Air-gapped clusters

Scanning works entirely inside a perimeter. Licensing needs one narrow route out, and this page is honest about it.

Nothing is fetched at install time

Trivy and Cosign are pinned into the operator image rather than downloaded when it starts. The console loads no fonts, scripts or analytics from anywhere. So an installation that can pull one image can run.

Mirroring the vulnerability database

The database comes from whichever registry trivy.dbRepository names. Mirror it into your own registry with the same tooling that already moves images inside the perimeter, and point the operator at it.

# on a host that can reach both
oras copy ghcr.io/aquasecurity/trivy-db:2 \
  registry.internal/mirror/trivy-db:2

helm upgrade attestkeep oci://ghcr.io/attestkeep/charts/attestkeep \
  --namespace attestkeep \
  --set trivy.dbRepository=registry.internal/mirror/trivy-db

Refresh the mirror on whatever schedule your change process allows. A stale database is not a broken installation — it is an installation making decisions on older information, and the evidence package records which database version a finding came from so that is visible rather than assumed.

Signature verification without a transparency log

Cosign's keyless flow checks a public transparency log, which an air-gapped cluster cannot reach. Setting scan.cosignOffline verifies against the key and skips that check.

This is a real reduction in what a signature proves. With the log, you learn that a signature exists and was publicly recorded when it was made. Without it, you learn that the artefact was signed by a key you trust. That is still worth having, and it is less. Choose it because your network requires it, not because it is simpler.

"Unsigned" and "could not be verified" have the same effect on the verdict — under a policy that requires signatures both refuse — but they are different failures, and the operator says which one happened in its logs and metrics so a broken verification path does not pass for a deliberate decision not to sign.

Licensing: one route out, or an offline certificate

Online licensing has no setting that turns the daily check off. What it needs is narrow enough to put through a proxy with a single allowed destination:


Destination	`https://lic.attestkeep.com`, port 443
Frequency	once a day, plus once at activation
Payload	licence id, cluster fingerprint, operator version
Tolerated outage	up to thirty days on the current certificate

Community works the same way.

A cluster with no route at all is activated offline instead. The console writes an activation request naming the cluster, somebody carries it to the licence page at attestkeep.com, and the certificate issued there for that cluster is uploaded back in the console — or handed to the operator through license.existingCertificateSecret for an installation nobody will open the console of. No daily check runs against it, and the console warns thirty days before it expires. Whether offline activation is offered for your licence is shown on the licence page at attestkeep.com; the steps are on licensing.