Deploying Harbor Service in Air-Gapped VCF 9.0 Environment

Note: Blog updated on 4th August, 2026 to incorporate changes to the outlined process due to release of the VMware Bootstrap Registry Appliance.

Modern private cloud infrastructure demands enterprise-grade container registry capabilities, particularly in environments where external internet connectivity is restricted or prohibited. Within VMware Cloud Foundation (VCF) 9.0, deploying Supervisor Services in air-gapped environments presents unique technical challenges that require careful planning and precise execution. This guide provides a systematic approach to deploying and managing Harbor as a Supervisor Service in air-gapped VCF deployments, enabling your organization to maintain container image availability while adhering to strict security and compliance requirements.

The critical challenge in air-gapped environments is the “bootstrap problem.” Harbor Supervisor Service requires container images to deploy, but in an air-gapped environment, you have no registry from which to pull those images. This guide addresses this challenge by demonstrating how to establish a bootstrap registry that enables Harbor Supervisor Service deployment, after which Harbor Supervisor Service can become your production container registry.

Understanding Air-Gapped Deployment Challenges

An air-gapped environment is a network security measure that physically or logically isolates a computer network from unsecured networks, including the internet. For organizations operating in regulated industries such as financial services, government agencies, healthcare, and defense, air-gapped infrastructure is not optional; it is a regulatory requirement.

Hence, we provide you here with a solution to deploying the Harbor Supervisor Service in an air-gapped setup that will then become your OCI registry for the air-gapped environment.

Deployment Process

For air-gapped VCF environments, we require a two-phased approach.

Step 1: VMware Bootstrap Registry Appliance OVA Deployment

Download the VMware Bootstrap Registry Appliance from the Broadcom Support Portal as a virtual machine to use as the bootstrap registry for storing the Harbor Supervisor Service images. This approach provides:

Quick deployment through a preconfigured appliance
Traditional VM-based management
Suitable for initial testing or smaller deployments

This bootstrap registry serves a critical purpose: it hosts the Harbor Supervisor Service container images that will be pulled during Harbor Supervisor Service deployment.

Full path for downloading the VMware Bootstrap Registry Appliance:

vSphere 8.0:
- Broadcom Support Portal → My Downloads → VMware vSphere → VMware vSphere Standard → 8.0 → Drivers & Tools → VMware Bootstrap Appliance → BOOTSTRAP_APPLIANCE-2.15.2+vmware.1-25635995.ova
VCF 9.0:
- Broadcom Support Portal → My Downloads → VMware Cloud Foundation → VMware Cloud Foundation 9 – 9.0.2 → VMware vCenter → Drivers & Tools → VMware Bootstrap Appliance → BOOTSTRAP_APPLIANCE-2.15.2+vmware.1-25635995.ova

Important: Strict Scope of Use and Operational Conditions

To maintain architectural compliance and supportability, the deployment of the VMware Bootstrap Registry Appliance is governed by the following mandatory operational constraints:

Exclusive Bootstrap Purpose: The VMware Bootstrap Registry Appliance shall only be utilized to upload and host the OCI images necessary to enable Contour and Harbor Supervisor services on the Supervisor.
Prohibition of Secondary Roles: The appliance must not be utilized for any other purpose within the infrastructure. Specifically, it is explicitly prohibited from serving as a permanent platform registry or enterprise workload registry.
Version-Specific Deployment Constraint: The use of the VMware Bootstrap Registry Appliance is restricted to deployments prior to VCF 9.1. Starting with VCF 9.1, the Fleet Depot Service (FDS) serves as the officially supported engineering solution for air-gapped environment lifecycle management

Step 2: Harbor Supervisor Service (Production Registry)

Once you have a bootstrap registry operational, you can deploy Harbor as a native Supervisor Service. This becomes your production container registry and provides:

Native integration with VCF lifecycle management
Scalability with your Supervisor infrastructure
Enterprise support through standard Broadcom channels
Integration with vSphere Namespaces and VKS clusters

Why This Two-Phase Approach?

Harbor Supervisor Service cannot deploy itself without access to its own container images. In internet-connected environments, these images are pulled from external registries automatically. In air-gapped environments, you must first provide an internal bootstrap registry using the Harbor VM that hosts these images. Once Harbor Supervisor Service is deployed and operational, it becomes the production registry for all your workloads.

This guide covers the complete workflow from setting up a bootstrap Harbor registry, populating it with required images, deploying Harbor Supervisor Service using the bootstrap registry, and using Harbor Supervisor Service as the production registry for workload deployment.

Prerequisites

Before beginning deployment, verify your environment meets these requirements:

VMware Cloud Foundation 9.0 with Supervisor enabled in an air-gapped environment
Harbor Supervisor Service package YAML

1. VMware Bootstrap Registry OVA Deployment

Download the latest VMware Bootstrap Registry Appliance from the Broadcom Support Portal and ensure the OVA is available in a location from where it can be uploaded to the air-gapped vCenter.
Log in to your air-gapped vCenter, right-click on your cluster, and select Deploy OVF Template.

Select the VMware Bootstrap Registry Appliance OVA.

Then, follow the wizard and deploy the OVF template.

After that, power on the Harbor VM and let the initial bootstrap of the VM complete and you will be able to see the IP and FQDN provided to it in vCenter.

