The Air-Gap Problem: Connectivity You Cannot Assume

▶ Watch (2:41)

Cloud-native software was designed to run on connected infrastructure. The challenge is the same whether you’re running on a windmill cluster off the North Sea or at a conference hall with unreliable Wi-Fi: no guaranteed connectivity. Edge can mean a single low-bandwidth node or a high-powered multi-node setup. If you can use cloud infrastructure, use it. If you can’t, you need a workflow that works without it.

Talos Linux: Immutable by Design

▶ Watch (7:43)

Talos Linux is configured entirely via YAML. You give it a config file and it becomes what you declare. There’s no direct shell access. Keppel applied configs to three nodes at static IPs (.252, .253, .254), bootstrapped the cluster from one node, and watched the others join. That cluster ran the entire demo disconnected from the internet. If you can’t reach the cluster, manual config changes aren’t possible. Talos removes the option. Every change goes through the API.

Bootstrapping Past the Registry Chicken-and-Egg

▶ Watch (9:14)

Deploying an app to an air-gapped cluster hits a chicken-and-egg problem first: you need a registry to deploy the registry image. Zarf solves this by initializing the cluster with a bundled registry. Every subsequent package deploy pushes images into that internal registry. A mutating webhook then rewrites image references at admission time, so Helm charts and GitOps manifests work unchanged. Bootstrap a git server with Zarf init and the webhook rewrites git repo references for Flux and Argo too.

Packages as Portable, Signed Archives

▶ Watch (13:54)

A Zarf package is a tarball: images, Helm manifests, and metadata in one archive. The zarf.yaml for the Doom demo declared the images and manifests needed. Running zarf package create on that file produces a reproducible archive. Packages can reach tens of gigabytes. During deploy, Zarf pushes images into the internal registry and installs Helm releases. You keep full access to those Helm releases and can inspect them with any standard tool. Zarf also bundles an SBOM per image and supports signing via Sigstore and cosign.

Treating the OS as a Deployable Artifact

▶ Watch (20:25)

Keppel wrote a custom Kubernetes controller wrapping the Talos API. A CRD declares the target Talos version and OCI image; the controller calls the API to upgrade each node in sequence. The OS image ships inside a Zarf package alongside coredns and other Kubernetes core images. The demo upgraded three nodes from Talos 1.12.4 to 1.12.5. Two nodes completed during the session; the third was mid-reboot. Major upgrades require bundling a new etcd version, which takes longer to package.

Failing at Build Time, Not at the Edge

▶ Watch (23:48)

Keller’s core argument: a missing dependency discovered at an air-gapped edge site can mean weeks to get a fix approved and shipped back in regulated environments. Zarf package create fails loudly when a declared image doesn’t exist. That catch happens at build time. Keller also keeps a disconnected node on his desk as a last-pass validation target. Every change gets tested there before it touches a secured facility. Build-time failure is the cheapest failure.

Notable Quotes

It’s a declarative operating system. Merijn Keppel · ▶ 7:49

there’s no manual intervention by me. Merijn Keppel · ▶ 8:55

tens of gigabytes. It happens. Brandt Keller · ▶ 15:08

Key Takeaways

  • Talos Linux applies a YAML config and becomes what you declare, with no direct shell access.
  • Zarf’s mutating webhook rewrites image references so the same package deploys connected or air-gapped.
  • Zarf package create fails immediately on a missing image, surfacing gaps before you reach the edge.
  • Packaging the OS as an OCI artifact makes Talos upgrades identical to any application deploy.
  • Air-gapped deployments are the strictest test: if it works disconnected, connected deployments are straightforward.

About the Speaker(s)

Brandt Keller is a Staff Software Engineer at Defense Unicorns. He serves as Maintainer and Technical Lead for the CNCF Security & Compliance Technical Advisory Group, a Cloud Native Ambassador, and a project maintainer within the OpenSSF.

Merijn Keppel is a Principal Consultant at TrueFullstaq focused on declarative systems, cloud native infrastructure, and networking.