Prerequisites · Genesis Downloads

Three-plane architecture

One boundary: the .tar.zst bundle on your gap-host. Autonomize never reaches into your cluster.

┌──────────────────────────────────────────────────────────────────────┐
│  Vendor side (Autonomize-run)                                        │
│  downloads.genesis.autonomize.ai                                     │
│    - Issues license keys                                             │
│    - Publishes signed Zarf bundles (cosign + SBOM)                   │
└──────────────────────────┬───────────────────────────────────────────┘
                           │  HTTPS pull (one-way)
                           ▼
┌──────────────────────────────────────────────────────────────────────┐
│  Gap-host (your EC2 / bastion VM)                                    │
│    genesis login → genesis pull → genesis push-images → genesis deploy│
│    Has one-way internet to downloads portal.                         │
│    Has kubeconfig for your cluster. Never reverse-tunnels back.      │
└──────────────────────────┬───────────────────────────────────────────┘
                           │  kubectl / zarf (local network only)
                           ▼
┌──────────────────────────────────────────────────────────────────────┐
│  Customer cluster (air-gapped VPC)                                   │
│    You bring: Postgres · Redis · cert-manager · DNS · TLS            │
│              ESO · image registry · Ingress controller               │
│    Genesis installs: ops bundle → platform bundle                    │
│    No outbound calls to Autonomize after install.                    │
└──────────────────────────────────────────────────────────────────────┘

Infra requirements

Confirm all of these before starting the install.

Component	Minimum	Notes
Kubernetes	1.28+	AKS / EKS / GKE / OpenShift / RKE2 / bare-metal. Amazon VPC CNI or Calico.
Nodes (demo)	3 × 4 vCPU / 16 GiB	Minimum for a POC or single-tenant demo environment.
Nodes (production)	4 × 8 vCPU / 32 GiB	Recommended for production. Platform bundle adds ~18 services + embedding pods.
PostgreSQL	14+	Reachable from cluster. Admin account needs `CREATEDB`. HA optional but recommended. Preflight creates the 10 platform DBs idempotently. Server parameters: `max_connections` ≥ 3000 (hard floor 166) and the `btree_gin` extension allow-listed — see PostgreSQL server parameters below.
Redis	7+	Auth token + TLS in transit. Single instance fine; Sentinel / cluster also supported.
cert-manager	v1.14+	Any namespace (default `cert-manager`). Used for in-cluster TLS cert issuance.
External Secrets Operator	0.18.2+	v1 CRDs required (`external-secrets.io/v1`). Syncs secrets from AWS SM / Azure KV / GCP SM. ESO can be bundled inside the platform deploy if you don't have it already.
Ingress controller	NGINX or cloud LB	Terminates TLS for the platform hostname. Cloud LB controllers (AWS ALB, Azure Application Gateway) are also supported.
Image registry	ECR / ACR / Harbor / Zarf in-cluster	One of three patterns: customer-owned, cloud-native attach, or Zarf bundled in-cluster registry. The CLI's `genesis push-images` relocates all images before install.
DNS	One hostname	Platform hostname (e.g. `genesis.yourorg.internal`) must resolve to your Ingress LB before install.
TLS certificate	One wildcard or SAN cert	Loaded into the `genesis` namespace as a `kubernetes.io/tls` Secret. Customer-issued (ACM / Let's Encrypt / PKI). TLS 1.2+ recommended; APISIX does not enforce a floor.

PostgreSQL database list

Genesis services each own their own database. Preflight's database-bootstrap check creates any missing DBs idempotently using the admin credentials you supply at configuration time. Your DBA only needs to ensure the admin role exists.

Database name	Owned by service
`keycloak`	genesis-idp (Keycloak)
`ai_studio`	genesis-be, genesis-be-runtime
`genesis_authz`	genesis-authz
`genesis_tenant`	genesis-tenant-mgmt
`genesis_prompts`	genesis-prompt-management-backend
`knowledge_center`	knowledge-center
`command_center`	genesis-cc-be
`openfga`	genesis-fga
`temporal`	genesis-de (Temporal frontend / history / matching)
`temporal_visibility`	genesis-de (Temporal visibility)

DBA-only DDL mode If your operations policy requires DBA-only DDL (preflight strictly read-only), set dbBootstrap: false in the PreflightReport CR and create the 10 databases manually before running preflight. Without admin creds AND without pre-created DBs, the database check FAILs with a clear list of what is missing.

PostgreSQL server parameters

Set these on the server before platform install — pods gate on them at startup and won't become Ready otherwise.

