On this page
Context and Problem Statement
For high-security environments, disconnected OpenShift deployments are an option but require extra preparation (registry mirroring, operator catalogs, and update processes). The 1H2026 engagement needs a decision that balances security requirements with delivery timelines while keeping a path open for stricter connectivity constraints later.
Definitions used in this ADR (Red Hat terms, with explicit project mapping).
Red Hat uses *disconnected environment* as a broad umbrella term for environments without full internet connectivity, with more specific terms for different levels of isolation. Source: Glossary of disconnected environment terms (OCP latest).
- Disconnected environment (Red Hat): "a broad term that can refer to environments with various levels of internet connectivity"; regardless of isolation level, "a cluster in a disconnected environment does not have access to public services hosted by Red Hat and requires additional setup to maintain full cluster functionality".
- Restricted Network (Red Hat): an environment "with limited connection to an external network"; traffic is limited by configurations such as firewalls and proxies.
- Air-gapped network (Red Hat): an environment "completely isolated from an external network" via physical separation (an "air gap").
Project usage in this vault:
- Phase 1 baseline is restricted network (controlled egress to required public Red Hat services/endpoints). This baseline is *not* treated as a Red Hat disconnected environment because it still relies on access to public services hosted by Red Hat for lifecycle.
- Reserve disconnected environment / air-gapped for clusters with no access to public services hosted by Red Hat (mirroring, catalog curation, and offline update workflows apply).
- Avoid the term "connected" for this baseline. If older notes use "connected", interpret it as "restricted network".
Decision Drivers
- Delivery timeline for 1H2026 implementation.
- Ability to start with a restricted network OpenShift AI cluster in Location A while the automated platform is built out in Location B.
- Operational overhead for mirrored registries and offline updates.
- Security requirements for regulated workloads.
Considered Options
- Restricted network OpenShift clusters.
- Disconnected environment OpenShift clusters.
- Air-gapped network OpenShift clusters.
Decision Outcome
Chosen option: Restricted network OpenShift for Phase 1 (1H2026).
Implementation Notes
This ADR decides the connectivity baseline only. Rollout sequencing and platform build-out are tracked in topic-datacenter-rollout-intent and WP-08 Platform Services and Automation.
- Location A: start with a restricted network OpenShift AI cluster to accelerate DevOps automation.
- Location B: build the automated target platform before cutover, including a tiered Quay deployment on the external-profile Clusters as a Service cluster. That Datacenter Services cluster is imported into Advanced Cluster Management (ACM) before production cutover.
If a fully air-gapped environment is required, that is a separate decision (different threat model and logistics) and is not covered by this ADR.
Pros and Cons of the Options
Option 1 – Restricted network OpenShift (chosen)
Pros
- Faster delivery and simpler operator lifecycle management.
- Lower operational overhead for updates and registries.
Cons
- Requires network connectivity to Red Hat services and registries.
Option 2 – Disconnected environment OpenShift
Pros
- Strong isolation for high-security workloads without relying on direct internet egress.
Cons
- Increased delivery time and operational complexity.
- Requires registry mirroring and curated operator catalogs.
- Requires a defined process for updates (image sets, catalogs, and evidence).
Option 3 – Air-gapped network OpenShift
Pros
- Maximum isolation when no network connectivity is permitted.
Cons
- Highest operational complexity (offline transfers, strict supply-chain controls).
- Out of scope for the initial 1H2026 baseline; requires a dedicated follow-up decision and design.