# Air-Gapped Kubernetes Deployment

> How to manually deploy the application in a Kubernetes cluster without network access.

If the network topology of a Kubernetes cluster prevents access to the ReversingLabs registry and APIs, several objects must be manually transferred and uploaded to the cluster. It is crucial to have Kubernetes API access available since `kubectl` will be used throughout this process.

**Steps:**

- **Download the threat data manually**: Use a FIE instance with internet access to download threat data.
- **Deploy FIE in production**: Deploy the production FIE application with cloud updates disabled
- **Transfer threat data**: Copy the downloaded threat data to the air-gapped FIE instance.

To complete this process, you will need:

- The [FIE Helm Chart](./kubernetes.md#appendix-fie-helm-chart)
- The FIE container image [pulled from the ReversingLabs registry](./docker.md#pulling-the-docker-image), which must be made available to the Kubernetes cluster via a client-provided registry.
- A valid license (provided by ReversingLabs).

### Manually download the threat data

The detailed process for downloading threat data is available [here](./docker.md#manual-threat-data-synchronization).

### Deploy the FIE application

After the threat data downloads, deploy FIE using the [Helm chart](./kubernetes.md#appendix-fie-helm-chart).

#### Making the container image available to Kubernetes

To make the FIE container image available to the Kubernetes cluster, you need to [pull it from the ReversingLabs registry](./docker.md#pulling-the-docker-image) and push it to your own registry.

Follow these steps:
1. **Load the image**2. **Tag the image**3. **Push the image to your registry****Note: Podman is used in this example, but the syntax should be similar if using Docker.**


#### Installing FIE Using Helm

Prepare a custom values file to configure the deployment using the [FIE Helm Chart](./kubernetes.md#install-fie-using-helm). Consult with your Kubernetes administrator to decide how to expose the FIE service (e.g., LoadBalancer, Ingress).

For the full list of available values, see the [example values.yaml](./Examples/values.md) file.

In this example, we use a LoadBalancer service to expose FIE, and we override the default image repository and tag with the settings from the previous step.

**Example Configuration (configuration.yaml):**Once you have prepared the values file, you can proceed to install the Helm chart. The Helm chart can be pushed to a chart repository, an OCI repository, or used directly as shown below:

**Example Helm installation command**

```bash
helm install fie ./fie-0.2.1.tgz --create-namespace --namespace fie-gapped \
  --set settings.cloudPassword="$RL_CLOUD_PASSWORD" \
  --values configuration.yaml --set-file licenseFileContent=RL-license.enc
```

```yaml
NAME: fie
LAST DEPLOYED: Mon Aug 26 11:57:56 2024
NAMESPACE: fie-ag
STATUS: deployed
REVISION: 1
TEST SUITE: None
```

**Note: CPU Requests: The `RL_CPU_REQUEST` environment variable exposes the number of CPU requests configured in Kubernetes (`resources.requests.cpu`) to the FIE container.**
FIE uses this value to report instance usage in `/status` as a percentage relative to the allotted CPU.

- **If deploying with our Helm chart**: the chart template maps `resources.requests.cpu` into this variable (see the [Kubernetes deployment guide](./kubernetes.md#cpu-requests)).
- **If deploying without Helm**: define `RL_CPU_REQUEST` in the container's environment section of your Pod or Deployment manifest.

### Copy the threat data

There are multiple ways to transfer the threat data to the air-gapped environment. Below is one example workflow:

1. **Download the tar package**

    We will store the threat data into a .tar file. This requires the `tar` package to be installed in the FIE pod.

    Since this is an air-gapped environment, the `tar` package must be downloaded externally and then transferred to the pod:

    ```bash
    curl -O https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi8/8/x86_64/baseos/os/Packages/t/tar-1.30-9.el8.x86_64.rpm
    ```

    This is an example command, make sure to check that you're downloading the latest available version.

2. **Upload the tar package to FIE and install it**

    ```bash
    cat tar-1.30-9.el8.x86_64.rpm | kubectl -n fie-gapped exec -it deploy/fie -- cp /dev/stdin /tar-1.30-9.el8.x86_64.rpm
    ```

    ```bash
    kubectl -n fie-gapped exec -it deploy/fie -- rpm -ihv /tar-1.30-9.el8.x86_64.rpm
    ```

3. **Store and transfer threat data**

    Once `tar` installs, threat data can be stored into a .tar archive and moved over to the pod:

    ```bash
    $ cd /external/dir
    $ tar cvf - * | kubectl -n fie-gapped exec -i deploy/fie -- tar xf - -C /rl/threat-data --no-same-owner
    ```

4. **Restart the pod**

    After everything is installed and copied over, restart the pod:

    ```bash
    kubectl -n fie-gapped rollout restart deploy/fie
    ```

Contact [ReversingLabs Support](mailto:support@reversinglabs.com) for more information and guidance.

---

### Get the application URL

To confirm that the File Inspection Engine is up and running, retrieve the application URL and perform a test file submission. You can follow the steps provided in the [Kubernetes Deployment guide](./kubernetes.md#get-the-application-url).
