Air-gapped installation

Cloudkeel-DD needs no internet access to run. We operate no endpoints of our own, so there is no telemetry, no analytics and no licence server to punch a hole for. The only outbound calls it makes are the read-only ones to the endpoints you connect: your Terraform state backend, your cloud APIs, your Kubernetes clusters, plus any notification webhook or Git host you configure yourself.

What an air-gapped install does need is the container images and the chart, mirrored inside your network before you start.

The trial and Free allowance work offline too

On chart 0.3.4 and newer, an unkeyed install runs unmetered for 30 days from its first workspace, then converts to Free: 1 enabled scope, 3 users and every feature. One scope keeps scanning on its normal schedule; scopes beyond the allowance are held back with an explanation. Findings, history, integrations and login remain available, running scans finish, and nothing is deleted.

The timer and licence checks run locally, with no callout. An install that predates enforcement gets a full window from its first enforcing upgrade. See Licensing to apply a key, or the pilot timer to configure an agreed extension. On older charts 0.3.0–0.3.3, expiry stopped new scans; that historical behavior does not describe current releases.

Images to mirror

Five, all pulled at install time.

Image	Used by	Always pulled?
driftdetective/ddetective-backend	API, worker, beat, the schema-migration Job, and the wait-for-database init containers	Yes
driftdetective/ddetective-frontend	The UI	Yes
openpolicyagent/opa:1.18.2	Policy evaluation	Yes (deployed unconditionally)
postgres:16	Bundled database	Only when postgresql.enabled (default true)
redis:7	Bundled broker and rate-limit store	Only when redis.enabled (default true)

One image covers five workloads. The API, worker and beat are the same backend image run with different commands, and both the migration Job and the wait-for-database init containers use it too. Mirror it once.

Pin the tags. images.backend.tag and images.frontend.tag default to the chart’s appVersion when left empty. Set them explicitly for an air-gapped mirror, so a chart upgrade cannot ask for a tag you have not copied in.

If you point postgresql.enabled and redis.enabled at external managed instances instead, those two images drop off the list.

Pull the chart

The chart lives in the same public OCI registry as the images. Pull it to a file on a connected machine:

helm pull oci://registry-1.docker.io/driftdetective/d-detective --version <version>

That writes d-detective-<version>.tgz. Carry it in with the images and install from the local file rather than from the registry.

Point the install at your registry

imagePullSecrets:
  - name: my-registry-creds

images:
  backend:
    repository: registry.internal/mirror/ddetective-backend
    tag: "<appVersion>"
  frontend:
    repository: registry.internal/mirror/ddetective-frontend
    tag: "<appVersion>"

opa:
  image: registry.internal/mirror/opa:1.18.2

postgresql:
  image: registry.internal/mirror/postgres:16

redis:
  image: registry.internal/mirror/redis:7

helm install dd ./d-detective-<version>.tgz -f airgap-values.yaml \
  --namespace ddetective --create-namespace

The required secrets are unchanged: see secrets. The Fernet key is immutable after first install.

What still has to be reachable

Nothing of ours. But Cloudkeel-DD can only scan what the cluster can reach: your Terraform state backend, the cloud API endpoints for each connected credential, and the API server of each connected Kubernetes cluster. If a scope is not reachable from inside the air gap, it cannot be scanned: that is a network constraint on your side, not an internet requirement on ours.

These docs, offline

Ask us for the offline documentation bundle. It includes the customer guides, self-hosted fonts, styles, search index and linked product pages. Hosted analytics is disabled in this build, so reading and searching the bundled docs requires no external service. Links to external resources still require access to those destinations.

Extract the archive and serve its contents from an internal HTTP server’s web root, then open /docs/. Use a web server rather than opening the HTML files directly, so navigation and search can resolve their local assets.