> ## Documentation Index
> Fetch the complete documentation index at: https://delivery.vexa.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# OpenShift

> What an OpenShift project must provide — including shared clusters where you hold a namespace, not the cluster

**Built for the shape large organizations actually run it: a shared cluster operated by a platform team, where your team holds a project and deploys through GitOps.** Nothing in the install needs cluster-admin, and nothing needs a CLI.

## Status

**Rehearsed against recorded constraints; never installed on an OpenShift cluster.** The profile carries `PROFILE_TESTED=no`, and that is the accurate value: `kit/install.sh --provider openshift` has not been run against OpenShift, so Argo install, Kyverno install, admission policy and repo secrets are all untried there against real SCC and real RBAC. What has been done is offline — the SCC/PSA/LimitRange logic checked against constraints recorded from a genuine SCC admission rehearsal (MicroShift 4.18, 2026-08-21) and from a subscriber's own measurements: 25 chart objects admitted stock, zero SCC rejects, random-UID security contexts injected on all 21 pods ([parity detail](/engineering/openshift-parity)).

**Vexa has not been observed converging and running on OpenShift, and one known defect is in the way.** Under a random UID, `HOME` is absent from the bot and agent-worker images at the `v0.12.23` digests; the minio-init hook fails with `mkdir /.mc: permission denied` and the Application never converges. `HOME=/tmp` is the one-variable fix, tracked upstream, not shipped. No preflight check detects it — a P4 PASS means admission will accept the pod, not that the process inside it can run. Two further gaps, stated as gaps: the OpenShift GitOps operator is recommended on evidence about upstream Argo's images rather than on a run of it with this kit, and bare-metal OpenShift with no LoadBalancer needs a `Route`, which the chart does not render today.

| Requirement                                                                                    | Why                                                                                                                               |
| ---------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- |
| A project with **ResourceQuota + LimitRange** and runtime RBAC                                 | the standard tenant grant your platform team already manages. Size the quota for the app **plus** Argo if Argo shares the project |
| Argo CD — the **OpenShift GitOps operator** (recommended) or your house instance               | upstream Argo's own images hard-code UIDs that `restricted-v2` rejects; the operator build installs clean                         |
| A registry path to the channel: your **Harbor/Artifactory pull-through proxy**, or direct pull | one proxy endpoint + project if the channel is private; nothing at all on the public lane                                         |
| `restricted-v2` SCC — the default                                                              | the stack runs under it stock: no SCC changes, no fixed UIDs, no privileged anything                                              |

## How the install works here

There is no setup script on a no-CLI platform — the script's work arrives as **one merge into your GitOps config repo**: an Argo Application carrying the station bundle reference, your contract, and the channel public key. Your Argo does the rest. Your staging tier then follows releases automatically and your production pin moves only when your approver moves it, recorded with the contract identity where your audit can read it.

## Platform notes

* **Admission injects the security context.** The platform assigns a random per-namespace UID and the images run under it; charts and spawned workloads deliberately set no `securityContext` of their own.
* **Spawned meeting bots** inherit your LimitRange defaults today; first-class resource fields on spawned workloads are tracked upstream and the LimitRange is the documented interim.
* **The private-channel lane through a corporate proxy is validated**: entries, charts, signatures and attestations flow through a credentialed Harbor proxy-cache, and revoking the subscriber credential fails closed for the verdict-carrying artifacts.
* Cluster-wide admission hardening at the platform layer is an optional later step; until then the in-project verify gate is the enforcement point.

Next: [Install](/install) · [Preflight](/preflight) · [Kubernetes](/environments/kubernetes)