Galileo On Prem Stack Setup

Galileo On-Prem Stack Setup

This skill is render-first and handoff-only. It never invokes a mutating Helm, Kubernetes, MicroK8s, CRD, node-label, rollback, or uninstall command. The historical --apply-* flags are permanent fail-closed sentinels.

When to Activate

Use this skill when a Galileo On-Prem Kubernetes deployment needs entitled chart inspection, immutable render evidence, target-bound read-only preflight, status observation, or a Galileo/CSE joint-session handoff. Do not activate it to execute Helm, kubectl, MicroK8s, CRD, upgrade, rollback, or uninstall mutations.

Prerequisites

| Requirement | Why it is required | |---|---| | Entitled local galileo-stack chart archive, exact version, and SHA-256 | The chart is proprietary and release-specific; never infer its values | | Version-matched CSE questionnaire and values contract | Product topology and secret paths must come from Galileo, not invented defaults | | Runtime-only secret values file, mode 0600 or stricter | Secret material is inspected in memory and never copied into the bundle | | Named kube context, exact API/CA/cluster/namespace identity | Connected evidence must bind one reviewed target | | Helm 3, kubectl, Python 3, and PyYAML | Required for local render and read-only connected inspection | | External Galileo/CSE change authorization | This local skill does not authenticate or replace change approval |

Required Intake

Ask for the Galileo instance console URL and record it exactly, for example https://console.demo-v2.galileocloud.io/. Pass it with --galileo-console-url; never assume a Galileo Cloud hostname for on-prem.

Never ask for or repeat passwords in chat. Never put credentials, tokens, private keys, Secret payloads, or credential-bearing URLs in the spec, command line, bundle, plans, evidence, logs, or support output.

Supported Outcomes

• Safely inspect a pinned umbrella chart and every nested chart for exact

dependencies, values/schema flags, images, hooks/migrations, CRDs, API kinds, cluster-scoped objects, routes, and persistence surfaces.

• Render a content-addressed private bundle containing only non-secret inputs,

the exact chart archive, normalized spec, and derived inventories.

• Run a connected, read-only preflight that binds the target, release state,

active CRDs, API discovery, runtime Secret influence, rendered manifests, images, endpoints, storage, routing, monitoring, data services, node pools, Wizard/GPU intent, and air-gap handoff evidence.

• Observe live status without claiming health or provenance that was not

proven. production_ready always remains false in this release.

• Prepare canonical pre-approval handoff candidates for all lifecycle changes,

including official installation methods, upgrades, rollback, retirement, galileoctl, dedicated CRDs, GPU/local inference, air-gap, and MicroK8s lab bootstrap.

The current Installation Guide defines four methods: galileoctl (Method A), umbrella Helm CLI (Method B), deployment script (Method C), and step-by-step (Method D). The galileoctl UI is identified for first install and its CLI is a workstation/CI alternative. This skill recognizes all four methods and can inspect pinned Method A/B chart artifacts. Method C remains incomplete without the exact script/config hashes and static review; Method D remains incomplete without the ordered chart/release/dependency contract. It executes none of the methods. Do not call the raw Helm path vendor-recommended.

Do not use this skill for Galileo projects, datasets, scorers, model-provider configuration, Agent Control ownership, or standalone Luna Studio; route those through their dedicated Galileo skills.

Workflow Overview

┌───────────────────────────────────────────┐
│ Pinned artifacts + closed review inputs   │
└───────────────────────────────────────────┘
                     ▼
          inspect -> render -> validate
                     ▼
           read-only connected preflight
                     ▼
 unauthorized candidate -> external Galileo/CSE session
                     ▼
            read-only status observation

Required Workflow

1. Read [reference.md](reference.md),

[references/lifecycle-contract.md](references/lifecycle-contract.md), and [references/coverage-and-safety.md](references/coverage-and-safety.md).

1. Run --inspect-chart. It emits only a runtime inventory and

coverage-review.yaml; it does not create a deployable bundle.

1. Copy every exact reviewed ID into spec.coverage, then run --render.
2. Run offline validation on the immutable bundle.
3. Run --preflight --for-action against the exact target with the

runtime secret file. Preflight is read-only; server-side dry-run admission checks are non-persisting and are reported separately from observer access.

