Static Manifest Bundling

All Kubernetes resource definitions are fully resolved into static YAML files before deployment. This process executes the template engine (e.g., Helm) in a connected 'staging' zone, producing a flat directory of manifests that require no further processing. The resulting bundle contains the exact desired state, eliminating variability caused by dynamic chart dependencies or conditional logic at deploy time. This ensures that what is scanned and approved is precisely what gets applied to the air-gapped cluster.

A standard helm install command fetches chart metadata and dependencies from live repositories. Static bundling severs this link. By executing helm template with all required values and then archiving the output, the deployment becomes entirely self-reliant. The target cluster never needs network access to a Helm repo, OCI registry for charts, or any external template engine. This is critical for high-security environments where any outbound connection is a policy violation.

The static bundle becomes an immutable release artifact. It can be cryptographically hashed, signed, and stored in an internal artifact repository. Security and compliance teams can perform a deep inspection of every resource—Deployments, Services, ConfigMaps—before it enters the disconnected environment. This supports rigorous change management processes, as the exact diff between version 1.0 and 1.1 of a bundle is a simple text comparison of the pre-rendered YAML, leaving no hidden logic.

The deployment workflow reduces to a two-step process: render and copy. The entire application definition is compressed into a single transportable archive (e.g., a .tar.gz file). This archive is then transferred via physical media or a one-way data diode to the disconnected side. On the target cluster, a standard kubectl apply -f command against the extracted directory instantiates the full application stack. No specialized operators or controllers are required for the manifest injection itself.

Static manifests are the native input for GitOps tools like Argo CD and Flux. Once the bundle is extracted into an air-gapped Git repository, the GitOps agent running inside the cluster can continuously reconcile the live state against the declared manifests. This enables fully automated, self-healing operations even in a disconnected environment. The combination of static bundling and GitOps provides a robust mechanism for drift detection and automated rollbacks without external orchestration.

This method avoids the need to run Helm's client-side logic or any SDK inside the secure environment. The rendering is performed entirely in a lower-security build pipeline. The disconnected cluster only needs kubectl, a tool already present for basic administration. This reduces the attack surface and software footprint on the production infrastructure, adhering to the principle of least functionality for critical systems.

The operational framework that makes static manifest bundling powerful. A Git repository serves as the single source of truth for declarative configurations. An agent like Argo CD continuously compares the desired state in Git against the live cluster state, automatically reconciling drift.

• Eliminates manual kubectl apply commands
• Provides a complete audit trail of every configuration change
• Enables disaster recovery by simply reapplying manifests from Git
• Works natively with pre-rendered YAML files in air-gapped environments

A deployment paradigm where components are never modified after creation. Static manifest bundling enforces this by treating generated YAML as immutable artifacts. Instead of patching a running deployment, you generate a new manifest set and replace the entire resource.

• Prevents configuration drift between environments
• Ensures every deployment is reproducible from versioned artifacts
• Simplifies rollbacks by reapplying a previous manifest version
• Aligns with container immutability principles

An internal, self-hosted OCI-compliant image repository that stores all container images referenced by your static manifests. Without this, pods in an air-gapped cluster cannot pull images.

• Mirror images using skopeo or crane from public registries
• Host on Harbor, Artifactory, or a simple Docker Registry
• Update manifest image references to point to the internal registry URL
• Perform vulnerability scanning on all stored images before deployment