> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getcollate.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Deploy CAIP | OpenShift (ROSA) Deployment

> Deploy the Collate AI Proxy (CAIP) on OpenShift (ROSA) using Helm, integrating with AWS Bedrock or Azure OpenAI to power AI features.

# Deploy Collate AI Proxy (CAIP)

<Note>
  Complete [Deploy Collate](/how-to-guides/deployment/byoc/kubernetes/openshift/collate) before this step. CAIP must run in the same namespace as Collate.
</Note>

CAIP (Collate AI Proxy) is the backend service powering AI features including AskCollate, Documentation Agent, Tier Agent, and DQ Generation Agent. It communicates with the Collate server via gRPC and authenticates using the user's Personal Access Token (PAT), so agents inherit the user's RBAC permissions.

***

## LLM Provider Support

| Provider         | Status                  | Chat Models           | Embedding Models       |
| ---------------- | ----------------------- | --------------------- | ---------------------- |
| **AWS Bedrock**  | ✅ Default & Recommended | Sonnet 4.5, Haiku 4.5 | Amazon Titan           |
| **Azure OpenAI** | Available (1.12+)       | GPT-4o                | text-embedding-3-small |
| **OpenAI**       | Available (1.12+)       | GPT-4o                | text-embedding-3-small |

***

## IAM Permissions for Bedrock (ROSA Only)

<Note>
  This section is ROSA/AWS-specific. For Azure OpenAI, skip to [Configure Helm Values](#configure-helm-values).
</Note>

CAIP reuses the Collate server's service account (`openmetadata`) and its existing IRSA role (`openmetadata-rosa-role`). Add a Bedrock inline policy to that role:

```bash theme={null}
cat > bedrock-policy.json <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "BedrockInferenceProfileAccess",
      "Effect": "Allow",
      "Action": "bedrock:InvokeModel*",
      "Resource": [
        "arn:aws:bedrock:*::foundation-model/*",
        "arn:aws:bedrock:*:*:inference-profile/*"
      ]
    }
  ]
}
EOF

aws iam put-role-policy \
  --role-name openmetadata-rosa-role \
  --policy-name bedrock-access \
  --policy-document file://bedrock-policy.json
```

Also confirm that the Anthropic models (Sonnet 4.5, Haiku 4.5) are enabled in your AWS region from the [AWS Bedrock console](https://console.aws.amazon.com/bedrock/).

***

## Configure Helm Values

Create a `values-caip-openshift.yaml` file for your provider.

### AWS Bedrock

```yaml theme={null}
imagePullSecrets:
  - name: collate-ecr-secret

collate:
  # Collate Kubernetes service DNS — must match the service name in the openmetadata namespace
  hostAndPort: http://openmetadata:8585

config:
  llmProvider:
    bedrock:
      awsRegion: <aws-region>  # e.g. us-east-1

# Reuse the Collate server service account — it already has the IRSA annotation for Bedrock
serviceAccount:
  create: false
  name: openmetadata

# [Any OpenShift] Required for restricted-v2 SCC on all OpenShift 4.x clusters
podSecurityContext: {}
securityContext:
  allowPrivilegeEscalation: false
  capabilities:
    drop: [ALL]
  runAsNonRoot: true
  seccompProfile:
    type: RuntimeDefault
```

### Azure OpenAI

```yaml theme={null}
replicaCount: 1

imagePullSecrets:
  - name: collate-ecr-secret

collate:
  hostAndPort: http://openmetadata:8585

config:
  llmProvider:
    type: openai
    model: gpt-4o
    modelSmall: gpt-4o
    openAI:
      apiKey: <AZURE_OPENAI_API_KEY>
      baseUrl: <AZURE_OPENAI_BASE_URL>
      azureOpenAI:
        enabled: true
        # Found in the Azure OpenAI Foundry Portal under your deployment details
        apiVersion: <AZURE_OPENAI_API_VERSION>
        deploymentName: <AZURE_OPENAI_DEPLOYMENT_NAME>
        resourceName: <AZURE_OPENAI_RESOURCE_NAME>

# [Any OpenShift] Required for restricted-v2 SCC on all OpenShift 4.x clusters
podSecurityContext: {}
securityContext:
  allowPrivilegeEscalation: false
  capabilities:
    drop: [ALL]
  runAsNonRoot: true
  seccompProfile:
    type: RuntimeDefault
```

<Note>
  For Azure OpenAI setup (creating a resource group, deploying models, and obtaining credentials), see the [Azure OpenAI Configuration](#azure-openai-configuration) section below.
</Note>

***

## Deploy

Add the Helm repo and deploy CAIP into the `openmetadata` namespace:

```bash theme={null}
helm repo add collate-ai-proxy https://open-metadata.github.io/collate-ai-proxy-helm-chart
helm repo update

helm upgrade --install caip collate-ai-proxy/collate-ai-proxy \
  --namespace openmetadata \
  --values values-caip-openshift.yaml
```

For subsequent upgrades:

```bash theme={null}
helm upgrade caip collate-ai-proxy/collate-ai-proxy \
  --namespace openmetadata \
  --values values-caip-openshift.yaml \
  --reuse-values
```

### Verify the Pod

```bash theme={null}
oc get pods -n openmetadata -l app.kubernetes.io/name=collate-ai-proxy

oc logs -n openmetadata -l app.kubernetes.io/name=collate-ai-proxy --tail=50

# Confirm IRSA env vars are injected (ROSA only)
oc exec -n openmetadata deployment/caip-collate-ai-proxy -- env | grep -E "AWS_ROLE_ARN|AWS_WEB_IDENTITY"
```

***

## Configure Collate to Use CAIP

After CAIP is running, update your Collate deployment to point to it.

