For an air-gapped (dark-site) NKP deployment the bastion host must 1) provide password-less SSH connectivity to the CVM/worker nodes and 2) have its clock synchronised to avoid TLS certificate and cluster-coordination problems.

Nutanix NKP Deployment Guide (section “Prepare the Bastion Host”) lists as mandatory steps:

• “Generate (or copy) an SSH key pair and place the public key on every host that will be reached from the bastion.”

• “Configure and enable NTP on the bastion host so that it stays in time sync with the cluster nodes.”

Docker or LDAP services are not cited as bastion-host requirements.

A. Install LDAP Server – Directory services are not required for bastion preparation; NKP consumes existing identity sources separately.

C. Install Docker – Container runtime is only needed on NKP worker/control-plane nodes or a separate registry server, not on the bastion host itself.

1. Nutanix Kubernetes Platform 2.0 Deployment and Operations Guide

“Prepare the Bastion Host” – Steps 1 & 2 (SSH keys

NTP). https://portal.nutanix.com/page/documents/kubernetes-platform/2.0/prepare-bastion

2. Nutanix Karbon Platform Services Air-Gap Installation Guide

“Bastion Host Requirements” – bullet points on SSH key pair and NTP configuration. https://portal.nutanix.com/page/documents/karbon/airgap/bastion-requirements