Dark Site Notes

For platforms with no internet at all: getting images, operators and upgrades across the air gap without surprises. Tar formats, signatures, kernel headers, and every check that passes right up until the moment it doesn’t. Read the posts in order; each builds on the one before.

Everything that has to cross the airlock: images, signatures, node OVAs, kernel headers, licences

VKS and the GPU Operator in a dark site: the whole airlock

Upgrading VKS, Kubernetes and the NVIDIA GPU Operator with no internet means five supply chains arriving intact. Each has a trap that passes every check until activation. This is the map.

Two tarballs that look the same: manifest.json vs oci-layout

imgpkg tar vs OCI archive: why your air-gap tarballs won't load

Two tarballs full of container images, both bound for the same Harbor. imgpkg loads one and rejects the other. The layout difference nobody explains, what survives a copy, and three ways across.