Outpost

An Outpost is a worker-only Teleskope deployment that runs inside your network and scans data sources your Teleskope environment cannot reach directly, such as on-premise SQL databases and SMB file shares. This page covers what runs where, host and network requirements, and how to install and update the Outpost bundle.

How It Works

The Outpost runs Teleskope's crawler and scanner workers on a single VM you provide, on k3s (a lightweight Kubernetes distribution) installed by the bundle. It connects outbound to your Teleskope environment to receive work and report results.

• File contents never leave your network. Workers read and classify data locally; only classification results and metadata are sent to your Teleskope environment.

• All connections are outbound from the Outpost. Teleskope requires no inbound access to your network.

• Container images ship inside the install bundle. The VM needs no access to a container registry.

Prerequisites

• A dedicated VM running Ubuntu 22.04 LTS with root access

• 4 vCPU and 16 GB RAM minimum (32 GB recommended), 100 GB disk

• Outbound network access per the table below

• An install bundle URL from your Teleskope team (a time-limited download link)

Network Requirements

All connections are outbound. No inbound rules are required.

Destination	Port	Purpose
api.metadata.<your-env>.teleskope.ai	443	Work coordination and result reporting
sqs.<region>.amazonaws.com	443	Job queueing
secretsmanager.<region>.amazonaws.com	443	Connector credential retrieval
Bundle download URL host	443	One-time bundle download
processing.<your-env>.teleskope.ai	6380	ML classification, when enabled for your deployment
Your file servers	445	SMB file share scanning
Your database servers	Database port	On-premise SQL scanning

Your Teleskope team confirms the exact hostnames, region, and ports for your deployment before install.

Warning: The installer downloads public packages over HTTPS while it runs, so general outbound access on port 443 must be open during installation. After install completes, egress can be restricted to the destinations above.

Install

1. Download the bundle. Single-quote the URL — it contains & characters that break the shell otherwise:

   curl -o teleskope-k3s.tar '<bundle-url>'

2. Extract the bundle:

   tar xf teleskope-k3s.tar && cd teleskope-k3s

3. Run the installer with the flags your Teleskope team provides:

   sudo ./install-k3s.sh --no-gpu

   The installer sets up k3s, imports the bundled container images, and starts the Teleskope workers.

4. Verify the node and workers are up:

   systemctl status k3s
   sudo k3s kubectl get pods -n teleskope

   All pods reach Running within a few minutes.

Update

Teleskope provides a new bundle URL for each update. On the Outpost VM:

sudo ./update.sh '<new-bundle-url>'

Updates replace container images and configuration. Scan state and connector credentials live in your Teleskope environment and are unaffected.

Troubleshooting

Symptom	Cause and fix
k3s node not Ready	Check systemctl status k3s and journalctl -u k3s -f.
x509: certificate signed by unknown authority	Install CA certificates: sudo apt-get install -y ca-certificates.
dial tcp ...:445: i/o timeout in worker logs	The VM cannot reach the file server. Check firewall rules between the Outpost VM and the target.
Pods stuck in CrashLoopBackOff	Usually a bundle configuration issue. Contact your Teleskope team.

For anything else, reach out to your Teleskope rep or email [e-mail].