EQTY LabDocs

Air-Gapped Install

Install the Guardian Platform with mirrored images and packaged charts.

View as Markdown

Use an air-gapped install when the cluster cannot pull charts or images from public or hosted registries.

Preparation

  1. Obtain the release package and release manifest.
  2. Mirror every runtime image listed in the manifest, and the upstream images below, to the customer-approved registry.
  3. Preserve image tags and digests from the manifest.
  4. Package or mirror the Helm chart and dependencies for the restricted environment.
  5. Prepare registry credentials, image pull secrets, values, and platform secrets.

Install Flow

Install the Guardian Platform chart from the approved internal source and override image registry values so every component pulls from the mirrored registry.

The global.imageRepositoryPrefixOverride redirects only source images under ghcr.io/eqtylab/. It does not mirror upstream images. For the gateway psql init container, also set global.imageRegistryOverride or gateway-stack.controlPlane.waitForRegistryViews.image.repository explicitly. Air-gapped installs that previously used the prefix alone must add this override.

The release manifest lists the EQTY Lab images only. The chart also pulls these upstream images, each with its own setting:

ImageUsed bySetting
busybox:1.36Auth, Governance, and Integrity dependency wait containersglobal.utilityImages.busybox
docker.io/bitnamilegacy/postgresql:17-debian-12Bundled PostgreSQLpostgresql.image.registry
postgres:17-alpineIdentity provider post-install JobsidpSetupImage
docker.io/library/postgres:17.6Gateway Stack psql init containergateway-stack.controlPlane.waitForRegistryViews.image.repository

The post-install Jobs need psql and pg_isready, and with createPlatformAdmin also curl and jq. postgres:17-alpine installs curl and jq with apk at runtime, which fails without internet access, so mirror an image that already contains them. The Jobs run as UID and GID 70 (the postgres user of postgres:17-alpine) with a read-only root filesystem and a writable /tmp, so the mirrored image must work as that user; otherwise set idpSetupPodSecurityContext to a user it supports.

Values that redirect every image to a mirror at registry.customer.example:

yaml
global:
  imageRegistryOverride: registry.customer.example
  imageRepositoryPrefixOverride: registry.customer.example/eqtylab
  utilityImages:
    busybox: registry.customer.example/library/busybox:1.36
  secrets:
    imageRegistry:
      registry: registry.customer.example

postgresql:
  global:
    security:
      allowInsecureImages: true # Bitnami refuses a changed image registry without it
  image:
    registry: registry.customer.example

# Mirrored image with psql, pg_isready, curl, and jq
idpSetupImage: registry.customer.example/library/postgres-setup:17

gateway-stack:
  controlPlane:
    waitForRegistryViews:
      image:
        repository: registry.customer.example/library/postgres

Verify that the cluster never needs to reach an external registry during install or restart.

PDFGen timestamps each report it signs through a public timestamp authority, http://timestamp.digicert.com by default. Without a route to one, every report export fails, so sign without a timestamp:

yaml
eqty-pdfgen:
  config:
    timestampUrl: ""

See PDFGen Configuration.

Validation Checks

  • All pods pull images from the mirrored registry.
  • Chart version and image digests match the release manifest.
  • Sign-in, project access, attachments, reports, indicators, and certificates work according to the rollout plan.

Support Notes

Keep the mirrored image list, chart package, values file, and validation evidence with the release records. They are needed for rollback, support, and disaster recovery.