Skip to content

Commit 97c6ac5

Browse files
Update content/nim/deploy/kubernetes/deploy-using-helm.md
Co-authored-by: Travis Martin <[email protected]>
1 parent 84c647b commit 97c6ac5

File tree

1 file changed

+5
-4
lines changed

1 file changed

+5
-4
lines changed

content/nim/deploy/kubernetes/deploy-using-helm.md

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -567,12 +567,13 @@ openshift:
567567
This ensures pods can run with the user IDs required by NGINX Instance Manager services.
568568

569569

570-
When `openshift.enabled: true` is set in the `values.yaml` file, the NGINX Instance Manager deployment automatically creates a **custom [Security Context Constraints](https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html/authentication_and_authorization/managing-pod-security-policies) (SCCs)** and links it to the Service Account used by all pods.
570+
When `openshift.enabled: true` is set in the `values.yaml` file, the NGINX Instance Manager deployment automatically creates a custom [Security Context Constraints (SCC)](https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html/authentication_and_authorization/managing-pod-security-policies) object and links it to the Service Account used by all pods.
571571

572-
By default, OpenShift enforces strict security policies that require containers to run as **non-root** users. The NGINX Instance Manager deployment needs specific user IDs (UIDs) for certain services, such as **1000** for `nms` and **101** for `nginx` and `clickhouse`. Since the default SCCs do not allow these UIDs, a **custom SCC** is created. This ensures that the deployment can run with the necessary permissions while maintaining OpenShift’s security standards. The custom SCC allows these UIDs by setting the `runAsUser` field, which controls which users can run containers.
572+
By default, OpenShift enforces strict security policies that require containers to run as **non-root** users. The deployment needs specific user IDs (UIDs) for certain services**1000** for `nms`, and **101** for `nginx` and `clickhouse`. Since the default SCCs don’t allow these UIDs, the deployment creates a custom SCC. This SCC sets the `runAsUser` field to allow the necessary UIDs while still complying with OpenShift’s security standards.
573573

574-
{{< note >}} The NGINX Instance Manager deployment on OpenShift has been tested with OpenShift v4.13.0 Server. {{< /note >}}
575-
{{< note >}} If you see permission errors during deployment, your user account might not have access to manage SCCs. Contact a cluster administrator to request access. {{< /note >}}
574+
This deployment has been tested with OpenShift v4.13.0 Server.
575+
576+
If you see permission errors during deployment, your account might not have access to manage SCCs. Ask a cluster administrator for access.
576577

577578
To verify that the SCC was created after installing the Helm chart, run:
578579

0 commit comments

Comments
 (0)