> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neuraltrust.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# OpenShift — Self-hosted deployment

> Complete walkthrough for deploying the full NeuralTrust Platform (Control Plane + Data Plane + TrustGate + Firewall) on Red Hat OpenShift 4.10+. Covers project setup, SCC, image pull secret linking, full values overlay, Routes for every component, and verification.

This guide walks you end-to-end through a **fully self-hosted deployment** on OpenShift — Control Plane API, UI, and Scheduler run in your cluster alongside the Data Plane, TrustGate, and Firewall.

For the SaaS-hosted Control Plane alternative, see [OpenShift hybrid](./hybrid).

## What you'll end up with

| Component                             | Location                             | Replicas |
| ------------------------------------- | ------------------------------------ | -------- |
| Control Plane API, UI, Scheduler      | Your OpenShift cluster               | 2, 2, 1  |
| Data Plane API, worker, Kafka Connect | Your OpenShift cluster               | 2, 1, 1  |
| TrustGate admin / gateway / actions   | Your OpenShift cluster               | 2 each   |
| Firewall gateway + 5 workers          | Your OpenShift cluster               | 2 + 5    |
| ClickHouse, Kafka, PostgreSQL, Redis  | Your OpenShift cluster (or external) | 1 each   |

Sizing baseline: \~21–23 vCPU / 45–50 GiB RAM / 80 GiB PVC. See [Image catalog](../images).

## Prerequisites

| Resource                                | Recommended                                                                  |
| --------------------------------------- | ---------------------------------------------------------------------------- |
| OpenShift version                       | 4.10+                                                                        |
| CPU pool node spec                      | 8 vCPU / 32 GiB                                                              |
| Min CPU nodes                           | **≥ 5** across 3 AZs. Drop to 4 if Firewall workers run on GPU nodes.        |
| GPU pool *(optional, for GPU Firewall)* | 4 vCPU / 16 GiB + 1 × NVIDIA GPU — 5 nodes (one per default Firewall worker) |
| Sizing baseline                         | \~23.1 vCPU / 61.8 GiB requests / 80 GiB PVC (defaults, CPU Firewall)        |
| Storage                                 | Cluster default; for ClickHouse + Postgres prefer fast SSD                   |
| Custom domain                           | A domain you control (e.g. `platform.example.com`)                           |
| Certificates                            | Custom Route TLS or cert-manager                                             |
| Image pull                              | `gcr-keys.json` from NeuralTrust                                             |

## Step 1 — Project setup

Same as hybrid — see [OpenShift hybrid › Step 1](./hybrid#step-1-create-the-project) and [Step 2](./hybrid#step-2-create-and-link-the-image-pull-secret). Self-hosted has identical project/SCC requirements aside from slightly higher CPU/memory budget for CP components.

## Step 2 — Write your values overlay

Save as `my-values.yaml`:

```yaml theme={null}
# Self-hosted deployment on OpenShift
global:
  platform: "openshift"
  domain: "platform.example.com"          # custom domain or apps.<cluster>.openshift.com
  storageClass: ""                         # use cluster default
  autoGenerateSecrets: true
  security:
    allowInsecureImages: true

# Control Plane in your cluster
neuraltrust-control-plane:
  controlPlane:
    enabled: true                          # ← key difference from hybrid
    components:
      api:
        enabled: true
      app:
        enabled: true
      scheduler:
        enabled: true
  infrastructure:
    postgresql:
      deploy: true

# Data Plane
neuraltrust-data-plane:
  dataPlane:
    enabled: true

# TrustGate
trustgate:
  enabled: true
  global:
    env:
      SERVER_BASE_DOMAIN: "platform.example.com"

# Firewall
neuraltrust-firewall:
  firewall:
    enabled: true

# Infrastructure
infrastructure:
  clickhouse:
    deploy: true
  kafka:
    deploy: true
```

The chart will create Routes for every public component (see [Step 4](#step-4-routes-and-dns)).

### Custom Route TLS (recommended for production)

```yaml theme={null}
neuraltrust-control-plane:
  controlPlane:
    components:
      app:
        ingress:
          route:
            tls:
              termination: edge
              certificate: |
                -----BEGIN CERTIFICATE-----
                ...
              key: |
                -----BEGIN PRIVATE KEY-----
                ...
      api:
        ingress:
          route:
            tls:
              termination: edge
              certificate: |
                -----BEGIN CERTIFICATE-----
                ...
              key: |
                -----BEGIN PRIVATE KEY-----
                ...
```

In production, prefer storing certs in OpenShift Secrets and referencing them via your secret-management workflow.

### Using external managed services

```yaml theme={null}
neuraltrust-control-plane:
  infrastructure:
    postgresql:
      deploy: false
  controlPlane:
    components:
      postgresql:
        secrets:
          host: "<managed-postgres>.example.com"
          port: "5432"
          user: "neuraltrust"
          password: ""
          database: "neuraltrust"

infrastructure:
  clickhouse:
    deploy: false
    external:
      host: "your-tenant.clickhouse.cloud"
      port: "8443"
      user: "neuraltrust"
      password: ""
      database: "neuraltrust"
  kafka:
    deploy: false
    external:
      bootstrapServers: "<bootstrap>:9092"
```

<Note>
  For **ClickHouse Cloud**, see the [native-port caveat](../feature-flags#required-clickhouse-cloud-caveat). For external Kafka with SASL, see [Authentication for external Kafka](../feature-flags#authentication-for-external-kafka).
</Note>

## Step 3 — Install

```bash theme={null}
helm upgrade --install neuraltrust-platform \
  oci://europe-west1-docker.pkg.dev/neuraltrust-app-prod/helm-charts/neuraltrust-platform \
  --version <VERSION> \
  --namespace neuraltrust \
  -f my-values.yaml

oc get pods -n neuraltrust -w
```

Initial install takes 4–6 minutes.

