Outbound connections
This page lists every connection Omnia’s chart-deployed components open to a
host outside the cluster, other than image pulls and the endpoints you
configure yourself. Set airGapped: true to turn off every connection that
is on by default.
airGapped
Section titled “airGapped”airGapped: false| Setting | Effect when airGapped: true |
|---|---|
telemetry.enabled | Ignored. The operator Deployment gets OMNIA_TELEMETRY_ENABLED=false, and the operator registers no telemetry reporter. |
| Licence activation and heartbeat | Off. The operator runs with --air-gapped and registers no licence-activation controller. The licence is still validated offline, and every licensed feature still works. |
enterprise.communityTemplates | The community templates source is not created while url is the GitHub default, and the GitHub URL is not forwarded to the operator. A url you point at an in-cluster mirror keeps the source. |
operator.promptPackSchema.source | network fails the render. |
controlPlane.url | A non-empty value fails the render. |
awsMarketplace.productSku | A non-empty value fails the render. |
gcpMarketplace.reportingSecret | A non-empty value fails the render. |
grafana.plugins | A non-empty list with grafana.enabled: true fails the render. |
dashboard.avatars.gravatar | true fails the render. |
A setting that is on by default is overridden, because the chart cannot tell
an explicit true from the default. A setting that is off by default and names
an outside host fails the render, and the error lists every such value at once.
The operator enforces the same rules without the chart. Started with
--air-gapped, it skips telemetry and licence activation, and refuses to start
with --promptpack-schema-source=network, --control-plane-url,
--aws-license-product-sku or --gcp-usage-reporting-secret.
airGapped does not change image references. Mirror the images and set each
*.image.repository to your registry.
Server-side connections
Section titled “Server-side connections”These connections leave the cluster from an Omnia pod.
| Destination | Component | Default | When it is made | Turn off with |
|---|---|---|---|---|
https://license.altairalabs.ai/v1/reports | operator | On, Core and Enterprise | Anonymous install report, shortly after start and then every 24 hours. See Install telemetry. | telemetry.enabled: false, or airGapped: true |
https://license.altairalabs.ai/v1/licenses/activate and its heartbeat endpoints | operator | On when enterprise.enabled is true and an Enterprise licence is installed | Activates the licence, then heartbeats every 24 hours. | airGapped: true |
https://github.com/AltairaLabs/promptkit-templates.git | arena-controller, syncing the community-templates ArenaTemplateSource | On when enterprise.enabled and defaultWorkspace.enabled are both true | Every enterprise.communityTemplates.syncInterval (1h). | enterprise.communityTemplates.enabled: false, or airGapped: true |
https://promptpack.org/schema/... | operator | Off | When operator.promptPackSchema.source is network, for each pack whose $schema names a version. | Leave source: embedded |
controlPlane.url | operator | Off | Registration, heartbeat and telemetry to the Commercial Control Plane. | Leave controlPlane.url empty |
AWS License Manager (license-manager.<region>.amazonaws.com) | operator | Off | Entitlement check every awsMarketplace.interval. | Leave awsMarketplace.productSku empty |
Google Service Control (servicecontrol.googleapis.com) | operator | Off | Usage report for a paid Google Cloud Marketplace plan. | Leave gcpMarketplace.reportingSecret empty |
grafana.com | Grafana subchart | Off (grafana.enabled: false) | Downloads each entry in grafana.plugins when Grafana starts. | grafana.plugins: [] |
stats.grafana.org, grafana.com | Grafana, Loki and Alloy subcharts | Off | Usage reporting, update checks and news feed. The chart turns these off in grafana.grafana.ini.analytics, grafana.grafana.ini.news, loki.loki.analytics and alloy.alloy.enableReporting, as it does in tempo.tempo.reportingEnabled. | Keep the chart’s values |
Browser-side connections
Section titled “Browser-side connections”These requests come from the browser of a person using the dashboard, not from the cluster, so a network policy on the cluster does not stop them.
| Destination | Default | When it is made | Turn off with |
|---|---|---|---|
https://www.gravatar.com/avatar/<sha256 of email> | Off | With dashboard.avatars.gravatar: true, the dashboard’s user menu loads an avatar for the signed-in user. The request carries a SHA-256 hash of the user’s email. When the setting is off, or the image fails to load, the menu shows the user’s initials. | dashboard.avatars.gravatar: false. airGapped: true refuses true. |
https://fonts.googleapis.com | Off | A branding preset or dashboard.branding.fonts.url names a Google Fonts stylesheet. The default brand uses fonts bundled in the dashboard image. | Leave dashboard.branding.fonts.url empty, and use no preset that names one |
omnia.altairalabs.ai, altairalabs.ai | On | Documentation and licensing links, followed only when clicked. | Not configurable |
The /docs pages of session-api, memory-api and privacy-api load their API
viewer, Scalar @scalar/api-reference, from the service itself at
/docs/scalar.js. The viewer is built into each binary, and the page turns off
its web fonts and telemetry, so /docs contacts no other host.
Connections you configure
Section titled “Connections you configure”airGapped does not turn these off. Each one points wherever you set it.
| Connection | Configured by |
|---|---|
| LLM, embedding, speech and rerank providers | Provider resources |
| Git, OCI and S3 sources | PromptPackSource, SkillSource, ArenaTemplateSource and ArenaProject resources |
| HTTP, MCP, gRPC and OpenAPI tools | ToolRegistry resources |
| Other A2A agents | AgentRuntime spec.a2aClients |
| OIDC issuers and JWKS endpoints | dashboard.oauth, managementApi sign-in and AgentRuntime facade auth |
| Microsoft Graph, for Azure group overage | Azure OIDC sign-in |
| OTLP traces | tracing.endpoint |
| Object storage for media and session archives | Workspace and retention-policy storage settings |
Verifying a render
Section titled “Verifying a render”hack/check-air-gapped-render.shThe script renders the chart with airGapped: true for Core and for
Enterprise with the starter workspace, and fails on any URL whose host is not a
Service name, a .svc or .svc.cluster.local name, <service>.<release namespace>, or localhost. YAML comment lines are skipped. CI runs it in the
Helm Validation job.