Skip to main content
7 min read

On-prem and air-gapped prerequisites checklist

On-prem and air-gapped prerequisites checklist

Complete this checklist with your platform, network, security, identity, storage, and database teams. Share it with StackGen before the architecture review.

Do not procure infrastructure from this checklist alone. StackGen must confirm the Kubernetes version, release-specific capacity, image inventory, storage classes, and upgrade path.

Environment details​

  • Data center or private cloud:
  • Environment name:
  • Production or non-production:
  • StackGen hostname:
  • Customer technical owner:
  • Customer security owner:
  • Operations team and escalation contact:
  • Internet-connected / restricted egress / fully air-gapped:

Kubernetes​

Reference sizing: 4 worker nodes with 8 vCPU and 32 GiB each, giving about 32 vCPU and 128 GiB of schedulable capacity, with 60 GiB or more of disk per node. See capacity sizing.

  • A dedicated, supported Kubernetes cluster is available.
  • The control plane and worker nodes meet StackGen-approved CPU, memory, architecture, and disk requirements.
  • At least three worker nodes or the agreed high-availability design is available for production.
  • Dynamic persistent volume provisioning is configured.
  • A default storage class is defined and tested.
  • An ingress controller or approved load balancer design is available.
  • Internal DNS resolution works from user networks and cluster workloads.
  • Cluster monitoring, audit logging, patching, and certificate ownership are assigned.
  • Capacity exists for rolling upgrades without interrupting all replicas.

Record:

  • Kubernetes distribution and version:
  • Node operating system and architecture:
  • Node count:
  • CPU and memory per node:
  • Default storage class:
  • Ingress implementation:

Network and TLS​

  • Users can reach the StackGen hostname over HTTPS.
  • Kubernetes workloads can reach PostgreSQL, object storage, the private registry, DNS, and the identity provider.
  • Required east-west firewall rules are approved.
  • Pod and service address ranges are reserved and do not overlap routed internal networks.
  • About 300 to 400 pod addresses are available at peak node count.
  • One address or virtual IP is reserved for the StackGen ingress endpoint.
  • A customer-issued TLS certificate covers the StackGen hostname.
  • The certificate chain is trusted by user devices and cluster workloads.
  • Certificate storage, renewal, and rotation owners are assigned.
  • No public ACME or Let's Encrypt dependency is present.
  • Any proxy or restricted-egress exception is documented.

Record:

  • Hostname:
  • Virtual IP or load balancer:
  • Certificate authority:
  • Certificate renewal owner:

Private image registry​

  • A private OCI-compatible registry is reachable from every worker node.
  • Registry capacity covers the current release and rollback release.
  • The registry supports the worker-node architecture selected for the cluster.
  • A process exists to import, scan, approve, sign, and promote images.
  • Kubernetes image pull credentials or workload identity are configured.
  • Registry retention does not delete images required for rollback.
  • StackGen has confirmed the release image inventory and registry rewrite method.

Record:

  • Registry hostname:
  • Registry owner:
  • Vulnerability policy:
  • Image retention:

Release transfer and installation​

  • An approved method exists to receive and transfer StackGen release packages.
  • File integrity and checksum verification are part of the transfer process.
  • An internal artifact store keeps the current and rollback packages.
  • An internal Git service is available if the agreed installation uses GitOps.
  • Installation tools can run inside the restricted environment.
  • A non-production environment is available to test installation and upgrades.
  • Your operators have documented change, maintenance window, and rollback procedures.
  • StackGen and your team have agreed how release notes, image lists, and compatibility information will be delivered.

Record:

  • Transfer method:
  • Internal artifact location:
  • Internal Git service, if used:
  • Change approval owner:

PostgreSQL​

Reference sizing: 2 vCPU, 4 GiB, and 32 GiB of storage to start, with room to grow.

  • A supported PostgreSQL service is available in the internal network.
  • The administrator can create the StackGen application databases.
  • Database connections require encryption in transit.
  • Encryption at rest meets your policy.
  • High availability, capacity, and connection limits meet the approved design.
  • Automated backups and point-in-time recovery are configured.
  • Restore procedures are tested before production launch.
  • Database credentials can be injected without storing plaintext in Git.

Record:

  • PostgreSQL version:
  • Endpoint and port:
  • High-availability mode:
  • Backup retention:
  • Restore owner:

Object storage​

  • S3-compatible object storage or the StackGen-approved equivalent is available.
  • Kubernetes workloads can reach it without external network access.
  • The bucket is private and encrypted.
  • Application credentials or workload identity can list, read, write, and delete required objects.
  • Capacity, retention, backup, and recovery requirements are defined.
  • Credential rotation is documented.

Record:

  • Service and version:
  • Endpoint:
  • Bucket:
  • Capacity:
  • Backup owner:

SSO and user access​

  • An approved identity provider is reachable from the cluster and user network.
  • The identity provider is supported and agreed with StackGen.
  • An application registration for StackGen is created in the identity provider.
  • https://<stackgen-domain>/auth/callback is registered as a redirect URI.
  • Client credentials can be delivered through the approved secret process.
  • The initial StackGen administrator email is confirmed.
  • Identity-provider certificate trust is installed in the cluster, if required.
  • User and administrator access has been tested without public network dependencies.
  • Group or role mapping behavior is documented.

Record:

  • Identity provider and version:
  • Administrator email:
  • Client secret rotation owner:

Secrets​

  • A secret-management approach is agreed for database, object storage, SSO, registry, and optional integration credentials.
  • Plaintext secrets are excluded from Git and release-transfer media.
  • Encryption keys and recovery keys have assigned owners.
  • Rotation intervals are documented.
  • Your team can rotate credentials without direct StackGen access.

Optional integrations​

  • Every optional integration has been classified as internal, proxied, or unavailable.
  • An internal Git provider is available if projects will publish generated infrastructure code.
  • An internal mail relay or approved SendGrid route is agreed if notifications are required.
  • An internal or approved AI provider endpoint is available if AI features are required.
  • Any Langfuse or Unleash endpoint is reachable through an approved route if enabled.
  • The product configuration disables integrations that cannot be reached.

Operations and support​

  • Your team owns platform monitoring and first-line incident response.
  • Alert routing and on-call contacts are configured.
  • Database, object storage, registry, and cluster recovery procedures are tested.
  • Upgrade and rollback owners are assigned.
  • A process exists to collect application logs and diagnostic bundles.
  • Logs and bundles can be reviewed and sanitized before export to StackGen.
  • The support transfer method is approved.
  • The installed version and release package are recorded in the configuration inventory.
  • StackGen has reviewed the completed checklist and final architecture.

See on-prem and air-gapped for the operating and release responsibility split.

Last updated on