional hostname. See OpenShift Route for steps.

Troubleshooting

Security Context Constraints

If you see “unable to validate against any security context constraint”, check for fixed UIDs or group IDs outside the namespace’s allowed ranges. If you see “container has runAsNonRoot and image will run as root”, inspect the admitted pod’s security context and the SCC used by its service account. Under a restricted SCC, admission should supply a non-root UID when none is specified. See Values for steps.

Use helm template to check that your overrides are applied and that rendered workloads do not retain fixed UID or group settings. Rendering does not test SCC admission or filesystem permissions; verify those in the target OpenShift cluster.

helm template "$NHX_HELM_RELEASE" nemo-helix/nemo-helix \
  --version "$NHX_HELM_CHART_VERSION" \
  -f values.yaml \
  -f openshift-values.yaml