OpenShift installation

Overview

DALP runs on Red Hat OpenShift Container Platform (OCP) and OKD when the cluster provides the Kubernetes APIs, Route API, storage classes, and security policy required by the charts. The OpenShift path keeps DALP workloads non-root, exposes selected services through Routes, and leaves registry approval, storage selection, secret handling, and disaster recovery evidence with the operator.

The chart renders Kubernetes and OpenShift resources. Your platform team controls the cluster policy that admits images, injects secrets, assigns storage, exposes hostnames, and restores state after an incident.

Platform requirements

Security context constraints

DALP images run as non-root and do not require privilege escalation. The charts avoid fixed user IDs so OpenShift can assign a UID from the target project's range.

Required security settings

Review rendered manifests for these settings before production promotion:

securityContext:
  runAsNonRoot: true
  allowPrivilegeEscalation: false
  capabilities:
    drop:
      - ALL
  seccompProfile:
    type: RuntimeDefault

User ID handling

OpenShift assigns arbitrary UIDs from each project's UID range. DALP charts set runAsUser: null to allow OpenShift's admission controller to inject the appropriate UID. Do not specify explicit UIDs in your values overrides.

Image security and evidence handoff

DALP can run as containerized workloads on enterprise OpenShift using non-root images, restricted SCC-compatible runtime settings, image evidence, and runtime secret injection. SettleMint provides the DALP images and Helm values. Your OpenShift team decides which registry, scanner, admission policy, and vault controls approve those images for production.

For the audit evidence model behind SBOMs, source review, and deployed image provenance, see Source verification and auditability.

Networking with Routes

OpenShift uses Routes for external access. DALP charts render Route resources only when the cluster exposes the OpenShift Route API and the relevant openShiftRoute.enabled value is true.

Route configuration

Enable only the public surfaces that the OpenShift Router should expose. The dApp, Blockscout, and Grafana use separate chart surfaces and separate Route values:

# DALP dApp Route
dapp:
  openShiftRoute:
    enabled: true
    host: dalp.apps.example.com
    tls:
      termination: edge
      insecureEdgeTerminationPolicy: Redirect

# Blockscout UI and API Routes
blockscout:
  blockscout:
    openShiftRoute:
      enabled: true
      host: explorer-api.apps.example.com
      tls:
        termination: edge
        insecureEdgeTerminationPolicy: Redirect
  frontend:
    openShiftRoute:
      enabled: true
      host: explorer.apps.example.com
      tls:
        termination: edge
        insecureEdgeTerminationPolicy: Redirect

# Grafana Route in observability chart values
grafana:
  openShiftRoute:
    enabled: true
    host: grafana.apps.example.com
    tls:
      termination: edge
      insecureEdgeTerminationPolicy: Redirect

The settlemint/dalp application chart consumes the dApp and Blockscout Route values. Configure the Grafana Route in the observability chart values when you install observability. If an umbrella chart nests observability under an observability key, put the same Grafana values under that chart key. Leave the Grafana Route disabled when operators should reach Grafana through a private network path or another ingress pattern. See Observability for the monitoring components behind that route.

TLS termination options

Most deployments should use edge termination with OpenShift's wildcard certificate or a custom certificate.

Storage configuration

OpenShift data foundation (ODF)

For production deployments, OpenShift Data Foundation provides:

• Ceph-based distributed storage
• RWX support for shared volumes
• Built-in replication and recovery
• S3-compatible object storage

Storage class selection

global:
  storageClass: ocs-storagecluster-ceph-rbd # ODF block storage

For object storage (RustFS alternative):

rustfs:
  enabled: false # Use ODF object storage instead

objectStorage:
  endpoint: s3://rook-ceph-rgw-ocs-storagecluster-cephobjectstore.openshift-storage.svc
  bucket: dalp-assets
  existingSecret: dalp-s3-credentials

Operator integration

OpenShift operators manage supporting infrastructure outside the DALP application chart.

CloudNativePG

The CloudNativePG operator works on OpenShift without modification. Install via OperatorHub or Helm.

Velero

For backup and disaster recovery, Velero integrates with OpenShift through the OADP (OpenShift API for Data Protection) operator available in OperatorHub.

NetworkPolicy considerations

OpenShift Network Policies work identically to Kubernetes, with one addition: the OpenShift Router requires explicit ingress rules.

DALP charts automatically add router access when running on OpenShift:

# Automatically included when route.openshift.io/v1 API is detected
ingress:
  - from:
      - namespaceSelector:
          matchLabels:
            network.openshift.io/policy-group: ingress

Installation outline

1. Prepare the project

# Create project (namespace)
oc new-project dalp-production

# Verify SCC assignment
oc get scc restricted-v2 -o yaml

2. Add the Helm repository

helm repo add settlemint https://harbor.settlemint.com/chartrepo/dalp
helm repo update

3. Configure values

Create an OpenShift-specific values file by merging the base values-openshift.yaml with your environment configuration:

# values-production.yaml
global:
  platform: openshift
  storageClass: ocs-storagecluster-ceph-rbd

# Enable Routes for user-facing services
dapp:
  openShiftRoute:
    enabled: true
    host: dalp.apps.example.com

blockscout:
  blockscout:
    openShiftRoute:
      enabled: true
      host: explorer-api.apps.example.com
  frontend:
    openShiftRoute:
      enabled: true
      host: explorer.apps.example.com

# Disable Traefik (OpenShift Router handles ingress)
traefik:
  enabled: false

4. Install the chart

helm install dalp settlemint/dalp \
  -n dalp-production \
  -f values-openshift.yaml \
  -f values-production.yaml

5. Verify the deployment

# Check pod status
oc get pods -n dalp-production

# Verify Routes
oc get routes -n dalp-production

# Check Route TLS
oc get route dalp -n dalp-production -o jsonpath='{.spec.tls.termination}'

Troubleshooting

Pod fails with SCC denied

Verify your deployment does not specify explicit UIDs:

oc get deployment <name> -o yaml | grep -A5 securityContext

Remove any runAsUser with explicit values. Use null or omit the field entirely.

Route not accessible

Check that the Route hostname resolves correctly:

oc get route <name> -o jsonpath='{.spec.host}'
nslookup <hostname>

Verify the router pod is running:

oc get pods -n openshift-ingress

Storage provisioning fails

Confirm the storage class exists and is default:

oc get storageclass
oc get pvc -n dalp-production

For ODF, verify the storage cluster is healthy:

oc get storagecluster -n openshift-storage

See also

• Prerequisites for infrastructure requirements.
• Installation process for the full deployment sequence.
• High availability for backup, recovery, and RTO/RPO planning.
• Source verification and auditability for evidence packs and image provenance.