Air-Gapped Installation

Overview

The installation ISO carries everything the CDN Manager needs, container images included, so an installation needs no internet access. What deploy does need is the operating system’s own packages: it installs a few with dnf on every machine: ansible-core on the first server, and on all of them rsync, tar, zstd, bash-completion, the storage tools (iscsi-initiator-utils and nfs-utils), and container-selinux, which the cluster’s SELinux policy needs.

Without internet access, give every machine a local package repository from the operating system’s installation media, then follow the Quickstart as written.

Prerequisites

Set Up a Local Repository on Every Machine

On each machine, mount the operating system ISO and add its two repositories. This example is for Red Hat Enterprise Linux 9; on a rebuild, use its ISO and the signing key file its own documentation names.

mkdir -p /mnt/os
mount -o loop,ro /root/rhel-9.4-x86_64-dvd.iso /mnt/os

cat > /etc/yum.repos.d/os-media.repo <<'REPO'
[os-media-baseos]
name=OS media - BaseOS
baseurl=file:///mnt/os/BaseOS
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release

[os-media-appstream]
name=OS media - AppStream
baseurl=file:///mnt/os/AppStream
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
REPO

Disable any repository the machine cannot reach, or dnf fails while trying to read it:

dnf repolist
dnf config-manager --set-disabled <repository id>

Then check that dnf can find the packages:

dnf -q repoquery --latest-limit 1 ansible-core rsync tar zstd bash-completion iscsi-initiator-utils nfs-utils container-selinux

Each package should be listed once, whether or not it is already installed.

Important: Keep the local repository available on every machine whenever you run deploy, not only for the first installation. Every run installs or checks packages with dnf on each machine, and stops if it cannot reach them. Remount the operating system ISO after a reboot, as you do the CDN Manager ISO.

Install

Follow the Quickstart. Copy the MaxMind databases, your TLS certificate and its key, and both ISOs to the machines by whatever means your site allows.

If the first server cannot install ansible-core, deploy init stops with:

Error: could not install ansible-core. Ensure your OS repositories
or mounted install media are available to dnf (air-gap SOP).

Check the repository on that machine and run deploy init again.