Back to Charts

JFrog Artifactory Helm Chart - DEPRECATED

stable/artifactory/README.md

latest21.1 KB
Original Source

JFrog Artifactory Helm Chart - DEPRECATED

This chart is deprecated! You can find the new chart in:

bash
helm repo add jfrog https://charts.jfrog.io

Prerequisites Details

Chart Details

This chart will do the following:

  • Deploy Artifactory-Pro/Artifactory-Edge (or OSS if set custom image)
  • Deploy a PostgreSQL database using the stable/postgresql chart
  • Deploy an optional Nginx server
  • Optionally expose Artifactory with Ingress Ingress documentation

Installing the Chart

To install the chart with the release name artifactory:

bash
$ helm install --name artifactory stable/artifactory

Deploying Artifactory OSS

By default it will run Artifactory-Pro to run Artifactory-Oss use following command:

bash
$ helm install --name artifactory --set artifactory.image.repository=docker.bintray.io/jfrog/artifactory-oss stable/artifactory

Deploying Artifactory with replicator enabled

bash
## Artifactory replicator is disabled by default. To enable it use the following:
$ helm install --name artifactory --set artifactory.replicator.enabled=true stable/artifactory

Accessing Artifactory

NOTE: It might take a few minutes for Artifactory's public IP to become available. Follow the instructions outputted by the install command to get the Artifactory IP to access it.

Updating Artifactory

Once you have a new chart version, you can update your deployment with

bash
$ helm upgrade artifactory --namespace artifactory stable/artifactory

This will apply any configuration changes on your existing deployment.

Artifactory memory and CPU resources

The Artifactory Helm chart comes with support for configured resource requests and limits to Artifactory, Nginx and PostgreSQL. By default, these settings are commented out. It is highly recommended to set these so you have full control of the allocated resources and limits. Artifactory java memory parameters can (and should) also be set to match the allocated resources with artifactory.javaOpts.xms and artifactory.javaOpts.xmx.

bash
# Example of setting resource requests and limits to all pods (including passing java memory settings to Artifactory)
$ helm install --name artifactory \
               --set artifactory.resources.requests.cpu="500m" \
               --set artifactory.resources.limits.cpu="2" \
               --set artifactory.resources.requests.memory="1Gi" \
               --set artifactory.resources.limits.memory="4Gi" \
               --set artifactory.javaOpts.xms="1g" \
               --set artifactory.javaOpts.xmx="4g" \
               --set nginx.resources.requests.cpu="100m" \
               --set nginx.resources.limits.cpu="250m" \
               --set nginx.resources.requests.memory="250Mi" \
               --set nginx.resources.limits.memory="500Mi" \
               stable/artifactory

Get more details on configuring Artifactory in the official documentation.

Customizing Database password

You can override the specified database password (set in values.yaml), by passing it as a parameter in the install command line

bash
$ helm install --name artifactory --namespace artifactory --set postgresql.postgresPassword=12_hX34qwerQ2 stable/artifactory

You can customise other parameters in the same way, by passing them on helm install command line.

Deleting Artifactory

bash
$ helm delete --purge artifactory

This will completely delete your Artifactory Pro deployment.
IMPORTANT: This will also delete your data volumes. You will lose all data!

Create Distribution Cert for Artifactory Edge

bash
# Create private.key and root.crt
$ openssl req -newkey rsa:2048 -nodes -keyout private.key -x509 -days 365 -out root.crt

Once Created, Use it to create ConfigMap

bash
# Create ConfigMap distribution-certs
$ kubectl create configmap distribution-certs --from-file=private.key=private.key --from-file=root.crt=root.crt

Pass it to helm

bash
$ helm install --name artifactory --set artifactory.distributionCerts=distribution-certs stable/artifactory

Kubernetes Secret for Artifactory License

You can deploy the Artifactory license as a Kubernetes secret. Prepare a text file with the license written in it.

bash
# Create the Kubernetes secret (assuming the local license file is 'art.lic')
$ kubectl create secret generic artifactory-license --from-file=./art.lic

# Pass the license to helm
$ helm install --name artifactory --set artifactory.license.secret=artifactory-license,artifactory.license.dataKey=art.lic stable/artifactory

NOTE: You have to keep passing the license secret parameters as --set artifactory.license.secret=artifactory-license,artifactory.license.dataKey=art.lic on all future calls to helm install and helm upgrade!

