← Back to reference

Air Gap Bundle

Bundle Layout

denpex-airgap-bundle-X.Y.Z.tar.gz
├── install.sh                                # the single entrypoint
├── sha256sums.txt                            # every file's hash
├── sigstore.cosign                           # cosign signature over sha256sums
├── README-AIRGAP.md                          # in-bundle README
├── binaries/
│   ├── rpm/
│   │   ├── denpex-enterprise-agent-X.Y.Z-1.x86_64.rpm
│   │   ├── denpex-collectors-X.Y.Z-1.x86_64.rpm
│   │   ├── denpex-control-plane-X.Y.Z-1.x86_64.rpm
│   │   └── denpex-remediator-X.Y.Z-1.x86_64.rpm
│   └── deb/
│       ├── denpex-enterprise-agent_X.Y.Z_amd64.deb
│       └── ...
├── helm/
│   ├── denpex-platform-X.Y.Z.tgz
│   ├── denpex-operator-X.Y.Z.tgz
│   └── crds/
├── ocis/
│   ├── denpex-agent-oci-X.Y.Z.tar
│   └── denpex-control-plane-oci-X.Y.Z.tar
├── bpf/
│   ├── sched_switch.bpf.o (signed)
│   ├── oom_kill.bpf.o (signed)
│   └── ...
├── secrets/
│   ├── platform-init.sops.yaml               # encrypted with customer KMS
│   └── rma-webhook.token
├── crds-pre-rendered/
└── self-test/
    ├── synthetic-xid-79.json
    └── synthetic-dbe-storm.json

Verification

cd denpex-airgap-bundle-X.Y.Z
sha256sum -c sha256sums.txt
cosign verify-blob --cert <sig> --signature <sig> sha256sums.txt

Install Steps

The single entrypoint install.sh:

  1. Verifies the bundle integrity above.
  2. Verifies kernel ≥ 5.15.
  3. Installs RPMs / DEBs.
  4. Loads signed BPF objects.
  5. Bootstraps the control plane via Helm.
  6. Configures Fabric Manager + UFM endpoints.
  7. Configures KMS via PKCS#11 (HSM).
  8. Starts a local MinIO instance.
  9. Runs the self-test.

Self-test verifies:

  • Synthetic Xid-79 emit → ingest → diagnosis → remediation.
  • Audit chain verifies.
  • Webhook delivery to in-cluster mirror.
  • Per-layer numeric anomaly detection on a synthetic stream.

Updates

Repeat the staging on a connected host and re-run ./install.sh --upgrade on the air-gapped host.

Per-Vendor Hardware

The bundle ships binaries compiled against:

  • libc 2.31+ (RHEL 8.4+, Ubuntu 20.04+).
  • libnvidia-ml.so.1 (loaded at runtime).
  • libdcgm.so (loaded at runtime).
  • libibverbs / libmlx5 (loaded at runtime).

Hardware Compatibility

Same as docs/supported-*-matrix.md. Linux kernel 5.15+ is required for the eBPF programs; otherwise the agent falls back to journald-only mode.