This article dives into how you might alter your Bitwarden self-hosted Helm Chart deployment based on the specific offerings of OpenShift.
This example will demonstrate OpenShift Routes instead of the default ingress controllers.
Disable default ingress
Disable the default ingress by specifying
The remaining ingress values do not require modification, as setting
ingress.enabled: false will prompt the chart to ignore them.
Add raw manifest for routes
rawManifests section in
my-values.yaml. This section is where the OpenShift Route manifests will be assigned.
An example file for a
rawManifests section that uses OpenShift Routes can be downloaded .
In the example provided above,
destinationCACertificate has been set to an empty string. This will use the default certificate setup in OpenShift. Alternatively, specify a certificate name here, or you can use Let's Encrypt by following this guide. If you do, you will be required to add
kubernetes.io/tls-acme: "true" to the annotations for each route.
A shared storage class is required for most OpenShift deployments.
ReadWriteMany storage must be enabled. This can be done through the method of your choice, one option is to use the NFS Subdir External Provisioner.
oc command can be used to deploy secrets. A valid installation id and key can be retrieved from bitwarden.com/host/. For more information, see What are my installation id and installation key used for?
The following command is an example:
This example will record commands to your shell history. Other methods may be considered to securely set a secret.
A service account in OpenShift is required as each container needs to run elevated commands on start-up. These commands are blocked by OpenShift's restricted SCCs. We need to create a service account and assign it to the
Run the following commands with the
occommand line tool:Bash
my-values.yamlto use the new service account. Set the following keys to the name of the service account
bitwarden-sathat was created in the previous step:Bash
Here is an example in the
You can create your own SCC to fine-tune the security of these pods. Managing SCCs in OpenShift describes the out-of-the-box SSCs and how to create your own if desired.