Galileo On Prem Kubernetes Setup

Galileo On-Prem Kubernetes Setup

Prerequisites

This parent does not require Kubernetes credentials and never calls the target.

Workflow Overview

┌─────────────────────────┐   ┌─────────────────────────┐   ┌──────────────────────┐
│ Intake + pinned sources │ → │ Render immutable packet │ → │ Coverage doctor/gaps │
└─────────────────────────┘   └─────────────────────────┘   └──────────┬───────────┘
                                                                      │
                                                                      ▼
       Air-gap → Stack → Agent Control/Luna → running-platform handoffs
          (each child owns read-only evidence and joint-session gates)

When to Activate

• Plan or assess a new Galileo On-Prem Kubernetes deployment.
• Resolve whether Galileo Stack, Agent Control, Luna Studio, Wizard GPU, or air-gap work belongs to a deployment child.
• Check product/feature coverage or production-readiness gaps.
• Review an existing parent packet without querying or changing the cluster.
• Do not use this parent to configure an already-running Galileo tenant; use galileo-platform-setup for application objects and product workflows.

Required Intake

Collect the non-secret fields in template.example. Always ask for the Galileo instance console URL, for example https://console.demo-v2.galileocloud.io/, and pass the confirmed value as --galileo-console-url. For on-premises use, this normally resolves to the customer-controlled TLS hostname. Its hostname must exactly match routing.public_hosts.console; a configured API URL must likewise match the API route host, and every route host must be the declared Galileo domain or a subdomain of it.

Require explicit target context, namespace, release names, environment class, installation method, CRD ownership, routing/TLS mode, storage and node-pool intent, optional-product topology, air-gap intent, backup/DR posture, and the paths and SHA-256 digests of entitled artifacts. Empty evidence becomes a doctor gap; contradictory topology, unknown fields, inline secrets, insecure URLs, mismatched hosts, placeholders, and unsupported enum values fail rendering. Secret-looking assignments, bearer values, private-key material, and credential-bearing URLs are rejected in every spec and runtime-inventory string, not only fields whose names appear sensitive.

Ownership Decision

Read references/deployment-feature-matrix.json when reviewing scope or changing a route. Read references/source-ledger.md before updating a product, version, support, or default claim.

Agent Control and Luna Studio have exactly one deployment owner. When the pinned package proves umbrella ownership, their deployment children emit a reviewed overlay for the Stack child; they must not install a second release.

The current Installation Guide defines four platform methods: recommended galileoctl UI/CLI (Method A), direct umbrella Helm (Method B), the vendor deployment script (Method C), and ordered charts (Method D). Both Method A interfaces apply the umbrella chart, and the current guide requires the UI for the first install. This repository uses direct pinned Helm as the deterministic inspection and rendering path and represents the other methods as reviewed, source-backed handoffs without claiming they ran. It is not an executable automation path; every live change remains a Galileo/CSE joint-session handoff.

Examples or Commands

Inspect the complete non-mutating CLI:

bash skills/galileo-on-prem-kubernetes-setup/scripts/setup.sh --help

Render and validate a hash-addressed packet:

bash skills/galileo-on-prem-kubernetes-setup/scripts/setup.sh \
  --render --validate \
  --spec skills/galileo-on-prem-kubernetes-setup/template.example \
  --galileo-console-url https://console.demo-v2.galileocloud.io/ \
  --output-dir galileo-on-prem-rendered

Run the doctor or print static plus chart-runtime coverage status:

bash skills/galileo-on-prem-kubernetes-setup/scripts/setup.sh \
  --doctor \
  --spec skills/galileo-on-prem-kubernetes-setup/template.example \
  --output-dir galileo-on-prem-rendered

bash skills/galileo-on-prem-kubernetes-setup/scripts/setup.sh \
  --coverage \
  --spec skills/galileo-on-prem-kubernetes-setup/template.example \
  --output-dir galileo-on-prem-rendered --json

Inspect an existing immutable bundle:

bash skills/galileo-on-prem-kubernetes-setup/scripts/setup.sh \
  --status --output-dir galileo-on-prem-rendered --json

The output root contains <deployment-id>/<bundle-sha>/. If multiple bundles exist, pass the exact bundle directory to --status or validate.sh.

Non-Mutating Contract

The only workflow modes are --render, --doctor, --coverage, and --status; --validate is an offline artifact-check modifier. Rendering only writes the local output directory. The parent never executes emitted handoffs.

Reject --apply, --install, --upgrade, --rollback, --uninstall, --execute, registry pushes, namespace creation, deletion, inline credentials, and unknown options before any output is written. Never call Helm, kubectl, SSH, cloud APIs, registries, child scripts, or the Galileo API from this skill.

A coverage result is complete only when uncovered, unowned, duplicate_mutation_owners, and unclassified_runtime_inventory are empty. Static documentation coverage can pass while the runtime inventory remains blocked until a pinned Stack child report is supplied. Do not label a deployment installed, healthy, production-ready, or GPU-live-validated from a parent render.

Validation

bash skills/galileo-on-prem-kubernetes-setup/scripts/validate.sh \
  --output-dir /exact/path/to/bundle

python3 -m py_compile \
  skills/galileo-on-prem-kubernetes-setup/scripts/render_router.py

PYTHONDONTWRITEBYTECODE=1 python3 \
  skills/galileo-on-prem-kubernetes-setup/scripts/self_test.py

Validation regenerates the complete JSON and Markdown packet from the normalized specification, normalized runtime inventory, current reviewed matrix, and referenced local artifact evidence. Updating a changed report and its ordinary manifest hash does not make that report valid.

Read reference.md for the deployment-spec, bundle, coverage, state, and handoff contracts.

Troubleshooting