OpenShift Considerations

Introduction

This guide explains how to deploy MetaDefender Storage Security (MDSS) on OpenShift using Helm with the required OpenShift-specific configuration.

Prerequisites

Access to OpenShift cluster with admin privileges
Helm 3.x installed
oc command-line tool configured
Ability to grant privileged SCC permissions

Deployment Steps

Bash
    
 
oc login --token=<your_token> --server=<cluster_url>
Copy

2. Create Project

Bash
    
 
oc new-project mdss
Copy

3. Create Service Account and Grant Permissions

The MDSS components require privileged access to function properly on OpenShift:

Bash
    
​x
 
# Create a service account for MDSSoc create sa mdss -n mdss​# Grant privileged security context constraints to the service accountoc adm policy add-scc-to-user privileged -z mdss -n mdss
Copy

Important: The privileged SCC is necessary because several MDSS components require elevated permissions.

4. Add Helm Repository

Bash
    
 
helm repo add mdk8s <https://opswat.github.io/metadefender-k8s/> helm repo update mdk8s
Copy

5. Prepare OpenShift Values File

Create a file named mdss-openshift.yml with the OpenShift-specific configuration:

Bash
    
 
# Download the OpenShift values file directly from GitHub # Run this command to fetch the file: curl -O <https://raw.githubusercontent.com/OPSWAT/metadefender-k8s/refs/heads/main/helm_charts/mdss-openshift.yml
Copy

6. Deploy the MDSS Helm Chart

Bash
    
 
helm install mdss mdk8s/metadefender_storage_security -f mdss-openshift.yml
Copy

Note: The OpenShift values file configures the SecurityContext to run as user 0 (root), assigns the mdss service account to pods, and adjusts command arguments for compatibility.

7. Verify Deployment

Bash
    
 
oc get pods -n mdss oc get services -n mdss
Copy

Wait until all pods are in Running state. This may take a few minutes as containers initialize.

Post-Deployment Configuration

Access MDSS Console

Bash
    
 
# Create a route to access the MDSS web interface oc expose svc/webclient -n mdss # Get the route URL oc get route webclient -n mdss
Copy

Access the web interface using the hostname provided by the route.

Maintenance

Upgrading MDSS

Bash
    
 
helm repo update mdk8s helm upgrade mdss mdk8s/metadefender_storage_security -f mdss-openshift.yml
Copy

Uninstalling MDSS

Bash
    
 
helm uninstall mdss oc delete project mdss
Copy

Last updated on

Was this page helpful?