Day 2 — Operate
Ongoing operations for the carbide-enclave. Day 2 answers the question: is the system still doing what we designed it to do?
Day 1 built the platform. Day 2 keeps it running, keeps it current, and confirms it stays in compliance. The three pillars are monitoring (know when something breaks), updates (bring new versions in through the same airgap pipeline), and troubleshooting (diagnose and recover when something goes wrong).
Day 2 topics
| Topic | What it covers |
|---|---|
| Monitoring | verify-enclave.sh smoke tests, observability stack (Grafana + Prometheus) |
| Updates | Hauler re-sync workflow, version bump procedure, rolling upgrade order |
| Troubleshooting | Layer-by-layer diagnostics, common failure modes and commands |
STIG compliance
Carbide's Stigatron component runs STIG compliance scans against the cluster nodes and reports findings in the Rancher UI. This is a Day 2 operational concern — compliance posture is something you monitor continuously, not just at install time.
:::info Coming soon Stigatron usage and STIG reporting workflow will be documented here once Rancher Manager is deployed and Stigatron is activated. :::
The update loop
Updates in an airgapped environment follow the same path as the initial install. There is no
apt upgrade calling the internet. There is no helm repo update reaching out to Artifact
Hub. Every version bump flows through Hauler:
This is intentional. The airgap boundary is not an obstacle — it is the control plane for what software is allowed to run. Hauler is the gatekeeper.
See Updates for the full step-by-step procedure.