Parent: #739
Depends on: BOM tooling issue (will link once filed)
Summary
Publish a guide for customers running AICR in air-gapped or private-registry environments that lists every public registry AICR pulls from and how to mirror them.
Motivation
AICR spans at least the following public registries across its 23 components:
nvcr.io — NVIDIA container registry (gpu-operator, network-operator, dynamo-platform, k8s-nim-operator, dra-driver)helm.ngc.nvidia.com — NVIDIA Helm chart registryghcr.io — GitHub Container Registry (nvsentinel, nodewright, kai-scheduler, grove, kubeflow-trainer, k8s-ephemeral-storage-metrics)gcr.io / gke.gcr.io / us-docker.pkg.dev — Google (gke-nccl-tcpxo)public.ecr.aws / *.dkr.ecr.us-west-2.amazonaws.com — AWS (aws-ebs-csi-driver, aws-efa)quay.io — Red Hat (cert-manager, prometheus components)registry.k8s.io — Kubernetes SIG (nfd, prometheus-adapter, kueue, csi-sidecars)cr.kgateway.dev — kgatewaydocker.io — Docker Hub (busybox, ubuntu, pytorch in manifests)
Customers behind a corporate firewall or in true air-gapped environments need a complete list and per-component guidance.
Proposed content
docs/integrator/air-gap-deployment.md covering:
- Full registry list with rationale per component.
- Mirroring strategies — Harbor/Artifactory/JFrog patterns; how to override
image.repository per component via --set or values overrides.
- Per-component override examples — how to point each component at a private mirror.
- Verification — how to confirm no images are pulled from the public internet (e.g., via NetworkPolicy or registry firewall logs).
- Generated image list — table sourced from the BOM tool output.
Success criteria
- Customer can mirror all required images and deploy AICR with zero public internet pulls.
- Page is regenerated when the BOM changes.
- Linked from
docs/integrator/.
Notes
This depends on the BOM tooling to produce the authoritative image list. Without that, the registry list above is incomplete (chart-default sub-images are not enumerated).
Parent: #739
Depends on: BOM tooling issue (will link once filed)
Summary
Publish a guide for customers running AICR in air-gapped or private-registry environments that lists every public registry AICR pulls from and how to mirror them.
Motivation
AICR spans at least the following public registries across its 23 components:
nvcr.io— NVIDIA container registry (gpu-operator, network-operator, dynamo-platform, k8s-nim-operator, dra-driver)helm.ngc.nvidia.com— NVIDIA Helm chart registryghcr.io— GitHub Container Registry (nvsentinel, nodewright, kai-scheduler, grove, kubeflow-trainer, k8s-ephemeral-storage-metrics)gcr.io/gke.gcr.io/us-docker.pkg.dev— Google (gke-nccl-tcpxo)public.ecr.aws/*.dkr.ecr.us-west-2.amazonaws.com— AWS (aws-ebs-csi-driver, aws-efa)quay.io— Red Hat (cert-manager, prometheus components)registry.k8s.io— Kubernetes SIG (nfd, prometheus-adapter, kueue, csi-sidecars)cr.kgateway.dev— kgatewaydocker.io— Docker Hub (busybox, ubuntu, pytorch in manifests)Customers behind a corporate firewall or in true air-gapped environments need a complete list and per-component guidance.
Proposed content
docs/integrator/air-gap-deployment.mdcovering:image.repositoryper component via--setor values overrides.Success criteria
docs/integrator/.Notes
This depends on the BOM tooling to produce the authoritative image list. Without that, the registry list above is incomplete (chart-default sub-images are not enumerated).