Air-Gapping: A Moat for the 21st Century
summary
Air-gapping a PaaS blocks all internet traffic but creates operational friction: installing and upgrading PCF requires mirroring artifacts (jars, Docker images, pipeline tasks) into internal services such as an S3‑compatible blob store (minio/Ceph), an internal docker registry (Harbor) and an internal git. Best practice is a DMZ with whitelisted VMs running Concourse pipelines that pull exact versions and populate those stores; worst practice is shuttling DVDs and repeated round trips. The pipeline approach preserves operator velocity; highly restrictive defense environments often forbid it.
AI-written summary · about
chapters (12)
- 0:00Start
- 1:34Why Do Organizations Airgap?
- 1:55Why Do Organizations Airgaps?
- 2:43At What Cost?
- 3:30Implications for Engineers
- 6:50Example: Installation of PCF
- 9:11Best Practice: Automation From DMZ
- 10:43Worst Practice
- 12:30Life Hack
- 13:55Installation Complete!
- 14:11Platform Upgrades
- 15:03Storytime!
related talks
22mAirgapped Kubernetes - Hannes Probst
33mSo you think you can airgap? (No.)
25mCloud Native Deployments in Air Gapped Environments
29mContainer Factory for Aerospace & Defense Enterprises
35mSecuring the Perimeter - CFCR/CFAR Chain of Custody With CI/CD Pipelines
32mService Networking Within Air-Gapped Environments: Deployment Strategies and Operat...
15mThe Airgap Paradox: Adversarial Tactics & Defensible Design
18mManaging Kubernetes in Air-Gapped Environments