Galileo On Prem Stack Setup

Galileo On-Prem Stack Setup

This skill is render-first and handoff-only. It never invokes a mutating Helm, Kubernetes, MicroK8s, CRD, node-label, rollback, or uninstall command. The historical --apply-* flags are permanent fail-closed sentinels.

When to Activate

Use this skill when a Galileo On-Prem Kubernetes deployment needs entitled chart inspection, immutable render evidence, target-bound read-only preflight, status observation, or a Galileo/CSE joint-session handoff. Do not activate it to execute Helm, kubectl, MicroK8s, CRD, upgrade, rollback, or uninstall mutations.

Prerequisites

Required Intake

Ask for the Galileo instance console URL and record it exactly, for example https://console.demo-v2.galileocloud.io/. Pass it with --galileo-console-url; never assume a Galileo Cloud hostname for on-prem.

Never ask for or repeat passwords in chat. Never put credentials, tokens, private keys, Secret payloads, or credential-bearing URLs in the spec, command line, bundle, plans, evidence, logs, or support output.

Supported Outcomes

• Safely inspect a pinned umbrella chart and every nested chart for exact dependencies, values/schema flags, images, hooks/migrations, CRDs, API kinds, cluster-scoped objects, routes, and persistence surfaces.
• Render a content-addressed private bundle containing only non-secret inputs, the exact chart archive, normalized spec, and derived inventories.
• Run a connected, read-only preflight that binds the target, release state, active CRDs, API discovery, runtime Secret influence, rendered manifests, images, endpoints, storage, routing, monitoring, data services, node pools, Wizard/GPU intent, and air-gap handoff evidence.
• Observe live status without claiming health or provenance that was not proven. production_ready always remains false in this release.
• Prepare canonical pre-approval handoff candidates for all lifecycle changes, including official installation methods, upgrades, rollback, retirement, galileoctl, dedicated CRDs, GPU/local inference, air-gap, and MicroK8s lab bootstrap.

The current Installation Guide defines four methods: galileoctl (Method A), umbrella Helm CLI (Method B), deployment script (Method C), and step-by-step (Method D). The galileoctl UI is identified for first install and its CLI is a workstation/CI alternative. This skill recognizes all four methods and can inspect pinned Method A/B chart artifacts. Method C remains incomplete without the exact script/config hashes and static review; Method D remains incomplete without the ordered chart/release/dependency contract. It executes none of the methods. Do not call the raw Helm path vendor-recommended.

Do not use this skill for Galileo projects, datasets, scorers, model-provider configuration, Agent Control ownership, or standalone Luna Studio; route those through their dedicated Galileo skills.

Workflow Overview

┌───────────────────────────────────────────┐
│ Pinned artifacts + closed review inputs   │
└───────────────────────────────────────────┘
                     ▼
          inspect -> render -> validate
                     ▼
           read-only connected preflight
                     ▼
 unauthorized candidate -> external Galileo/CSE session
                     ▼
            read-only status observation

Required Workflow

1. Read reference.md, references/lifecycle-contract.md, and references/coverage-and-safety.md.
2. Run --inspect-chart. It emits only a runtime inventory and coverage-review.yaml; it does not create a deployable bundle.
3. Copy every exact reviewed ID into spec.coverage, then run --render.
4. Run offline validation on the immutable bundle.
5. Run --preflight --for-action <action> against the exact target with the runtime secret file. Preflight is read-only; server-side dry-run admission checks are non-persisting and are reported separately from observer access.
6. Give the bundle, canonical redacted evidence, unresolved gates, and exact target/release inventory to the Galileo/CSE operator. The operator executes the vendor-approved command in the jointly controlled session. The emitted handoff-candidate.json is authorized:false; it is not a final approval.
7. Run --status for retryable read-only observation. Without independently authenticated adoption/provenance evidence it reports an unverified state, never successful production completion.

Commands

bash skills/galileo-on-prem-stack-setup/scripts/setup.sh --help
bash skills/galileo-on-prem-stack-setup/scripts/validate.sh --help

bash skills/galileo-on-prem-stack-setup/scripts/setup.sh \
  --inspect-chart \
  --spec ./galileo-stack-deployment.yaml \
  --galileo-console-url "$GALILEO_CONSOLE_URL" \
  --output-dir ./galileo-on-prem-rendered

bash skills/galileo-on-prem-stack-setup/scripts/setup.sh \
  --render \
  --spec ./galileo-stack-deployment.yaml \
  --galileo-console-url "$GALILEO_CONSOLE_URL" \
  --output-dir ./galileo-on-prem-rendered

bash skills/galileo-on-prem-stack-setup/scripts/validate.sh \
  --bundle ./galileo-on-prem-rendered/acme/<bundle-sha>

bash skills/galileo-on-prem-stack-setup/scripts/setup.sh \
  --preflight \
  --for-action install \
  --bundle ./galileo-on-prem-rendered/acme/<bundle-sha> \
  --secret-values-file /secure/runtime/secret-values.yaml \
  --galileo-console-url "$GALILEO_CONSOLE_URL"

bash skills/galileo-on-prem-stack-setup/scripts/setup.sh \
  --status \
  --bundle ./galileo-on-prem-rendered/acme/<bundle-sha> \
  --galileo-console-url "$GALILEO_CONSOLE_URL" \
  --json

--apply-install, --apply-upgrade, --apply-rollback, --apply-uninstall, and --apply-lab-bootstrap reject before reading a bundle, opening a kubeconfig, resolving a binary, writing state, or running a subprocess. Planning flags emit manual handoffs only.

Hard Safety Rules

• Require exact local archives and hashes; never fetch latest or switch installation ownership mid-lifecycle.
• Keep non-secret and runtime-secret values separate. Reject duplicate YAML keys, aliases, merge keys, unknown spec fields, populated secret-like non-secret fields, and unsafe runtime override paths. Until a version/hash- bound closed CSE values/questionnaire contract is supplied, keep cse_values_contract_missing open even when chart inspection succeeds.
• Never persist raw Secret bodies or unredacted Helm output. Runtime secret leaves must independently influence only classified Secret payload fields.
• Shared CRDs must already exist and be semantically exact. Dedicated CRDs are a handoff. Never create, patch, replace, or delete a CRD here.
• Treat hooks, migrations, operator-created claims, cluster-scoped resources, RBAC, routing/TLS, monitoring, external services, GPU/model artifacts, and air-gap mirrors as review surfaces, not implicit approval.
• Never delete or alter namespaces, PVCs, PVs, buckets, databases, nodes, labels, load-balancer pools, or release history.
• A syntactically valid render is not production readiness. Keep explicit gaps such as entitled_chart_integration_unvalidated, cse_values_contract_missing, and live_readonly_integration_unvalidated open until exact artifacts and connected evidence exist.

Troubleshooting