Remote access

A cluster with no internet access can serve only what is already in its registry. The bastion agent is a small service you run on a machine that can reach the internet, such as a bastion host in a DMZ. Olympusx AI asks it to fetch model weights, package them and push them to the registry the cluster pulls from, and to copy serving runtimes into that registry. Olympusx AI watches the transfer like any other import: progress, size, time left, and a notification when it finishes.

A bastion belongs to one registered cluster. An organization with an air-gapped production network, a connected pre-production network and a DMZ has a different machine allowed to reach the internet in each, so each cluster names its own.

How it is secured

   internet              bastion host                 secure network
 ┌──────────────┐     ┌──────────────┐  push only  ┌────────────────────┐
 │ model source │◀────│ bastion agent│────────────▶│ your registry      │
 └──────────────┘     └──────────────┘             └────────────────────┘
       egress allow-list    ▲                               ▲ pull
                            │ mutual TLS, Olympusx AI dials │
                     ┌──────────────┐              ┌────────────────────┐
                     │ Olympusx AI  │              │ air-gapped cluster │
                     └──────────────┘              └────────────────────┘

Olympusx AI opens every connection. The agent answers; it never calls in. There is no path from the machine with internet access into the secure network: the traffic is outbound from the secure side.
Mutual TLS, not a shared token. One CA you control signs both ends. Olympusx AI presents a client certificate the agent requires; a connection without one is refused before a request is read. Olympusx AI verifies the agent’s certificate against the CA you give it, not against public roots.
The agent decides where from and where to. A request names a model. The agent’s own configuration names the sources it may fetch from and the one registry path it may push to. A compromised control plane cannot turn the bastion into a machine that fetches from anywhere and pushes anywhere.
The registry credential on the bastion is push-only, scoped to one repository path. It is the only credential on that host that reaches into the secure network.

Install the agent

The bastion agent ships with each release as a static binary and a systemd unit. It is not part of the platform’s installation in the cluster.

Prerequisites

A Linux host that can reach the model source (Hugging Face, or your mirror of it) and push to your registry.
Rootless podman for the olympus user, or the ability to run the agent’s packaging step without containers (see the end of this section).
Disk for the largest model you will import, twice over: weights are staged, then layered. A 70B-parameter model needs about 300 GB of headroom.
A CA, and certificates for both ends.

Steps

Create the user and directories.

sudo useradd --system --home /var/lib/olympus-bastion-agent olympus
sudo mkdir -p /etc/olympus/pki /var/lib/olympus-bastion-agent
sudo chown olympus:olympus /var/lib/olympus-bastion-agent

Let the user run containers. Give it a range of subordinate ids no other user in /etc/subuid uses, and a cgroup manager that needs no login session:

sudo usermod --add-subuids 200000-265535 --add-subgids 200000-265535 olympus
sudo -u olympus mkdir -p /var/lib/olympus-bastion-agent/.config/containers
printf '[engine]\ncgroup_manager = "cgroupfs"\nevents_logger = "file"\n' |
  sudo -u olympus tee /var/lib/olympus-bastion-agent/.config/containers/containers.conf

Without the id range, every pull fails with “potentially insufficient UIDs or GIDs available in user namespace”.

Install the binary and the unit.

sudo install -m 0755 olympus-bastion-agent /usr/local/bin/
sudo install -m 0644 olympus-bastion-agent.service /etc/systemd/system/

Issue the certificates. Olympusx AI is the client and the agent is the server; one CA signs both. Put the address Olympusx AI will dial in the agent certificate’s subject alternative names.

Write the configuration at /etc/olympus/bastion-agent.yaml, owned by root and readable by the olympus group:

# The INTERNAL interface. The agent refuses to start on 0.0.0.0.
listen: 10.0.0.5:8443

tls:
  certFile: /etc/olympus/pki/agent.crt
  keyFile: /etc/olympus/pki/agent.key
  # Only clients with a certificate from this CA get in.
  # Without it the agent refuses to start.
  clientCAFile: /etc/olympus/pki/olympus-ca.crt

allowedSources:
  - huggingface

# Imports are pushed under this path, never one a request names.
registryPrefix: <registry>/olympus-models
registryAuthFile: /etc/olympus/registry-auth.json # push-only
registryInsecure: false

# The packaging image the in-cluster importer also runs.
# Mirror it into your registry and pin its digest.
importImage: <registry>/olympus-model-import@sha256:<digest>
runtime: podman
workDir: /var/lib/olympus-bastion-agent

# For gated repositories: a file, read once at start-up.
# hfTokenFile: /etc/olympus/hf-token

Scope the registry credential in registryAuthFile, a container registry auth file, to push-only on the registryPrefix path.

