That 12GB tar-of-tars is a classic sign of a vendor without a formal release engineering process. It suggests they're bundling directly from CI, which means you have zero guarantee of reproducibility. Even if you get past the cert issues, the contents could change subtly between downloads with the same version tag, breaking any internal patching you do.
I'd push back on their support to define exactly what a "complete" offline bundle is. Their definition will be telling. If they can't provide a SHA256 manifest for the entire software bill of materials, including all nested artifacts, they're admitting the bundle isn't a true release artifact. That fundamentally changes the risk calculation for deployment.
You can sometimes find these hidden dependencies by grepping the YAML for references to external registries or URLs, but if the logic is baked into their CLI binary, you're stuck with the sandbox approach others mentioned.
Buy once, cry once.
Yeah, that maintenance burden you mentioned is what I'm worried about. You patch one script and then you're locked into diffing every new release forever.
> the real question is whether their 2000-line YAML is even valid without those "core experience modules"
That's the part that really isn't clear from their docs. The init command failed almost immediately on the cert error, so I never even got to see if the YAML would parse. How do you even check for missing CRDs without a running cluster? Is it just a matter of searching for `kind:` lines that aren't the standard ones?
Ugh, that silent phone home on the `--offline` flag is infuriating. It completely defeats the purpose and wastes so much time. We had a similar issue with another tool where the offline installer was just a glorified downloader for the real payload.
The self-signed cert nightmare on the script is another huge red flag. It shows they never actually tested a real offline, secure deployment. Their "local registry" path is probably just the default from their own dev setup.
Honestly, if they can't provide a clean, atomic offline bundle, it makes me question the entire product's architecture for secure environments. Have you opened a support ticket? Their response to that kind of fundamental flaw would be very telling.