### Collate Helm Chart

Add the following to your `values-openshift.yaml` and run `helm upgrade`:

```yaml theme={null}
collate:
  aiProxy:
    enabled: true
```

```bash theme={null}
helm upgrade openmetadata open-metadata/openmetadata \
  --namespace openmetadata \
  --values values-openshift.yaml \
  --reuse-values
```

### Environment Variables (Custom Chart)

If you deployed Collate with a custom Helm chart, add these environment variables:

**AWS Bedrock:**

```yaml theme={null}
extraEnvs:
  - name: EMBEDDING_PROVIDER
    value: bedrock
  - name: AI_PLATFORM_HOST
    value: caip-collate-ai-proxy
  - name: AWS_BEDROCK_REGION
    value: <aws-region>
```

**Azure OpenAI:**

```yaml theme={null}
extraEnvs:
  - name: OPENAI_API_KEY
    value: <AZURE_OPENAI_SEMANTIC_SEARCH_KEY>
  - name: OPENAI_API_ENDPOINT
    value: <AZURE_OPENAI_SEMANTIC_SEARCH_ENDPOINT>
  - name: OPENAI_DEPLOYMENT_NAME
    value: <AZURE_OPENAI_SEMANTIC_SEARCH_DEPLOYMENT_NAME>
  - name: OPENAI_API_VERSION
    value: <AZURE_OPENAI_SEMANTIC_SEARCH_API_VERSION>
  - name: OPENAI_EMBEDDING_MODEL_ID
    value: text-embedding-3-small
```

***

## Validation

Once deployed and configured, verify CAIP is healthy from the Collate UI:

**Settings → Preferences → Health Check**

All AI services should show a healthy status.

***

## Hardware Requirements

CAIP is stateless — no persistent storage is required.

| Resource | Minimum |
| -------- | ------- |
| CPU      | 300m    |
| Memory   | 2Gi     |
| Storage  | None    |

***

## Azure OpenAI Configuration

If using Azure OpenAI, follow these steps to create the required resources:

1. Sign in to the [Azure portal](https://portal.azure.com/) and create a dedicated resource group.
2. Navigate to **Azure OpenAI** (Microsoft Foundry) and create a new service. Fill in the resource group, name, and region; leave other settings as default.
3. Once created, click **Go to Foundry Portal** (Microsoft Foundry).
4. Under **Shared Resources → Deployments**, click **Deploy model → Deploy base model**.
   * Deploy a chat model (e.g. `gpt-4o`) for CAIP.
   * Deploy a separate embedding model (`text-embedding-3-small`) for Collate Server semantic search.
5. From each deployment's detail page, collect: API key, deployment name, API version, base URL, and resource name.

### Supported Models

All OpenAI GPT models are supported. Collate recommends **gpt-4o** for CAIP.

***

## Troubleshooting

### Pod Stuck in Pending

```bash theme={null}
oc describe pod -n openmetadata -l app.kubernetes.io/name=collate-ai-proxy
```

| Symptom                              | Cause                                              | Fix                                                                                                                               |
| ------------------------------------ | -------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- |
| `Insufficient cpu / memory`          | Cluster at capacity                                | Reduce `resources.requests` in `values-caip-openshift.yaml`                                                                       |
| `ImagePullBackOff`                   | ECR pull secret missing or expired                 | Recreate `collate-ecr-secret` — see [Deploy Collate](/how-to-guides/deployment/byoc/kubernetes/openshift/collate#ecr-credentials) |
| `unable to validate against any SCC` | Security context incompatible with `restricted-v2` | Ensure `podSecurityContext: {}` and `securityContext` block match the values above                                                |

### Bedrock Access Denied (ROSA)

```bash theme={null}
# Check IRSA env vars are injected into the pod
oc exec -n openmetadata deployment/caip-collate-ai-proxy -- env | grep AWS

# Verify the service account has the IRSA annotation
oc get sa openmetadata -n openmetadata -o jsonpath='{.metadata.annotations}'
```

If Bedrock calls are failing:

1. Confirm the `bedrock-access` inline policy was attached: `aws iam get-role-policy --role-name openmetadata-rosa-role --policy-name bedrock-access`
2. Verify the trust policy `sub` condition matches `system:serviceaccount:openmetadata:openmetadata` exactly.
3. Confirm the Anthropic models are enabled in your AWS region in the Bedrock console.

### CAIP Cannot Reach Collate

CAIP connects to Collate via the Kubernetes service DNS name. Test connectivity from inside the CAIP pod:

```bash theme={null}
oc exec -n openmetadata deployment/caip-collate-ai-proxy -- \
  curl -s http://openmetadata:8585/healthcheck
```

Expected: `{"status":"OK"}`

If this fails, check that `hostAndPort` in your values matches the actual Collate service name and port in the `openmetadata` namespace:

```bash theme={null}
oc get svc -n openmetadata
```