← Back to reference

Air Gapped Install Guide

Prerequisites

  • A clean RHEL 9 / Ubuntu 22.04 host with uname -r ≥ 5.15.
  • Internet only on a staging host to download the bundle.
  • A USB stick ≥ 16 GB.

Step 1: Stage the bundle (online host)

# On online staging host
curl -L -O https://dl.denpex.ai/airgap/denpex-airgap-bundle-0.7.0.tar.gz
cosign verify-blob --cert https://dl.denpex.ai/airgap/0.7.0.cert \
    --signature https://dl.denpex.ai/airgap/0.7.0.sig \
    denpex-airgap-bundle-0.7.0.tar.gz

Step 2: Move the bundle to the offline host

Copy the .tar.gz + the .cert + the .sig to the USB stick. Walk it over to the offline host.

Step 3: Verify the bundle integrity (offline host)

cosign verify-blob --cert 0.7.0.cert --signature 0.7.0.sig \
    denpex-airgap-bundle-0.7.0.tar.gz

Step 4: Run install.sh

tar -xzf denpex-airgap-bundle-0.7.0.tar.gz
cd denpex-airgap-bundle
sudo ./install.sh

The script:

  • Verifies kernel ≥ 5.15.
  • Installs RPMs/DEBs (no internet).
  • Loads BPF objects with signature checks.
  • Bootstraps the control plane via Helm with --set airgapped=true.
  • Configures Fabric Manager + UFM endpoints from /etc/denpex/fabric.yaml.
  • Starts a local MinIO instance for S3-compatible storage.
  • Configures KMS via PKCS#11 (HSM).

Step 5: Self-test

denpex-control-plane selftest --scenario synthetic-xid-79.json

The selftest runs a deterministic Xid-79 → diagnosis → remediation flow against the in-cluster endpoints.

Expected Output

[denpex-airgap] ok kernel 5.15.0
[denpex-airgap] ok agent installed
[denpex-airgap] ok bpf loaded (7 programs)
[denpex-airgap] ok control plane listening on 0.0.0.0:4317
[denpex-airgap] ok object store ready
[denpex-airgap] ok kms reachable
[denpex-airgap] ok selftest passed (Xid 79 → diagnosis → remediation)

Failure Modes

If any step fails, install.sh rolls back the partial install. The journald log /var/log/denpex/install.log is shipped back on USB for support.

Updating the bundle

Repeat the bundle staging on the online host and re-run ./install.sh --upgrade. The script preserves /var/lib/denpex and rolls the binaries.