Modern private cloud infrastructure demands enterprise-grade container registry capabilities, particularly in environments where external internet connectivity is restricted or prohibited. Within VMware Cloud Foundation (VCF) 9.0, deploying Supervisor Services in air-gapped environments presents unique technical challenges that require careful planning and precise execution. This guide provides a systematic approach to deploying and managing Harbor as a Supervisor Service in air-gapped VCF deployments, enabling your organization to maintain container image availability while adhering to strict security and compliance requirements.
The critical challenge in air-gapped environments is the “bootstrap problem.” Harbor Supervisor Service requires container images to deploy, but in an air-gapped environment, you have no registry from which to pull those images. This guide addresses this challenge by demonstrating how to establish a bootstrap registry that enables Harbor Supervisor Service deployment, after which Harbor Supervisor Service can become your production container registry.
An air-gapped environment is a network security measure that physically or logically isolates a computer network from unsecured networks, including the internet. For organizations operating in regulated industries such as financial services, government agencies, healthcare, and defense, air-gapped infrastructure is not optional; it is a regulatory requirement.
Hence, we provide you here with a solution to deploying the Harbor Supervisor Service in an air-gapped setup that will then become your OCI registry for the air-gapped environment.
For air-gapped VCF environments, we require a two-phased approach.
Step 1: Bitnami Harbor OVA Deployment
Deploy the Harbor Open Virtual Appliance (OVA) from Bitnami as a virtual machine as the bootstrap registry for storing the Harbor Supervisor Service images. This approach provides:
This bootstrap registry serves a critical purpose: it hosts the Harbor Supervisor Service container images that will be pulled during Harbor Supervisor Service deployment.
Step 2: Harbor Supervisor Service (Production Registry)
Once you have a bootstrap registry operational, you can deploy Harbor as a native Supervisor Service. This becomes your production container registry and provides:
Why This Two-Phase Approach?
Harbor Supervisor Service cannot deploy itself without access to its own container images. In internet-connected environments, these images are pulled from external registries automatically. In air-gapped environments, you must first provide an internal bootstrap registry using the Harbor VM that hosts these images. Once Harbor Supervisor Service is deployed and operational, it becomes the production registry for all your workloads, and the bootstrap registry can be decommissioned or retained as a backup.
This guide covers the complete workflow: setting up a bootstrap Harbor registry, populating it with required images, deploying Harbor Supervisor Service using the bootstrap registry, and using Harbor Supervisor Service as the production registry for workload deployment.
Before beginning deployment, verify your environment meets these requirements:
Now that the bootstrap registry is available, we must pre-stage all required container images by the Harbor Supervisor Service. This section describes the process.
Pre-requisites:
At the time of writing this blog, the latest Carvel Imgpkg available is 0.47.2. For information on the latest version available, refer to the Carvel imgpkg documentation. Since we are using a Windows jumphost with internet connectivity, we download the imgpkg.exe file from GitHub and add it to the Windows Environment Variables list.
Image Collection and Pre-Staging Process:
Add the Harbor Service to vCenter
Update Harbor Supervisor Service Data Values File
Deploy Harbor Supervisor Service
The installation creates a namespace (e.g., svc-harbor-<unique-id>) and deploys all Harbor components. Once the deployment completes, we can access the Harbor Supervisor Service UI using the FQDN provided in the data values yaml file.
From this point, we have an air-gapped, production-grade enterprise registry that can be used to deploy other Supervisor Services as well as applications.
Deploying Supervisor Services in an air-gapped VCF 9.0 environment requires careful planning, precise execution, and ongoing operational discipline. The Harbor Supervisor Service provides a robust foundation for container registry operations without external internet connectivity.
Key takeaways:
By following this guide, you establish a production-ready container registry infrastructure that meets the stringent requirements of air-gapped operations while maintaining the flexibility and scalability expected from modern private cloud platforms.
For additional resources and updates, refer to the Broadcom TechDocs for VCF Supervisor Services.
If you are looking for more information on Harbor, follow our Harbor blog series:
Subscribe to get the latest posts sent to your email.
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。