Running Knative-based Solution Offline - No Internet Access

[safae-ic]

Hello Knative community,

I have a requirement to deploy a Knative-based solution in an environment without internet access. The client's infrastructure is isolated from the internet for security reasons. However, we want to leverage the capabilities and benefits offered by Knative.

Is it possible to run a Knative-based solution offline, without requiring internet connectivity? Specifically, we would like to know if we can deploy Knative services, use eventing, and manage scaling and autoscaling without internet access. Our focus is on maintaining the functionality and benefits of Knative within the confined network environment.

If running Knative offline is possible, what are the potential considerations, challenges, or limitations we need to be aware of? Are there any alternative approaches or configurations we should consider for a self-contained Knative deployment?

Thank you in advance for any insights, recommendations, or guidance you can provide!

[dprotaso]

Yes it's possible. You will just have to move all the container images to your internal registry and update the references in the deployment.

I haven't used it but I'm aware off folks doing relocation with - https://carvel.dev/imgpkg/

There are probably other tools as well

[safae-ic]

Thank you for the reply , but not only during installation , but I noticed when the connection is down I got error from the webhook and the activator pod crashes and the service not longer available , can we eventually run a knative based solution offline or only allow the communication needed by knative to maintain its functionality.

[dprotaso]

when the connection is down

We expect connectivity between components to work. For example when Knative resources are created/updated we perform validation through k8s admission webhooks. Thus the kubernetes API server needs to communicate to the webhook pod.

Likewise the activator sends metrics to the autoscaler so there needs to be connectivity between those two components.

[safae-ic]

yes the communication inter-pod can be done , but if we have to restrict access to internet , what configuration in the firewall that need to be done to allow just the knative solution to function properly and the services keep running ,in other words , what are the needed external communication ?

[maghnim]

I have the same issue , Could You please explain more i don't understand you what you mean by "we except connectivity between component" because i test in my machine , once i cut the connection all the serving component turn down : webhook , activator , autoscaler , and the services that already deployed down also, is there is any solution to run knative services without networking connection ? or it is required ?

[dprotaso]

what are the needed external communication ?

The networking layers typically have a Kubernetes Services of type=LoadBalancer - we expect traffic to hit the backing pods.

So for Istio it would be the ingressgateway pods, for contour it would be the envoy pods. Generally your firewall rules need to allow incoming traffic to these L7 proxies.

Could You please explain more i don't understand you what you mean by "we except connectivity between component" because i test in my machine , once i cut the connection all the serving component turn down : webhook , activator , autoscaler , and the services that already deployed down also, is there is any solution to run knative services without networking connection ? or it is required ?

You need connectivity because

Our webhook provides defaulting and validation thus you need to make sure the Kubernetes API Server can reach the webhook.

Other things that happen within the cluster are:
Activator sends metrics to the autoscaler
Autoscaler scrapes pods for metrics
If one Knative Service hits another Knative Service's internal URL then it will need to go through the internal shared L7 proxy.