> For the complete documentation index, see [llms.txt](https://docs.collibra.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.collibra.com/platform-self-hosted/about-installation-and-upgrade-for-collibra-platform-self-hosted-expanded-capabilities/air-gapped-edge-installation-via-the-zarf-method.md). # Air-gapped Edge installation via the Zarf method {% hint style="warning" %} The Zarf package method is only supported if you have an Air-gapped Collibra Platform and environment. {% endhint %} ## Prerequisites ### On your workstation * Your server meets all system requirements. * You must have admin level access to the Kubernetes cluster where you want to install your Edge site. * If you are installing your Edge site on an OpenShift cluster, you must have the permission to create `SecurityContextConstraints` and `ClusterRoleBinding` objects, such as cluster-admin. * You have [configured the forward proxy](https://productresources.collibra.com/docs/cpsh/latest/Content/Edge/EdgeSitesInstallation/ta_configure-forward-proxy.htm), if a forward proxy is required for Edge to connect to Collibra Platform Self-Hosted. Contact your network administrator if this is applicable. ### In your CPSH environment * You are installing your Edge site on an EKS or OpenShift cluster that has [Zarf deployed](/platform-self-hosted/about-installation-and-upgrade-for-collibra-platform-self-hosted-expanded-capabilities/zarf-installation-and-upgrade-for-cpsh-extended-capabilities.md).

The AWS Load Balancer Controller is not needed.

* FIPS Mode: Collibra must be installed in FIPS mode for Air-gapped Edge installation to support required cryptographic modules. (See [Install CPSH](/platform-self-hosted/collibra-platform-self-hosted-installation-and-upgrade/collibra-platform-self-hosted-installation/install-collibra-platform-self-hosted.md) for more information.)

For Air-gapped environments, FIPS mode is mandatory to support required cryptographic algorithms.

* If you want to deploy in Edge-only mode, you must apply the `kubectl apply -f cpsh-priority-classes.yaml` and `/cpsh-platform-zarf-package/resources/cpsh-priority-classes.yaml` priority classes before proceeding. * The username and password for a Collibra user that has the following [global permissions](https://productresources.collibra.com/docs/collibra/latest/Default.htm#cshid=DOC0630). This user is used only to create, reinstall, and delete Air-gapped Edge sites. For reference purposes, we will refer to this user as the Air-gapped Edge installation user. * Install Edge sites * Manage Edge sites * Manage connections and capabilities * Upload Edge charts * View Edge connections and capabilities ## Steps {% hint style="warning" %} You can only have 1 Air-gapped Edge site per Kubernetes cluster. {% endhint %} {% stepper %} {% step %} From the [Downloads page](https://productresources.collibra.com/downloads/#collibra_platform_self_hosted), click the latest Collibra Zarf package. {% hint style="info" %} If you do not see Collibra CPSH extended capabilities please reach out to your Collibra account team. {% endhint %} {% endstep %} {% step %} From the Collibra ZARF package page, click and download the Edge Zarf package. {% endstep %} {% step %} Set up your kubeconfig or kubecontext so that it points to your Kubernetes cluster. {% endstep %} {% step %} If you don't plan to install [Technical lineage Collibra Platform Self-Hosted](/platform-self-hosted/about-installation-and-upgrade-for-collibra-platform-self-hosted-expanded-capabilities/technical-lineage-installation-and-upgrade-for-cpsh-extended-capabilities.md), apply these priority classes with `kubectl apply -f cpsh-priority-classes.yaml` and `/cpsh-platform-zarf-package/resources/cpsh-priority-classes.yaml`: ```yml apiVersion: scheduling.k8s.io/v1 kind: PriorityClass metadata: name: platform value: 10000000 description: "Platform supporting services level" --- apiVersion: scheduling.k8s.io/v1 kind: PriorityClass metadata: name: application value: 100000 description: "Application level" --- apiVersion: scheduling.k8s.io/v1 kind: PriorityClass metadata: name: job value: 1000 description: "Job level" ``` {% endstep %} {% step %} If you are using an Openshift cluster, deploy Security Context Constraints (SCC) which provide Edge service accounts with the required permissions.
How to create and install security constraints… 1. Create the SCC file, for example, edge-scc-minimal.yaml, and paste the following information into it: ```yaml apiVersion: security.openshift.io/v1 kind: SecurityContextConstraints metadata: name: edge-scc-documented allowHostDirVolumePlugin: false allowHostIPC: false allowHostNetwork: false allowHostPID: false allowHostPorts: false allowPrivilegeEscalation: false allowPrivilegedContainer: false allowedCapabilities: [] allowedUnsafeSysctls: [] defaultAddCapabilities: [] fsGroup: type: MustRunAs priority: null readOnlyRootFilesystem: true requiredDropCapabilities: [] runAsUser: type: MustRunAs uid: 1000 seLinuxContext: type: MustRunAs seLinuxOptions: level: "s0" role: "system_r" type: "container_t" user: "system_u" seccompProfiles: - 'runtime/default' supplementalGroups: type: MustRunAs # who can use it users: [] groups: [system:authenticated] ``` 2. Create the SCC-role file, for example, edge-scc-role-minimal.yaml, and paste the following information into it: ```yaml # File: edge-scc-role-minimal.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: edge-scc-minimal rules: - apiGroups: - security.openshift.io resourceNames: - edge-scc-minimal resources: - securitycontextconstraints verbs: - use --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: edge-scc-minimal subjects: - kind: Group name: system:serviceaccounts apiGroup: rbac.authorization.k8s.io roleRef: kind: Role name: edge-scc-minimal apiGroup: rbac.authorization.k8s.io ``` 3. Deploy both the SCC and SCC-role files: ```bash kubectl apply -f edge-scc-minimal.yaml kubectl apply -f edge-scc-role-minimal.yaml -n \ ```
{% endstep %} {% step %} Using the Zarf CLI: {% stepper %} {% step %} Copy and paste the following command in the Zarf CLI: ```bash zarf package deploy \ --set PLATFORM_ID= \ --set PLATFORM_USER= \ --set PLATFORM_PASSWORD= \ --set SITE_NAME= ``` {% hint style="info" %} This can be run in interactive mode by just running the first line of the command. When you run the first line of the above command, you will be prompted to enter the information individually. {% endhint %} {% endstep %} {% step %} Enter the relevant details for each installation flag. For example, enter your Collibra Platform Self-Hosted URL for ``.
Show me the Zarf flags…
FlagDescription
zarf package deploy <PATH TO ZST PACKAGE>The path Edge site Zarf package you downloaded.
--set PLATFORM_ID=<DGC URL>The URL of your Collibra Platform Self-Hosted.
--set PLATFORM_USER=<DGC ADMIN NAME>The username of your Collibra admin.
--set PLATFORM_PASSWORD=<DGC ADMIN PASSWORD>The password of your Collibra admin.
--set SITE_NAME=<SITE_NAME>

