Upgrade an air-gapped install

curl -fsSL https://charts.xpander.ai/image_sync.sh -o image_sync.sh
curl -fsSL https://github.com/xpander-ai/releases/releases/download/v2026.10.22/release-manifest.json -o release-manifest.json

bash image_sync.sh --source-user xpanderaihub --source-token <xpander-token> \
  --dest <your-registry> --release-manifest release-manifest.json --manifest-out pins.yaml

helm registry login registry-1.docker.io -u xpanderaihub -p <xpander-token>
helm upgrade xpander oci://registry-1.docker.io/xpanderaihub/xpander-airgap --version 0.17.2 \
  -n <namespace> --reset-then-reuse-values -f pins.yaml --wait --timeout 30m

global:
  upgradeStrategy: replace                  # in-place recreation; surge upgrades cascade into node waves on autoscaled clusters
  imageRegistry: <registry>/<mirror path>   # every image is pulled from the mirror
  license:
    secretName: xpander-license
  smtp:                                     # one block feeds sign-in mail, invitations and xpander's notifications
    host: email-smtp.<region>.amazonaws.com
    port: 587
    starttls: true
    user: <smtp user>
    passwordSecret: { name: xpander-smtp, key: password }
    adminEmail: admin@<domain>
    senderName: xpander
  assetStore: { publicUrl: https://auth.<domain> }
  shortLinks: { publicUrl: https://links.<domain> }
  # mcp.publicUrl unset: Platform > Agents > Channels shows the MCP row as "Not offered on this install" until you set it
  llm:
    defaults: { provider: amazon_bedrock, model: global.anthropic.claude-sonnet-5, apiBase: "", credentialsKey: "" }
    bedrock: { region: us-west-2 }          # may differ from the cluster's region
    gateway: { provider: amazon_bedrock, model: global.anthropic.claude-sonnet-4-6 }
  harness:
    defaultProviders: { claudeCode: amazon_bedrock }
    defaultModels: { claudeCode: global.anthropic.claude-sonnet-5 }
  fleet:
    replicas: 1
    storage: { createClass: true, provisioner: ebs.csi.eks.amazonaws.com }
  network:
    internalFetchAllowlist: [".internal.<domain>"]   # intranet hosts agents may fetch for knowledge ingest
  redis: { endpoint: <clustercfg endpoint>, clusterMode: true, auth: { username: <acl user> } }
redis: { mode: external }
postgres: { mode: external, external: { host: <rds host>, port: 5432 } }
supabase:
  ingress: { enabled: true, className: alb, host: auth.<domain> }
  auth: { apiExternalUrl: https://auth.<domain>, siteUrl: https://app.<domain> }
  storage:
    persistence: { size: 100Gi }
    publicUrl: https://auth.<domain>
  edgeRuntime:
    publicUrl: https://auth.<domain>
    functionsEnv:
      APP_URL: https://app.<domain>
      INBOUND_GW_URL: https://hooks.<domain>
      AGENT_CONTAINER_INGRESS_DOMAIN: <domain>
      DEPLOYMENT_MANAGER_PUBLIC_URL: https://dm.internal.<domain>
ui:
  ingress: { host: app.<domain>, className: alb }
  authProviders: [sso]
  env:
    VITE_WEBHOOK_URL: https://hooks.<domain>     # the app's baked default is the cloud host
    VITE_EMAIL_DOMAIN: agents.<domain>
    VITE_PLATFORM_URL: https://app.<domain>
    VITE_SUPABASE_URL: https://auth.<domain>
    VITE_AGENTS_API_URL: https://api.<domain>
    VITE_CHAT_BACKEND_URL: https://chat.<domain>/chat-backend/{agent_id}
    VITE_ACTIONS_SERVICE_URL: https://actions.<domain>
    VITE_CLIENT_AUTH_URL: https://client-auth.<domain>
    VITE_LICENSE_MODE: "true"
    VITE_OMNI_MCP_URL: ""
  extraEnv:
    - name: VITE_SUPABASE_ANON_KEY
      valueFrom: { secretKeyRef: { name: xpander-generated-keys, key: SUPABASE_ANON_KEY } }
client-auth: { ingress: { host: client-auth.<domain> }, env: { APP_URL: https://app.<domain>, CLIENT_AUTH_EXTERNAL_URL: https://client-auth.<domain> } }   # the second turns on MCP OAuth
api:
  ingress: { host: api.<domain> }
  env: { API_URL: https://api.<domain>, INBOUND_EMAIL_REPLY_DOMAIN: agents.<domain>, SMTP_HOST: <smtp host>, SMTP_PORT: "587", SMTP_STARTTLS: "true", SMTP_USERNAME: <smtp user> }
  extraEnv:
    - { name: SMTP_PASSWORD, valueFrom: { secretKeyRef: { name: xpander-smtp, key: password } } }
    - { name: INBOUND_EMAIL_TOKEN, valueFrom: { secretKeyRef: { name: xpander-inbound-mail, key: token } } }
    - { name: MAILGUN_SIGNING_KEY, valueFrom: { secretKeyRef: { name: xpander-inbound-mail, key: signing-key } } }
agent-controller: { ingress: { host: chat.<domain> } }   # API clients on this host add /<organization id> to the base URL
webhook: { ingress: { host: hooks.<domain> } }
functions: { ingress: { host: links.<domain> } }
deployment-manager: { ingress: { host: dm.internal.<domain>, className: alb-internal } }
actions:
  ingress: { host: actions.<domain> }
  env: { XPANDER_SANDBOX_DNS: <CoreDNS ClusterIP> }
catalog: { env: { OAS_GEN_BUCKET_NAME: <versioned bucket>, AWS_DEFAULT_REGION: <region> } }
openapi-spec-generator: { env: { OAS_GEN_BUCKET_NAME: <versioned bucket>, AWS_DEFAULT_REGION: <region> } }

