OpenShift

​

Prerequisites

• An OpenShift cluster, and oc / kubectl access.
• Helm 3.14 or later (Helm 4 works).
• The tracebloc CLI, signed in (tracebloc login). It creates your secure environment’s Client ID and password; see Configuration → Authentication.

​

Install

tracebloc client create --credential-file tb.env   # Client ID, password and namespace, see below
helm repo add tracebloc https://tracebloc.github.io/client
helm repo update
helm show values tracebloc/client > values.yaml   # edit per below
. ./tb.env
helm upgrade --install "$TRACEBLOC_NAMESPACE" tracebloc/client \
  -n "$TRACEBLOC_NAMESPACE" --create-namespace -f values.yaml

​

Verify

oc get pods -n "$TRACEBLOC_NAMESPACE"

​

Environment-specific config

storageClass:
  create: false
  name: ocs-storagecluster-cephfs
clusterScope: false
openshift:
  scc:
    enabled: true            # SCC for the privileged resource-monitor
networkPolicy:
  training:
    enabled: true
    dnsNamespace: openshift-dns
    dnsSelector:
      dns.operator.openshift.io/daemonset-dns: default

• OVN-Kubernetes enforces NetworkPolicy by default, so the training-pod egress lockdown works out of the box.
• metrics-server is present on OpenShift.
• GPU or CPU-only. In the env block of values.yaml, declare what your nodes have. Without GPU_LIMITS, every training pod requests one NVIDIA GPU, and on CPU-only nodes it stays Pending:
  env:
    TRACEBLOC_DDP: "1"           # from the chart's env block; keep it
    GPU_LIMITS: ""               # CPU-only nodes. For NVIDIA GPUs: "nvidia.com/gpu=1"
  
  The chart’s values.yaml writes env in braces (env: { … }), where a new line without a comma is a YAML error. Replace that whole block with the one above, and carry over any other keys you’ve set. With GPUs, use x86_64 nodes with an NVIDIA GPU of the Turing generation or newer (GPU support). The nodes also need the NVIDIA device plugin. Install it yourself (on OpenShift, usually through the NVIDIA GPU Operator), or let the chart run it:
  gpu:
    devicePlugin:
      enabled: true
      vendor: nvidia
  

​

Production notes

• The bundled SCC grants the resource-monitor the host access it needs — review it against your cluster policy.
• Size training compute per job; day-2 management is in Operations.