updating NOTES.txt

Author: romdalf

charts/netapp-neo/Chart.yaml

@@ -4,5 +4,5 @@ description: NetApp Neo v4.x — context lake microservice architecture for AI s
 type: application
 keywords: ["NetApp", "Neo", "MCP", "AI", "context lake"]
 home: "https://netapp.github.io/Innovation-Labs/"
-version: 26.5.5
+version: 26.5.6
 appVersion: "4.1.4"

charts/netapp-neo/templates/NOTES.txt

@@ -38,16 +38,59 @@ To access the API locally:
 To access the UI locally:
   kubectl -n {{ .Release.Namespace}} port-forward svc/{{ include "netapp-neo.fullname" . }}-ui 8080:{{ .Values.ui.service.port }}
 
+{{- if .Values.openshift.deploy }}
+
+OpenShift mode is enabled (openshift.deploy=true).
+
+Service accounts created:
+  - api:       {{ include "netapp-neo.apiServiceAccountName" . }}
+  - ui:        {{ include "netapp-neo.uiServiceAccountName" . }}
 {{- if .Values.openshift.privilegedWorkloads.worker.enabled }}
+  - worker:    {{ include "netapp-neo.workerPrivilegedServiceAccountName" . }}
+{{- end }}
+{{- if .Values.openshift.privilegedWorkloads.extractor.enabled }}
+  - extractor: {{ include "netapp-neo.extractorPrivilegedServiceAccountName" . }}
+{{- end }}
+{{- if and .Values.openshift.postgres.bindAnyuid .Values.postgresql.enabled }}
+  - postgres:  {{ include "netapp-neo.postgresServiceAccountName" . }}
+{{- end }}
 
-OpenShift setup required for worker privileged mode:
-  - Bind an SCC that allows the required mount behavior to service account:
-    {{ include "netapp-neo.workerPrivilegedServiceAccountName" . }}
+{{- if .Values.openshift.privilegedWorkloads.bindSCC }}
+
+SCC access for the privileged workloads was bound automatically via RoleBindings:
+{{- if .Values.openshift.privilegedWorkloads.worker.enabled }}
+  - {{ include "netapp-neo.workerPrivilegedServiceAccountName" . }} -> system:openshift:scc:{{ .Values.openshift.privilegedWorkloads.sccName }}
 {{- end }}
+{{- if .Values.openshift.privilegedWorkloads.extractor.enabled }}
+  - {{ include "netapp-neo.extractorPrivilegedServiceAccountName" . }} -> system:openshift:scc:{{ .Values.openshift.privilegedWorkloads.sccName }}
+{{- end }}
+  No manual `oc adm policy` step is required.
+{{- else }}
 
+SCC auto-binding is disabled (openshift.privilegedWorkloads.bindSCC=false).
+Bind an SCC that allows the required mount behavior manually:
+{{- if .Values.openshift.privilegedWorkloads.worker.enabled }}
+  oc adm policy add-scc-to-user {{ .Values.openshift.privilegedWorkloads.sccName }} -z {{ include "netapp-neo.workerPrivilegedServiceAccountName" . }} -n {{ .Release.Namespace }}
+{{- end }}
 {{- if .Values.openshift.privilegedWorkloads.extractor.enabled }}
+  oc adm policy add-scc-to-user {{ .Values.openshift.privilegedWorkloads.sccName }} -z {{ include "netapp-neo.extractorPrivilegedServiceAccountName" . }} -n {{ .Release.Namespace }}
+{{- end }}
+{{- end }}
+
+{{- if and .Values.openshift.postgres.bindAnyuid .Values.postgresql.enabled }}
+
+PostgreSQL runs under the {{ .Values.openshift.postgres.sccName }} SCC
+{{- if not .Values.openshift.privilegedWorkloads.bindSCC }} (bind manually):
+  oc adm policy add-scc-to-user {{ .Values.openshift.postgres.sccName }} -z {{ include "netapp-neo.postgresServiceAccountName" . }} -n {{ .Release.Namespace }}
+{{- else }} (bound automatically).
+{{- end }}
+{{- end }}
+
+Verify the SCC RoleBindings:
+  oc get rolebinding -n {{ .Release.Namespace }} | grep scc
+{{- else }}
 
-OpenShift setup required for extractor privileged mode:
-  - Bind an SCC that allows the required mount behavior to service account:
-    {{ include "netapp-neo.extractorPrivilegedServiceAccountName" . }}
+Running in vanilla Kubernetes mode (openshift.deploy=false).
+Workloads use explicit runAsUser security contexts and the default service account.
+Set openshift.deploy=true to enable the OpenShift security model (restricted-v2 + SCC binding).
 {{- end }}