Skip to main content

Install Patient Journey Intelligence on OpenShift and ROSA

This guide installs an OpenShift-compatible Patient Journey Intelligence release on Red Hat OpenShift or Red Hat OpenShift Service on AWS (ROSA). Review the common prerequisites before following the platform-specific steps below.

Use release artifacts that include the OpenShift compatibility profile. Confirm the supported OpenShift and Kubernetes versions for your release before installation.

Prerequisites​

Log in to the cluster​

Log in and confirm that the intended cluster and user are active:

oc login <api-url>
oc whoami
oc get nodes

Release directory and license​

Run the installer from the extracted release directory. It must contain the required files, including an OpenShift-compatible pj-app-<version>.tgz with values-openshift.yaml. Put license.json in this directory when enabling Spark NLP Station and Resolver.

Namespace and permissions​

Use a dedicated, non-default namespace. The installer creates it when needed. The current OpenShift compatibility profile requires a cluster administrator, or equivalent permissions, because the installer grants both anyuid and privileged SCCs to all service accounts in that namespace.

Shared storage​

OpenShift and ROSA installs use an EFS-compatible RWX StorageClass named pj-app-efs for shared PVCs by default. Create that StorageClass before installing, or set EFS_STORAGE_CLASS=<your-rwx-class> when using a different name. The scripts apply this class to docStorage, dagJobRuns, API persistence, and the data-curation PVC, so pods scheduled on different nodes can mount these volumes.

Application host name​

The host must be a DNS name served by the OpenShift ingress controller. For example, use an application hostname below the cluster apps domain: pj-app.apps.<cluster-domain>.

Install Patient Journey Intelligence​

The following HTTP deployment command was verified successfully:

./pj-app-installer.sh \
  --host pj-app.apps.<cluster-domain> \
  --openshift \
  --namespace pj-app

When license.json is in the release directory, the installer detects it automatically. Use --license-file <path> when it is stored elsewhere.

What --openshift configures​

--openshift performs the OpenShift-specific setup automatically. It:

  • disables node image pre-pull and does not require crictl or pass an explicit --kubeconfig;
  • creates or selects the requested OpenShift project;
  • grants the anyuid and privileged SCCs to system:serviceaccounts:<namespace>;
  • loads values-openshift.yaml from the packaged chart;
  • points shared PVCs at the EFS-compatible pj-app-efs StorageClass (EFS_STORAGE_CLASS can override the name); and
  • uses the supplied hostname for the shared ingress.

HTTPS​

TLS is disabled by default, so the application URL uses http://. To configure HTTPS through cert-manager, add the normal --tls options in Configuration.

CPG Agent registry credentials​

CPG Agent is enabled by default and needs valid private-registry credentials. The deployment uses both jsl-registry and cpg-regcred: jsl-registry pulls the restore init image, while cpg-regcred pulls registry.johnsnowlabs.com/jsl-cpg/cpg-agent. If your CPG registry secret has a different name, set CPG_SECRET_NAME=<secret-name> before running the installer or updater. If those credentials are unavailable, add --disable-cpg-agent to prevent an unrelated ImagePullBackOff.

Verify the deployment​

oc get pods -n pj-app
oc get pvc -n pj-app
oc get ingress -n pj-app
helm status pj-app -n pj-app

Then open http://pj-app.apps.<cluster-domain> (or https:// when installed with --tls). The installer prints the generated Keycloak administrator password when the Helm installation completes. Store it securely, and do not copy it into deployment documentation or tickets.

Upgrade on OpenShift​

For an upgrade, authenticate with oc again. For HTTPS, also pass --tls and any explicit issuer selection, and retain your --values files and release name. Preserve the OpenShift mode, namespace, and hostname:

./pj-app-updater.sh \
  --openshift \
  --namespace pj-app \
  --host pj-app.apps.<cluster-domain>

Security limitation​

OpenShift mode retains the namespace-wide anyuid and privileged SCC bindings for other legacy workloads. Redis, RabbitMQ, Keycloak, and both Docker Official Image PostgreSQL workloads are non-privileged; their one-time volume migration init containers run as UID 0 with only the filesystem capabilities required to change ownership. Do not use the same namespace for unrelated workloads. A production hardening effort should replace the namespace-wide bindings with service-account-specific permissions for the remaining legacy workloads.

Frequently asked questions​

Run pj-app-installer.sh with --openshift, a dedicated non-default --namespace, and a --host served by the OpenShift ingress controller, such as pj-app.apps.<cluster-domain>. Use release artifacts that include the OpenShift compatibility profile.

The current OpenShift compatibility profile grants both the anyuid and privileged SCCs to all service accounts in the namespace, which requires a cluster administrator or equivalent permissions.

Shared PVCs use an EFS-compatible RWX StorageClass named pj-app-efs by default. Create it before installing, or set EFS_STORAGE_CLASS to the name of your RWX class.

No. TLS is disabled by default and the application URL uses http://. Add the --tls options from the Configuration page to configure HTTPS through cert-manager.

The CPG Agent is enabled by default and needs valid private-registry credentials in jsl-registry and cpg-regcred. If those credentials are unavailable, add --disable-cpg-agent.