Once powered on, log in to the console and confirm Harbor bootstrap completion.

We can now log in to the bootstrap Harbor instance. This will act as our bootstrap registry for storing the Harbor Supervisor Service images. Navigate to the registry project.

When deploying the VMware Bootstrap Registry Appliance, you can choose between generating a new certificate or providing one. Now, we need to establish trust between the Supervisor and this new bootstrap registry. So, we download its CA certificate by clicking on Registry Certificate.

Next, we create a new project called supervisor-services, which will be used to store the Harbor Supervisor Service images.

2. Register VMware Bootstrap Registry with Supervisor

Log back in to your air-gapped vCenter.
We will add the bootstrap registry as a container registry in supervisor. For this, we log in to vCenter > Menu > Supervisor Management > <supervisor> > Configure > Container Registries and click on Add Registry.

Then, provide the bootstrap Harbor VM detail. Then, we paste the contents of the ca.crt file that was downloaded from the bootstrap registry into the input in the UI shown below.

As a result, we can see the registry gets added successfully. Consequently, this will allow Supervisor to use this registry for pulling the Harbor-related Supervisor Service images without additional trust establishment.

3. Image Pre-Staging

Now that the bootstrap registry is available, we must pre-stage all required container images by the Harbor Supervisor Service. The following section describes the process.

Pre-requisites:

Carvel imgpkg

At the time of writing this blog, the latest Carvel Imgpkg available is 0.47.2. For information on the latest version available, refer to the Carvel imgpkg documentation. Since we are using a Windows jumphost with internet connectivity, we download the imgpkg.exe file from GitHub and add it to the Windows Environment Variables list.

Image Collection and Pre-Staging Process:

We open the Harbor Supervisor Service yaml file and identify the carvel packages it pulls during installation to pre-stage them. In this case, we are using Harbor 2.14.3.

Now we copy the bundle on to our Windows jumphost using imgpkg:

    imgpkg copy -b projects.packages.broadcom.com/vsphere/supervisor/harbor-service/2.14.3/harbor:v2.14.3_vmware.2-vks.1 –to-tar harbor-v2.14.3.tar –cosign-signatures

We can see that the Harbor Supervisor Service carvel package is now available as a tar file on our jumphost.

Now we copy the tar file from our jumphost to our bootstrap Harbor registry.

    imgpkg copy –tar harbor-v2.14.3.tar –to-repo harbor-bootstrap.site-a.vcf.lab/supervisor-services/harbor –cosign-signatures –registry-insecure –registry-username admin –registry-password Harbor12345

At this point, we can now see that the Harbor Supervisor Services-related images are now available in the bootstrap Harbor VM registry.

Finally, we update the image URL in the harbor supervisor service YAML from the internet-based location to point it to the air-gapped bootstrap Harbor VM.

4. Install Harbor Supervisor Service

Add the Harbor Service to vCenter

Log in to vSphere Client.
Then, navigate to Menu > Supervisor Management > Services > Add New Service.

Select Upload.

Upload the harbor-service-x.xx.x.yml file.

Click on Finish.

Update Harbor Supervisor Service Data Values File

Configure Harbor Data Values: Edit the harbor-data-values-x.xx.x.yml file to configure Harbor for your air-gapped environment. Details on how to set the values can be found in the Reducing Harbor Deployment Complexity on Kubernetes blog and the Making harbor production-ready: Essential considerations for deployment blog.

Deploy Harbor Supervisor Service

Back in the vSphere Client, locate the Harbor service card.
Then, click Actions > Manage Service.

Then, select your supervisor cluster and click Next.

Paste the modified harbor-data-values-x.xx.x.yml content.

Then click Finish.
Finally, monitor the installation progress.

The installation creates a namespace (e.g., svc-harbor-<unique-id>) and deploys all Harbor components. Once the deployment completes, we can access the Harbor Supervisor Service UI using the FQDN provided in the data values yaml file.

From this point, we have an air-gapped, production-grade enterprise registry that can be used to deploy other Supervisor Services as well as applications.

Conclusion

Deploying Supervisor Services in an air-gapped VCF 9.0 environment requires careful planning, precise execution, and ongoing operational discipline. In particular, the Harbor Supervisor Service provides a robust foundation for container registry operations without external internet connectivity.

Key takeaways:

Architecture decisions: The Harbor Supervisor Service approach offers superior integration with VCF lifecycle management compared to standalone VM deployments. Moreover, it scales with your infrastructure and receives enterprise support.
Pre-staging is critical: Success in air-gapped environments depends entirely on comprehensive image pre-staging. Thus, maintaining detailed image inventories and establishing reliable transfer procedures is essential.
Certificate management: Internal PKI and certificate trust relationships are fundamental. Therefore, implementing automated certificate rotation and maintaining complete certificate chains becomes important.
Security first: Air-gapped environments exist for security reasons. Implement content trust, vulnerability scanning, and RBAC from day one.

By following this guide, you establish a production-ready container registry infrastructure that meets the stringent requirements of air-gapped operations while maintaining the flexibility and scalability expected from modern private cloud platforms.

For additional resources and updates, refer to the official documentation for VCF Supervisor Services.

If you are looking for more information on Harbor, follow our Harbor blog series:

Discover more from VMware Cloud Foundation (VCF) Blog

Subscribe to get the latest posts sent to your email.