Self-hosted
DERequest a demo →
Skip to documentation content
ClusterPilot Docs
Product tour Self-hosted
Start with:EvaluateInstallCreate a clusterOperateRecoverAutomate
Documentation/Administer
Administer

Registry & air gap

Mirror signed, digest-pinned releases and add-on artifacts into a customer registry without silent public fallback.

AudienceRegistry administrators, security and platform teamsReading time18 minCommands in contextNo terminal requiredReviewed source9552586 · 1 August 2026

Distribution modes

ModeSource of artifactsRequired evidence
OnlineApproved public registries and release bundle.Signatures, checksums, digests, compatibility, outbound policy.
Private registryMirrored API, agent, tools, add-ons, and metadata.Promotion record, digest equality, registry trust/auth, pull tests.
Air-gappedPreassembled signed bundle imported through a controlled transfer.Complete inventory, transfer chain, offline verification, no-egress test.

Immutable artifact contract

  • ✓
    API and agent image references include an immutable sha256 digest.
  • ✓
    Official runtime subject basenames remain clusterpilot-api and clusterpilot-agent.
  • ✓
    Charts, manifests, tools, and add-on images have complete lock metadata.
  • ✓
    Signed release metadata and compatibility inputs remain available after mirroring.
  • ✓
    The target environment refuses tag-only, missing, stale, partially synchronized, or drifted mirrors.
  • ✓
    There is no undocumented fallback to latest, an alternate registry, or the public internet.

Harbor integration

Use a dedicated project and a least-privileged robot account for ClusterPilot promotion/pull workflows. Retain the robot credential through a typed SecretRef and validate Harbor TLS, project quota, retention, scanning, garbage collection, and replication policy.

Harbor robot account guidanceHarbor vulnerability scanning

Air-gap rollout

  1. 01

    Generate the complete inventory

    Include API, agent, tools, Kubernetes artifacts, CNI, add-ons, charts/manifests, metadata, signatures, SBOM, and provenance.

  2. 02

    Verify before export

    Validate signatures and checksums in the connected staging environment.

  3. 03

    Transfer under customer policy

    Record bundle identity, media/courier control, approver, and destination.

  4. 04

    Verify after import

    Recompute checksums, validate signatures offline, and compare the inventory.

  5. 05

    Promote to the private registry

    Preserve original digests and record target references and registry evidence.

  6. 06

    Test no-egress operation

    Block external DNS/egress and prove install, agent heartbeat, cluster lifecycle, add-on, validation, backup, and recovery paths.

Self-hosted and air-gapped environments

Open the product tour →