Runbooks & operations guides

Install

• Install with ArgoCD

  The supported path, and the only one we build and test against: your own registry, your own git repo as the source of truth, and ArgoCD's selfHeal keeping the platform converged on it. Covers the OCI credential and the APISIX-CRD step that otherwise blocks a first sync. (Bundled OpenCost is off by default and does not block a sync.)

Upgrades & releases

• Upgrading an existing install

  Pull and genesis verify the new bundles, deploy the ops bundle first — always, not only when release notes call out ops-side changes (an older deploy operator rejects any config key a newer release added), then submit a GenesisUpgrade CR. Every upgrade emits a fresh translator overlay (never Helm --reuse-values) and produces a helm-diff preview plus a HIPAA audit PDF for you to review before approving. The Install guide carries the same flow inline; the full runbook ships as upgrade.md in your distribution.

• Never retag — cut a new version

  A published version is immutable. To fix a bad release, cut the next monotonic vX.Y.Z+1 and yank the old one from the portal admin UI (Releases → Yank). Retagging serves stale Zarf-cached bytes — yanking blocks new pulls without disturbing installs already running the version.

Operations guides (shipped with your distribution)

The online phase — prerequisites, install, secrets and configuration — is documented on this portal: see Install with ArgoCD, Prerequisites, Secrets management, and Platform values. Read these while your gap-host still has internet.

The full cluster-side reference guides (deploy, configure, preflight, operate, troubleshoot, upgrade) ship with your distribution. genesis pull <version> lands them on your gap-host as markdown under ./docs/customer/, next to your bundles — available offline, no internet access required. Open the local copies once you've crossed the gap:

• ops-overview.md — the toolkit map

  What every component is (Bastion, deploy operator, preflight, health agent, workflow smoke, Vin Agent, genesis doctor), how each runs, and when to use it.

• troubleshooting.md — when something breaks

  Run genesis doctor first — one verdict with the exact fix. Covers the common first-install snags and how to hand Autonomize a redacted support bundle for remote diagnosis.

• runbook-argocd.md — the golden runbook

  The full, tested, top-to-bottom install runbook, expanding on the install page above.