Air-Gapped Promotion Checklist
A checklist for promoting builds from a lab to production and then to a customer network—Jenkins, Ansible, Kubernetes, Nexus, and scan evidence on every artifact.
An air gap fails in the promotion path, not in the diagram. This is the checklist we use when a build has to leave the lab, enter production, and then reach a customer network without pulling from the public internet.
Four zones, one artifact
Name the zones before you automate them: the build network, the internal lab, production, and the customer network. A hop that still needs outbound internet is a topology problem. The artifact that leaves the lab is the artifact that arrives on the customer site.
Checklist
Tick these before calling promotion audit-ready. Done looks like a release that moves through every zone by pipeline, with scan evidence already attached. It fails an audit when someone copies a build by hand, a runner can see two zones, or evidence is assembled the week of the review.
- Zones are written down: build, lab, production, and the customer network. Each hop is a promotion, not a pull from the internet.
- Jenkins agents stay inside one zone. A lab job cannot deploy to production.
- Nexus (or an equivalent mirror) lives inside the zone. Promotion copies an immutable tag. It does not fetch from a public registry.
- Ansible applies the same hardening bar in the lab and in production, including Kubernetes nodes and the VMs beside them.
- Scan results and the SBOM are attached to the build before it crosses a zone. Reviewers query that bundle.
- A customer install is a controlled remote session from your network, using the lab-validated build. It is not a laptop upload.