[Digvijay (Digvijay)]

Summary

Adds a new sovereign industrial edge AI MicroHack: "Air-Gapped Agentic AI: Orchestrating Local SLMs and IoT on Edge Kubernetes" under 03-Azure/01-04-AI/09_Air_Gapped_Agentic_Edge_AI.

What Participants Build Across 5 Progressive Challenges

#	Challenge	Core Technology	Deliverable
01	Sovereign Edge Foundation	Ubuntu 24.04 + K3s (v1.33.13+k3s2) + Azure Arc (connectedk8s)	An Arc-connected Kubernetes cluster with OIDC Issuer, Workload Identity, Custom Locations, and kernel inotify tuning
02	Unified Edge IoT Data Plane	Azure IoT Operations (Microsoft.IoTOperations v1.4.112)	Native MQTT Broker (aio-broker-internal) + CNC Telemetry Simulator + an AIO Dataflow (cnc-anomaly-router) filtering anomalies to factory/line1/anomalies
03	Local CPU SLM Serving	Foundry Local (Microsoft.Foundry) + Gateway API + Istio	Locally cached Phi-4-mini-instruct-generic-cpu:5 ONNX INT4 model served at an internal Istio Gateway /v1/chat/completions endpoint
04	Zero-Cloud SAT Auth & Edge Agent	Kubernetes Service Account Tokens (SAT) + Local SOP ConfigMap	Autonomous Edge Agent pod authenticating locally (audience: foundry-local), reasoning against SOP-CNC-042, and throttling PLC spindle RPM
05	"Cut the Cord" Air-Gap Mode	Kubernetes NetworkPolicy + Critical Fault Injector	Verified sub-8-second emergency safety interlock (-60% RPM, SAFE_HOLD) while public internet and Azure cloud egress are blocked

Included Artifacts

• Overview & Architecture (Readme.md): Architecture diagrams, sequence diagrams, scenario overview, and facilitator guidance from live Azure validation.
• 5 Challenges & 5 Step-by-Step Solutions (challenges/, walkthrough/): Complete with live Azure Portal screenshots, live Azure Bastion terminal outputs, parameter reference tables, common stumbles, and grounding questions/answers.
• Infrastructure & Lab Automation (resources/infra/, labautomation/): Bicep template (main.bicep), cloud-init-k3s.yaml (with pre-cached container images & wheels for air-gap resilience), and Hackbox deploy-lab.ps1 / shared-deploy-lab.ps1 / lab-defaults.json.
• Prebuilt Kubernetes Workloads & Automated Validation (resources/manifests/, resources/src/, resources/tests/): Ready-to-apply manifests plus offline & live E2E validation scripts (Invoke-E2ELabValidation.ps1, test-local-simulation.py, run-challenges-e2e.sh).

cc Marco Weber (@qxsch)

[Digvijay (Digvijay)]

Hi Marco Weber (@qxsch)!

I developed a new hack for Swedish customers now but i believe this can be a very reusable hack across all geographies where we have big Industrial/Manufacturing/Automotive customers.

Please review!

/Digvijay