After install, link `gcr-secret` to component service accounts (see [OpenShift hybrid › Step 7](./hybrid#step-7-link-pull-secret-to-component-service-accounts)).

## Step 4 — Routes and DNS

```bash theme={null}
oc get route -n neuraltrust
```

Self-hosted creates Routes for **all** public components:

| Route                     | Host                               | Required |
| ------------------------- | ---------------------------------- | -------- |
| `control-plane-app`       | `control-plane-app.<domain>`       | ✅        |
| `control-plane-api`       | `control-plane-api.<domain>`       | ✅        |
| `control-plane-scheduler` | `control-plane-scheduler.<domain>` | ✅        |
| `data-plane-api`          | `data-plane-api.<domain>`          | ✅        |
| `trustgate-admin`         | `trustgate-admin.<domain>`         | ✅        |
| `trustgate-gateway`       | `trustgate-gateway.<domain>`       | ✅        |
| `trustgate-actions`       | `trustgate-actions.<domain>`       | ✅        |

For a custom domain, add CNAMEs pointing each host at the OpenShift router's canonical hostname.

## Step 5 — First login to the Control Plane

1. Open `https://control-plane-app.<domain>`.

2. Get the bootstrap credentials:

   ```bash theme={null}
   oc logs -n neuraltrust deploy/control-plane-app -c init-db | grep -i bootstrap
   ```

3. Sign in, configure SSO ([Platform › SSO](/platform/sso)), rotate the bootstrap admin password.

4. Configure LLM providers, integrations, and policies.

## Step 6 — Send traffic through TrustGate

Point your AI applications at `https://trustgate-gateway.<domain>`. Telemetry flows through TrustGate → Data Plane → ClickHouse, surfaced by your self-hosted Control Plane UI.

## Verification

```bash theme={null}
oc get pods -n neuraltrust
oc get route -n neuraltrust

curl https://control-plane-api.<domain>/health
curl https://control-plane-app.<domain>
curl https://data-plane-api.<domain>/health
curl https://trustgate-gateway.<domain>/__health
```

## Upgrading

```bash theme={null}
helm upgrade neuraltrust-platform \
  oci://europe-west1-docker.pkg.dev/neuraltrust-app-prod/helm-charts/neuraltrust-platform \
  --version <NEW_VERSION> \
  --namespace neuraltrust \
  -f my-values.yaml
```

Watch the `init-db` init container of the new CP UI pod for Prisma migration errors.

## Air-gapped / disconnected OpenShift

Common for sovereign-cloud and government OpenShift installs.

1. **Mirror images** to your internal registry (Red Hat Quay or any OCI registry). Use `oc-mirror` or `helm template … | yq …` (see [Image catalog › Mirroring](../images#mirroring-images-for-air-gapped-installs)).

2. **Override the registry**:

   ```yaml theme={null}
   global:
     imageRegistry: "registry.internal.example.com/neuraltrust"
   ```

3. **Proxy egress**:

   ```yaml theme={null}
   global:
     proxy:
       enabled: true
       httpProxy: "http://proxy.corp.example:3128"
       httpsProxy: "http://proxy.corp.example:3128"
       noProxy: "localhost,127.0.0.1,.cluster.local,.svc"
   ```

4. **Pre-load Firewall model weights** or mirror `huggingface.co` if using the Firewall with HF token.

5. **TLS**: bring your own Route certificates instead of public CAs.

## Migration to hybrid

```yaml theme={null}
neuraltrust-control-plane:
  controlPlane:
    enabled: false
```

Enroll the existing Data Plane with NeuralTrust SaaS — see [OpenShift hybrid › Step 8](./hybrid#step-8-enroll-the-data-plane-with-neuraltrust-saas).

## Troubleshooting

| Symptom                               | Likely cause                  | Fix                                                     |
| ------------------------------------- | ----------------------------- | ------------------------------------------------------- |
| CP UI blank                           | API URL wrong                 | Verify `control-plane-api.<domain>` Route and config    |
| Login fails                           | DB migration failed           | `oc logs -c init-db` on CP UI pod                       |
| Scheduler not running jobs            | Can't reach Data Plane API    | Verify `data-plane-api.<domain>` Route and TLS          |
| Pods `ImagePullBackOff`               | `gcr-secret` not linked to SA | Re-run `oc secrets link` for each component SA          |
| ClickHouse `Permission denied` on PVC | SCC override                  | Don't override `podSecurityContext` for CH on OpenShift |

## Related guides

* [Hybrid deployment on OpenShift](./hybrid) — Control Plane on SaaS
* [OpenShift overview](./overview) — cluster prerequisites and OpenShift-specific defaults
* [Deployment models](../deployment-models) — hybrid vs self-hosted comparison
* [Image catalog](../images) — what runs in self-hosted mode
* [Secrets management](../secrets) — auto-generation, External Secrets Operator
* [Firewall deployment](../firewall) — GPU workers on OpenShift
* [Configuration scenarios](../configuration) — external infrastructure modes