Skip to main content

Prepare the artifacts

Before you start​

0. Set your keys​

Create your token files.

mkdir -p ~/.gen0sec
cd ~/.gen0sec/ && touch .registry-token .download-api-key

Then open up an editor of your choice to fill each file with their respective content. Then run

export REGISTRY_TOKEN=$(cat ~/.gen0sec/.registry-token)
export G0S_DOWNLOAD_API_KEY=$(cat ~/.gen0sec/.download-api-key)
Manage your keys securely

By storing keys in files, you make sure they don't get etched into your shell history. If you have history turned off or you know what you're doing, you can also go with

export REGISTRY_TOKEN="your-registry-token"
export G0S_DOWNLOAD_API_KEY="your-gen0sec-api-key"

1. Set the release​

Pin the release explicitly. A pinned tag installs the same bytes in six months; a resolved one does not. You can find available release versions on the Releases page.

export TAG=v0.1.0-rc.9
export VERSION=${TAG#v}

To always use the latest version instead:

export TAG=$(curl -fsSL https://releases.gen0sec.com/api/repos/cerebellum/latest | jq -r .tag_name)
[ -n "$TAG" ] && [ "$TAG" != null ] || echo "no full release published yet - pin a tag from the release index instead"
export VERSION=${TAG#v}

2. Download the install kit​

curl -fsSLO https://releases.gen0sec.com/cerebellum/$TAG/cerebellum-install-kit.tar.gz
curl -fsSLO https://releases.gen0sec.com/cerebellum/$TAG/cerebellum-install-kit.tar.gz.cosign.bundle

3. Verify the signature​

Run this before you unpack anything.

cosign verify-blob \
  --bundle cerebellum-install-kit.tar.gz.cosign.bundle \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp '^https://github\.com/gen0sec/cerebellum/\.github/workflows/release\.yaml@refs/tags/' \
  cerebellum-install-kit.tar.gz

The output is similar to this:

Verified OK

Anything else means stop. Do not unpack the archive.

Why both certificate flags are required

cosign refuses to verify without an expected issuer and an expected identity, so a shortened command fails rather than passing weakly. The identity is pinned to one workflow on a tag reference. A broader pattern would accept a signature produced by any workflow in our organization. The signature covers the file's contents, so it proves the bytes are ours regardless of how they reached you.

4. Unpack it​

tar -xzf cerebellum-install-kit.tar.gz
export KIT=$PWD/cerebellum-install-kit-$VERSION
cd $KIT

The kit contains the bundler, the release manifest, the helper scripts used later in this install, and the sizing overlays. It does not contain images or charts.

5. Log in to our registry​

export REGISTRY=registry.gen0sec.com
export REGISTRY_USER=any
printf '%s' "$REGISTRY_TOKEN" | helm registry login $REGISTRY -u "$REGISTRY_USER" --password-stdin
printf '%s' "$REGISTRY_TOKEN" | skopeo login $REGISTRY -u "$REGISTRY_USER" --password-stdin

Both are needed. helm and skopeo keep separate credential stores, and the next step uses each of them.

cosign is a third store again, and it needs no login of its own. The bundler lends it the credential skopeo holds.

6. Get the charts​

Pull the charts and their values files. Images are not pulled: your cluster pulls each one from registry.gen0sec.com when it needs it.

Confirm your nodes can pull from us before you go further

Our registry challenges pulls that send no User-Agent, which on some distributions is what the kubelet's pull path does. This step succeeds either way, because it runs from your workstation. The failure appears at step 3 of Install, as a 403 on every image.

Check it now: Known limitations.

./bundler.sh assemble-charts release-manifest.yaml
export B=$PWD/gen0sec-cerebellum-multiarch-$VERSION

The output ends with a per-chart digest confirmation.

What "digest-verified" means here

assemble-charts checks two digests per chart: the registry's manifest against the digest this release pins, and the chart archive against the layer named in that manifest. What you install provably came out of the chart this release published.

Each chart carries its own values-onprem.yaml, extracted into $B/values/. That file is what points the install at a registry. The default values.yaml leaves the registry blank on purpose, so installing without -f will not resolve images.

Checkpoint​

Whichever method you used, you should now have the following:

VariablePoints at
$KITThe unpacked install kit
$BA directory containing charts/ and values/
$REGISTRYThe registry your cluster will pull from
$REGISTRY_USERThe username for that registry (any for ours)
$REGISTRY_TOKENThe password or token for that registry

You are logged in to $REGISTRY. Every page after this one assumes exactly that and nothing else, which is why nothing after this point branches.