# Outbound connections

This page lists every connection Omnia's chart-deployed components open to a
host outside the cluster, other than image pulls and the endpoints you
configure yourself. Set `airGapped: true` to turn off every connection that
is on by default.

## `airGapped`

```yaml
airGapped: false
```

| Setting | Effect when `airGapped: true` |
|---|---|
| `telemetry.enabled` | Ignored. The operator Deployment gets `OMNIA_TELEMETRY_ENABLED=false`, and the operator registers no telemetry reporter. |
| Licence activation and heartbeat | Off. The operator runs with `--air-gapped` and registers no licence-activation controller. The licence is still validated offline, and every licensed feature still works. |
| `enterprise.communityTemplates` | The community templates source is not created while `url` is the GitHub default, and the GitHub URL is not forwarded to the operator. A `url` you point at an in-cluster mirror keeps the source. |
| `operator.promptPackSchema.source` | `network` fails the render. |
| `controlPlane.url` | A non-empty value fails the render. |
| `awsMarketplace.productSku` | A non-empty value fails the render. |
| `gcpMarketplace.reportingSecret` | A non-empty value fails the render. |
| `grafana.plugins` | A non-empty list with `grafana.enabled: true` fails the render. |
| `dashboard.avatars.gravatar` | `true` fails the render. |

A setting that is on by default is overridden, because the chart cannot tell
an explicit `true` from the default. A setting that is off by default and names
an outside host fails the render, and the error lists every such value at once.

The operator enforces the same rules without the chart. Started with
`--air-gapped`, it skips telemetry and licence activation, and refuses to start
with `--promptpack-schema-source=network`, `--control-plane-url`,
`--aws-license-product-sku` or `--gcp-usage-reporting-secret`.

`airGapped` does not change image references. Mirror the images and set each
`*.image.repository` to your registry.

## Server-side connections

These connections leave the cluster from an Omnia pod.

| Destination | Component | Default | When it is made | Turn off with |
|---|---|---|---|---|
| `https://license.altairalabs.ai/v1/reports` | operator | On, Core and Enterprise | Anonymous install report, shortly after start and then every 24 hours. See [Install telemetry](/reference/platform/telemetry/). | `telemetry.enabled: false`, or `airGapped: true` |
| `https://license.altairalabs.ai/v1/licenses/activate` and its heartbeat endpoints | operator | On when `enterprise.enabled` is true and an Enterprise licence is installed | Activates the licence, then heartbeats every 24 hours. | `airGapped: true` |
| `https://github.com/AltairaLabs/promptkit-templates.git` | arena-controller, syncing the `community-templates` ArenaTemplateSource | On when `enterprise.enabled` and `defaultWorkspace.enabled` are both true | Every `enterprise.communityTemplates.syncInterval` (`1h`). | `enterprise.communityTemplates.enabled: false`, or `airGapped: true` |
| `https://promptpack.org/schema/...` | operator | Off | When `operator.promptPackSchema.source` is `network`, for each pack whose `$schema` names a version. | Leave `source: embedded` |
| `controlPlane.url` | operator | Off | Registration, heartbeat and telemetry to the Commercial Control Plane. | Leave `controlPlane.url` empty |
| AWS License Manager (`license-manager.<region>.amazonaws.com`) | operator | Off | Entitlement check every `awsMarketplace.interval`. | Leave `awsMarketplace.productSku` empty |
| Google Service Control (`servicecontrol.googleapis.com`) | operator | Off | Usage report for a paid Google Cloud Marketplace plan. | Leave `gcpMarketplace.reportingSecret` empty |
| `grafana.com` | Grafana subchart | Off (`grafana.enabled: false`) | Downloads each entry in `grafana.plugins` when Grafana starts. | `grafana.plugins: []` |
| `stats.grafana.org`, `grafana.com` | Grafana, Loki and Alloy subcharts | Off | Usage reporting, update checks and news feed. The chart turns these off in `grafana.grafana.ini.analytics`, `grafana.grafana.ini.news`, `loki.loki.analytics` and `alloy.alloy.enableReporting`, as it does in `tempo.tempo.reportingEnabled`. | Keep the chart's values |

## Browser-side connections

These requests come from the browser of a person using the dashboard, not from
the cluster, so a network policy on the cluster does not stop them.

| Destination | Default | When it is made | Turn off with |
|---|---|---|---|
| `https://www.gravatar.com/avatar/<sha256 of email>` | Off | With `dashboard.avatars.gravatar: true`, the dashboard's user menu loads an avatar for the signed-in user. The request carries a SHA-256 hash of the user's email. When the setting is off, or the image fails to load, the menu shows the user's initials. | `dashboard.avatars.gravatar: false`. `airGapped: true` refuses `true`. |
| `https://fonts.googleapis.com` | Off | A branding preset or `dashboard.branding.fonts.url` names a Google Fonts stylesheet. The default brand uses fonts bundled in the dashboard image. | Leave `dashboard.branding.fonts.url` empty, and use no preset that names one |
| `omnia.altairalabs.ai`, `altairalabs.ai` | On | Documentation and licensing links, followed only when clicked. | Not configurable |

The `/docs` pages of session-api, memory-api and privacy-api load their API
viewer, Scalar `@scalar/api-reference`, from the service itself at
`/docs/scalar.js`. The viewer is built into each binary, and the page turns off
its web fonts and telemetry, so `/docs` contacts no other host.

## Connections you configure

`airGapped` does not turn these off. Each one points wherever you set it.

| Connection | Configured by |
|---|---|
| LLM, embedding, speech and rerank providers | `Provider` resources |
| Git, OCI and S3 sources | `PromptPackSource`, `SkillSource`, `ArenaTemplateSource` and `ArenaProject` resources |
| HTTP, MCP, gRPC and OpenAPI tools | `ToolRegistry` resources |
| Other A2A agents | `AgentRuntime` `spec.a2aClients` |
| OIDC issuers and JWKS endpoints | `dashboard.oauth`, `managementApi` sign-in and `AgentRuntime` facade auth |
| Microsoft Graph, for Azure group overage | Azure OIDC sign-in |
| OTLP traces | `tracing.endpoint` |
| Object storage for media and session archives | Workspace and retention-policy storage settings |

## Verifying a render

```bash
hack/check-air-gapped-render.sh
```

The script renders the chart with `airGapped: true` for Core and for
Enterprise with the starter workspace, and fails on any URL whose host is not a
Service name, a `.svc` or `.svc.cluster.local` name, `<service>.<release
namespace>`, or `localhost`. YAML comment lines are skipped. CI runs it in the
Helm Validation job.

## Related pages

- [Install telemetry](/reference/platform/telemetry/)
- [Helm values](/reference/platform/helm-values/)
- [Licensing](/explanation/platform/licensing/)