> ## Documentation Index
> Fetch the complete documentation index at: https://docs.prisme.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Deploying Prisme.ai on OpenShift

> OpenShift-specific routes, SCCs, operators and persistent storage. The Helm install itself is documented under Installation.

This page covers the OpenShift-specific bits. The actual Helm install — values, ingress, env vars — lives in [Install with Helm](/self-hosting/kubernetes/helm).

***

## Recommended managed services

| Component                | OpenShift / on-prem option                                                                                               | Notes                                   |
| ------------------------ | ------------------------------------------------------------------------------------------------------------------------ | --------------------------------------- |
| Kubernetes               | **OpenShift 4.x** (OCP, ROSA, ARO, OpenShift on IBM Cloud).                                                              | 3+ worker nodes, ≥ 4 vCPU / 16 GB each. |
| MongoDB                  | **MongoDB Enterprise Operator** for OpenShift, or external Atlas. See [MongoDB](/self-hosting/databases/mongodb).        |                                         |
| PostgreSQL (alternative) | **Crunchy Postgres for Kubernetes** operator. See [PostgreSQL](/self-hosting/databases/postgresql).                      |                                         |
| Elasticsearch            | **Elasticsearch Operator (ECK)** or **OpenSearch Operator**. See [Elasticsearch](/self-hosting/databases/elasticsearch). |                                         |
| Redis                    | **Redis Operator** for OpenShift (standard Redis, no modules required). See [Redis](/self-hosting/databases/redis).      |                                         |
| Object storage           | **OpenShift Data Foundation** (Noobaa) or external S3-compatible (MinIO, Ceph RGW).                                      |                                         |
| File storage (PVC RWX)   | **OpenShift Data Foundation** (CephFS) or external NFS.                                                                  |                                         |
| Ingress                  | **OpenShift Routes** (HAProxy-based) with TLS edge termination.                                                          |                                         |
| TLS / Certificates       | **cert-manager** Operator, or import a wildcard certificate.                                                             |                                         |
| Secrets                  | **HashiCorp Vault** + Vault Agent Injector, or **External Secrets Operator**.                                            |                                         |

***

## Persistent storage

The shared RWX PVC (used by `prismeai-functions`) must be backed by **CephFS** (via OpenShift Data Foundation) or **NFS**, with the right RWX storage class set on the PVC.

***

## Security Context Constraints (SCCs)

OpenShift restricts container privileges by default. Apply (or grant) an SCC compatible with running the platform images as non-root:

* `restricted-v2` works for most services if the chart's default `securityContext.runAsUser` is honored.
* `prismeai-functions` forks isolated child processes — review its SCC requirements with Prisme.ai before granting elevated privileges.

Make sure the service account used by each Helm release is bound to the appropriate SCC.

***

## Routes vs Ingress

Prisme.ai's chart ships Kubernetes `Ingress` resources by default. On OpenShift you have two options:

1. **Keep Ingress** — OpenShift's Ingress Operator translates them to Routes automatically.
2. **Use Routes directly** — disable the chart's Ingress and create two Routes (`api`, `studio`) with TLS edge termination and a `haproxy.router.openshift.io/timeout: 300s` annotation to keep SSE / websocket connections alive.

***

## DNS and TLS

Create two records:

```
api.<your-domain>     -> OpenShift router VIP / Cloud LB
studio.<your-domain>  -> same
```

Certificate covering both, managed by cert-manager or imported as a Route TLS secret.

***

## Next Steps

<CardGroup cols={2}>
  <Card title="Install with Helm" icon="ship" href="/self-hosting/kubernetes/helm">
    Configure values and deploy core + apps namespaces.
  </Card>

  <Card title="Databases" icon="database" href="/self-hosting/databases/overview">
    PostgreSQL or MongoDB, Redis, Elasticsearch or OpenSearch.
  </Card>

  <Card title="Install products" icon="rocket" href="/self-hosting/install-products">
    Fresh-install walkthrough.
  </Card>

  <Card title="Migration v27" icon="arrow-right-arrow-left" href="/self-hosting/operations/migration-v27">
    Migrate an existing instance to v27.
  </Card>
</CardGroup>