Skip to main content

Getting Started

What You'll Build​

By the end of this guide you will have a fully airgapped, production-grade Kubernetes platform running on commodity Intel NUC hardware:

  • A bastion host (nuc-00) that serves DNS, DHCP, NTP, internal PKI, a container registry, and a web/file server — all without touching the internet after initial artifact collection
  • A 3-node Harvester HCI cluster (nuc-01/02/03) providing bare-metal virtualization and Longhorn persistent storage
  • A 3-node RKE2 management cluster running as VMs on Harvester — HA control plane with Canal CNI
  • Rancher Manager with RGS Carbide (Stigatron STIG compliance, CSR vulnerability scanning)
  • Harbor as the permanent OCI registry and Helm chart proxy — the authoritative artifact source after cutover from Hauler
  • Keycloak as the single OIDC identity provider covering Rancher, Harbor, and DGX AI workloads
  • cert-manager + step-ca providing automated TLS for all internal services — zero self-signed certs in production
  • An NVIDIA DGX Spark (arm64) joined as an RKE2 agent node with GPU Operator, running vLLM and ExMachina for AI inference

The Airgap Constraint​

:::caution The central rule of this entire project Nothing enters the enclave that has not passed through Hauler.

No helm repo add to upstream registries. No docker pull from docker.io. No downloading binaries on a node inside the enclave. If an artifact isn't in the Hauler store before you cross the airgap boundary, it doesn't exist on the other side. :::

Hauler is the transport mechanism. You run it on nuc-00 while it still has internet access, collect every image, chart, and binary the platform needs, save the result to a compressed tarball, and carry that tarball across the airgap boundary — by USB drive, sneakernet, or whatever your data-diode policy permits. Everything else follows from that one transfer.

The Airgap Design page covers this in detail. Read it before you start Day 1.

Day 0 / 1 / 2 Framework​

PhasePagesWhat gets done
Day 0 — DesignHardware, Network, Airgap Design, PrerequisitesPlan everything before touching hardware
Day 1 — BuildBastion, step-ca, Hauler, Harvester, RKE2, cert-manager, Harbor, Keycloak, Rancher, DGX SparkInstall the full stack in dependency order
Day 2 — OperateUpdate workflow, monitoring, STIG complianceRun it sustainably without internet

Start with Day 0. The design decisions made there — network plan, credential strategy, airgap approach — are load-bearing for everything that follows. Mistakes made on Day 0 are the most expensive to fix.

Prerequisites Summary​

See Day 0 — Prerequisites for the full checklist. The short version:

Credentials (stored in ~/.config/RGS/creds on nuc-00 and your operator workstation — never committed to git):

  • RGS Carbide portal account with registry access (CARBIDE_USERNAME / CARBIDE_PASSWORD)
  • Docker Hub account with a personal access token (DOCKER_USERNAME / DOCKER_PASSWORD) — avoids rate limits during Hauler sync
  • Passwords you choose for Harbor admin and step-ca key encryption
  • An RKE2 cluster token (generate with openssl rand -hex 32)

Knowledge:

  • Linux CLI: SSH, systemctl, journalctl
  • Networking basics: subnets, DNS, DHCP
  • YAML syntax
  • Kubernetes basics (pods, deployments, namespaces, Helm)
  • Familiarity with airgap concepts is helpful but not assumed — Day 0 explains them

Workstation:

  • kubectl, helm, and openssl in your PATH
  • git for pulling the infra repo
  • SSH key deployed to the mansible user on all nodes

Source Repository​

The infrastructure repository — scripts, Helm values, Terraform configs, and Packer templates — lives at:

https://github.com/jradtke-rgs/carbide-enclave.kubernerdes.com

Clone it on your operator workstation and on nuc-00. The scripts reference each other by relative path, so the clone location matters: nuc-00 expects the repo at /srv/www/htdocs/carbide-enclave.kubernerdes.com/.

arm64 Note​

note

The NVIDIA DGX Spark is arm64 (aarch64), not x86_64. Every image, chart, and binary that runs on it or is managed by it (GPU Operator, vLLM, model artifacts) must include an linux/arm64 platform entry in the Hauler manifest. This is a hard requirement — there is no fallback to amd64 on the Spark.

This is called out explicitly throughout the Day 1 docs wherever it applies.

Ready? Start with Day 0 — Design.