The cluster was offline. No internet. No external repos. And yet, deployments had to ship.
Running kubectl in an air-gapped environment is not optional for teams handling strict compliance, classified systems, or isolated data centers. It’s a hard constraint. Every image, every manifest, every plugin must be available inside the perimeter before a single command can succeed.
Start with the basics. Kubernetes tools, including kubectl, are not magical. They talk to the API server, which lives inside your cluster. In an air-gapped Kubernetes setup, nothing pulls from public networks. That means your workflows depend on internal mirrors, private registries, and locally cached binaries.
Download kubectl from a trusted source ahead of time. Check its checksum. Store it in a secure, internal location. Distribute it through your configuration management or provisioning pipeline. Never assume the binary will be available later—you will not be able to curl or wget anything once inside the air gap.
Next, replicate container images into an internal registry. Use docker save or ctr to create tar archives. Import them into your private registry before deployment. Update manifests to point to internal image paths. If kubectl applies a manifest pointing to docker.io/library/nginx, it will fail in an air-gapped zone unless you’ve mirrored that image locally.