--- title: "How to secure the cluster in an air gap environment with Calico Cloud" source: "https://www.tigera.io/blog/how-to-secure-the-cluster-in-an-air-gap-environment-with-calico-cloud/" --- [Technical Blog](https://www.tigera.io/category/technical-blog/) # How to secure the cluster in an air gap environment with Calico Cloud By [Joao Coutinho](https://www.tigera.io/blog/author/joao-coutinho/) on Jun 13, 2023 • 5 min read The concern about securing the clusters has grown exponentially and one of the ways to secure it is by isolating the cluster from the Internet to lower the risk of eventual attack. Enterprises that deal with confidential customer data and work with regulatory agencies, such as financial and insurance institutions, require air gap environments for their clusters to create highly secure environments. ## What’s an air gap? The air gap is a security configuration in which the cluster, network, or workload will not have access to the Internet, unless it is explicitly authorized to do so. It is a highly controlled environment and prevents the cluster from establishing external connections without prior authorizations. The diagram below shows an air gap network: ![Diagram comparing an open network to an air gap network, both using internet, router, firewall, VPC, Kubernetes cluster, and](https://www.tigera.io/app/uploads/2023/06/How-to-secure-the-cluster-on-a-air-gap-environment-with-Calico-Cloud-1.jpg)   In a containerized environment, the cluster needs to pull the images for spinning up containers and it is usually done by pulling the images from a repository located on the cloud or Internet. However, as the air gap network doesn’t have access to the Internet, pulling images from the Internet is not possible. To address this situation, it is necessary to create a private registry/repository in the air gap network and pull all required images for the cluster into this private registry, rather than pulling the image from the Internet, the cluster will pull them from a local repository placed on the air gap network. Calico Cloud supports the air gap installation, which we will go into more detail in this blog. ## Setting up the prerequisites In order to install Calico Cloud from a private registry, some prerequisites need to be met as below: - Helm charts installation is the only way to install Calico Cloud from a private registry, therefore, helm must be installed in the machine from where the installation will be triggered. - The cluster must have the CNI installed and if you want to install the Calico CNI, follow this documentation: Install Calico. ## Setting up a private registry One of the most well-known private registry is by deploying the Docker registry container. Let’s look at an example based on the Docker registry. The prerequisites for installing the Docker private registry: - On the Linux server in which the private registry will be configured, install docker as per this [documentation](https://docs.docker.com/engine/install/). - Deploy the Docker registry container in the private registry server as per the [documentation](https://docs.docker.com/registry/deploying/). - The Docker registry container will only accept access from the localhost IP address. In order to make it accessible from the cluster, the TLS certificate needs to be configured to encrypt the traffic between the cluster and the private registry container. Follow the [documentation](https://docs.docker.com/registry/deploying/#run-an-externally-accessible-registry) to configure the certificate in the docker registry container. You can also add the following: - Authentication on the Docker registry container as per the [documentation](https://docs.docker.com/registry/deploying/#restricting-access). - Self-signed certificates are only recommended for non-production clusters. You can generate the certificate and configure it in the Docker registry container and in the Kubernetes cluster as per this [documentation](https://docs.docker.com/registry/deploying/#restricting-access). ## Pull