Bootstrapping Artifactory

IMPORTANT: Bootstrapping Artifactory needs license. Pass license as shown in above section.

  1. Create bootstrap-config.yaml with artifactory.config.import.xml and security.import.xml as shown below:
apiVersion: v1
kind: ConfigMap
metadata:
  name: my-release-bootstrap-config
data:
  artifactory.config.import.xml: |
    <config contents>
  security.import.xml: |
    <config contents>
  1. Create configMap in Kubernetes:
bash
$ kubectl apply -f bootstrap-config.yaml
  1. Pass the configMap to helm
bash
$ helm install --name artifactory --set artifactory.license.secret=artifactory-license,artifactory.license.dataKey=art.lic,artifactory.configMapName=my-release-bootstrap-config stable/artifactory

Use custom nginx.conf with Nginx

Steps to create configMap with nginx.conf

  • Create nginx.conf file.
bash
kubectl create configmap nginx-config --from-file=nginx.conf
  • Pass configMap to helm install
bash
helm install --name artifactory-ha --set nginx.customConfigMap=nginx-config stable/artifactory-ha

Use an external Database

There are cases where you will want to use a different database and not the enclosed PostgreSQL. See more details on configuring the database

The official Artifactory Docker images include the PostgreSQL database driver. For other database types, you will have to add the relevant database driver to Artifactory's tomcat/lib

This can be done with the following parameters

bash
# Make sure your Artifactory Docker image has the MySQL database driver in it
...
--set postgresql.enabled=false \
--set artifactory.postStartCommand="curl -L -o /opt/jfrog/artifactory/tomcat/lib/mysql-connector-java-5.1.41.jar https://jcenter.bintray.com/mysql/mysql-connector-java/5.1.41/mysql-connector-java-5.1.41.jar && chown 1030:1030 /opt/jfrog/artifactory/tomcat/lib/mysql-connector-java-5.1.41.jar" \
--set database.type=mysql \
--set database.host=${DB_HOST} \
--set database.port=${DB_PORT} \
--set database.user=${DB_USER} \
--set database.password=${DB_PASSWORD} \
...

NOTE: You must set postgresql.enabled=false in order for the chart to use the database.* parameters. Without it, they will be ignored!

Deleting Artifactory

To delete the Artifactory.

bash
$ helm delete --purge artifactory

This will completely delete your Artifactory HA cluster.

Custom Docker registry for your images

If you need to pull your Docker images from a private registry, you need to create a Kubernetes Docker registry secret and pass it to helm

bash
# Create a Docker registry secret called 'regsecret'
$ kubectl create secret docker-registry regsecret --docker-server=<your-registry-server> --docker-username=<your-name> --docker-password=<your-pword> --docker-email=<your-email>

Once created, you pass it to helm

bash
$ helm install --name artifactory --set imagePullSecrets=regsecret stable/artifactory

Configuration

The following table lists the configurable parameters of the artifactory chart and their default values.