1. Give the bundle, canonical redacted evidence, unresolved gates, and exact

target/release inventory to the Galileo/CSE operator. The operator executes the vendor-approved command in the jointly controlled session. The emitted handoff-candidate.json is authorized:false; it is not a final approval.

1. Run --status for retryable read-only observation. Without independently

authenticated adoption/provenance evidence it reports an unverified state, never successful production completion.

Commands

bash skills/galileo-on-prem-stack-setup/scripts/setup.sh --help
bash skills/galileo-on-prem-stack-setup/scripts/validate.sh --help

bash skills/galileo-on-prem-stack-setup/scripts/setup.sh \
  --inspect-chart \
  --spec ./galileo-stack-deployment.yaml \
  --galileo-console-url "$GALILEO_CONSOLE_URL" \
  --output-dir ./galileo-on-prem-rendered

bash skills/galileo-on-prem-stack-setup/scripts/setup.sh \
  --render \
  --spec ./galileo-stack-deployment.yaml \
  --galileo-console-url "$GALILEO_CONSOLE_URL" \
  --output-dir ./galileo-on-prem-rendered

bash skills/galileo-on-prem-stack-setup/scripts/validate.sh \
  --bundle ./galileo-on-prem-rendered/acme/

bash skills/galileo-on-prem-stack-setup/scripts/setup.sh \
  --preflight \
  --for-action install \
  --bundle ./galileo-on-prem-rendered/acme/ \
  --secret-values-file /secure/runtime/secret-values.yaml \
  --galileo-console-url "$GALILEO_CONSOLE_URL"

bash skills/galileo-on-prem-stack-setup/scripts/setup.sh \
  --status \
  --bundle ./galileo-on-prem-rendered/acme/ \
  --galileo-console-url "$GALILEO_CONSOLE_URL" \
  --json

--apply-install, --apply-upgrade, --apply-rollback, --apply-uninstall, and --apply-lab-bootstrap reject before reading a bundle, opening a kubeconfig, resolving a binary, writing state, or running a subprocess. Planning flags emit manual handoffs only.

Hard Safety Rules

• Require exact local archives and hashes; never fetch latest or switch

installation ownership mid-lifecycle.

• Keep non-secret and runtime-secret values separate. Reject duplicate YAML

keys, aliases, merge keys, unknown spec fields, populated secret-like non-secret fields, and unsafe runtime override paths. Until a version/hash- bound closed CSE values/questionnaire contract is supplied, keep cse_values_contract_missing open even when chart inspection succeeds.

• Never persist raw Secret bodies or unredacted Helm output. Runtime secret

leaves must independently influence only classified Secret payload fields.

• Shared CRDs must already exist and be semantically exact. Dedicated CRDs are

a handoff. Never create, patch, replace, or delete a CRD here.

• Treat hooks, migrations, operator-created claims, cluster-scoped resources,

RBAC, routing/TLS, monitoring, external services, GPU/model artifacts, and air-gap mirrors as review surfaces, not implicit approval.

• Never delete or alter namespaces, PVCs, PVs, buckets, databases, nodes,

labels, load-balancer pools, or release history.

• A syntactically valid render is not production readiness. Keep explicit gaps

such as entitled_chart_integration_unvalidated, cse_values_contract_missing, and live_readonly_integration_unvalidated open until exact artifacts and connected evidence exist.

Troubleshooting

| Symptom | Safe response | |---|---| | Bundle validation fails | Preserve the bundle and render a new one; never edit or rehash it | | Runtime inventory drifts | Review every new ID and rerender | | Shared CRD differs | Stop and coordinate with the cluster CRD owner and Galileo/CSE | | Routing, storage, data-service, monitoring, or GPU proof is incomplete | Keep the gate open in the handoff; do not convert an attestation into a pass | | An apply flag is rejected | This is expected; execute only through the reviewed Galileo/CSE joint session |

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: chambear2809
• Source: chambear2809/splunk-cisco-skills
• License: Apache-2.0

Install and usage instructions live in the source repository linked above.