images to the private registry After finishing the configuration for the Docker registry container, the Calico Cloud images need to be pulled into the private registry container and this way the cluster will be able to pull the image from it. 1. To pull the images from Calico Cloud, log into Docker with a user that has permission to pull out the private registry. Go to **Calico Cloud UI** > **Managed Clusters** and click on the ![Command prompt icon, indicating the need to pull Calico Cloud images into the private registry container](https://www.tigera.io/app/uploads/2023/06/How-to-secure-the-cluster-on-a-air-gap-environment-with-Calico-Cloud-2.png) icon to obtain the user and password needed to pull the Calico Cloud Images.![Calico Cloud UI showing private registry credentials. The command pulls Calico images into the private registry](https://www.tigera.io/app/uploads/2023/06/How-to-secure-the-cluster-on-a-air-gap-environment-with-Calico-Cloud-3.png) Copy the following command and paste it into the Linux server that is running the private registry container: ``` `docker login -u tigera+calicocloud_images -p quay.io` ``` 2. As the helm is required, first add the `calico-cloud` charts to the helm repo: ``` `helm repo add calico-cloud https://installer.calicocloud.io/charts` ``` 3. Export the installer image to the variable `INSTALLER_IMAGE`: ``` `INSTALLER_IMAGE="us-docker.pkg.dev/tigera-prod-01/calico-cloud-public/cc-operator:$(helm show chart calico-cloud/calico-cloud | grep version: | sed -e 's/version: *//' -e 's/+/-g/')"` ``` 4. Create an array containing all images required to install Calico Cloud plus the Installer image: ``` `IMAGES=( $INSTALLER_IMAGE quay.io/tigera/operator:v1.29.4 quay.io/tigera/cnx-apiserver:v3.16.1 quay.io/tigera/compliance-benchmarker:v3.16.1 quay.io/tigera/compliance-controller:v3.16.1 quay.io/tigera/compliance-reporter:v3.16.1 quay.io/tigera/compliance-snapshotter:v3.16.1 quay.io/tigera/deep-packet-inspection:v3.16.1 quay.io/tigera/fluentd:v3.16.1 quay.io/tigera/fluentd-windows:v3.16.1 quay.io/tigera/guardian:v3.16.1 quay.io/tigera/intrusion-detection-controller:v3.16.1 quay.io/tigera/packetcapture:v3.16.1 quay.io/tigera/egress-gateway:v3.16.1 quay.io/tigera/l7-collector:v3.16.1 quay.io/tigera/envoy:v3.16.1 quay.io/tigera/prometheus:v3.16.1 quay.io/tigera/prometheus-service:v3.16.1 quay.io/tigera/alertmanager:v3.16.1 quay.io/tigera/cnx-queryserver:v3.16.1 quay.io/tigera/kube-controllers:v3.16.1 quay.io/tigera/cnx-node:v3.16.1 quay.io/tigera/typha:v3.16.1 quay.io/tigera/cni:v3.16.1 quay.io/tigera/cloud-controllers:v3.16.1 quay.io/tigera/es-gateway:v3.16.1 quay.io/tigera/calico-windows-upgrade:v3.16.1 quay.io/tigera/dikastes:v3.16.1 quay.io/tigera/pod2daemon-flexvol:v3.16.1 quay.io/tigera/csi:v3.16.1 quay.io/tigera/node-driver-registrar:v3.16.1 quay.io/tigera/key-cert-provisioner:v1.1.7 quay.io/tigera/image-assurance-admission-controller:v1.6.2 quay.io/tigera/image-assurance-operator:v1.6.2 quay.io/tigera/image-assurance-container-runtime-adaptor:v1.6.2 quay.io/tigera/runtime-security-operator:v1.6.0 quay.io/tigera/skimble:v1.6.0 quay.io/tigera/cc-core:v0.1.5 quay.io/tigera/prometheus-operator:v3.16.1 quay.io/tigera/prometheus-config-reloader:v3.16.1 alpine:3.12.1 )` ``` Please note that the images will vary depending on the Calico Cloud version, so getting the latest version from the [documentation](https://docs.tigera.io/calico-cloud/get-started/setup-private-registry#create-the-list-of-required-images) is highly recommended. To verify if the array contains all images, run a look in the IMAGES array to print them: ``` `for image in ${IMAGES[@]}; do echo $image; done` ``` 5. Export the variables below to the registry and image path: ``` `REGISTRY= IMAGEPATH=""` ``` If all images come from the same path in the registry, set it as blank “”, otherwise, insert the custom path. 6. To upload the images into the private registry, you can use `crane` as per the loop below or customize another loop or way to upload the images. ``` `for image in ${IMAGES[@]}; do img_base=$(echo ${image} | sed "s#^.