We use rancher (actually just rke wrapped in some simple ansible) for this and it works really well. They have a whole guide for running airgapped [0] however,

We use rancher (actually just rke wrapped in some simple ansible) for this and it works really well. They have a whole guide for running airgapped [0] however, we found that our security requirements (extremely heavily regulated, think nation state and identity) only come into play once the data is ON the systems. So we can happily build a new cluster/environment with internet connections to docker hub or helm.io or whatever, and then as soon as we have data coming in we kill the connectivity -- usually you can wrangle something like this. In either case though, rancher makes running on-prem a really nice experience for us, vs the clusterfsck of kubespray and openshift it replaced. YMMV but I would reccommend giving it a shot. ps -- I would probably avoid K3S if you actually need some redundancy -- unless you're happy managing some kind of distributed mysql setup for it. 0: https://rancher.com/docs/rancher/v2.x/en/installation/other-installation-methods/air-gap/ https://rancher.com/docs/rancher/v2.x/en/installation/other-...