Skip to content

IVAAP All in one Binary

The ivaap binary is the single, self-contained executable that ships with the IVAAP SDC deployment package. It carries the Helm chart, container images, database seed, and supporting helpers inside the binary itself — no external downloads or scripts to manage. This page is a reference for the binary's subcommands, grouped by where they fit in the deployment lifecycle.

For a step-by-step first install, see Single-Node K3s Installation Guide or Multi-Node Kubernetes Installation Guide. For TLS, authentication, and connector activation after install, see Post-Deployment Advanced Configuration.

Overview

A single ivaap binary performs every supported deployment workflow:

  • Single-node k3s — ivaap install provisions k3s, loads images, prepares storage, deploys the chart, and seeds the database on the local host.
  • Bring-your-own Kubernetes — ivaap retag-images and ivaap generate-yaml produce the artifacts you push to an existing cluster (EKS, AKS, OpenShift, on-prem k8s).
  • Day-2 operations — TLS configuration, connector enable/disable, upgrade-in-place, and uninstall all run from the same binary.

Installer state lives under /opt/ivaap/.installer/ and survives partial failures. Resumes and rollbacks are first-class — a failed step does not require starting over.

Subcommand reference

Subcommands are grouped by lifecycle phase. Use ivaap <subcommand> --help for the authoritative flag list on the build you have installed.

Pre-deploy and setup

Subcommand Purpose
ivaap activate [path] Register the unzipped package on the system PATH. Creates /opt/ivaap/bin/ivaap as a symlink to the unzipped binary and drops /etc/profile.d/ivaap.sh so new shells find ivaap without absolute paths.
ivaap preflight Run CPU, RAM, disk, and WSL checks against the host without making any changes. Use to confirm a host is sized correctly before scheduling an install window.
ivaap license-check Probe a FlexNet license server (host + port) and report which IVAAP features are entitled. Same probe ivaap install runs interactively.
ivaap retag-images Load the bundled container images, retag them for a target registry, and (optionally) push. Required for bring-your-own Kubernetes deployments.
ivaap generate-yaml Produce ivaap.values.yaml for a bring-your-own cluster. Walks through license, FQDN, image registry, and connector selection without deploying.

Install and deploy

Subcommand Purpose
ivaap install Full guided deployment on the local host using embedded k3s. Walks through preflight, license probe, FQDN selection, image load, Helm deploy, and health checks.
ivaap install --resume Continue a previously failed install from the last successful step. State is read from /opt/ivaap/.installer/state.json.
ivaap install --rollback-to=<step_id> Roll back to a named checkpoint and re-run from there. See State and recovery for the destructive checkpoints that additionally require --accept-data-loss.
ivaap install --upgrade Upgrade an existing installer-managed deployment (2026.1 minimum) to the version carried by the current binary. See Upgrade with IVAAP Binary. Refuses identical version + payload unless --reapply.
ivaap install --upgrade --skip-backup Skip mandatory pre-upgrade pg_dump (dangerous).
ivaap install --upgrade --accept-unsupported-upgrade Allow upgrade paths beyond N-1 major version policy.
ivaap install --upgrade --reapply Force a full upgrade DAG re-run when version and payload are unchanged.

Post-deploy and day-2

Subcommand Purpose
ivaap tls setup Interactive TLS configuration. Supports bring-your-own certificate, automatic self-signed, and Let's Encrypt (HTTP-01 challenge).
ivaap tls status Show the current TLS mode, secret state, and expiry information.
ivaap tls update-cert Replace certificate material on an existing bring-your-own TLS deployment without re-running setup.
ivaap tls renew Trigger renewal of an existing Let's Encrypt certificate.
ivaap tls disable Revert to HTTP bootstrap. Not recommended outside lab environments.
ivaap nodes List licensed datanodes and which are currently deployed. Useful before enable or disable.
ivaap enable <node> Activate a licensed but currently-disabled datanode. Re-probes the license server, imports the connector image, updates the deployment YAML, and runs a Helm upgrade with automatic rollback on failure.
ivaap disable <node> Deactivate a datanode. Removes the connector from the active deployment and stages it under /opt/ivaap/connectors/disabled/.
ivaap docs start Serve the bundled IVAAP documentation site locally.
ivaap docs stop Stop the local documentation server.

Diagnostics

Subcommand Purpose
ivaap status Print install state, last completed step, and resume hints. First command to run when an install fails or after a host reboot.
ivaap manifest List the contents of the embedded payload (chart, images, seed, helpers) without extracting anything.
ivaap extract-payload --dest <dir> Extract the full embedded payload to a directory. Useful for offline inspection or to feed BYO-cluster pipelines.
ivaap extract-file <name> <dest> Extract a single file from the embedded payload by name.
ivaap version / ivaap -v Print IVAAP version, Helm chart commit, and package name. Include this output in support tickets.

Decoding ivaap -v

The ivaap -v (or ivaap version) subcommand prints the full version string and the underlying chart commit baked into the binary:

$ ivaap -v
ivaap local (built 2026-06-10T12:45:13Z, commit 17b1510)
  IVAAP version:        2026.1.0-rc.1
  Helm template commit: c4e456a
  Package name:         2026.1.0-rc.1_IVAAPHelmTemplate_2026-06-07-476858
Field What it identifies
IVAAP version The major.minor.patch[-x] of the bundled IVAAP application + chart.
Helm template commit The exact commit of IVAAPHelmTemplate baked into the binary.
Package name The full SDC package identifier including the chart template snapshot date.

Include this output in any SLB support ticket — it uniquely identifies the build the customer is running.

Teardown

Subcommand Purpose
ivaap uninstall Remove a previous IVAAP deployment. Runs Helm uninstall, deletes the ivaap and ivaap-postgres namespaces, removes /opt/ivaap, and strips the FQDN from /etc/hosts. Destroys all IVAAP data on the host.

State and recovery

Every ivaap install step records its outcome to /opt/ivaap/.installer/state.json under an exclusive file lock. The runner writes atomically, so a crashed or interrupted install leaves a valid state file behind.

When a step fails, the installer prints recovery options:

  1. Resume — fix the underlying issue, then ivaap install --resume. The runner picks up at the failed step.
  2. Rollback and retry — ivaap install --resume --rollback-to=<step_id> walks the rollback handlers for steps from <step_id> forward, then re-runs from <step_id>.
  3. Full wipe — ivaap uninstall && ivaap install if the host is unrecoverable. Destroys all data.

Some rollback targets touch persistent data: postgres, namespace, secrets, and helm_deploy. Rolling back to one of these checkpoints additionally requires --accept-data-loss to confirm you understand the data will be removed.

ivaap status prints the current state, the last completed step, and the next resume command without modifying anything.