Using the PoC Installer in an Air-Gapped Environment
Defining Air-Gapped Environments
An air-gapped environment is any environment in which the running hosts will not have access to the greater internet. This proposes a situation in which these hosts are unable to get access to various needed bits of software from Element and also are unable to share telemetry data back with Element.
For some of these environments, they can be connected to the internet from time to time and updated during those connection periods. In other environments, the hosts are never connected to the internet and everything must be moved over sneaker net.
This guide will cover running the microk8s installer when only sneaker net is available as that is the most restrictive of these environments.
ansible and pip installed artifacts
hmm...On the system that has access to internet
pip download -r requirements.txt -d
On the system that has no access to internet
pip install --no-index --find-links /path/to/download/dir/ -r requirements.txt
microk8s and helm3
On a machine connected to the internet, you will need to download the appropriate snaps for microk8s. Our installer presently uses the 1.21 version of microk8s from the stable branch.
snap download microk8s --channel=1.21
snap download core18
This will download 4 files -- a .assert and a .snap for each requested package. In my case, I have the following files:
core18_2409.assert
core18_2409.snap
microk8s_3202.assert
microk8s_3202.snap
Your list will be similar, but the revision numbers will possibly be different.
Now, we need to go grab the helm3 binary. As this is a dependency of microk8s, we need to actually check which version our microk8s will need. As such, you will need to have the microk8s that you downloaded installed for this to work.
If you have not previously installed microk8s, please do the following:
sudo snap ack core18_2409.assert
sudo snap install core18_2409.snap
sudo snap ack microk8s_3202.assert
sudo snap install microk8s_3202.snap --classic
cat /var/lib/snapd/snap/microk8s/current/actions/enable.helm3.sh | awk -F 'HELM_VERSION=' '{print $2}' - | xargs | sort -b | uniq
In my case, this yields:
v3.5.0
With this knowledge, we can now construct a wget command to grab the proper helm3 binary:
wget https://get.helm.sh/helm-<VERSION>-linux-amd64.tar.gz
which with our output from above would be:
wget https://get.helm.sh/helm-v3.5.0-linux-amd64.tar.gz
Now we need to unpack this tarball:
tar xvzf helm-v3.5.0-linux-amd64.tar.gz
and now we will find the proper helm binary for microk8s in the linux-amd64 directory.
Now, we need to take the snap artifacts and the helm binary to our disconnected environment.
Microk8s must be running and the installer will have failed to enable helm3 to do this:
sudo mkdir /var/snap/microk8s/current/bin
sudo cp /path/to/helm /var/snap/microk8s/current/bin/helm3
microk8s.enable helm3
Once you have helm3 enabled, you can opt to re-run the installer as it will now get past the enabling of helm3.
Getting Element's Container Images into your air-gapped environment.
Workflow on connected host:
Get installer from Element. Run download_images.sh and point this at an images directory. Tar up the installer that download_images.sh has run on and the images directory.
Take this installer and the images directory to the air gapped environment and deploy.