← Back to reference

Air Gapped Architecture

Install Path

denpex-airgap-bundle.tar.gz
├── install.sh
├── binaries/
│   ├── denpex-enterprise-agent.rpm
│   ├── denpex-enterprise-agent.deb
│   ├── denpex-collectors.rpm
│   ├── denpex-collectors.deb
│   ├── denpex-control-plane.rpm
│   ├── denpex-control-plane.deb
│   ├── denpex-remediator.rpm
│   └── denpex-remediator.deb
├── helm/
│   ├── denpex-platform-*.tgz
│   └── crds/*.yaml
├── ocis/
│   ├── denpex-agent-oci.tar
│   └── denpex-control-plane-oci.tar
├── bpf/
│   ├── sched_switch.bpf.o (signed)
│   ├── oom_kill.bpf.o (signed)
│   └── ...
├── secrets/
│   └── platform-init.yaml (encrypted with KMS/HSM)
├── crds-pre-rendered/
├── offline-kb/
│   └── *.md (the entire docs/ folder)
└── self-test/
    └── synthetic-xid-79.json

install.sh flow

  1. Verify kernel ≥ 5.15 via uname -r.
  2. Install the agent RPM/DEB.
  3. Detach signed BPF programs (/usr/lib/denpex/bpf/).
  4. Bootstrap the control plane via Helm with airgapped=true.
  5. Configure Fabric Manager and UFM endpoints from /etc/denpex/fabric.yaml (pre-shipped).
  6. Start a local S3-compatible endpoint (MinIO).
  7. Configure KMS via PKCS#11 to talk to the customer's HSM.
  8. Print a self-test that runs a deterministic Xid-79 → diagnosis → remediation flow against the in-cluster endpoints.

Self-Test Script

#!/usr/bin/env bash
set -euo pipefail
echo "[denpex-airgap] verifying kernel..."
[[ $(uname -r | cut -d- -f1 | cut -d. -f2) -ge 15 ]] || { echo "kernel too old"; exit 1; }
echo "[denpex-airgap] installing packages..."
rpm -i --quiet binaries/denpex-enterprise-agent.rpm || true
echo "[denpex-airgap] loading signed bpf..."
/usr/lib/denpex/bin/denpex-bpf-loader --from-dir bpf/
echo "[denpex-airgap] bootstrapping control plane..."
helm upgrade --install denpex helm/denpex-platform-*.tgz \
    --set airgapped=true \
    --set objectStore.endpoint=http://minio.minio.svc:9000 \
    --set kms.pkcs11Module=/opt/denpex/pkcs11.so
echo "[denpex-airgap] running self-test..."
denpex-control-plane selftest --scenario self-test/synthetic-xid-79.json

No-Network Invariants

  • denpex-enterprise-agent is built with the offline feature.
  • All telemetry exporters are configured to point at the in-cluster OTLP receiver (no HTTPS to SaaS).
  • Webhooks (Slack/PagerDuty/Jira) are configured to forward to the in-cluster mirror, which then dedupes and saves to disk.
  • The control plane forbids all reqwest calls outside denpex.platform.airGap.allowList.