Guide
Air-gapped Kubernetes: running clusters with no internet.
Kubernetes assumes it can pull whatever it needs from the internet. In an air-gapped environment it cannot, and every one of those assumptions has to be replaced with something you run yourself.
What air-gapped means
An air-gapped environment has no connection to the internet, and often no connection to other internal networks either. It is common in defence, critical infrastructure, healthcare, finance and industrial systems. Software still has to get in, but only through a controlled, audited path.
What stops working without internet
- Container images cannot be pulled from public registries
- Operating system packages and security updates cannot be downloaded
- Helm charts and operators that fetch their dependencies at install time fail
- Clocks drift without a time source, and certificates start failing in confusing ways
- Tools that phone home for licences or updates hang or log errors
What to set up first
- An internal container registry and a repeatable process for mirroring the images you need into it
- A package mirror for the operating system and language ecosystems you use
- A transfer procedure for bringing artifacts in: scanned, checksummed and logged
- An internal certificate authority with automated rotation
- A reliable time source inside the network
- Internal Git and CI/CD, so cluster configuration is deployed from version control
How to handle upgrades
Treat every upgrade as a release bundle: the Kubernetes version, all images, charts and packages it needs, tested together on a connected staging cluster that mirrors production. Then move the bundle across in one controlled transfer.
Upgrades that are postponed get harder each time. A fixed schedule, for example once a quarter, keeps the jump between versions small and the procedure fresh in the team's memory.
Monitoring and logs
Observability has to live entirely inside the environment: metrics, logs and alerting on the same network as the cluster. Decide early how alerts reach a human, since email and chat integrations that work elsewhere are usually not available.
Common mistakes
- Discovering missing images during the installation instead of before it
- Copying artifacts in by hand with no record of what came from where
- No staging environment that matches production
- Certificates that expire because nobody owns rotation
- Skipping security updates because bringing them in is inconvenient
Integritasec does this work hands-on. See Platform engineering and Kubernetes consulting, or talk it through directly.