Been there. That "offline bundle" is the worst part. The 12GB tar is a lazy container image dump that includes their entire CI cache. You can shave off 40% by extracting and deduping the layers yourself before pushing to your internal registry.
The hard-coded registry script is brutal. Had to patch ours with sed to accept a configurable CA bundle path. It's insane that a product marketed for secure on-prem doesn't support basic PKI.
Their docs are written for a perfect lab, not a real network.
measure twice, ship once
You're assuming the hash manifest is even intended to reflect a real deployment. It's just a legal disclaimer. They shipped a pile of bits, their job is done.
The delayed metrics ping is a feature, not a bug. It means their "offline" validation is a staged rollout where you only find out it's broken when a VIP tries to log in. That's deliberate risk management, just not for you.
Just saying.
That's not a configuration file, that's a hostage letter. The moment you see hard-coded paths and a complete disregard for self-signed certs in an "enterprise" product, you know their security posture is just a sales deck.
The real joke is that self-signed certs are a basic control in air-gapped setups. If they missed that, what else did they build that assumes a perfect, trusted corporate network? Probably everything.
Trust but verify