Deploy and support Gateway in an air-gapped environment

Transfer the architecture-matched release tarball, configuration template, state key, certificates, and this documentation through your approved offline process. Install using standalone. Run node-id, transfer the Gateway/replica IDs and entitlement request to the issuer, then transfer the returned signed license back and install it. License validation, lease service, HA replication, and report generation work without Internet access.

Disable telemetry unless a customer-operated Collector is reachable inside the air-gapped network. The only optional outbound integration is that Collector; Gateway does not contact Keystone. Generate reports locally with keystone-gateway report --format json, inspect them, and transfer them out using approved media. For upgrades and renewals, repeat the controlled artifact/license transfer, back up state and secrets first, and follow upgrade and license renewal.