mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-17 05:31:16 +08:00
Taylor Mutch
d8f614fa31
* docs(kubernetes): add initial reference docs Add a Kubernetes reference section under docs/reference/kubernetes/ covering gateway setup, OIDC and reverse-proxy authentication, cert-manager PKI, and Gateway API external access. Update installation.mdx to link to the new setup page and nest the new folder under the Reference section in index.yml. * docs(kubernetes): promote Kubernetes to top-level nav and retitle pages Move docs/reference/kubernetes/ to docs/kubernetes/ so the section appears as a top-level nav entry rather than nested under Reference. Retitle the pages to broader, action-oriented names (Managing Certificates, Ingress, Access Control) and rename the files to match. Update cross-references in setup.mdx and the installation page. * docs(nav): revert Reference to folder mode The Reference section was switched to explicit section/contents to host the nested Kubernetes subsection. With Kubernetes promoted to a top-level folder, restore folder-mode auto-detection. Side effect: sandbox-compute-drivers is picked up again, which was silently absent from the explicit list. * docs(kubernetes): add OpenShift install page Mirror the OpenShift install instructions from PR #1240 into the Kubernetes docs section. Documents the SCC binding for sandbox pods and the chart overrides required by OpenShift's Security Context Constraints (disabled PKI init Job, plaintext TLS, cleared fsGroup and runAsUser).
89 lines
3.2 KiB
Plaintext
89 lines
3.2 KiB
Plaintext
---
|
|
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
title: "OpenShift"
|
|
sidebar-title: "OpenShift"
|
|
description: "Install the OpenShell Helm chart on OpenShift, including the SCC binding and chart overrides required by OpenShift's Security Context Constraints."
|
|
keywords: "Generative AI, Cybersecurity, Kubernetes, OpenShift, SCC, Security Context Constraints, Helm, Gateway, Installation"
|
|
position: 5
|
|
---
|
|
|
|
<Warning>
|
|
The OpenShift install path is experimental. It currently requires running sandbox pods under the `privileged` SCC and installing the gateway with TLS and the PKI init job disabled. Use only for evaluation on a private network.
|
|
</Warning>
|
|
|
|
OpenShift's [Security Context Constraints](https://docs.openshift.com/container-platform/latest/authentication/managing-security-context-constraints.html) reject the chart's default pod security settings. Installing on OpenShift requires precreating the namespace, granting the `privileged` SCC to the default service account, and overriding a few chart values so the cluster admission controller can assign UIDs and FS groups itself.
|
|
|
|
## Prerequisites
|
|
|
|
- OpenShift 4.x cluster with `oc` configured
|
|
- Helm 3.x
|
|
- [Agent Sandbox](/kubernetes/setup#install-agent-sandbox) controller and CRDs installed
|
|
|
|
## Install
|
|
|
|
<Steps>
|
|
|
|
## Create the namespace
|
|
|
|
Pre-create the namespace so the SCC binding can be applied before the chart installs:
|
|
|
|
```shell
|
|
oc create ns openshell
|
|
```
|
|
|
|
## Grant the privileged SCC to sandbox pods
|
|
|
|
Sandbox pods run under the `default` service account in the `openshell` namespace and require the `privileged` SCC:
|
|
|
|
```shell
|
|
oc adm policy add-scc-to-user privileged -z default -n openshell
|
|
```
|
|
|
|
## Install the chart with OpenShift overrides
|
|
|
|
```shell
|
|
helm install openshell oci://ghcr.io/nvidia/openshell/helm-chart \
|
|
--version <version> \
|
|
--namespace openshell \
|
|
--set pkiInitJob.enabled=false \
|
|
--set server.disableTls=true \
|
|
--set podSecurityContext.fsGroup=null \
|
|
--set securityContext.runAsUser=null
|
|
```
|
|
|
|
| Override | Reason |
|
|
|---|---|
|
|
| `pkiInitJob.enabled=false` | The PKI init Job runs as a non-root user with a fixed UID, which the SCC admission rewrites or rejects. Disabling it skips the Job; TLS must also be disabled. |
|
|
| `server.disableTls=true` | The gateway has no certificates without `pkiInitJob`, so it must run plaintext. |
|
|
| `podSecurityContext.fsGroup=null` / `securityContext.runAsUser=null` | Clear the chart's hardcoded UID and fsGroup so OpenShift's SCC admission can assign them. |
|
|
|
|
## Wait for the gateway to be ready
|
|
|
|
```shell
|
|
oc -n openshell rollout status statefulset/openshell
|
|
```
|
|
|
|
</Steps>
|
|
|
|
## Connect to the gateway
|
|
|
|
The gateway is now running over plaintext HTTP. Connect with `oc port-forward`:
|
|
|
|
```shell
|
|
oc -n openshell port-forward svc/openshell 8080:8080
|
|
```
|
|
|
|
Register the gateway with the CLI:
|
|
|
|
```shell
|
|
openshell gateway add http://127.0.0.1:8080 --local --name openshift
|
|
openshell status
|
|
```
|
|
|
|
## Next Steps
|
|
|
|
- For TLS-enabled deployments, see [Managing Certificates](/kubernetes/managing-certificates) once SCC-compatible PKI is supported.
|
|
- To expose the gateway externally, see [Ingress](/kubernetes/ingress).
|
|
- To configure OIDC authentication, see [Access Control](/kubernetes/access-control).
|