Skip to main content

Overview

What is Cerebellum?​

Cerebellum is the enterprise version of the Gen0Sec platform that you can host in your own Kubernetes cluster.

Charts​

Installation orderChartNamespaceWhat it installs
1.gen0sec-infragen0sec-systemThree operators (Postgres, Kafka, ingress), the object store, and two caches: one shared by the application, one for the ingress data plane
2.gen0sec-datagen0sec-systemThe Postgres cluster, the Kafka cluster, topics and database roles
3.gen0sec-platformgen0secSchema migrations, then the application services and the dashboard

The installation order is mandatory, as each chart creates resources the next one depends on.

Installation methods​

Choose it when,

  • your cluster can access our registry,
  • you don't mind depending on an external registry

Install via creating an offline bundle​

Choose it when,

  • your cluster don't have access to our registry,
  • you'd rather host mirrored images yourself,
  • you're facing issues pulling images from our registry
Same content

Worry not, the offline bundle builds the same release and installs the same charts.

If you are unsure, go with Install from registry. You can always switch later.

One thing that can decide this for you

Our registry challenges pulls that arrive with no User-Agent, and on some Kubernetes distributions the kubelet's pull path sends none. That is deliberate policy on our side, and the result is a 403 the kubelet cannot recover from.

If you cannot change container runtime configuration on your nodes, use Create an offline bundle. Your own registry does not inspect user agents. See Known limitations.

You will need to decide the installation method in the Prepare the artifacts step.

Connectivity​

What 'offline' means

The 'offline' part in the offline bundler is used to describe the installation method, not the resulting product.

It's important to note that even by creating an offline bundle, doesn't mean you can operate the platform in an airgapped cluster that is entirely isolated from reaching the public internet.

Cerebellum needs exactly one outbound destination from your cluster:

  • api.gen0sec.com on port 443.

That single connection carries threat intelligence, GeoIP databases, ML models and IDS rules. All four are licensed by their upstream providers and are not included in any of the artifacts we ship.

Every agent in your fleet reaches it through one in-cluster service, so it is one destination to allow and one to audit. Nothing else in either namespace has a route out.

Read Network and connectivity before you start. It is the page to send to whoever runs your firewall.

Before you install​

  1. Requirements. Cluster, tools, and your access token.
  2. Network and connectivity. What to allow, and why.
  3. Prepare the artifacts. Prepare for the installation.

If you want a working instance to look at before you plan a real install, use the Quickstart. It builds a throwaway single-node install and tears it down again.