Kubernetes

OpenShift

View as Markdown

The OpenShift install path is experimental. It currently requires running sandbox pods under the privileged SCC and installing the gateway with TLS disabled. Use only for evaluation on a private network.

OpenShift’s Security Context Constraints reject the chart’s default pod security settings. Installing on OpenShift requires precreating the namespace, granting the privileged SCC to the sandbox service account, and overriding a few chart values so the cluster admission controller can assign UIDs and FS groups itself.

OpenShell installs sandbox nftables rules as individual commands. On OpenShift nodes where optional conntrack or packet log expressions are unavailable, those optional rules can fail without rolling back the required proxy bypass reject rules.

Prerequisites

  • OpenShift 4.x cluster with oc configured
  • Helm 3.x
  • Agent Sandbox controller and CRDs installed

Install

1

Create the namespace

Pre-create the namespace so the SCC binding can be applied before the chart installs:

$oc create ns openshell
2

Grant the privileged SCC to sandbox pods

Sandbox pods run under the openshell-sandbox service account in the openshell namespace and require the privileged SCC:

$oc adm policy add-scc-to-user privileged -z openshell-sandbox -n openshell
3

Install the chart with OpenShift overrides

$helm install openshell oci://ghcr.io/nvidia/openshell/helm-chart \
>  --version <version> \
>  --namespace openshell \
>  --set server.disableTls=true \
>  --set podSecurityContext.fsGroup=null \
>  --set securityContext.runAsUser=null
OverrideReason
server.disableTls=trueRuns the gateway over plaintext HTTP for simpler evaluation.
podSecurityContext.fsGroup=null / securityContext.runAsUser=nullClear the chart’s hardcoded UID and fsGroup so OpenShift’s SCC admission can assign them.
4

Wait for the gateway to be ready

$oc -n openshell rollout status statefulset/openshell

If you set workload.kind=deployment, use oc -n openshell rollout status deployment/openshell instead.

Connect to the gateway

The gateway is now running over plaintext HTTP. Connect with oc port-forward:

$oc -n openshell port-forward svc/openshell 8080:8080

Register the gateway with the CLI:

$openshell gateway add http://127.0.0.1:8080 --local --name openshift
$openshell status

Next Steps