Overview
What is Cerebellum?
Cerebellum is the enterprise version of the Gen0Sec platform that you can host in your own Kubernetes cluster.
Charts
| Installation order | Chart | Namespace | What it installs |
|---|---|---|---|
| 1. | gen0sec-infra | gen0sec-system | Three operators (Postgres, Kafka, ingress), the object store, and two caches: one shared by the application, one for the ingress data plane |
| 2. | gen0sec-data | gen0sec-system | The Postgres cluster, the Kafka cluster, topics and database roles |
| 3. | gen0sec-platform | gen0sec | Schema migrations, then the application services and the dashboard |
The installation order is mandatory, as each chart creates resources the next one depends on.
Installation methods
Installation from registry (Recommended)
Choose it when,
- your cluster can access our registry,
- you don't mind depending on an external registry
Install via creating an offline bundle
Choose it when,
- your cluster don't have access to our registry,
- you'd rather host mirrored images yourself,
- you're facing issues pulling images from our registry
Worry not, the offline bundle builds the same release and installs the same charts.
If you are unsure, go with Install from registry. You can always switch later.
Our registry challenges pulls that arrive with no User-Agent, and on some Kubernetes distributions the
kubelet's pull path sends none. That is deliberate policy on our side, and the result is a 403 the
kubelet cannot recover from.
If you cannot change container runtime configuration on your nodes, use Create an offline bundle. Your own registry does not inspect user agents. See Known limitations.
You will need to decide the installation method in the Prepare the artifacts step.
Connectivity
The 'offline' part in the offline bundler is used to describe the installation method, not the resulting product.
It's important to note that even by creating an offline bundle, doesn't mean you can operate the platform in an airgapped cluster that is entirely isolated from reaching the public internet.
Cerebellum needs exactly one outbound destination from your cluster:
api.gen0sec.comon port443.
That single connection carries threat intelligence, GeoIP databases, ML models and IDS rules. All four are licensed by their upstream providers and are not included in any of the artifacts we ship.
Every agent in your fleet reaches it through one in-cluster service, so it is one destination to allow and one to audit. Nothing else in either namespace has a route out.
Read Network and connectivity before you start. It is the page to send to whoever runs your firewall.
How long it takes
Set aside half a day for a first install, and about an hour once you have done one. The install is 26 numbered steps across five pages, and most of the elapsed time is spent waiting on image pulls and on two clusters becoming ready, not on typing.
The waits are gated explicitly, so the ceiling is knowable. These are the timeouts the commands themselves carry — the upper bound before a step is treated as failed, not a prediction:
| Stage | You are waiting on | Gate |
|---|---|---|
| Prepare the artifacts | Downloads and signature verification. From the registry this is minutes; building an offline bundle copies every image and is the longest single stage | None |
| Install infra | Three operators and the object store | None |
| Install data | Kafka ready, then Postgres Running | 15m each |
| Install platform | Schema migrations, then every pod ready | 20m + 10m |
| Publish | The ingress rollout | 20m |
| First sign-in | You: MFA enrolment, a forced password change, the onboarding wizard | None |
| Verify | Four checks you run | None |
What actually decides your number is how fast your nodes pull images. Everything else is bounded by the table above.
It is the same procedure with one extra values file per chart, on one node. It is quicker because a single-node cluster pulls and schedules less — not because it skips steps.
Before you install
- Requirements. Cluster, tools, and your access token.
- Network and connectivity. What to allow, and why.
- Prepare the artifacts. Prepare for the installation.
If you want a working instance to look at before you plan a real install, use the Quickstart. It builds a throwaway single-node install and tears it down again.