Install Path
denpex-airgap-bundle.tar.gz
├── install.sh
├── binaries/
│ ├── denpex-enterprise-agent.rpm
│ ├── denpex-enterprise-agent.deb
│ ├── denpex-collectors.rpm
│ ├── denpex-collectors.deb
│ ├── denpex-control-plane.rpm
│ ├── denpex-control-plane.deb
│ ├── denpex-remediator.rpm
│ └── denpex-remediator.deb
├── helm/
│ ├── denpex-platform-*.tgz
│ └── crds/*.yaml
├── ocis/
│ ├── denpex-agent-oci.tar
│ └── denpex-control-plane-oci.tar
├── bpf/
│ ├── sched_switch.bpf.o (signed)
│ ├── oom_kill.bpf.o (signed)
│ └── ...
├── secrets/
│ └── platform-init.yaml (encrypted with KMS/HSM)
├── crds-pre-rendered/
├── offline-kb/
│ └── *.md (the entire docs/ folder)
└── self-test/
└── synthetic-xid-79.json
install.sh flow
- Verify kernel ≥ 5.15 via
uname -r. - Install the agent RPM/DEB.
- Detach signed BPF programs (
/usr/lib/denpex/bpf/). - Bootstrap the control plane via Helm with
airgapped=true. - Configure Fabric Manager and UFM endpoints from
/etc/denpex/fabric.yaml (pre-shipped). - Start a local S3-compatible endpoint (MinIO).
- Configure KMS via PKCS#11 to talk to the customer's HSM.
- Print a self-test that runs a deterministic Xid-79 → diagnosis → remediation flow against the in-cluster endpoints.
Self-Test Script
#!/usr/bin/env bash
set -euo pipefail
echo "[denpex-airgap] verifying kernel..."
[[ $(uname -r | cut -d- -f1 | cut -d. -f2) -ge 15 ]] || { echo "kernel too old"; exit 1; }
echo "[denpex-airgap] installing packages..."
rpm -i --quiet binaries/denpex-enterprise-agent.rpm || true
echo "[denpex-airgap] loading signed bpf..."
/usr/lib/denpex/bin/denpex-bpf-loader --from-dir bpf/
echo "[denpex-airgap] bootstrapping control plane..."
helm upgrade --install denpex helm/denpex-platform-*.tgz \
--set airgapped=true \
--set objectStore.endpoint=http://minio.minio.svc:9000 \
--set kms.pkcs11Module=/opt/denpex/pkcs11.so
echo "[denpex-airgap] running self-test..."
denpex-control-plane selftest --scenario self-test/synthetic-xid-79.json
No-Network Invariants
denpex-enterprise-agent is built with the offline feature.- All telemetry exporters are configured to point at the in-cluster OTLP receiver (no HTTPS to SaaS).
- Webhooks (Slack/PagerDuty/Jira) are configured to forward to the in-cluster mirror, which then dedupes and saves to disk.
- The control plane forbids all
reqwest calls outside denpex.platform.airGap.allowList.