*/([^/]*/[^/]*$)#1#") crane cp ${image} ${REGISTRY}${img_base} || break done` ``` ## Install Calico Cloud through the private registry After uploading the images to the private registry, open **Calico Cloud UI** > **Managed Clusters** and click **Connect Cluster**. Provide the name and type of the cluster. Click on **Advanced Options** and select **Install via helm and Private registry**. Type the **Image Registry** and optionally, the **Image Path** and **Registry Secret Name** if needed.![Calico Cloud UI: Connect Cluster page. Shows fields for registry secret name, image registry, and image path](https://www.tigera.io/app/uploads/2023/06/How-to-secure-the-cluster-on-a-air-gap-environment-with-Calico-Cloud-4.png) Click on **Connect** and the next screen will provide the command to run in the cluster to install Calico Cloud from the defined private registry. ## Conclusion The Calico Cloud installation will be done without accessing the Internet and the cluster will be isolated and secured from external/public attacks and threats. With Calico Cloud, you can secure your Kubernetes and containerized workload environment, effectively reduce the attack surface using [zero-trust security](https://www.tigera.io/learn/guides/zero-trust/zero-trust-security/), monitor for both known and zero-day threats on an ongoing basis, and mitigate breaches by dynamically responding to threats. Want to learn more? Get started with a [free Calico Cloud trial](https://link.tigera.io/ueOp4). [Best Practices](https://www.tigera.io/tags/best-practices/)[How-To](https://www.tigera.io/tags/how-to/)[Products](https://www.tigera.io/tags/products/) ## Related posts [![The Clearinghouse For AI Agents Has A Blind Spot](https://www.tigera.io/app/uploads/2026/09/Lynx-Clearinghouse-Blog.png)](https://www.tigera.io/blog/clearinghouse/) #### [The Clearinghouse For AI Agents Has A Blind Spot](https://www.tigera.io/blog/clearinghouse/) By [Dillon Barry](https://www.tigera.io/blog/author/dillon-barry/) on Sep 23, 2026 Jamin Ball’s recent piece, “Systems of Record Won the SaaS Era — Clearinghouses Will Win the Agents Era,” is the cleanest articulation I’ve seen of where the durable moat goes next. His argument is simple... [Read more](https://www.tigera.io/blog/clearinghouse/) [![Meet Mylo: An AI-native way to work with Calico](https://www.tigera.io/app/uploads/2026/09/Meet-Mylo-An-AI-native-way-to-work-with-Calico.png)](https://www.tigera.io/blog/meet-mylo-an-ai-native-way-to-work-with-calico/) #### [Meet Mylo: An AI-native way to work with Calico](https://www.tigera.io/blog/meet-mylo-an-ai-native-way-to-work-with-calico/) By [Phil DiCorpo](https://www.tigera.io/blog/author/phil-dicorpo/) on Sep 3, 2026 A library of Calico tools and skills — delivered through the Calico MCP Server What if your hardest network question took ten minutes instead of ten days? Anyone who has operated Kubernetes networking at scale... [Read more](https://www.tigera.io/blog/meet-mylo-an-ai-native-way-to-work-with-calico/) [![The Safest Place to Run an AI Agent Is On a Cluster That Doesn’t Trust It](https://www.tigera.io/app/uploads/2026/08/The-Safest-Place-to-Run-an-AI-Agent-Is-On-a-Cluster-That-Doesnt-Trust-It.png)](https://www.tigera.io/blog/the-safest-place-to-run-an-ai-agent-is-on-a-cluster-that-doesnt-trust-it/) #### [The Safest Place to Run an AI Agent Is On a Cluster That Doesn’t Trust It](https://www.tigera.io/blog/the-safest-place-to-run-an-ai-agent-is-on-a-cluster-that-doesnt-trust-it/) By [Alister Baroi](https://www.tigera.io/blog/author/alister-baroi/) on Aug 27, 2026 Every organization running AI agents has already made a hosting decision. Most made it by accident. The sales team switched on the agent built into their CRM. Engineering is piloting a coding agent in a... [Read more](https://www.tigera.io/blog/the-safest-place-to-run-an-ai-agent-is-on-a-cluster-that-doesnt-trust-it/)