DocumentationSelf-Managed DeploymentSetupHelm

OpenShift

View as Markdown

The NeMo Platform chart works on Red Hat OpenShift when security context overrides are applied. OpenShift’s restricted or restricted-v2 Security Context Constraint (SCC) requires pods to run as non-root with explicit runAsUser and runAsNonRoot.

Values

You can override the default values for the NeMo Platform chart to make it compatible with OpenShift.

  1. Create the OpenShift values file. Save the following as openshift-values.yaml:
# openshift-values.yaml
podSecurityContext:
runAsNonRoot: true
fsGroup: 1000
seccompProfile:
type: RuntimeDefault
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
# If using the embedded PostgreSQL, otherwise skip this section
postgresql:
securityContext:
runAsUser: 999
runAsNonRoot: true
podSecurityContext:
runAsNonRoot: true
fsGroup: 999
  1. Install with your custom values and the OpenShift overrides (order matters; later files override earlier). Complete the Prerequisites and follow Install, using the provided OpenShift values file.
helm upgrade --install "$NMP_HELM_RELEASE" nemo-platform/nemo-platform \
  --version "$NMP_HELM_CHART_VERSION" \
  --namespace "$NMP_NAMESPACE" \
  --create-namespace \
  -f values.yaml \
  -f openshift-values.yaml

Ingress

You can expose the API using the following methods:

  • Kubernetes Ingress - supported by OpenShift’s default IngressController; set ingress.enabled: true and ingress.defaultHost as in Ingress.
  • Gateway API HTTPRoute - optional; configure httpRoute in values. See Gateway API HTTPRoute.
  • OpenShift Route - enable the chart’s Route and set an optional hostname. See OpenShift Route for steps.

Troubleshooting

Security Context Constraints

If you see “unable to validate against any security context constraint” or “container has runAsNonRoot and image will run as root”, ensure you pass the necessary pod security context overrides. See Values for steps. If you want to validate your values are being applied correctly, you can use the helm template command to see the rendered templates.

helm template "$NMP_HELM_RELEASE" nemo-platform/nemo-platform \
  --version "$NMP_HELM_CHART_VERSION" \
  -f values.yaml \
  -f openshift-values.yaml