Start it, and check it can run a container.

sudo systemctl enable --now olympus-bastion-agent
sudo -u olympus env XDG_RUNTIME_DIR=/run/olympus-bastion-agent \
  podman run --rm <importImage> true && echo containers-ok

Firewall the port so only the Olympusx AI cluster’s egress addresses reach it. The client certificate is the boundary; the firewall is the second lock.

The unit keeps the agent away from the rest of the host, with a read-only system and one writable path. It cannot set the options that forbid new privileges, because rootless podman needs them; the unit file says which option fails how.

For a host that cannot run containers at all, the agent can run the packaging step as a child process instead (nativeCommand). A crash then takes a running import with it, and image copies are not available. Use it only if you must.

Verify the boundary

From a machine holding Olympusx AI’s client certificate:

curl --cacert olympus-ca.crt --cert olympus.crt --key olympus.key \
  https://10.0.0.5:8443/healthz

Then confirm the same request without the client certificate fails:

curl --cacert olympus-ca.crt https://10.0.0.5:8443/healthz

If the second request succeeds, the agent is not enforcing mutual TLS and must not stay running.

Attach a bastion to a cluster

Open Platform › Infrastructure › Clusters, the cluster, and the Internet access tab. Under Bastion agent, select Attach a bastion.
Address: where Olympusx AI dials the agent, such as https://bastion.internal:8443. https:// only, with a port unless it is 443. The address must be in the agent certificate’s subject alternative names. Select Next.
Certificates:
- Client certificate (PEM): the certificate Olympusx AI presents to the agent.
- Client key (PEM): its unencrypted private key. Stored encrypted and never shown again, so it is asked for every time you save.
- CA certificate (PEM): the CA that signed the agent’s certificate.
Paste each whole block, BEGIN and END lines included. A private key pasted into a certificate field is refused. Select Next.
Test and review: select Test connection. The agent answered means mutual TLS succeeded in both directions. Then save with Attach a bastion. Nothing is stored until you save.

A failed test names what failed. Use it: a certificate signed by the wrong CA, an agent certificate whose names miss the address, and a firewall dropping the port otherwise all look the same, as an import that fails hours later.

Replace bastion replaces the address, both certificates and the key together. Detach removes them; imports already running through the bastion do not finish.

What the bastion does for the cluster

Import model weights

With a bastion attached, Import a model on the Model registry offers Its bastion agent — a machine outside the cluster for this cluster. For a cluster declared air-gapped it is the only choice. Asking for a model already being fetched attaches to the running import instead of starting a second download.

A restart of the agent loses nothing: each import runs as a detached container that carries its own state, and the next poll finds it still going.

Copying runtime images

With imageRegistryPrefix set, the agent copies a serving runtime into the cluster’s registry by digest, streaming registry to registry with nothing written to its disk. Olympusx AI then reads the digest back from the registry before it records the copy. Select Copy through the bastion on the runtime’s Availability tab: see Runtimes.

# Must be the registry the cluster names on its Registry tab.
imageRegistryPrefix: <registry>/olympus
imageRegistryInsecure: false
# Repository prefixes images may be copied from.
imageSources:
  - <upstream-registry>/<project>/
# Push-only, separate from registryAuthFile.
imageRegistryAuthFile: /etc/olympus/image-registry-auth.json

A source outside imageSources, or not pinned by digest, is refused. A copy to a prefix other than the cluster’s registry is refused by Olympusx AI.

Browsing models from inside the secure network

With browseEnabled: true, the agent answers the console’s model search, model cards and model configurations from Hugging Face (or the mirror in hfUpstream). Only those three read-only requests are forwarded; weights and everything else are refused. It is off by default, because it is the one thing the agent fetches on demand.

Checking for new runtime versions

releaseRepos lists the upstream repositories whose release lists the console may read through the agent, for checking runtime versions. Only those repositories’ release lists are fetched.

When it fails

Symptom	Cause
The agent exits at start: the client CA file is missing	No boundary configured. It refuses rather than accept everyone.
The agent exits at start: it binds every interface	`listen` is `0.0.0.0`. Name the internal address.
`403 source_not_allowed`	The request named a source not in `allowedSources`.
Import fails with a Hugging Face `401`	A gated repository with no `hfTokenFile`, or a token without access.
Import fails on push	The registry credential is missing, expired, or not scoped to `registryPrefix`.
Import fails with “no space left”	`workDir` is too small; it holds the model twice.
The agent did not answer in the console	Wrong CA, an address missing from the agent certificate’s names, or a firewall.

The agent’s log names the client certificate’s subject on every request, which identifies the caller.