Open Source Summit Korea 2026

Running Kubernetes in air-gapped environments changes how the software supply chain behaves. Image distribution, signature verification, and dependency updates cannot rely on upstream access and need to be handled explicitly.
This talk examines what breaks when enforcing SBOM and image provenance in restricted networks. It covers artifact promotion across trust boundaries, signature verification without external services, base image drift, and coordinating updates across disconnected environments.
The focus is on concrete failure patterns and trade-offs: broken trust chains, stale dependencies, inconsistent SBOM data, and operational overhead introduced by manual controls. Several common supply chain practices do not translate directly to air-gapped setups.

The session shows which parts of the supply chain need to be redesigned to keep provenance and integrity intact without relying on continuous connectivity to upstream ecosystems.