Air-gapped clusters

Scanning works entirely inside a perimeter. Licensing needs one narrow route out, and this page is honest about it.

Nothing is fetched at install time

Trivy and Cosign are pinned into the operator image rather than downloaded when it starts. The console loads no fonts, scripts or analytics from anywhere. So an installation that can pull one image can run.

Mirroring the vulnerability database

The database comes from whichever registry trivy.dbRepository names. Mirror it into your own registry with the same tooling that already moves images inside the perimeter, and point the operator at it.

# on a host that can reach both
oras copy ghcr.io/aquasecurity/trivy-db:2 \
  registry.internal/mirror/trivy-db:2

helm upgrade attestkeep oci://ghcr.io/attestkeep/charts/attestkeep \
  --namespace attestkeep \
  --set trivy.dbRepository=registry.internal/mirror/trivy-db

Refresh the mirror on whatever schedule your change process allows. A stale database is not a broken installation — it is an installation making decisions on older information, and the evidence package records which database version a finding came from so that is visible rather than assumed.

Signature verification without a transparency log

Cosign's keyless flow checks a public transparency log, which an air-gapped cluster cannot reach. Setting scan.cosignOffline verifies against the key and skips that check.

This is a real reduction in what a signature proves. With the log, you learn that a signature exists and was publicly recorded when it was made. Without it, you learn that the artefact was signed by a key you trust. That is still worth having, and it is less. Choose it because your network requires it, not because it is simpler.

"Unsigned" and "could not be verified" are recorded as different answers, and your policy can treat them differently. Collapsing them would let a broken verification path look like a deliberate decision not to sign.

Licensing needs one route out

There is no offline licence format and no setting that turns the check off. What licensing needs is narrow enough to put through a proxy with a single allowed destination:


Destination	`https://lic.attestkeep.com`, port 443
Frequency	once a day, plus once at activation
Payload	licence id, cluster fingerprint, operator version
Tolerated outage	up to thirty days on the current certificate

Community works the same way. A cluster with permanently no route at all is the one case this product cannot license, and saying so plainly is better than selling into it and disappointing later.