Day 1 — Build
Initial deployment, strictly ordered. Each component depends on the previous one being verified and healthy before proceeding. Skipping a step does not save time — it creates a broken state that is harder to diagnose than the step itself would have been.
Why order matters
The dependencies are real, not ceremonial:
- DNS must be running before Harvester boots. The installer resolves hostnames for the cluster VIP and the image registry. A silent DNS failure causes an install that appears to succeed but produces a broken cluster.
- Hauler must be serving before RKE2 installs. Every container image pulled during node bootstrap comes from the Hauler registry on port 5000. If it is not reachable, nodes join with no images and fail immediately.
- Harbor must be healthy before Rancher installs. Rancher is configured with
system-default-registrypointing at Harbor. If Harbor is down or its TLS certificate is not trusted, Rancher cannot pull its own components. - Keycloak must be configured before Rancher OIDC is enabled. Rancher's auth provider configuration points at Keycloak. Enabling it against a Keycloak that is not ready locks you out of Rancher.
Do not skip steps.
Build sequence
Step status
| Step | Component | Script / Method | Status |
|---|---|---|---|
| 1 | Bastion (nuc-00) | 10_bootstrap-nuc-00.sh | ✅ Complete |
| 2 | step-ca | 20_bootstrap-step-ca.sh | ✅ Complete |
| 3 | Hauler collect | hauler.sh sync / hauler.sh save | — |
| 4 | Harvester bare-metal install | iPXE boot | ✅ Complete |
| 5 | Harvester post-install bootstrap | 30_bootstrap-harvester.sh | — |
| 6 | RKE2 cluster | 40_bootstrap-rke2.sh | — |
| 7 | cert-manager | helm | — |
| 8 | Harbor | helm + hauler.sh push | — |
| 9 | Keycloak | helm | — |
| 10 | Rancher Manager | helm | — |
| 11 | DGX Spark | 40_bootstrap-rke2.sh (agent) + helm | — |
Scripts live at /srv/www/htdocs/carbide-enclave.kubernerdes.com/scripts/ on nuc-00.
All scripts source scripts/env.d/carbide-enclave.sh for environment variables. Never
hardcode IPs or versions — change them in that one file and re-run.
What you'll have after Day 1
At the end of Day 1 you have a fully operational airgapped platform:
- A three-node Harvester HCI cluster hosting all management VMs
- A three-node RKE2 management cluster with HA control plane at
10.0.0.30 - cert-manager issuing TLS certificates from the internal step-ca root
- Harbor serving as the permanent OCI registry for all images and Helm charts at
10.0.0.99 - Keycloak providing OIDC authentication for all platform components at
10.0.0.98 - Rancher Manager with Carbide CSR and Stigatron for supply chain security and STIG compliance
- The DGX Spark joined as an RKE2 agent node with GPU Operator and vLLM serving AI workloads
Everything lives inside the airgap boundary. No component calls home. No artifact is pulled from the internet. The Hauler store is the only source of truth for software delivery.