OpenShift follow-up for NVBug 6218358

[kheiss-uwzoo]

Summary

• Adds docs/docs/extraction/openshift.md as the canonical OpenShift install guide (restricted-v2 / PSA restricted): openshift-restricted.yaml profile, prebuilt ffmpeg service image, internal registry pull secrets (ngcImagePullSecret.name: ""), optional NIM LD_LIBRARY_PATH overrides, direct Omni NIM /v1/chat/completions example, service-only and NIM Operator install flows, and post-install pod/NIMService checks.
• Trims nemo_retriever/helm/README.md to a short #openshift-deployment stub plus cross-links into openshift.md; chart values and generic Kubernetes guidance stay in the Helm README.
• Fixes deploy leakage in prerequisites-support-matrix.md (Software Requirements ffmpeg bullet → one line to audio-video.md; removed matrix Omni smoke-test cross-link).
• Updates deployment-options.md and docs/mkdocs.yml nav to point at openshift.md.
• Addresses Randy review: no QA phrasing; install sections describe user actions; OpenShift content moved out of the Helm README per follow-up request.

NVBugs

6218358 — OpenShift Helm chart SCC/PodSecurity documentation follow-up (comment #6).

PR scope check

• Base: main
• Files changed: docs/docs/extraction/openshift.md (new), docs/docs/extraction/deployment-options.md, docs/docs/extraction/prerequisites-support-matrix.md, docs/mkdocs.yml, nemo_retriever/helm/README.md
• Red flags: none (docs only; no .cursor/, link-audit artifacts, chart/code changes)

Test plan

• Confirm openshift.md renders on docs site (mkdocs nav entry under Deployment options)
• Verify Helm README #openshift-deployment stub links to openshift.md
• Confirm prerequisites matrix Software Requirements has no Helm/OpenShift/air-gap deploy prose
• Spot-check OpenShift install examples read as user procedures (no QA references)

[greptile-apps]

Greptile Summary

This documentation-only PR introduces openshift.md as a standalone OpenShift deployment guide and trims the Helm README's OpenShift section to a short stub with a cross-link, cleanly separating OpenShift-specific content from generic Kubernetes guidance.

• openshift.md (new): Covers restricted-v2/PSA-restricted value overrides, prebuilt-ffmpeg Dockerfile, internal-registry pull-secret handling (including the ngcImagePullSecret.name: "" fix from previous review), complete copy-paste-safe LD_LIBRARY_PATH env lists for Parakeet and Omni NIMs, and two install flows (service-only and NIM Operator).
• Helm README: OpenShift section reduced to a one-liner stub; air-gap section gains the explicit name: "" override; all see → refer to replacements are applied throughout.
• Cross-references verified: prerequisites-support-matrix.md#image-captioning-2605 and multimodal-extraction.md#image-captioning both resolve; the new #1-service-image anchor in the Helm README is introduced in this same PR and is correctly targeted by openshift.md.

Confidence Score: 5/5

Documentation-only change with no chart, code, or schema modifications — safe to merge.

All cross-reference anchors resolve correctly (verified #image-captioning-2605, #image-captioning, and the newly introduced #1-service-image). The ngcImagePullSecret.name: "" and LD_LIBRARY_PATH env-list issues from prior review rounds are addressed directly in the new guide. The Dockerfile and install-flow examples are internally consistent and handle the restricted-v2 UID injection correctly.

No files require special attention.

Important Files Changed

Filename	Overview
docs/docs/extraction/openshift.md	New canonical OpenShift deployment guide with restricted-v2/PSA-restricted overrides, ffmpeg Dockerfile, pull-secret guidance (name: "" fix included), complete LD_LIBRARY_PATH env lists, and two install flows
nemo_retriever/helm/README.md	OpenShift section replaced with a short stub + cross-link to openshift.md; air-gap section gains explicit ngcImagePullSecret.name="" to clear the default; "see" → "refer to" throughout
docs/docs/extraction/deployment-options.md	Adds OpenShift restricted-v2 as an example alongside air-gapped clusters in the ffmpeg prose; adds cross-link to openshift.md; "see" → "refer to" cleanups
docs/docs/extraction/prerequisites-support-matrix.md	Simplifies ffmpeg bullet to a single line pointing at audio-video.md; removes matrix Omni smoke-test cross-link; "see" → "refer to" throughout
docs/mkdocs.yml	Adds "OpenShift deployment" nav entry pointing at extraction/openshift.md under the "3. Deployment options" section

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[helm install on OpenShift] --> B{Need audio/video?}
    B -- No --> C[Use openshift-restricted.yaml\nservice.installFfmpeg: false]
    B -- Yes --> D[Build custom image\nwith ffmpeg baked in]
    D --> E[Push to NGC / private registry\nor OpenShift internal registry]
    E --> F{Internal registry?}
    F -- Yes --> G[Set ngcImagePullSecret.name: empty\nList SA dockercfg secret in imagePullSecrets]
    F -- No --> H[Keep ngcImagePullSecret.name: ngc-secret\nPre-create ngc-secret via oc create secret]
    G --> I[Apply openshift-restricted.yaml]
    H --> I
    C --> I
    I --> J{NIM Operator needed?}
    J -- No --> K[--set nims.enabled=false\n--set persistence.enabled=false\nService-only install]
    J -- Yes --> L[Install NIM Operator + GPU Operator\nThen helm install with openshift-restricted.yaml]
    L --> M{NIM pods crash on missing .so?}
    M -- Yes --> N[Add LD_LIBRARY_PATH overrides\nvia nimOperator.audio.env\nor nimOperator.omni.env]
    M -- No --> O[oc get pods\noc get nimservice]
    N --> O
    K --> O

Loading

_{Reviews (14): Last reviewed commit: "docs: address Greptile review on pull se..." | Re-trigger Greptile}