Parameter	Required value	Why
`max_connections`	≥ 3000 recommended; hard floor 166	The ~30 platform services each hold a connection pool. A runtime `PostgresCapacityCheck` gate runs `SHOW max_connections` at pod startup and refuses readiness if the value is below the required floor (166) — the pod loops in startup-probe failure until Postgres is resized. 3000 leaves comfortable headroom for the production profile plus external consumers.
`azure.extensions`	include `BTREE_GIN`	Azure Database for PostgreSQL (Flexible Server) blocks `CREATE EXTENSION` unless the extension is allow-listed in this server parameter. A platform migration runs `CREATE EXTENSION IF NOT EXISTS btree_gin` on first start; without the allow-list it fails. Set `azure.extensions` to include `BTREE_GIN` (comma-separated alongside any others you already allow). Non-Azure Postgres has no equivalent gate — just ensure `CREATE EXTENSION` is permitted for the admin role.

Managed-service notes Azure Flexible Server: set both via Server parameters (Portal / az postgres flexible-server parameter set); max_connections requires a server restart, azure.extensions takes effect on the next connection. AWS RDS / Aurora: max_connections is governed by the instance class / parameter group — size the SKU so the effective value clears the floor. Self-hosted: ALTER SYSTEM SET max_connections = 3000; SELECT pg_reload_conf(); (restart required for max_connections on most flavours).

Resource requirements — ops bundle

The ops bundle deploys the deploy operator, Vin Advisor, health agent, preflight runner, and Genesis Bastion admin console. These are the resource boundaries for the ops workloads only. Platform bundle adds ~18 more services.

Workload	CPU request/limit	RAM request/limit	Notes
`genesis-bastion`	100m / 1000m	256Mi / 1Gi	In-cluster admin console + wizard. Deployment.
`genesis-deploy-operator`	100m / 1000m	256Mi / 1Gi	kopf reconciler for 5 CRDs. Deployment.
`genesis-vin-advisor`	50m / 500m	128Mi / 512Mi	HolmesGPT wrapper for preflight advice. Deployment.
`genesis-health-agent`	20m / 200m	64Mi / 256Mi	CronJob → HealthReport CRs. Runs every 5 minutes.
Bundle PVC	—	10 GiB	Stores downloaded `.tar.zst` bundles on the gap-host before deploy.
Support-bundle PVC	—	5 GiB	Temporary storage for support bundle archives.

Platform bundle sizing The platform bundle adds ~18 services including embedding / AI services. Full platform sizing: minimum 4 vCPU / 8 GiB per node. See docs/customer/aks-sizing.md.

Image list — ops bundle

The ops bundle ships 8 container images. All are relocated to your registry by genesis push-images before install. Your CISO's scanner runs against the images in your registry; Zarf re-tags them internally during deploy.

Image	Type
`genesis-bastion`	Genesis (Chainguard wolfi-base)
`genesis-deploy-operator`	Genesis (Chainguard wolfi-base)
`genesis-vin-advisor`	Genesis (Chainguard wolfi-base)
`genesis-health-agent`	Genesis (Chainguard wolfi-base)
`genesis-preflight`	Genesis (Chainguard wolfi-base)
`genesis-workflow-smoke`	Genesis (Chainguard wolfi-base)
`genesis-support-bundle`	Genesis (Chainguard wolfi-base)
`robustadev/holmes:0.27.0`	Upstream (Apache-2.0). HolmesGPT core powering Vin Advisor.

Gap-host tooling

Two CLIs are not part of the Genesis bundle and must be on the gap-host before you start. Linux install commands below; macOS operators substitute brew install <name>.

Tool	When you need it	Install (Linux)
`trivy`	Required to run `genesis scan` — the per-image CycloneDX gate that fails on HIGH/CRITICAL CVEs. Wizcli generates the SBOM during release; trivy consumes it on the customer side (wizcli has no SBOM-file scan mode).	`# Air-gapped (default): the trivy binary + CVE DB ship in the signed # portal tool bundle — no internet needed (audit A5): genesis pull --tools # writes ./tools/<os-arch>/ incl. trivy-db.tar.gz trivy --version # Connected hosts only (NOT reachable air-gapped): # curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh \| sudo sh -s -- -b /usr/local/bin` `genesis scan` auto-detects `./tools/<os-arch>/trivy-db.tar.gz`, or pass `--trivy-db <path>`. An internal trivy-db mirror also works: `--db-repository <internal>/trivy-db:2 --skip-db-update`.
`az` (Azure CLI)	Required only if your image registry is Azure Container Registry (ACR). Used by install step 06 to mint a short-lived ACR pull token (`az acr login --expose-token`) for `skopeo` / podman. Not needed for ECR, GCR, Harbor, or in-cluster Zarf registry.	`curl -sL https://aka.ms/InstallAzureCLIDeb \| sudo bash az --version # One-time sign-in (interactive device-code on a headless VM): az login --use-device-code az account set --subscription <your-subscription-id>` RHEL / Amazon Linux: see Microsoft's per-distro install matrix.

