§08 · Deploy & operate

Air-gapped & private registries

Run Exo from a private registry with no public-internet access. Mirror the images, point the manifests at your registry, and nothing reaches out.

Air-gapped and egress-restricted clusters work. Beyond its own image, the autonomic-manager launches pods from a set of published container images. For an offline install, mirror those images into your own registry and point the operator and platform manifests at the mirror.

Supported

There are two offline shapes, depending on what the cluster can reach:

Private registry, still managed. The cluster can reach your platform but not the public registry. Mirror images locally and keep the operator connected to the control plane.
Fully offline. The cluster can't reach anything external. Mirror images and run the operator unmanaged (see below).

Point at your registry

Point each image reference at your mirror. The installer takes the operator and platform images as flags:

●manager env· yaml

1env:
2  - name: AUTONOMIC_IMAGE_REGISTRY
3    value: registry.example.com/exo-mirror

Via Helm, set image.manager.repository (and the platform image in its values). An individual Agent or Tool can pin its own image through the CR's image field, useful when only part of the fleet is mirrored.

Pull secrets

A private mirror needs image pull secrets. Via Helm that's image.pullSecrets; for raw manifests, attach imagePullSecrets to the operator's ServiceAccount so both the manager and the pods it creates can pull.

Fully offline

If the cluster can't reach the platform at all, run the operator unmanaged (AUTONOMIC_MANAGED=false, the default). Agents, Tools, and the rest still reconcile and run from your mirrored images; nothing leaves for a control plane. You lose the dashboard view and centralized audit, but the runtime works in-cluster.