DocumentationSelf-Managed DeploymentSetupHelm

OpenShift

View as Markdown

The NeMo Platform chart works on Red Hat OpenShift when security context overrides are applied. OpenShift’s restricted or restricted-v2 Security Context Constraint (SCC) requires pods to run as non-root with explicit runAsUser and runAsNonRoot.

Values

You can override the default values for the NeMo Platform chart to make it compatible with OpenShift.

  1. Create the OpenShift values file. Save the following as openshift-values.yaml:
1# openshift-values.yaml
2
3podSecurityContext:
4runAsNonRoot: true
5fsGroup: 1000
6seccompProfile:
7type: RuntimeDefault
8
9securityContext:
10allowPrivilegeEscalation: false
11capabilities:
12drop:
13- ALL
14
15# If using the embedded PostgreSQL, otherwise skip this section
16postgresql:
17securityContext:
18runAsUser: 999
19runAsNonRoot: true
20podSecurityContext:
21runAsNonRoot: true
22fsGroup: 999
  1. Install with your custom values and the OpenShift overrides (order matters; later files override earlier). Complete the Prerequisites and follow Install, using the provided OpenShift values file.
1helm upgrade --install "$NMP_HELM_RELEASE" nemo-platform/nemo-platform \
2  --version "$NMP_HELM_CHART_VERSION" \
3  --namespace "$NMP_NAMESPACE" \
4  --create-namespace \
5  -f values.yaml \
6  -f openshift-values.yaml

Ingress

You can expose the API using the following methods:

  • Kubernetes Ingress - supported by OpenShift’s default IngressController; set ingress.enabled: true and ingress.defaultHost as in Ingress.
  • Gateway API HTTPRoute - optional; configure httpRoute in values. See Gateway API HTTPRoute.
  • OpenShift Route - enable the chart’s Route and set an optional hostname. See OpenShift Route for steps.

Troubleshooting

Security Context Constraints

If you see “unable to validate against any security context constraint” or “container has runAsNonRoot and image will run as root”, ensure you pass the necessary pod security context overrides. See Values for steps. If you want to validate your values are being applied correctly, you can use the helm template command to see the rendered templates.

1helm template "$NMP_HELM_RELEASE" nemo-platform/nemo-platform \
2  --version "$NMP_HELM_CHART_VERSION" \
3  -f values.yaml \
4  -f openshift-values.yaml