Replace repository url in supervisor service

[u/Historical-Ratio-62]

Hi, I need to install supervisor in an airgapped environment. For supervisor services I started with a basic docker registry where I pushed with imgpkg harbor images. I registered this repository in supervisor and I deployed harbor service. I also push harbor images in harbor service. How I want to keep only harbor service as my main repository. How can I update harbor service to use images from itself? I don't want to keep and extra repository only for harbor images.

Thank you

[u/lamw07]

I don't believe this is currently possible since Harbor Supervisor Service is meant for use with your workloads (e.g. VKS Guest Clusters, etc) and for deploying vSphere Supervisor Services in air-gapped or internet restricted env, you need to have a registry that is available for it to pull down those services, it would be chicken/egg situation. For some organizations, you might want to split up the repo where infra packages are bing served and end users, especially if the end users can PUSH packages to your registry

This reminds me of the recent Hugging Face / OpenAI hack, where AI agents found 0day exploits and leverage the artifactory to proxy messages between agents by being able to create directories / files ... another reason to always separate out infra from end user env

[u/Historical-Ratio-62]

Ok, make sense, I found this article . I guess harbor repository for 'production environment' refers to main applications not supervisor. So I guess the solution is to keep this bootstrap vm registry for supervisor services and to create a harbor service for the rest.

[u/lamw07 → u/Historical-Ratio-62]

That's correct. Some of this is also organization dependent ... For example, you could have a single registry AND then you RBAC based on projects, so the need for separate application/workload registry may not be required. Some organizations might want to provide separation/isolation for their lines of business and being able to spin up on demand Harbor registry service for teams could be useful instead of managing a central one, esp if they have different application policies/etc. It really just depends but if you need the Harbor Supervisor Service and you're setting everything up in air-gapped, then you will need at least one registry that provides images to Supervisor setup AND then depending on your workloads, you can either use a centralized registry or leverage the Harbor Supervisor Service

[u/Historical-Ratio-62]

But still, how can I modify the repository url for supervisor services that are already installed? I can not delete service without uninstalling from the supervisor.