short term workaround: - moved private reg to management subnet - isolated with security groups long term resolution: - need to identify resolution for api access within the airgap subnet