Skip to content

Commit 0ab04d6

Browse files
solacelostsolacelost
authored
fix: enable deployment on OpenShift (#8005)
1 parent 5704238 commit 0ab04d6

File tree

5 files changed

+176
-2
lines changed

5 files changed

+176
-2
lines changed

‎deploy/k8s-onprem/README.md‎

Lines changed: 21 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
<!--
2-
# Copyright (c) 2018-2024, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
2+
# Copyright (c) 2018-2025, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
33
#
44
# Redistribution and use in source and binary forms, with or without
55
# modification, are permitted provided that the following conditions
@@ -234,6 +234,26 @@ EOF
234234
$ helm install example -f config.yaml .
235235
```
236236

237+
## Deploying the Inference Server on OpenShift or OKD
238+
239+
Because of the default security posture of OpenShift and OKD, the configuration
240+
of which uses OpenShift-specific APIs, the chart needs special consideration
241+
when targeting those environments. Any of the above discussed customizations and
242+
prerequisites hold for an OpenShift environment, except that you do not need to
243+
install Prometheus and Grafana and can instead enable monitoring for
244+
user-defined projects by following
245+
[the OpenShift documentation on the topic](https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html/monitoring/enabling-monitoring-for-user-defined-projects).
246+
247+
To deploy the configurations to enable NFS mounts and the non-root UIDs used in
248+
the Triton deployment, a tag can be enabled alongside any other configurations
249+
discussed above. In the simplest case, to use `--set` on the command line, you
250+
can simply update the tags.openshift parameter.
251+
252+
```
253+
$ cd <directory containing Chart.yaml>
254+
$ helm install example --set tags.openshift=true .
255+
```
256+
237257
## Probe Configuration
238258

239259
In `templates/deployment.yaml` is configurations for `livenessProbe`, `readinessProbe` and `startupProbe` for the Triton server container.

‎deploy/k8s-onprem/templates/deployment.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Copyright (c) 2019-2021, NVIDIA CORPORATION. All rights reserved.
1+
# Copyright (c) 2019-2025, NVIDIA CORPORATION. All rights reserved.
22
#
33
# Redistribution and use in source and binary forms, with or without
44
# modification, are permitted provided that the following conditions
@@ -51,6 +51,7 @@ spec:
5151
release: {{ .Release.Name }}
5252

5353
spec:
54+
serviceAccountName: {{ template "triton-inference-server.fullname" . }}
5455
volumes:
5556
- name: models
5657
nfs:

‎deploy/k8s-onprem/templates/rbac.yaml‎

Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
# Copyright (c) 2019-2025, NVIDIA CORPORATION. All rights reserved.
2+
#
3+
# Redistribution and use in source and binary forms, with or without
4+
# modification, are permitted provided that the following conditions
5+
# are met:
6+
# * Redistributions of source code must retain the above copyright
7+
# notice, this list of conditions and the following disclaimer.
8+
# * Redistributions in binary form must reproduce the above copyright
9+
# notice, this list of conditions and the following disclaimer in the
10+
# documentation and/or other materials provided with the distribution.
11+
# * Neither the name of NVIDIA CORPORATION nor the names of its
12+
# contributors may be used to endorse or promote products derived
13+
# from this software without specific prior written permission.
14+
#
15+
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
16+
# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17+
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
18+
# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
19+
# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
20+
# EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
21+
# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
22+
# PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
23+
# OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
24+
# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
25+
# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
26+
27+
# Configures RBAC if required for the platform to support running with
28+
# NFS volumes and pinned non-root UIDs as required
29+
30+
{{- if .Values.tags.openshift }}
31+
apiVersion: security.openshift.io/v1
32+
kind: SecurityContextConstraints
33+
metadata:
34+
name: {{ template "triton-inference-server.fullname" . }}
35+
annotations:
36+
kubernetes.io/description: triton has the same settings as restricted-v2,
