diff --git a/Deployment-to-Kubernetes-and-Minikube.md b/Deployment-to-Kubernetes-and-Minikube.md index 0609e1f..988b1b3 100644 --- a/Deployment-to-Kubernetes-and-Minikube.md +++ b/Deployment-to-Kubernetes-and-Minikube.md @@ -183,4 +183,29 @@ http://minikubecluster:30070/ui/index.html ``` `minikubecluster` in my environment resolves to the IP address of the minikube's VM which you can get using `minikube ip` command. -The port numbers in these commands are the `node ports` defined as part of the service spec which map to the internal container ports and to which they forward all the requests. For more information about Node Ports see https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport. + +# OpenShift Deployment + +OpenShift (and other clusters enforcing the `restricted` Pod Security Standard) has stricter security requirements than default Kubernetes. Specifically, it blocks containers that attempt to run as root or use `hostPath` volumes. + +SeaweedFS can be deployed on OpenShift by using a specialized Helm values file that overrides the defaults to comply with the `restricted` Security Context Constraints (SCC). + +## Steps + +1. Use the generic SeaweedFS Helm chart but provide the `openshift-values.yaml` overrides file. This file (located in the chart directory) configures the pods to: + - Use `PersistentVolumeClaims` instead of `hostPath`. + - Set `runAsNonRoot: true` and omit specific UIDs (allowing OpenShift to automatically assign a valid UID from the namespace's allocated range). + - Drop all Linux capabilities and disable privilege escalation. + - Use the `RuntimeDefault` seccomp profile. + +2. Install the Helm chart with the OpenShift overrides: + +```bash +helm install seaweedfs seaweedfs/seaweedfs \ + -n seaweedfs --create-namespace \ + -f https://raw.githubusercontent.com/seaweedfs/seaweedfs/master/k8s/charts/seaweedfs/openshift-values.yaml +``` + +*Note: If you have already cloned the repository, you can reference the local file: `-f k8s/charts/seaweedfs/openshift-values.yaml`.* + +For more details on the specific settings, see the comments within [openshift-values.yaml](https://github.com/seaweedfs/seaweedfs/blob/master/k8s/charts/seaweedfs/openshift-values.yaml).