Update an Air-Gapped Install

Updates to an air-gapped deployment always start back on the internet-connected prep host: re-download, re-bundle, re-transfer, re-import. There is no data-only bundle — every bundle carries the platform packages for its version, and the target skips anything it already has on import.

Application updates (new platform version)

On the prep host:

manifest-installer download --version <new-version>
manifest-installer export-bundle --version <new-version>

Transfer the tarball and verify its checksum as in Set Up the Target Host. Then, on the target host:

1. Take an instance snapshot of the target host. The installer does not back up the cluster for you — recovery from a failed upgrade is the snapshot you take here (VM snapshot, EBS snapshot, hypervisor snapshot, whatever your platform provides).

2. Apply the update:

   Shell

   manifest-installer import-bundle /path/to/manifest-self-hosted-<new-version>-<YYYYMMDD>.tar
   manifest-installer deploy --version <new-version>

3. If the bundle carried vulnerability data (built with export-bundle --include-data), load it — deploy does not:

   Shell

   manifest-installer deploy-data

   Data updates below covers what this deploys and how to follow its progress.

When the requested version is newer than what's installed, deploy confirms interactively before applying it. Pass --yes to skip the confirmation for unattended runs, but only when a wrapper around deploy takes the snapshot from step 1.

• Re-running setup is only needed if the new version's config schema has changed. Release notes will call this out when applicable.
• If the upgrade fails partway, restore the host from the instance snapshot you took in step 1, then contact support if needed. There is no manifest-installer rollback command.
• Downgrades are refused. Restore from your pre-upgrade snapshot instead, or contact support for an assisted downgrade.

Data updates

In an air-gapped deployment, vulnerability data (NVD, OSV, KEV, EPSS) does not refresh automatically — it must be carried across the air gap on a periodic basis. On the prep host, pull only what's new since your last sync, then bundle it:

manifest-installer download-data --since <YYYYMMDD>
manifest-installer export-bundle --include-data

export-bundle has no date flag: --include-data bundles exactly what your most recent download-data run selected, so control coverage with --since. See Build the Air-Gap Bundle for the full reference.

Transfer the tarball, verify its checksum, and import-bundle it on the target as in Set Up the Target Host. Then load the imported data into the running platform:

manifest-installer deploy-data

deploy-data reads what the cluster already has and deploys only the newer packages, oldest-first. Each package's in-cluster load can take up to 3 hours; the command waits for completion. Re-running resumes where a previous run stopped.

deploy-data logs each package as it starts and finishes, and nothing in between. To watch a load progress, follow the loader Job's logs from a second shell:

kubectl logs -f job/vuln-loader -n job

Each package's deploy replaces the vuln-loader Job, so this follows the package currently loading and exits when that package's pod finishes — run it again for the next package.

❗️

import-bundle does not load the data

Importing only stages the data packages on the target's disk. Until deploy-data runs, the platform keeps matching against the data from your last load — there is no error to indicate the step was missed.

For recommended update cadence and data-export procedures, contact Manifest support at [email protected].