Deployment models

Two bundles, one sequence

The ops bundle must be deployed before the platform bundle in every model. No exceptions — the 5 CRDs and the deploy operator must exist before platform workloads start.

1. Standard model (recommended)

Registry-first CLI path: relocate every image into your registry, let your scanner clear it, then install from there. Scriptable, auditable, and the default for first installs.

# On the gap-host (one-way internet to the portal)
genesis login                                   # paste your sk_... license key
VER=3.6.3                                        # from `genesis releases`
genesis pull $VER -o /tmp/bundles                # both bundles + .sig/.sha256/SBOM
genesis verify /tmp/bundles/genesis-ops-$VER.tar.zst
genesis verify /tmp/bundles/genesis-platform-$VER.tar.zst
genesis push-images --bundle /tmp/bundles/genesis-ops-$VER.tar.zst      --to your-registry.azurecr.io
genesis push-images --bundle /tmp/bundles/genesis-platform-$VER.tar.zst --to your-registry.azurecr.io

# Cross the gap (USB / encrypted SCP), then on the cluster-side host:
genesis verify ./genesis-ops-$VER.tar.zst        # re-verify after transfer
# Deploy ops FROM YOUR REGISTRY — images come through your scanner:
genesis deploy --bundle ./genesis-ops-$VER.tar.zst --registry your-registry.azurecr.io
genesis configure --save --emit-helm-values /tmp/values.yaml
genesis preflight                                # all checks must PASS first
genesis deploy --bundle ./genesis-platform-$VER.tar.zst \
  --registry your-registry.azurecr.io --values /tmp/values.yaml

Bare zarf package deploy also works for ops, but relocates images into Zarf's in-cluster registry (unscanned) — use genesis deploy --registry so the customer scanner sees every image. Full annotated runbook: Install guide.

2. CRD pre-apply (restricted clusters)

For clusters where cluster-admin is unavailable. A DBA or cluster-admin pre-applies the 5 CRDs separately; after that, ops deploy only needs namespace-scoped permissions.

# Step 1 — pre-apply CRDs (requires only CRD create permission)
#   Extract from chart/templates/crds/ in the genesis-delivery repo
kubectl apply -f chart/templates/crds/

# Verify all 5 are served
kubectl get crd | grep genesis
#   genesisdeployments.genesis.autonomize.ai
#   genesisupgrades.genesis.autonomize.ai
#   preflightreports.genesis.autonomize.ai
#   healthreports.genesis.autonomize.ai
#   workflowsmokereports.genesis.autonomize.ai

# Step 2 — deploy ops bundle (no CRD create needed; they exist).
# Registry-first (scanner-gated) — same as the standard model:
genesis deploy --bundle ./genesis-ops-$VER.tar.zst --registry your-registry.azurecr.io
# Or bare Zarf (unscanned in-cluster registry) — pass the LOCAL init
# package you transferred; a bare `zarf init` pulls from ghcr.io and fails
# air-gapped:
#   zarf init ./zarf-init-amd64-<ZARF_VER>.tar.zst --confirm
#   zarf package deploy genesis-ops-$VER.tar.zst --confirm

After this point, day-2 operations only need namespace-scoped access to the genesis namespace.

3. ArgoCD / GitOps hybrid

Ops bundle is deployed once imperatively (always). Platform bundle can be managed by ArgoCD after ops is deployed.

# Step 1 — ops bundle: one-time imperative (same as standard model).
# Registry-first so images pass your scanner:
genesis deploy --bundle ./genesis-ops-$VER.tar.zst --registry your-registry.azurecr.io
# (bare Zarf alternative — pass the LOCAL init package, never a bare
#  `zarf init` which reaches ghcr.io: zarf init ./zarf-init-*.tar.zst --confirm)

# Step 2 — Configuration → Install method = ArgoCD, then Preflight (adds
#          argocd-pull-secret + argocd-chart-reachable checks). Reach the
#          Control Plane by port-forward:
kubectl -n genesis port-forward deploy/genesis-bastion 8020:8020
# open http://localhost:8020 → Configuration → Preflight → Export

# Step 3 — register an OCI credential in YOUR ArgoCD first (else sync 401s).
#          Apply a credential TEMPLATE (not the UI "Connect Repo" entry, which
#          rejects a path in the URL on ArgoCD 3.x):
#            kubectl create secret generic genesis-helm-oci-creds -n argocd \
#              --from-literal=type=helm \
#              --from-literal=url=oci:///helm \
#              --from-literal=enableOCI=true \
#              --from-literal=username= --from-literal=password= \
#              --dry-run=client -o yaml \
#              | kubectl label --local -f - argocd.argoproj.io/secret-type=repo-creds -o yaml \
#              | kubectl apply -f -
#          (matches the Application's oci:///helm/genesis by prefix)

# Step 4 — download the generated Application from the Export screen and apply
#          it to the argocd namespace, then force the first reconcile:
#          (the manifest sets selfHeal:true, so ArgoCD may begin syncing on
#           apply; `argocd app sync` just runs/observes it immediately)
kubectl apply -f genesis-platform-application.yaml
argocd app sync genesis-platform && argocd app wait genesis-platform --health

The exported Application pins the OCI source oci://<your-registry>/helm/genesis (chart genesis under the helm repo — not genesis-platform under charts, which 404s) with your values inlined as valuesObject.

To upgrade: deploy new ops bundle imperatively, then update targetRevision in the ArgoCD Application and sync.

4. Helm-only (no Zarf)

For customers who cannot use Zarf due to policy constraints. Requires manual image mirroring with skopeo or equivalent.

# Decompress bundle
zstd -d genesis-platform-$VER.tar.zst -o genesis-platform-$VER.tar
tar -xf genesis-platform-$VER.tar -C /tmp/genesis-bundle/

# Mirror each image to your registry
skopeo copy \
  docker://sprintregistry.azurecr.io/genesis-bastion:$VER \
  docker://your-registry.internal/genesis-bastion:$VER
# ... repeat for all images in zarf.yaml

# Install ops workloads
helm install genesis-ops /tmp/genesis-bundle/chart/ \
  --namespace genesis --create-namespace \
  --values /tmp/genesis-platform-values.yaml

# Install platform
helm install genesis-platform /tmp/genesis-bundle/chart/ \
  --namespace genesis \
  --values /tmp/genesis-platform-values.yaml

See the Scan bundle page “Without Zarf” section for the full image mirror command list for a given release.

See also