Air-gapped installation

Fixed installation namespace

SKE and the SKE Operator must run in the kratix-platform-system namespace. You cannot override this namespace. Create it before creating any registry, release-storage, or TLS Secrets used by the installation.

You may want to manage SKE manifests and images within your own environment either due to air-gapped requirements or other security and redundancy measures.

Regardless of the reason, if you want to host your own manifests and/or images you will need to ensure that your Platform cluster has access to the following resources:

• An image registry containing the required SKE images and any optional SKE integration images you use
• A location where the SKE Release manifests can be found

Depending on your environment configuration, you will be instructed how to create configuration and secrets the SKE Operator requires to access both the Image Registry and manifest locations.

Manifests include reference to the SKE docker images. Do not directly change the manifest to reference your image storage. If you need to change the image locations, you can do so by using the image registry configuration fields on the SKE Operator which is documented below.

note

The user associated with your SKE licence is syntasso-pkg. To pull the images from the Syntasso Registry, first login with:

docker login --username syntasso-pkg ghcr.io

You will be prompted for a password. The password is your Licence Key.

Once you have logged in, you can pull the images using the docker pull command.

Tokens

Review the SKE tokens page for an overview on different SKE tokens and which one to use for registry access.

Image registry

The SKE Operator and SKE images are stored in the GitHub Container Registry (GHCR).

Images required for an Operator-managed installation

Mirror these images for a standard SKE installation:

Component	Source image	Tag
SKE Operator	ghcr.io/syntasso/ske-operator:<SKE_OPERATOR_VERSION>	The SKE Operator version installed by your chosen Helm chart, or the version of the Operator manifest you apply
SKE	ghcr.io/syntasso/ske-platform:<SKE_VERSION>	The version set in skeDeployment.version or spec.version

The preconfigured installation pulls additional development and third-party images and is not covered by this air-gapped procedure. Use the advanced installation for an air-gapped environment.

Images required by optional integrations

The following images are not required for a base SKE installation. Mirror them only when you enable the corresponding integration:

Integration	Source image	Packaging
Backstage Controller	ghcr.io/syntasso/backstage-controller:<BACKSTAGE_CONTROLLER_VERSION>	Contains both the controller and the Backstage Generator used by its Workflow Jobs
Cortex Controller	ghcr.io/syntasso/ske-cortex-controller:<CORTEX_CONTROLLER_VERSION>	Contains the Cortex integration controller

The integration image tag is the version set on that integration, not the SKE version. See the Backstage Controller installation and Cortex installation guides for their supported versions and configuration.

Other separately installed SKE components have their own image requirements:

• SKE Health Agent
• SKE GUI

You can find the available versions of the images in the Syntasso Enterprise Releases page.

How to: Push the images to your internal registry

Log in to the Syntasso registry:

docker login --username syntasso-pkg ghcr.io

When prompted, enter your Syntasso registry token as the password.

Set the versions and the destination registry:

SKE_OPERATOR_VERSION="<SKE_OPERATOR_VERSION>"
SKE_VERSION="<SKE_VERSION>"
INTERNAL_REGISTRY="<INTERNAL_REGISTRY>"

Pull the required core images:

docker pull "ghcr.io/syntasso/ske-operator:${SKE_OPERATOR_VERSION}"
docker pull "ghcr.io/syntasso/ske-platform:${SKE_VERSION}"

Tag the images for your internal registry:

docker tag \
  "ghcr.io/syntasso/ske-operator:${SKE_OPERATOR_VERSION}" \
  "${INTERNAL_REGISTRY}/syntasso/ske-operator:${SKE_OPERATOR_VERSION}"

docker tag \
  "ghcr.io/syntasso/ske-platform:${SKE_VERSION}" \
  "${INTERNAL_REGISTRY}/syntasso/ske-platform:${SKE_VERSION}"

Push the images:

docker push "${INTERNAL_REGISTRY}/syntasso/ske-operator:${SKE_OPERATOR_VERSION}"
docker push "${INTERNAL_REGISTRY}/syntasso/ske-platform:${SKE_VERSION}"

Providing SKE Operator access to use your image registry

You need provide the SKE Operator with both the credentials and location to read your image registry.

To create the Image Registry secret, run:

kubectl create secret docker-registry <PULL SECRET NAME> \
    --namespace "kratix-platform-system" \
    --docker-username="<YOURUSERNAME>" \
    --docker-password="<YOURPASSWORD>" \
    --docker-server="<YOUR.REGISTRY.ADDRESS>"

You will need to reference this secret when installing SKE operator which is described in each installation guide.

SKE Release Storage

The manifests for SKE deployments are available in the Syntasso Enterprise Releases page.

You need to host the manifests in your own S3-compatible bucket or Git repository that's accessible from the Platform cluster.

The contents must match exactly the structure of the Syntasso Enterprise releases bucket.

In Git, all files/directories starting with . are ignored.

Providing SKE Operator access to use your release registry

To create the secret to access the SKE Release Storage:

Mirroring from Bucket

kubectl create secret generic <BUCKET SECRET NAME> \
    --namespace kratix-platform-system \
    --from-literal=accessKeyID="<YOURACCESSKEY>" \
    --from-literal=secretAccessKey="<YOURSECRETKEY>"

Mirroring from Git Repo

kubectl create secret generic <GIT SECRET NAME> \
    --namespace kratix-platform-system \
    --from-literal=username="<USERNAME>" \
    --from-literal=password="<PASSWORD>"

You will need to reference this secret when installing SKE operator which is described in each installation guide.

Install SKE via the Helm chart

With the mirrors in place, you can install SKE via the Helm chart. Refer to the installation guide for more details, and make sure to configure the air-gapped mirrors.