Galileo On Prem Agent Control Setup

Galileo On-Prem Agent Control Setup

Prerequisites

• Obtain the exact CSE-approved Agent Control or umbrella package and non-secret

questionnaire values. Never infer proprietary defaults.

• Complete the parent galileo-on-prem-kubernetes-setup contract and establish

that api and authz are healthy.

• Create the chart-required PostgreSQL and API Kubernetes Secrets out of band.
• Use Bash, Python 3, and a private render destination.

Workflow Overview

+-- Intake + ownership proof --+ -> +-- Immutable render --+ -> +-- Bound preflight --+
                                                               -> +-- Joint-session handoff --+

When to Activate

• Add the packaged agent-control service to an on-prem Galileo deployment.
• Review a new chart, database-bootstrap choice, route, feature flag, or UI

integration before an install or upgrade.

• Produce a stack overlay when the exact umbrella package owns Agent Control.
• Diagnose missing ownership, Secret-reference, or deployment-order evidence.

Do not activate this skill for creating controls, targets, or Splunk event sinks; those belong to galileo-agent-control-setup after the service is healthy.

Required Intake

Ask for the Galileo instance console URL and record the exact value, for example https://console.demo-v2.galileocloud.io/. Pass it with --galileo-console-url; never assume a Galileo Cloud hostname for on-prem.

Also collect the Kubernetes namespace/release, exact ownership mode, chart or umbrella evidence hashes, parent stack contract, database policy, existing Secret names/keys, routing mode, UI-proxy choice, feature-flag source, and CSE approval reference. Secrets themselves never belong in the spec.

Ownership and Lifecycle Rules

1. Default to standalone. Require a local agent-control chart archive whose

version and SHA-256 match the spec.

1. Select umbrella-overlay only when a hash-bound artifact from the exact

umbrella package proves ownership. Emit an overlay contract; never install a second release.

1. Reject specifications that contain both ownership paths.
2. Preserve the required order: healthy api and authz, Agent Control,

optional direct route, then ui upgrade/restart and validation.

1. Treat database bootstrap as a privileged migration choice. Prefer a

pre-provisioned database for production and air-gapped deployments.

1. Keep the Controls UI same-origin proxy enabled. A direct route is optional

for SDKs, health checks, docs, or a customer-managed load balancer.

1. Never set a per-customer image version unless the approved chart package and

exception explicitly require it; chart appVersion is the default source.

Read [reference.md](reference.md), [lifecycle-contract.md](references/lifecycle-contract.md), and [source-ledger.md](references/source-ledger.md) before reviewing a production bundle.

Commands

Inspect the safe interface:

bash skills/galileo-on-prem-agent-control-setup/scripts/setup.sh --help

Render a standalone or overlay bundle from reviewed input:

bash skills/galileo-on-prem-agent-control-setup/scripts/setup.sh \
  --render \
  --spec ./agent-control.local.yaml \
  --galileo-console-url "https://console.demo-v2.galileocloud.io/" \
  --output-dir ./galileo-on-prem-rendered/agent-control

Validate the immutable output without contacting Kubernetes:

bash skills/galileo-on-prem-agent-control-setup/scripts/validate.sh \
  --output-dir ./galileo-on-prem-rendered/agent-control

Standalone mode owns its distinct preflight, status, and lifecycle handoff phases. Preflight/status require --kubeconfig, the exact console URL, and the gates printed by --help. Every non-uninstall preflight also requires a new private --image-evidence-file and --endpoint-evidence-file; they bind the exact bundle, parent target, chart, non-secret value hashes, a value-free Secret path/type influence contract, an all-scalar-redacted render hash, digest-pinned containers, and a credential-free host[:port] inventory derived in memory from non-secret and Secret-backed settings. All historical --apply-* modes are permanent fail-closed sentinels and touch neither the bundle nor Kubernetes. Use the immutable lifecycle.json packet and fresh preflight/image/endpoint evidence in a Galileo/CSE joint session. Umbrella mode emits an overlay only and never mutates a second release.

Completion Gate

Keep completion open until the ownership mode is unique, every non-secret chart/evidence hash matches, required Secret names and keys exist, database migration policy is approved, routing/DNS/TLS are aligned, /health succeeds, UI proxying works, and the agent_control feature flag is verified at its declared precedence.

Troubleshooting

| Symptom | Likely cause | Resolution | |---|---|---| | Dual-ownership rejection | Standalone chart and umbrella proof were both supplied | Choose the single owner proved by the exact package | | Chart identity mismatch | Archive is not the approved agent-control release | Obtain the correct package and digest from Galileo | | Database bootstrap blocked | Production/air-gap policy lacks an exception | Pre-create the database and grants; disable bootstrap | | Controls UI is absent | UI proxy/flag was not reconciled | Upgrade or restart UI after enabling the flag | | Direct route fails | DNS, route host, or TLS SAN differs | Make all three names identical; never use insecure TLS |

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: chambear2809
• Source: chambear2809/splunk-cisco-skills
• License: Apache-2.0

Install and usage instructions live in the source repository linked above.