Deploy and offline install

Diting ships in three profiles: standalone, performance cluster and HA cluster. All three use the same packages and the same upgrade path. What changes is replica count and resource planning.

Profiles

Profile	Fits	Scaling
Standalone	Evaluation, branch offices, edge sites	Vertical
Performance cluster	Larger host and container estates	gateway, collector and ClickHouse separately
HA cluster	Systems that cannot stop	Replicas and failover

Offline bundle

Build the bundle on a release machine. It contains image tars, dependencies, the license and a digest manifest. The entry point is ci/pack-standalone-from-spec.sh:

cd diting-deploy
bash ci/pack-standalone-from-spec.sh \
  --spec <package-spec.json> --version <version> \
  --output <dist-dir> --workspace <ws-dir>

The script validates and assembles. It does not build or push images. Image tars must already be in diting-deploy/images/, named after <image_ref> with / and : replaced by _, plus .tar.

Each tar's sha256 and config_digest are recorded in the bundle. After moving it inside the isolated network, verify the manifest before installing.

Install

The platform is deployed with the Helm chart onto k3s or standard Kubernetes. Before installing, confirm:

node clocks are synchronized
a storage class is available
images are present in the internal registry
the license file is in place

The installer reports each component. A failure stops where it happened instead of leaving half a platform running.

License

The license is an offline file verified with asymmetric signatures. Import it at install time and renew offline before expiry. The platform never contacts a vendor server.

Upgrade and rollback

Upgrade bundles use the same offline path. Key configuration is backed up before the upgrade, and a failed upgrade can return to the previous version.

Agent capture mode can be rolled back on its own. Set collectors.traces.capture.mode in /etc/diting/agent.yaml to tc_ebpf or socket_syscall and restart the agent. No binary swap needed.

Verify

kubectl -n diting get pods
kubectl -n diting get svc

Confirm core reports ready on /readyz, then open the console. Core stays NotReady while dependencies are unavailable. That is expected.