Minimal OpenMetadata 1.12.13 stack — Postgres + OpenSearch + OM server only (no Airflow, MySQL, or Fuseki) — using the official OpenMetadata Helm chart. Targets minikube (local test) and on-prem OpenShift (airgapped).
Dockerfile # builds the OCP deploy-bundle image (chart + scripts + docs + helm/oc)
OPENSHIFT.md # OpenShift deploy guide (embedded in the image)
helm/
openmetadata/ # official OM app chart 1.12.13 (vendored)
values-minikube.yaml # minikube overrides
values-openshift.yaml # OpenShift static overrides (env-specifics injected by deploy-ocp.sh)
k8s/
00-infra.yaml # minikube: Postgres + OpenSearch + secrets
om-localhost.crt # self-signed cert for the local HTTPS test
k8s-openshift/
deploy.env # ← single source of truth (registry, namespace, creds, TLS, sizing)
00-infra.template.yaml # Postgres (RH image) + OpenSearch, SCC-safe, envsubst placeholders
deploy-ocp.sh # renders infra + chart, oc apply, patches the Route cert
Jenkinsfile # CI pipeline (render / deploy / destroy)
OpenMetadata's UI registers a service worker (app-worker.js) that attaches the
auth token. Browsers refuse to register a service worker over a TLS cert they don't
trust, so with an untrusted cert login succeeds server-side but the browser is bounced
back to /signin. The Route/URL must serve a browser-trusted cert. localhost is
exempt (it's a secure context even over plain HTTP), which is why the local http://localhost:8585
works with no cert but a real hostname does not. See OPENSHIFT.md.
Proof (real Edge, trusted cert, HTTPS): docs/k8s/edge-https-login-proof.png.
# images pre-loaded via `minikube image load`; apply via in-node kubectl
kubectl apply -f k8s/00-infra.yaml
helm template openmetadata helm/openmetadata -f helm/values-minikube.yaml \
-n openmetadata --skip-tests | kubectl apply -n openmetadata -f -
# UI: http://localhost:8585 (localhost = no cert needed). [email protected] / admin
vi k8s-openshift/deploy.env # set REGISTRY, ROUTE_TLS_* (browser-trusted cert), creds
./k8s-openshift/deploy-ocp.sh # render + oc apply + patch Route cert
Or run the bundle image (chart + scripts + helm/oc baked in):
docker run --rm \
-v $HOME/.kube/config:/root/.kube/config:ro \
-v $PWD/deploy.env:/bundle/k8s-openshift/deploy.env:ro \
ghcr.io/…/openmetadata-ocp-deployer:1.12.13 deploy
See OPENSHIFT.md for the full guide (SCC, images to mirror, cert, Node Tuning).
Content type
Image
Digest
sha256:3ede06dac…
Size
401 MB
Last updated
2 months ago
docker pull n8500x/openmetadata-bundle