Skip to main content

Yabanin on-prem / air-gap install guide

For the Docker/compose-only offline path (bundle build, checksum/signature/SBOM verification, docker load, minimal no-network compose) see offline-bundle.md.

Prerequisites​

  • Kubernetes 1.28+ (or compatible: OpenShift 4.14+, Rancher).
  • 3 worker nodes, 16GB RAM each, 4 vCPU each.
  • GPU node (optional, for local models: vLLM/Ollama). NVIDIA operator recommended.
  • StorageClass supporting ReadWriteOnce.
  • Outbound egress BLOCKED at the network level (air-gap requirement).
  • kubectl, helm 3.12+, docker (or ctr) on a jump host with the air-gap bundle.

Step 1 — Copy the air-gap bundle​

Transfer yabanin-airgap-<tag>.tar.gz to the jump host (USB, scp over private link).

Step 2 — Load images into offline registry​

tar -xzf yabanin-airgap-<tag>.tar.gz -C /tmp/airgap
sha256sum -c /tmp/airgap/images/../manifest.sha256   # tamper check
scripts/airgap/load_bundle.sh yabanin-airgap-<tag>.tar.gz localhost:5000

Step 3 — Prepare secrets​

kubectl create namespace yabanin
kubectl -n yabanin create secret generic yabanin-secrets \
    --from-literal=pg_password=$(openssl rand -hex 16) \
    --from-literal=pg_uri='postgres://yabanin:$(PG_PASSWORD)@yabanin-postgres:5432/yabanin?sslmode=disable'
openssl rand -hex 32 > kek && \
kubectl -n yabanin create secret generic yabanin-kek --from-file=kek
kubectl -n yabanin create secret generic yabanin-license \
    --from-file=license=<vendor-issued-license-token>

Step 4 — Install​

helm install yabanin deploy/helm/yabanin-onprem \
    -f deploy/helm/yabanin-onprem/values-airgap.yaml \
    --set image.registry=localhost:5000 \
    --set image.tag=<tag>

Step 5 — Verify​

kubectl -n yabanin rollout status deploy/yabanin-gateway
curl -sf http://<node-ip>:30082/healthz        # expect {"status":"ok"}
curl -sf http://<node-ip>:30082/healthz/license # expect {"active":true,...}

Step 6 — Enable local models (optional)​

kubectl -n yabanin exec -it yabanin-postgres-0 -- \
    psql -U yabanin -d yabanin -c \
    "UPDATE models_registry SET enabled=true WHERE provider='vllm';"

Troubleshooting​

SymptomFix
license invalid signaturevendor public key mismatch — re-issue token for this build
ImagePullBackOffrun load_bundle.sh; confirm image.registry points to offline registry
OOMKilledraise gateway.resources.limits.memory; check for a hot-looping consumer
connection refused :5432postgres statefulset not ready — check PVC bound
RLS row-level security errorsmigrations run without region — re-run with YABANIN_REGION=onprem yabanin-migrate (region is an env var, not a flag)