Failure downloading product-warehouse to Tanzu Hub > Foundation > Capabilities section in air-gapped environment: “connection timed out after 2000ms: downloads2.broadcom.com”

Products

• VMware Tanzu Platform - Hub

Issue/Introduction

• During product-warehouse download phase of the Capabilities enablement in Tanzu Hub, when attempting to stream file from target, encountering failures like: “connection timed out after 2000ms: downloads2.broadcom.com”
• This prevents product downloads, blocking some Tanzu Hub features (such as foundation auto-attach). 
• Logging from the graphql-rest-provider-service pods will show errors like:
  
  
  16:31:20.349Z [thread='Activity Executor taskQueue="tanzu-local-worker-task-queue", namespace="default": 8' user='' org='' trace=''] INFO com.vmware.ensemble.rest.warehouse.downloader.workflow.activities.WarehouseStreamingActivitiesImpl - Start streaming file ####......####4eeaac96756 to vrn/provider:Tanzu/origin:Platform/ProductRelease:product-warehouse~2026-04-29_110920
  16:31:25.115Z [thread='Activity Executor taskQueue="tanzu-local-worker-task-queue", namespace="default": 8' user='' org='' trace=''] WARN io.temporal.internal.activity.ActivityTaskExecutors$ActivityTaskExecutor - Activity failure. ActivityId=########-####-####-75187d67254b, activityType=Stream file from source to target, attempt=6
  org.springframework.web.reactive.function.client.WebClientRequestException: connection timed out after 2000 ms: downloads2.broadcom.com/<IP_ADDRESS>:443
   

Environment

Tanzu Hub 10.4 initial release in air-gapped environments. This includes environments that have Proxy configured and utilize the workaround noted in this KB.

Cause

There is a component of the product-warehouse collector that doesn’t use the proxy configuration when HTTP Proxy is configured.

Resolution

This is resolved in the first patch release of Tanzu Hub: 10.4.1

 

 

Workaround

Manually download the product warehouse using cf CLI, then upload to Tanzu Hub, reference manifest examples detailed in the air-gapped documentation:

1. 1. Login with cf CLI:
      
      # cf login -a https://<HUB_FQDN> --skip-ssl-validation
      
      
      • NOTE: cf CLI version 10 is required
        
   2. Download command (Requires a Refresh TOKEN gathered from the Broadcom support portal):
      
      # cf download-content --manifest download.yaml --target-dir . --refresh-token <TOKEN>  --accept-eulas
      
      
      • Content of the manifest in above download.yaml for reference:
        
        downloads:
- slug: tas-hub-collector
  hubDocumentServiceTtlSeconds: 2628000
  hubDocumentServiceCategory: INSTALLER

- slug: stemcells-ubuntu-jammy
  filePatterns:
    - "*vSphere*"
  hubDocumentServiceTtlSeconds: 2628000
  hubDocumentServiceCategory: BUILD_ARTIFACTS
        
        
        - slug: product-vulnerabilities
          hubDocumentServiceTtlSeconds: 2628000
          hubDocumentServiceCategory: SECURITY_METADATA
         
        - slug: product-sboms
          hubDocumentServiceTtlSeconds: 2628000
          hubDocumentServiceCategory: SBOM
        
        
      • If authentication takes a long time on this step, you might have to regenerate the Refresh Token.
        
        
      • NOTE: The TtlSeconds hubDocumentServiceTtlSeconds: 2628000 configures this to hold the product for 30 days in Tanzu Hub. These products will be automatically removed from Hub and will require this manual process be run again if the TtlSeconds expire.
        
        
   3. Upload command (utilizes the download-content-result.yml file downloaded in Step2):
      
      # cf upload-content --metadata download-content-result.yml