Red Hat OpenShift Container Platform (OCP) requirements

Red Hat OpenShift Container Platform (OCP)¶

This section outlines the supplementary configuration required for the Red Hat OpenShift Container Platform (OCP) to successfully run the DataRobot platform.

The services described below are presumed to be part of an OCP deployment, but they're not required. This page doesn't cover setup of clusters without these services.

OCP service integration¶

Certificate management¶

DataRobot's Helm chart enables ingress TLS by default and expects cert-manager to supply the certificate. With the default values, global.ingress.tls.enabled and global.ingress.tls.certmanager are both true, so the chart creates a cert-manager Certificate for the secret named in global.ingress.tls.secretName (default datarobot-acme-cert), requested from the ClusterIssuer named in global.ingress.tls.issuer. Every DataRobot Ingress then references that secret.

Since cert-manager is not included in the DataRobot release artifacts, you must install it yourself, along with a working ClusterIssuer that can issue a certificate for your DataRobot domain. See Cert manager for TLS on ingress.

On OpenShift, each Ingress is converted into a Route, and that conversion reads the TLS secret the Ingress references. If the secret doesn't exist, no Route is created, and the Ingress's paths return HTTP 404 instead of falling back to an untrusted certificate.

A cert-manager `Certificate` that never issues causes this failure without any error. This can happen when the `ClusterIssuer` is missing or the domain can't be validated. The Helm install succeeds, but the secret never appears. To check for this problem:

1. Run `oc get certificate -n <namespace>` and confirm that each certificate reports `READY=True`.
2. Run `oc get ingress -n <namespace>` and confirm that each Ingress has an address.

If you don't want to run cert-manager, set global.ingress.tls.certmanager to false and create the TLS secret yourself, as described in Using a 3rd party certificate.

To terminate TLS at the OpenShift router with the router's default certificate instead, set global.ingress.tls.enabled to false and add the route.openshift.io/termination: edge annotation, as described in Ingress settings.

OCI registry¶

To install the DataRobot platform, you can pull the application images from your private OCI Container Registry. Alternatively, you can use the Docker Hub registry.

Network policy engine¶

Custom model and custom task features benefit from a network policy engine to enforce Kubernetes Network Policies. It's recommended, but not required, to ensure the security of custom model pods.

For details, see the Network security RedHat documentation.