Air-Gapped Deployments

For deployments without internet connectivity to Cartesia’s licensing servers, you can run in air-gapped mode. This mode uses an offline license file instead of real-time authentication. Licenses for air-gapped deployments come in two forms: a temporary license you issue yourself to get a deployment running, and a long-term license that Cartesia issues once you submit an audit bundle from your running deployment.

Temporary licenses

Issue a temporary license yourself from the on-prem portal to bootstrap and test an air-gapped deployment. Temporary licenses expire 3 days after issue.

Open the Deployments tab

Go to the on-prem portal and select the Deployments tab.

The on-prem portal is only accessible under the organization that has on-prem enabled. If you don’t see it, switch to that organization in the account switcher.

Create a deployment

Click New Deployment, enter a name (for example, Production), and click Create. Cartesia generates a temporary license for the deployment. The status moves from Creating to Active once it’s ready.

Download the license

Click Download on the deployment row to save the license file (<deployment-id>-license.txt). Download is available while the license is Active and unexpired.

Seed this file at install time or upload it to a running cluster. See Loading a license. Each deployment row shows its license ID, expiry date, and status:

Status	Meaning
Creating	License generation is in progress
Active	License is valid and available for download
Expired	The license has passed its expiry date
Failed	License generation failed; retry or contact support

Configuration

Terraform
Helm

# In your .tfvars file
authenticate               = false
license_proxy_persistence  = true   # Required for air-gapped mode

infra:
  authenticate: false
licenseProxy:
  persistence:
    enabled: true
    storageClass: gp2  # Use appropriate storage class for your cluster

Loading a License

You can seed a license at install time (recommended for first deployment) or upload one to a running cluster via the /license endpoint.

At install time

Pass the downloaded license file directly to your deploy tool. The chart creates a ConfigMap containing the license and adds an initContainer that copies it into the license-proxy volume on first boot, so terraform apply / helm install is a one-shot setup.

Terraform
Helm

# In your .tfvars file
authenticate              = false
license_proxy_persistence = true
license_proxy_seed_file   = "/path/to/license.json"

Then:

terraform apply

helm install cartesia ./cartesia \
  --set infra.authenticate=false \
  --set licenseProxy.persistence.enabled=true \
  --set-file licenseProxy.licenseContent=/path/to/license.json

Use --set-file to pass the file contents; --set will try to parse the JSON as structured values and fail.

The seed is a one-time bootstrap — if a license already exists on disk, the initContainer skips the copy. Licenses uploaded later via POST /license take precedence automatically (the license proxy picks the license with the latest issued_at), and they are not clobbered on pod restart. To rotate a seeded license, upload the new license with POST /license (see below) — re-running terraform apply / helm upgrade alone will not overwrite an existing license on disk.

On a running cluster

The /license and /audit endpoints are served by the license proxy pod behind the cartesia-license-proxy service, not by the API pod.

In air-gapped mode, the /license endpoint is exposed for license management.

Via Port-Forward

kubectl port-forward svc/cartesia-license-proxy 8080:8080 -n cartesia

In another terminal:

curl -X POST http://localhost:8080/license -d '<license-json>'

Via Ingress

If ingress is enabled:

curl -X POST https://<your-domain>/license -d '<license-json>'

Retrieving Audit Logs

The /audit endpoint is available in air-gapped mode for retrieving usage audit logs:

curl -X GET https://<your-domain>/audit --output audits.tar

These audit logs contain usage metadata for billing reconciliation. No transcript data is included, which you can validate by looking at the contents of the output.

Long-term licenses

A long-term license is bound to a specific deployment and issued for a duration you agree on with Cartesia. Because it’s bound to your deployment, Cartesia issues it from an audit bundle exported by your running cluster rather than self-serve.

Run your deployment on a temporary license

Seed the temporary license and deploy. While running, the deployment establishes its identity and accumulates usage audit logs.

Export the audit bundle

Retrieve the audit logs from the license proxy:

curl -X GET https://<your-domain>/audit --output audits.tar

The bundle contains usage metadata and your deployment’s signature for billing reconciliation. It includes no transcript data, which you can verify by inspecting its contents. See Retrieving audit logs.

Submit the bundle to Cartesia

Send the audit bundle to your Cartesia on-prem contact. Cartesia verifies it and issues a long-term license bound to your deployment signature, valid for the agreed duration.

Install the long-term license

Upload the long-term license to your running cluster with POST /license. The license proxy activates the license with the latest issued_at, so the long-term license takes precedence over the temporary one with no downtime. See On a running cluster.

Repeat the audit-export and submission steps when a long-term license nears expiry to renew it.

The license proxy applies a grace period after a license expires or connectivity is lost, so requests keep being served while you install a renewed license. See License Proxy Server.

Overview

Deployments

Guides

Performance

Temporary licenses

Configuration

Loading a License

At install time

On a running cluster

Via Port-Forward

Via Ingress

Retrieving Audit Logs

Long-term licenses

​Temporary licenses

​Configuration

​Loading a License

​At install time

​On a running cluster

​Via Port-Forward

​Via Ingress

​Retrieving Audit Logs

​Long-term licenses

Temporary licenses

Configuration

Loading a License

At install time

On a running cluster

Via Port-Forward

Via Ingress

Retrieving Audit Logs

Long-term licenses