Air-Gapped Updates

The disconnected path uses the same immutable images, charts, release descriptor, and signatures as connected updates. The transfer bundle preserves OCI signature referrers; the enclave promotes its own local stable tag only after verification.

Artifacts received

Obtain through the approved media handoff:

• pretorin-customer-images-<version>.tar.gz and checksum;
• pretorin-customer-update-<version>.tar.gz and checksum;
• pretorin-release.pub, whose fingerprint was confirmed out of band;
• the canonical offline documentation snapshot; and
• a customer-specific license.jwt plus license-trust.json through the separate license handoff.

The image bundle carries runtime images. The update bundle carries five stable OCI charts, one immutable application release, and their Cosign referrers.

Verify transfer files

sha256sum -c pretorin-customer-images-<version>.tar.gz.sha256
sha256sum -c pretorin-customer-update-<version>.tar.gz.sha256
openssl pkey -pubin -in pretorin-release.pub -outform DER | sha256sum

Compare the last fingerprint with the out-of-band Pretorin record. Do not use a public key that arrived only on the same unverified media.

Load images

Use the loader shipped with the image bundle:

export BUNDLE="$PWD/pretorin-customer-images-<version>.tar.gz"
export TARGET_REPOSITORY=<registry.airgap.local/pretorin/platform>
scripts/customer/load-image-bundle.sh

The loader verifies the bundle inventory and uploads the recorded images. It does not deploy the application.

Load charts and the signed release

ORAS 1.3.0 and Cosign are required on the transfer workstation.

export BUNDLE="$PWD/pretorin-customer-update-<version>.tar.gz"
export TARGET_CHART_REGISTRY=<registry.airgap.local/pretorin/charts>
export TARGET_RELEASE_REPOSITORY=<registry.airgap.local/pretorin/releases/pretorin>

./load-customer-update-bundle.sh

The loader verifies every archive checksum, restores referrers, verifies every chart and release by digest, and then moves the enclave’s local stable tag to the verified release. A signature or digest mismatch stops before promotion.

Reconcile inside the enclave

Install the pinned Flux prerequisite from the approved offline controller image set. Create read-only credentials for the internal registry, then follow Bootstrap with internal registry paths.

pretorin deployment flux bootstrap \
  --context <airgap-context> --namespace pretorin \
  --customer-values ./values-customer.install.yaml \
  --chart-registry <registry.airgap.local/pretorin/charts> \
  --release-repository <registry.airgap.local/pretorin/releases/pretorin> \
  --release-public-key ./pretorin-release.pub \
  --update-mode approval --channel stable

pretorin --json deployment flux status
pretorin deployment flux resume --context <airgap-context>

The enclave never contacts Pretorin to validate a license or release. Expiry is checked against cluster UTC time using the installed public trust bundle.

Pending, warning, expiration, and renewal

The platform may be installed before license.jwt crosses the approved media boundary. Omit the token rather than creating a placeholder. The optional projected resource lets Auth and the UI become ready, the bootstrap owner can log in and see License pending, and only new system creation is denied. The public trust bundle may arrive before or with the token.

Owners and administrators receive local inbox alerts for missing/failure-state transitions and at 30, 14, 7, 1, and 0 days. Configured customer SMTP, Slack, or Teams delivery follows the existing notification preferences; none is required for the in-app path. Existing systems, reads, exports, diagnostics, and the renewal surface stay available after expiration.

Transfer a replacement license.jwt and license-trust.json through the same approved media process, verify the trust fingerprint out of band, and run:

pretorin deployment license install \
  --context <airgap-context> --namespace pretorin \
  --license-file ./license.jwt \
  --trust-bundle ./license-trust.json
pretorin --json deployment license status

Auth hot-loads the replacement; no Helm reconciliation or Pod restart is needed. The current alert clears and the new expiry re-arms future milestones. For infrastructure paging, enable the bundled rules and route component="customer-license" to an enclave-local Alertmanager receiver as described in Operations. License evaluation, notification scheduling, metrics, and rules require no internet connectivity.

Update an existing enclave

For each approved version, repeat verify → load images → load update bundle → inspect status → resume. Do not reinstall charts or recreate Secrets. Preserve:

• pretorin-deployment-identity;
• pretorin-license and pretorin-license-trust;
• database and object-storage data;
• customer values ConfigMaps; and
• registry credentials and release public key.