The desired name of your Edge site.

  • If you don't enter a site name, your Air-gapped Edge site is created with the default name: CPSH-Collibra-Edge.
  • If you plan to have more than 1 Air-gapped Edge site on the same Collibra Platform, ensure that each site has a unique name. If you have multiple Air-gapped Edge sites with the same name on the same Collibra Platform, your sites may fail to deploy.
--namespace <NAMESPACE>

Add this flag if you want to use a custom namespace, for example, wen you need to run multiple Air-gapped Edge sites on a single cluster. This flag specifies the Kubernetes namespace where your Air-gapped Edge site will be installed.

By default, the Edge installation packages deploys into a namespace called collibra-edge. If you don't specify a custom namespace, your Air-gapped Edge site will be installed in the collibra-edge namespace.

--set EDGE_NAMESPACE=<NAMESPACE>

Required when you use the --namespace flag. This flag sets the internal custom namespace variable used by the Air-gapped Edge site package scripts.

The value here must match the value used with the --namespace flag. Omitting one flag or using different values can cause the Air-gapped Edge site deployment to fail or behave unexpectedly.

--set OPENSHIFT_ENABLED=trueAdd this flag if you are deploying your Air-gapped Edge site on an OpenShift cluster. This enables the required Security Context Constraints (SCC) and OpenShift-specific configuration for the Edge site pods.
**Example** ```bash zarf package deploy zarf/edgefolder \ --set PLATFORM_ID=https://mycollibra.com \ --set PLATFORM_USER=EdgeUser1 \ --set PLATFORM_PASSWORD=Pass1234 \ --set SITE_NAME=EdgeSite1234 ```
{% endstep %} {% step %} Run the command to create the Edge site.\ :chevrons-right: Your Air-gapped Edge site is created and deployed. It will appear in Edge. A dedicated user account is created in Collibra Platform Self-Hosted that grants the permission to manage your Edge site. {% endstep %} {% endstepper %} {% endstep %} {% step %} Log in to Edge to add connections and capabilities to your Air-gapped Edge site. {% endstep %} {% endstepper %} ### Troubleshooting If an Air-gapped Edge site fails to install on your Kubernetes cluster, a site is still created in Edge. You can choose to do one of the following: * Remove the failed Edge site from your Kubernetes cluster and Edge by running the following command: ```bash zarf package remove ZARF_PACKAGE_FILE/ZARF_PACKAGE_NAME ``` * Remove the failed Edge site from your Kubernetes cluster, but keep the Edge site in Edge by running the following command: ```bash ZARF_VAR_KEEP_CPSH_EDGE_SITE=true \ zarf package remove ZARF_PACKAGE_FILEZARF_PACKAGE_NAME ``` When you try to install or reinstall the failed Air-gapped Edge site installation, you can use the same name to reuse the Edge site in Edge. {% hint style="info" %} If you installed your Air-gapped Edge site on a custom namespace, `zarf package remove` doesn't delete the namespace. After removing the package, you need to run the following command to manually delete the namespace: `kubectl delete namespace ` {% endhint %} ## What's next * Add [connections](https://productresources.collibra.com/docs/cpsh/latest/Content/Edge/EdgeConnections/ref_available-edge-connections.htm) and [capabilities](https://productresources.collibra.com/docs/cpsh/latest/Content/Edge/EdgeCapabilities/ref_edge-capabilities.htm) to your Air-gapped Edge site * [Backup your Air-gapped Edge site](https://productresources.collibra.com/docs/cpsh/latest/Content/Edge/EdgeSiteManagement/ta_back-up-edge-site.htm) * [Upgrade your Air-gapped Edge site](https://productresources.collibra.com/docs/cpsh/latest/Content/Edge/EdgeSitesInstallation/ta_zarf-package-upgrade.htm) * [Reinstall your Air-gapped Edge site](https://productresources.collibra.com/docs/cpsh/latest/Content/Edge/EdgeSitesInstallation/ta_reinstall-edge-site.htm) * [Delete your Air-gapped Edge site](https://productresources.collibra.com/docs/cpsh/latest/Content/Edge/EdgeSiteManagement/ta_delete-edge-site.htm)