Air-gap pre-flight checklist

Infrastructure

• K8s cluster reachable, nodes healthy (kubectl get nodes)
• Offline registry reachable from nodes (curl localhost:5000/v2/)
• StorageClass exists (kubectl get storageclass)
• GPU node labeled nvidia.com/gpu.present=true (if local models)

Secrets

• pg_password generated (≥32 chars)
• kek file created (32 random bytes / 64 hex chars)
• license token issued by vendor, not expired

Network

• Egress deny-all NetworkPolicy present
• No outbound 443/53 to public internet (tcpdump baseline = 0 packets/24h)
• DNS resolves intra-namespace service names

Images

• sha256sum -c manifest.sha256 PASS on the bundle
• cosign signatures present (if procurement requires provenance)
• trivy image — 0 HIGH/CRITICAL CVEs

License

• Token expires_at > planned install date + buffer
• Vendor public key matches build (yabanin-license-issuer round-trip)