CI/CD and network automation in air-gapped environments
Control deployments and network changes through pipelines without internet access: traceable and within the classified-information requirements.
- Critical infrastructure (KRITIS)
- Public sector
CI/CD also works in air-gapped environments if all components sit within the isolated network: local GitLab Runners, an internal artefact repository and a dedicated container runtime. Ansible controls network changes based on the source of truth. FlixConsulting builds such pipelines with an authorisation concept, security checks and test environments that require no access to classified information.
Where organisations stand
- Systems run in isolated networks without internet access. Public repositories and cloud services cannot be reached there.
- Software, configurations and network changes are applied by hand. Traceability depends on individual people.
- Development and testing need environments in which nobody requires access to classified information.
How we work
- 01
Analysis
We record security and classified-information requirements, network zones, permitted transfer paths and the existing toolchain.
- 02
Target architecture
We design the pipeline with local GitLab Runners, Artifactory as the internal repository and Podman containers, including an authorisation concept and security checks.
- 03
Delivery
We build pipelines and separate test environments and connect NetBox data via Artifactory and Ansible to the automated network configuration.
- 04
Handover to operations
We document pipelines, roles and approval processes for operations and information security and brief the teams.
What changes afterwards
- Deployments and network changes run through version-controlled pipelines instead of by hand.
- The network configuration follows the data from the source of truth.
- The classified-information requirements are embedded in permissions, review steps and separate test environments.
Critical infrastructure (KRITIS) environment with classified-information requirements: building secure CI/CD pipelines with GitLab Runners in air-gapped environments and automated network configuration.
Questions about this use case
How do updates and packages get into an air-gapped network?
Via clearly defined, checked transfer paths into an internal repository such as Artifactory. Your security requirements determine which paths are permitted. The pipeline uses only these paths.
Can developers contribute without gaining access to classified information?
Yes. Separate development and test environments work without classified data. Only approved artefacts reach the protected environment via the pipeline.
Let us talk about your project.
No obligation, confidential and with a concrete next step.