> ## Documentation Index
> Fetch the complete documentation index at: https://www.truefoundry.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Install on OpenShift

> Install TrueFoundry control plane and AI Gateway on OpenShift clusters with restricted SCCs.

Deploy the TrueFoundry control plane and AI Gateway. See the [overview](/docs/platform/deploy-control-plane-and-gateway-plane) for compute requirements and prerequisites.

## Installation Instructions

In OpenShift clusters, the values file will be slightly different. The rest of the steps remains the exact same as what you would do for [AWS](/docs/platform/deploy-control-plane-install-aws), [GCP](/docs/platform/deploy-control-plane-install-gcp), or [Azure](/docs/platform/deploy-control-plane-install-azure).

<Note>
  OpenShift's `restricted` and `restricted-v2` Security Context Constraints (SCCs) require pods to have an empty security context so that OpenShift can assign user and group IDs at runtime. The values file below disables the chart's default security contexts globally through `global.podSecurityContext.enabled`. See [How to deploy on OpenShift with restricted SCCs](/docs/platform/deploy-control-plane-faq#how-to-deploy-on-openshift-with-restricted-security-context-constraints-scc) for details.
</Note>

The values file will be as follows:

```yaml truefoundry-values.yaml wrap lines theme={"dark"}
global:
  # Domain to map the control plane dashboard
  controlPlaneURL: https://example.com

  # Disable fixed security contexts so OpenShift's SCC can assign UIDs/GIDs
  podSecurityContext:
    enabled: false

  # Ask TrueFoundry team to provide these
  tenantName: <TENANT_NAME>

  # This is the reference to the secrets we created in the previous step
  existingTruefoundryCredsSecret: "truefoundry-creds"
  imagePullSecrets:
    - name: "truefoundry-image-pull-secret"
  ## Add if you have restricted public registry access
  # image:
  #   pullSecretNames:
  #   - "truefoundry-image-pull-secret"

  # Choose the resource tier as per your needs
  resourceTier: medium # or small or large

  config:
    defaultCloudProvider: "aws"
    storageConfiguration:
      awsS3BucketName: "<AWS_S3_BUCKET_NAME>"
      awsRegion: "<AWS_REGION>"

  serviceAccount:
    annotations:
      eks.amazonaws.com/role-arn: <CONTROL_PLANE_IAM_ROLE_ARN>
  ingress:
    hosts:
      - example.com
    enabled: true
    annotations: {}
    ingressClassName: nginx # Replace with your ingress class name
    # For haproxy openshift, please add the following annotation to the ingress
    haproxy.router.openshift.io/rewrite-target: /
# In case, you want to spin up PostgreSQL on kubernetes, enable this
# Please add creds and host details in the secret `truefoundry-creds`
devMode:
  enabled: false
tags:
  llmGateway: true
  llmGatewayRequestLogging: true

# Disable few dependencies for only LLM Gateway setup
tfyBuild:
  enabled: false
sfyManifestService:
  enabled: false
tfyController:
  enabled: false
tfyConfigs:
  enabled: false
```