pipeline {
  agent { label 'xpander-admin' }        // has kubectl access to the cluster
  triggers { cron('H 6 * * 1') }         // or trigger from releases.atom
  environment {
    XPANDER_PULL = credentials('xpander-pull-token')  // username: xpanderaihub, password: the read token
    XPANDER_ORG  = credentials('xpander-org-id')      // the organization id from the license handoff
  }
  stages {
    stage('Mirror the release') {
      steps {
        sh '''
          curl -fsSLO https://charts.xpander.ai/image_sync.sh
          curl -fsSL https://github.com/xpander-ai/releases/releases/download/latest/release-manifest.json -o release-manifest.json
          bash image_sync.sh --source docker.io/xpanderaihub \
            --dest registry.corp.example:5000/xpander \
            --release-manifest ./release-manifest.json \
            --source-user "$XPANDER_PULL_USR" --source-token "$XPANDER_PULL_PSW"
        '''
      }
    }
    stage('Upgrade and verify') {
      steps {
        sh '''
          curl -fsSL https://charts.xpander.ai/install.sh -o install.sh
          bash install.sh --non-interactive --quiet --edition airgap \
            --org "$XPANDER_ORG" --install-license-file install.json --activation-license-file activation.json \
            --registry registry.corp.example:5000/xpander --mirror skip \
            --release-manifest ./release-manifest.json --values values.yaml \
            --helm-timeout 20m
          bash install.sh status --quiet
        '''
      }
    }
  }
}

helm upgrade --install xpander ./xpander-airgap-<X.Y.Z>.tgz \
  --namespace xpander --create-namespace \
  -f xpander/values.yaml -f xpander/values.yaml.release.json

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: xpander
  namespace: argocd
spec:
  project: default
  destination:
    server: https://kubernetes.default.svc
    namespace: xpander
  sources:
    - repoURL: registry.corp.example:5000/xpander/charts   # OCI repo credential with "Enable OCI"
      chart: xpander-airgap
      targetRevision: <the chart version you mirrored>     # keep it in step with the release values
      helm:
        valueFiles:
          - $values/xpander/values.yaml           # generated once: install.sh --values-out
          - $values/xpander/values.yaml.release.json  # generated release image pins, applied last
    - repoURL: https://git.corp.example/platform/xpander-config.git
      targetRevision: main
      ref: values
  syncPolicy:
    syncOptions:
      - CreateNamespace=true