Comment by kkgupta

One nuance on the air-gapped / shrinkwrap end of the spectrum that I was thinking about afterward is that there is a difference between “no connection back to the vendor” and “just ship binaries and scripts.” One can also imagine shipping a local control plane with the product so provisioning, health checks, upgrades, rollback, etc. still follow a consistent operational model entirely inside the customer boundary. There are several examples in the industry that take this route as well. Obviously that doesn’t remove the enterprise change-control problem — updates to that local control plane still have to go through the customer’s own approval/import process. It just gives you a bit more operational consistency than traditional shrinkwrap software.