37+
except it also allows non-root UIDs and NFS mounts.
38+
labels:
39+
app: {{ template "triton-inference-server.name" . }}
40+
chart: {{ template "triton-inference-server.chart" . }}
41+
release: {{ .Release.Name }}
42+
heritage: {{ .Release.Service }}
43+
allowHostDirVolumePlugin: false
44+
allowHostIPC: false
45+
allowHostNetwork: false
46+
allowHostPID: false
47+
allowHostPorts: false
48+
allowPrivilegeEscalation: false
49+
allowPrivilegedContainer: false
50+
allowedCapabilities:
51+
- NET_BIND_SERVICE
52+
defaultAddCapabilities: null
53+
fsGroup:
54+
type: RunAsAny
55+
groups: []
56+
priority: null
57+
readOnlyRootFilesystem: false
58+
requiredDropCapabilities:
59+
- ALL
60+
runAsUser:
61+
type: MustRunAsNonRoot
62+
seLinuxContext:
63+
type: MustRunAs
64+
seccompProfiles:
65+
- runtime/default
66+
supplementalGroups:
67+
type: RunAsAny
68+
users: []
69+
volumes:
70+
- configMap
71+
- csi
72+
- downwardAPI
73+
- emptyDir
74+
- ephemeral
75+
- nfs
76+
- persistentVolumeClaim
77+
- projected
78+
- secret
79+
---
80+
kind: Role
81+
apiVersion: rbac.authorization.k8s.io/v1
82+
metadata:
83+
name: {{ include "triton-inference-server.fullname" . }}-scc
84+
namespace: {{ .Release.Namespace }}
85+
labels:
86+
app: {{ template "triton-inference-server.name" . }}
87+
chart: {{ template "triton-inference-server.chart" . }}
88+
release: {{ .Release.Name }}
89+
heritage: {{ .Release.Service }}
90+
rules:
91+
- apiGroups: ["security.openshift.io"]
92+
resources: ["securitycontextconstraints"]
93+
resourceNames: [{{ include "triton-inference-server.fullname" . | quote }}]
94+
verbs: ["use"]
95+
---
96+
kind: RoleBinding
97+
apiVersion: rbac.authorization.k8s.io/v1
98+
metadata:
99+
name: {{ include "triton-inference-server.fullname" . }}-scc
100+
namespace: {{ .Release.Namespace }}
101+
labels:
102+
app: {{ template "triton-inference-server.name" . }}
103+
chart: {{ template "triton-inference-server.chart" . }}
104+
release: {{ .Release.Name }}
105+
heritage: {{ .Release.Service }}
106+
subjects:
107+
- kind: ServiceAccount
108+
name: {{ template "triton-inference-server.fullname" . }}
109+
namespace: {{ .Release.Namespace }}
110+
roleRef:
111+
kind: Role
112+
name: {{ include "triton-inference-server.fullname" . }}-scc
113+
apiGroup: rbac.authorization.k8s.io
114+
{{- end -}}

‎deploy/k8s-onprem/templates/serviceaccount.yaml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
# Copyright (c) 2019-2025, NVIDIA CORPORATION. All rights reserved.
2+
#
3+
# Redistribution and use in source and binary forms, with or without
4+
# modification, are permitted provided that the following conditions
5+
# are met:
6+
# * Redistributions of source code must retain the above copyright
7+
# notice, this list of conditions and the following disclaimer.
8+
# * Redistributions in binary form must reproduce the above copyright
9+
# notice, this list of conditions and the following disclaimer in the
10+
# documentation and/or other materials provided with the distribution.
11+
# * Neither the name of NVIDIA CORPORATION nor the names of its
12+
# contributors may be used to endorse or promote products derived
13+
# from this software without specific prior written permission.
14+
#
15+
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
16+
# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17+
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
18+
# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
19+
# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
20+
# EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
21+
# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
22+
# PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
23+
# OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
24+
# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
25+
# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
26+
27+
# Configures a ServiceAccount for the Triton deployment to enable RBAC
28+
29+
apiVersion: v1
30+
kind: ServiceAccount
31+
metadata:
32+
name: {{ template "triton-inference-server.fullname" . }}
33+
namespace: {{ .Release.Namespace }}
34+
labels:
35+
app: {{ template "triton-inference-server.name" . }}
36+
chart: {{ template "triton-inference-server.chart" . }}
37+
release: {{ .Release.Name }}
38+
heritage: {{ .Release.Service }}

‎deploy/k8s-onprem/values.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@
2727
tags:
2828
autoscaling: true
2929
loadBalancing: true
30+
openshift: false
3031

3132
image:
3233
imageName: nvcr.io/nvidia/tritonserver:25.01-py3

0 commit comments

Comments
 (0)