“Air-gapped” gets used loosely. For high-assurance environments it has a precise meaning: the system has no path to the public internet, by design, and must install, run, and update entirely from resources inside the boundary.
What has to change vs. a connected cluster
A normal Kubernetes install pulls container images, binaries, and Helm charts from the internet on demand. Air-gapped, none of that is available. Three things move inside the boundary:
1. An internal container registry
Every image the platform and your workloads need is mirrored into a registry you run inside the air gap. Nothing is pulled from Docker Hub, quay.io, or a vendor registry at runtime.
2. A controlled update pipeline
Updates — platform versions, security patches, new images — are staged outside, validated, and carried across the boundary through your controlled process (a one-way data diode, a review-and-transfer workflow, removable media under policy). The cluster never reaches out; you push in.
3. No call-home, no licence check-in
This is the test that separates genuinely sovereign platforms from the rest: it must run with no telemetry, no licence-server heartbeat, and no remote management path. If disconnection breaks it, it was never air-gap-capable.
Day-2 in an air gap
The operational model is the interesting part. You still need:
- Observability — metrics, logs, and alerting that live entirely inside the boundary.
- Certificate and secret rotation — automated, with no external CA dependency.
- Backup and restore — to storage inside the air gap.
- Fleet management — because most real deployments are many clusters, not one.
The platform is designed for this: a sovereign management core operates the fleet, and edge/disconnected sites keep running locally when the link is cut (see Secure Operations).
What to verify in an evaluation
- Can it install with the network physically disconnected? (Not “offline mode” that still checks a licence server.)
- Is there a documented, supported mirror-and-update workflow?
- Does Day-2 — upgrades, rotation, backup — work fully disconnected?
- Can one team operate many air-gapped clusters, or does each site need its own?
Bring those four questions to any vendor that claims air-gap support. The answers separate a checkbox from a capability.