> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.nvidia.com/nemo-platform/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/nemo-platform/_mcp/server.

# OpenShift

<a id="nemo-ms-install-openshift" />

The NeMo Platform chart works on Red Hat OpenShift when security context overrides are applied. OpenShift’s **restricted** or **restricted-v2** Security Context Constraint (SCC) requires pods to run as non-root with explicit `runAsUser` and `runAsNonRoot`.

## Values

You can override the default values for the NeMo Platform chart to make it compatible with OpenShift.

1. **Create the OpenShift values file.** Save the following as `openshift-values.yaml`:

```yaml
# openshift-values.yaml

podSecurityContext:
runAsNonRoot: true
fsGroup: 1000
seccompProfile:
type: RuntimeDefault

securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL

# If using the embedded PostgreSQL, otherwise skip this section
postgresql:
securityContext:
runAsUser: 999
runAsNonRoot: true
podSecurityContext:
runAsNonRoot: true
fsGroup: 999
```

2. **Install** with your custom values and the OpenShift overrides (order matters; later files override earlier). Complete the [Prerequisites](/documentation/self-managed-deployment/setup/helm/prerequisites) and follow [Install](/documentation/self-managed-deployment/setup/helm/install), using the provided OpenShift values file.

```sh
helm upgrade --install "$NMP_HELM_RELEASE" nemo-platform/nemo-platform \
  --version "$NMP_HELM_CHART_VERSION" \
  --namespace "$NMP_NAMESPACE" \
  --create-namespace \
  -f values.yaml \
  -f openshift-values.yaml
```

## Ingress

You can expose the API using the following methods:

* **Kubernetes Ingress** - supported by OpenShift's default IngressController; set `ingress.enabled: true` and `ingress.defaultHost` as in [Ingress](/documentation/self-managed-deployment/setup/helm/ingress).
* **Gateway API HTTPRoute** - optional; configure `httpRoute` in values. See [Gateway API HTTPRoute](/documentation/self-managed-deployment/setup/helm/ingress#gateway-api-httproute).
* **OpenShift Route** - enable the chart's Route and set an optional hostname. See [OpenShift Route](/documentation/self-managed-deployment/setup/helm/ingress#openshift-route) for steps.

## Troubleshooting

### Security Context Constraints

If you see "unable to validate against any security context constraint" or "container has runAsNonRoot and image will run as root", ensure you pass the necessary pod security context overrides. See [Values](#values) for steps.
If you want to validate your values are being applied correctly, you can use the `helm template` command to see the rendered templates.

```sh
helm template "$NMP_HELM_RELEASE" nemo-platform/nemo-platform \
  --version "$NMP_HELM_CHART_VERSION" \
  -f values.yaml \
  -f openshift-values.yaml
```