mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-16 05:20:22 +08:00
Taylor Mutch
7dab612feb
* feat(helm): support Deployment kind in HA gateway workloads Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(helm): handle null workload values Signed-off-by: Taylor Mutch <taylormutch@gmail.com> --------- Signed-off-by: Taylor Mutch <taylormutch@gmail.com>
96 lines
3.5 KiB
Plaintext
96 lines
3.5 KiB
Plaintext
---
|
|
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
title: "OpenShift"
|
|
sidebar-title: "OpenShift"
|
|
description: "Install the OpenShell Helm chart on OpenShift, including the SCC binding and chart overrides required by OpenShift's Security Context Constraints."
|
|
keywords: "Generative AI, Cybersecurity, Kubernetes, OpenShift, SCC, Security Context Constraints, Helm, Gateway, Installation"
|
|
position: 5
|
|
---
|
|
|
|
<Warning>
|
|
The OpenShift install path is experimental. It currently requires running sandbox pods under the `privileged` SCC and installing the gateway with TLS and the PKI init job disabled. Use only for evaluation on a private network.
|
|
</Warning>
|
|
|
|
OpenShift's [Security Context Constraints](https://docs.openshift.com/container-platform/latest/authentication/managing-security-context-constraints.html) reject the chart's default pod security settings. Installing on OpenShift requires precreating the namespace, granting the `privileged` SCC to the sandbox service account, and overriding a few chart values so the cluster admission controller can assign UIDs and FS groups itself.
|
|
|
|
## Prerequisites
|
|
|
|
- OpenShift 4.x cluster with `oc` configured
|
|
- Helm 3.x
|
|
- [Agent Sandbox](/kubernetes/setup#install-agent-sandbox) controller and CRDs installed
|
|
|
|
## Install
|
|
|
|
<Steps>
|
|
|
|
## Create the namespace
|
|
|
|
Pre-create the namespace so the SCC binding can be applied before the chart installs:
|
|
|
|
```shell
|
|
oc create ns openshell
|
|
```
|
|
|
|
## Grant the privileged SCC to sandbox pods
|
|
|
|
Sandbox pods run under the `openshell-sandbox` service account in the `openshell` namespace and require the `privileged` SCC:
|
|
|
|
```shell
|
|
oc adm policy add-scc-to-user privileged -z openshell-sandbox -n openshell
|
|
```
|
|
|
|
## Install the chart with OpenShift overrides
|
|
|
|
```shell
|
|
helm install openshell oci://ghcr.io/nvidia/openshell/helm-chart \
|
|
--version <version> \
|
|
--namespace openshell \
|
|
--set pkiInitJob.enabled=false \
|
|
--set server.disableTls=true \
|
|
--set podSecurityContext.fsGroup=null \
|
|
--set securityContext.runAsUser=null
|
|
```
|
|
|
|
| Override | Reason |
|
|
|---|---|
|
|
| `pkiInitJob.enabled=false` | Skips the built-in TLS PKI Job. TLS must also be disabled unless you provide TLS Secrets another way. |
|
|
| `server.disableTls=true` | The gateway has no certificates without `pkiInitJob`, so it must run plaintext. |
|
|
| `podSecurityContext.fsGroup=null` / `securityContext.runAsUser=null` | Clear the chart's hardcoded UID and fsGroup so OpenShift's SCC admission can assign them. |
|
|
|
|
The gateway still needs the sandbox JWT signing Secret. When disabling
|
|
`pkiInitJob` without enabling cert-manager, pre-create that Secret before
|
|
installing the chart.
|
|
|
|
## Wait for the gateway to be ready
|
|
|
|
```shell
|
|
oc -n openshell rollout status statefulset/openshell
|
|
```
|
|
|
|
If you set `workload.kind=deployment`, use
|
|
`oc -n openshell rollout status deployment/openshell` instead.
|
|
|
|
</Steps>
|
|
|
|
## Connect to the gateway
|
|
|
|
The gateway is now running over plaintext HTTP. Connect with `oc port-forward`:
|
|
|
|
```shell
|
|
oc -n openshell port-forward svc/openshell 8080:8080
|
|
```
|
|
|
|
Register the gateway with the CLI:
|
|
|
|
```shell
|
|
openshell gateway add http://127.0.0.1:8080 --local --name openshift
|
|
openshell status
|
|
```
|
|
|
|
## Next Steps
|
|
|
|
- For TLS-enabled deployments, refer to [Managing Certificates](/kubernetes/managing-certificates) after SCC-compatible PKI is supported.
|
|
- To expose the gateway externally, refer to [Ingress](/kubernetes/ingress).
|
|
- To configure OIDC authentication, refer to [Access Control](/kubernetes/access-control).
|