Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

Deployment (Zarf)

Airgap-ready packaging per the cyberphy laws — CLOSURE, CONSERVATION, RECONCILIATION, PARTIAL ROLLOUT:

  • Everything the deploy needs is declared once in zarf/artifacts.manifest.json and verified at build time by zarf/scripts/check-closure.py (just zarf-build) — nothing is discovered missing inside the air gap.
  • SBOMs are required. Never pass --skip-sbom; the closure gate asserts the SBOM entry in the built package. This is a deliberate raise over the older repos (aegir skips SBOMs; cyberphy generates but never asserts).
  • Realized *.closure.json files are committed per release as provenance.
  • Size budget: 2 GiB hard (GitHub release asset limit), warn at 1.75 GiB.

Deployment modalities follow the house taxonomy — laptop (k3d + Tilt) → workstation (RKE2) → airgap — with policy/k8s/<modality>/ gating each as it lands.

Open item: cosign/GPG signing (the whole constellation is SHA256SUMS-only today).