Network requirements

Genesis clusters are air-gap-safe. No outbound call-home to Autonomize after install. The only inbound traffic is from your users to the platform hostname.

Direction	Source → Destination	Protocol / Port	Why
Inbound	Users → Ingress LB	TCP 443	HTTPS to platform hostname
Cluster → external	Pods → PostgreSQL	TCP 5432	Platform services (DB in your VPC subnet)
Cluster → external	Pods → Redis	TCP 6379	Session caching + rate limiting
Cluster → external	genesis-eso → Secrets Manager / Key Vault	TCP 443	ExternalSecret sync. AWS SM / Azure KV / GCP SM endpoint.
Cluster → external	Pods → Image registry	TCP 443	Image pulls. ECR / ACR / Harbor / Zarf in-cluster (localhost if bundled).
Cluster → external	genesis-bastion → OIDC issuer	TCP 443	JWT validation at steady-state. Not needed during bootstrap.
Gap-host → external	Gap-host → `downloads.genesis.autonomize.ai`	TCP 443	One-way bundle pull. Gap-host only, not the cluster.

Air-gap The customer cluster itself does not need outbound access to Autonomize. All bundle pulls happen on the gap-host; the cluster only pulls images from your private registry.

RBAC requirements

Installing the ops bundle requires elevated cluster permissions once. Post-install operations run under scoped ServiceAccount roles.

Ops bundle install

zarf init + zarf package deploy genesis-ops-* requires cluster-admin or a ClusterRole with:

customresourcedefinitions: [create, list, get, patch]
namespaces: [create, get]
clusterroles / clusterrolebindings: create

For clusters where cluster-admin is unavailable, see Deployment models for the CRD pre-apply workaround.

Platform bundle + day-2

After ops is deployed, the ops ServiceAccounts create their own scoped Roles. Platform install and day-2 configuration only need namespace-scoped access to the genesis namespace. No additional customer RBAC required.

5 CRDs The ops bundle installs 5 CRDs: GenesisDeployment, GenesisUpgrade, PreflightReport, HealthReport, WorkflowSmokeReport. These are cluster-scoped resources that require cluster-admin or CRD-create permission during initial deploy.

Domain & TLS requirements

One DNS hostname

Single hostname for the platform (e.g. genesis.yourorg.internal). Must resolve to your Ingress load-balancer IP before install. Preflight's connectivity checks verify this DNS record exists.

TLS certificate

One kubernetes.io/tls Secret in the genesis namespace. Certificate source is customer-managed: ACM, Let's Encrypt via cert-manager, or internal PKI. TLS 1.2+ recommended. Genesis does not enforce a minimum TLS version.

SSO / OIDC

For steady-state admin access, Genesis Bastion requires an OIDC issuer, client ID, and either a client secret or a Workload Identity Federation credential. Options: bundled Keycloak, Azure AD, Okta.

SSO configuration guide →

Install order

The sequence is deterministic. Do not skip steps — platform pods crash without secrets and ops CRDs installed first.

Provision: Postgres, Redis, cert-manager, DNS, TLS cert, ESO, image registry
Apply ExternalSecret CRs (customer-genesis-secrets, ai-studio-secrets) — see required-secrets.md
zarf init (one-time per cluster)
zarf package deploy genesis-ops-<VER>.tar.zst --confirm
genesis configure --save --emit-helm-values /tmp/values.yaml
genesis preflight → all 34 checks PASS
genesis deploy --bundle genesis-platform-<VER>.tar.zst --values /tmp/values.yaml

Ops first, always The platform bundle will fail to deploy if the ops bundle has not been deployed first. The 5 CRDs and the deploy operator must be present before the platform install starts.

Prerequisites — what you bring

Three-plane architecture

Infra requirements

PostgreSQL database list

PostgreSQL server parameters

Resource requirements — ops bundle

Image list — ops bundle

Gap-host tooling

Network requirements

RBAC requirements

Ops bundle install

Platform bundle + day-2

Domain & TLS requirements

One DNS hostname

TLS certificate

SSO / OIDC

Install order

See also

Install guide

Deployment models

Required secrets

SSO configuration