Install kit contents
What you download
Two files, published per release at https://releases.gen0sec.com/cerebellum/<tag>/.
| File | What |
|---|---|
cerebellum-install-kit.tar.gz | The kit |
cerebellum-install-kit.tar.gz.cosign.bundle | Its detached signature |
Verify before unpacking. See Prepare the artifacts.
Layout
cerebellum-install-kit-<version>/
├── bundler.sh builds and loads the offline bundle
├── release-manifest.yaml every image and chart, pinned to a digest
├── scripts/
│ ├── preflight.sh cluster checks the charts assume but do not create
│ ├── make-db-secrets.sh composes the ~20 application secrets
│ ├── uninstall.sh the three releases, finalizers, namespaces
│ └── verify-deployment.sh external smoke test, read-only
├── examples/
│ ├── single-node/ three overlays, one replica each
│ └── single-entrypoint/ one address for the dashboard and every API
├── offline-data/
│ └── README.txt
└── SHA256SUMS over every file above
No images and no charts. Those come from the registry, or from the offline bundle.
The scripts
| Script | Run it | Documented in |
|---|---|---|
preflight.sh | Before installing | Install step 1 |
make-db-secrets.sh | After the databases are ready, before the platform | Install step 6 |
verify-deployment.sh | After every install and every upgrade | Verify the install |
uninstall.sh | When removing the installation | Uninstall |
verify-deployment.sh reads two environment variables:
export GEN0SEC_BASE_URL=https://cerebellum.example.internal
export GEN0SEC_AGENT_KEY=$(cat ~/.gen0sec/agent-key)
The examples
Everything under examples/ is a starting point you are meant to read and edit. Each file carries
comments marking which values are yours.
| Directory | Purpose |
|---|---|
single-node/ | Three overlays that reduce every component to one node. Quickstart |
single-entrypoint/ | One address for the dashboard and every agent-facing API. Publish the endpoints |
Verifying the kit's own integrity
cd $KIT && sha256sum -c SHA256SUMS
SHA256SUMS covers the kit as delivered. Adding files makes it no longer match, which is expected
once you start using it.
What the offline bundle method has to transfer
Two things, and the order matters.
| Transfer | Contains |
|---|---|
| The bundle tarball | Images, charts, values, the manifest, a copy of the bundler |
| The kit directory | scripts/, examples/, and the manifest |
The bundle carries its own copy of bundler.sh, so loading it needs no tooling from the kit. The kit
still has to cross, because the install uses its scripts and its examples.
Copy the bundle first, then clean up, then the kit. create-package runs inside the kit directory, so
the bundle is sitting in it, and copying the kit first transfers tens of gigabytes twice. See
Prepare the artifacts.
Both archives unpack side by side:
~/gen0sec-cerebellum-multiarch-0.1.0/ the bundle
~/cerebellum-install-kit-0.1.0/ the kit
The offline-data directory
The kit creates offline-data/ containing a single README.txt, and nothing else.
It is a placeholder for a data-delivery path that is not part of this release: the four datasets the platform needs are fetched at runtime through the relay, not delivered as files. See Data relay.
If you were told to populate it, check with us first. At this release you should not need to.