Deploying Dynamic Engine on OpenShift

Last updated: 9/17/2026

After your OpenShift cluster is ready, configure the image registry and, if required, the security context constraint, then deploy your Dynamic Engine and its environment.

Before you begin

An OpenShift cluster configured for Dynamic Engine deployment. For platform-specific prerequisites, supported versions, and cluster access steps, see Configuring OpenShift (OKD) for Dynamic Engine deployment.
The Helm values files generated by Talend Management Console for your Dynamic Engine and its environment. See Default Helm deployment.
The dynamic-engine-crd custom resource definitions must have been installed using the oci://ghcr.io/talend/helm/dynamic-engine-crd Helm chart. If not, run the following commands for the installation:
1. Find the chart version to be used:
  - Run the following Helm command:
    helm show chart oci://ghcr.io/talend/helm/dynamic-engine-crd --version <engine_version>
  - See the version directly from Talend Management Console or check the Dynamic Engine changelog for the chart version included in your Dynamic Engine version.
  - Use an API call to the Dynamic Engine version endpoint.
2. Run the following command to install the Helm chart of a given version:
```
helm install dynamic-engine-crd oci://ghcr.io/talend/helm/dynamic-engine-crd --version <helm_chart_version>
```
  Replace <helm_chart_version> with the chart version supported by your Dynamic Engine version.
  Without specifying the version, you install the latest available dynamic-engine-crd chart version.

About this task

Important: If you deploy with global.profile: standard and do not provide a security context constraint, the deployment fails with the message Only minimal profile is supported in an OpenShift cluster if no securityContextConstraint is provided. Either set global.profile: minimal, or provide configuration.security.securityContextConstraint as described in step 2.

This procedure adds an OpenShift-specific values file on top of the values files generated by Talend Management Console.

Procedure

Create an OpenShift-specific values file for your Dynamic Engine that disables the embedded image registry.
```
---
global:
  profile: minimal
docker-registry:
  enabled: false
```
The embedded docker-registry service is not suitable for production use on an OpenShift cluster.

Information noteTip: To pull Dynamic Engine's own service images through a private registry proxy instead of directly from ghcr.io/talend, configure global.registry.dockerRegistry as described in Using a private image registry for Dynamic Engine deployments. This is separate from configuration.registry, which points to the registry for your own Data Integration and Data Services/Routes images, as described in the following step.
Create an OpenShift-specific values file for your Dynamic Engine environment that points to your image registry.
With the minimal profile:
```
---
global:
  profile: minimal
configuration:
  registry:
    url: <your-registry-url>
    secretName: <your-registry-secret>
```
With the standard profile, add a security context constraint that permits any non-root user ID:
```
---
global:
  profile: standard
configuration:
  registry:
    url: <your-registry-url>
    secretName: <your-registry-secret>
  security:
    securityContextConstraint: nonroot-v2
```
Information noteTip: You can set dedicated constraints for data integration Jobs and for Data Services and Routes with configuration.jobDeployment.securityContextConstraint and configuration.dataServiceRouteDeployment.securityContextConstraint. If these are not set, the value of configuration.security.securityContextConstraint applies.

Information noteNote: The Dynamic Engine itself does not require this constraint, because its operator service account already has access to a more permissive constraint.

Deploy the Dynamic Engine instance and its environment with both values files.

helm upgrade --install dynamic-engine-$DYNAMIC_ENGINE_ID \
 -f $DYNAMIC_ENGINE_ID-values.yaml \
 -f $DYNAMIC_ENGINE_ID-custom-openshift-values.yaml \
 oci://ghcr.io/talend/helm/dynamic-engine \
 --version $DYNAMIC_ENGINE_VERSION

helm upgrade --install dynamic-engine-environment-$DYNAMIC_ENGINE_ENVIRONMENT_ID \
 -f $DYNAMIC_ENGINE_ENVIRONMENT_ID-values.yaml \
 -f $DYNAMIC_ENGINE_ENVIRONMENT_ID-custom-openshift-values.yaml \
 oci://ghcr.io/talend/helm/dynamic-engine-environment \
 --version $DYNAMIC_ENGINE_VERSION

Optional: If your tasks require persistent storage, configure a ReadWriteMany storage class.

See Provisioning a storage class dedicated to Dynamic Engine environment services.

Results

Your Dynamic Engine and its environment are deployed in your OpenShift cluster. Verify the pod status:

oc get pods -n <your-namespace>

In Talend Management Console, the status of this environment becomes Ready, confirming that it is ready to run tasks or plans.

If deployment fails, or if Dynamic Engine services are disassociated, the status becomes Not ready.

What to do next

After successful deployment, you can add tasks to the Dynamic Engine environment as you would for standard engines. For details, see Adding a Job task in a Dynamic Engine environment.

Did this page help you?

If you find any issues with this page or its content – a typo, a missing step, or a technical error – please let us know!

Leave your feedback here