Deploy DALP to OpenShift

Routing#

The overlay disables ingress and serves through native Routes. Every workload that serves HTTP has its own openShiftRoute block that sets the host, labels and TLS, and not every one ships turned on. The Console, the block explorer's frontend and the docs site enable openShiftRoute by default. The block explorer's API and the Platform API disable it by default. The Console reaches the Platform API inside the cluster, and most integrators use the Console's API path. Set dapi.openShiftRoute.enabled to true only when integrators must call the Platform API directly. Gateway API httpRoute is disabled for the Platform API on OpenShift, and Routes replace it. The Console Route sets an HAProxy router timeout of 5 minutes, above the worst-case create and write latency, so a slow request completes instead of returning a 504.

Every Route in the overlay terminates TLS at the router with termination: edge and insecureEdgeTerminationPolicy: Redirect: HTTPS ends at the OpenShift router, traffic continues unencrypted inside the cluster over the Service network, and a plain HTTP request is redirected to HTTPS. The chart does not restrict this value. The Route template passes your tls block through unchanged, so passthrough, where the original TLS session reaches the pod, or reencrypt, where the router terminates TLS and encrypts again to the pod, needs no template edit. Passthrough requires TLS at the pod. The Console service port uses plain HTTP, so changing the Route value alone cannot enable passthrough. Reencrypt also needs a destinationCACertificate and a pod that serves TLS on the port the Route re-encrypts to.

LimitRange floor#

A namespace LimitRange, a separate admission check from the restricted-v2 SCC, sets the lowest CPU and memory each container may request and rejects any request below it. The chart's own defaults fall under a common floor of 100m CPU and 128Mi memory in several places: the Conjur authenticator init container ships 10m CPU and 32Mi memory. The overlay raises the containers in the table to at least that floor. The Conjur and Console blocks in the example show the shape of the overlay's resources keys, and the other containers follow the same pattern. These are the overlay's values, and they replace the base chart's sizing in Resource sizing.

global:
  conjur:
    resources:
      requests:
        cpu: "100m"
        memory: "128Mi"
      limits:
        cpu: "200m"
        memory: "256Mi"

dapp:
  resources:
    requests:
      cpu: 100m
      memory: 256Mi
    limits:
      cpu: "1"
      memory: 512Mi

Compare your namespace's LimitRange floor with every container in the table before you deploy. A floor set higher than the overlay's requests rejects the pod at admission, and the workload controller reports a failed pod creation with an admission event naming the container and invalid request. A floor set lower still admits the pod but wastes the headroom the overlay already budgeted. For how the Conjur authenticator init container receives its credentials, see Values and secrets.

Preconditions beyond the security context#

For an air-gapped OpenShift deployment, serve the chart and every image from a registry inside your network, in addition to the SCC and LimitRange settings. List the images a release uses with helm template dalp ./dalp -f values.yaml -f ./dalp/values-openshift.yaml | grep 'image:' | sort -u, and mirror each one by digest. Confirm every image reference, init and utility images included, carries an explicit registry and repository plus a tag or digest, because an air-gapped cluster cannot resolve an implicit public registry. The overlay supplies mirrored-registry overrides for the kubectl helper and the Conjur authenticator. A correct registry override cannot load an image whose digest is missing from the mirror.

The Platform API, the Workflow Engine, Ledger Data and the scheduler run as separate images, each with its own repository value and each distroless with no shell, so a mirrored registry needs all four. Any entrypoint wrapping these images, including the Conjur summon injection described in Values and secrets, must run in exec form, not through /bin/sh -c.

Every Route host, the Console public URL and the direct Platform API Route origin ship as placeholder apps-crc.testing hostnames, the domain a local CodeReady Containers cluster serves. Applying the overlay unchanged renders Routes on hostnames no production cluster serves. Override every openShiftRoute.host, global.dalpApp.config.app.http.url and the https://dapi.apps-crc.testing entry in global.dalpApp.config.auth.consoleUrls. When you enable the Investor portal, also set global.dalpApp.env.INVESTOR_PORTAL_URL to its public Route host: the overlay ships no value for it, and the render fails without one.

Set the Console public URL only in global.dalpApp.config.app.http.url. The Console and the Platform API both read that one value: the Console sends it as the origin of its server-side calls, and the Platform API accepts a Console session only from the origins it lists. Give it as a plain https:// URL. The chart refuses to render dapp.config.app or dapi.config.app, a ${...} variable in the URL, or a Helm template expression anywhere in global.dalpApp.config, because a second copy of the URL, or one that resolves differently per component, lets the two disagree and signs every user out on a full page load.

The observability overlay pins the storage classes of VictoriaMetrics and VictoriaLogs to one name, standard-csi. Without a StorageClass named standard-csi, those PersistentVolumeClaims stay Pending, and their provisioning events name the missing class. Set server.persistentVolume.storageClassName for VictoriaMetrics and VictoriaLogs to a class your cluster provides.

The overlay also turns on deny-by-default egress for two workloads: dapp.networkPolicy.enabled and investorPortal.networkPolicy.enabled both become true. The Console policy declares both Ingress and Egress policy types, and its egress allow list selects pods only, which covers same-namespace, chart-deployed dependencies. It does not reach an object store, an SMTP relay or a database outside the cluster. Before you apply the overlay, add ipBlock peers for those external dependencies to dapp.networkPolicy.egress, and to investorPortal.networkPolicy.egress when the portal is enabled. An endpoint missing from the allow list cannot be reached, and the blocked connection produces no admission error.

Browser apps with user sessions#

When the Console and the Investor portal use separate Routes, each app serves /api and /dalp on its own host and forwards to the private DAPI_INTERNAL_URL. The Investor portal needs no platform URL of its own: its server forwards the browser's /api and /dalp calls to DAPI_INTERNAL_URL in investorPortal.env, which defaults to the in-cluster http://dalp-api:3001. Do not configure a public DAPI_URL for the Portal. Deploy browser apps with user sessions lists the values, and the SDK browser guide shows the proxy handler.

Troubleshooting#

Frequently asked questions#