ParameterDescriptionDefault
imagePullSecretsDocker registry pull secret
serviceAccount.createSpecifies whether a ServiceAccount should be createdtrue
serviceAccount.nameThe name of the ServiceAccount to createGenerated using the fullname template
rbac.createSpecifies whether RBAC resources should be createdtrue
rbac.role.rulesRules to create[]
artifactory.nameArtifactory nameartifactory
artifactory.replicaCountReplica count for Artifactory deployment1
artifactory.image.pullPolicyContainer pull policyIfNotPresent
artifactory.image.repositoryContainer imagedocker.bintray.io/jfrog/artifactory-pro
artifactory.image.versionContainer tag6.1.0
artifactory.service.nameArtifactory service name to be set in Nginx configurationartifactory
artifactory.service.typeArtifactory service typeClusterIP
artifactory.externalPortArtifactory service external port8081
artifactory.internalPortArtifactory service internal port8081
artifactory.internalPortReplicatorReplicator service internal port6061
artifactory.externalPortReplicatorReplicator service external port6061
artifactory.livenessProbe.enabledEnable liveness probetrue
artifactory.livenessProbe.initialDelaySecondsDelay before liveness probe is initiated180
artifactory.livenessProbe.periodSecondsHow often to perform the probe10
artifactory.livenessProbe.timeoutSecondsWhen the probe times out10
artifactory.livenessProbe.successThresholdMinimum consecutive successes for the probe to be considered successful after having failed.1
artifactory.livenessProbe.failureThresholdMinimum consecutive failures for the probe to be considered failed after having succeeded.10
artifactory.readinessProbe.enabledwould you like a readinessProbe to be enabledtrue
artifactory.readinessProbe.initialDelaySecondsDelay before readiness probe is initiated60
artifactory.readinessProbe.periodSecondsHow often to perform the probe10
artifactory.readinessProbe.timeoutSecondsWhen the probe times out10
artifactory.readinessProbe.successThresholdMinimum consecutive successes for the probe to be considered successful after having failed.1
artifactory.readinessProbe.failureThresholdMinimum consecutive failures for the probe to be considered failed after having succeeded.10
artifactory.persistence.mountPathArtifactory persistence volume mount path"/var/opt/jfrog/artifactory"
artifactory.persistence.enabledArtifactory persistence volume enabledtrue
artifactory.persistence.accessModeArtifactory persistence volume access modeReadWriteOnce
artifactory.persistence.sizeArtifactory persistence volume size20Gi
artifactory.resources.requests.memoryArtifactory initial memory request
artifactory.resources.requests.cpuArtifactory initial cpu request
artifactory.resources.limits.memoryArtifactory memory limit
artifactory.resources.limits.cpuArtifactory cpu limit
artifactory.javaOpts.xmsArtifactory java Xms size
artifactory.javaOpts.xmxArtifactory java Xms size
artifactory.javaOpts.otherArtifactory additional java options
artifactory.replicator.enabledEnable Artifactory Replicatorfalse
artifactory.distributionCertsName of ConfigMap for Artifactory Distribution Certificate``
artifactory.replicator.publicUrlArtifactory Replicator Public URL
ingress.enabledIf true, Artifactory Ingress will be createdfalse
ingress.annotationsArtifactory Ingress annotations{}
ingress.hostsArtifactory Ingress hostnames[]
ingress.tlsArtifactory Ingress TLS configuration (YAML)[]
nginx.nameNginx namenginx
nginx.enabledDeploy nginx servertrue
nginx.replicaCountNginx replica count1
nginx.image.repositoryContainer imagedocker.bintray.io/jfrog/nginx-artifactory-pro
nginx.image.versionContainer tag6.1.0
nginx.image.pullPolicyContainer pull policyIfNotPresent
nginx.service.typeNginx service typeLoadBalancer
nginx.service.loadBalancerSourceRangesNginx service array of IP CIDR ranges to whitelist (only when service type is LoadBalancer)
nginx.loadBalancerIPProvide Static IP to configure with Nginx
nginx.externalPortHttpNginx service external port80
nginx.internalPortHttpNginx service internal port80
nginx.externalPortHttpsNginx service external port443
nginx.internalPortHttpsNginx service internal port443
nginx.internalPortReplicatorReplicator service internal port6061
nginx.externalPortReplicatorReplicator service external port6061
nginx.livenessProbe.enabledEnable liveness probetrue
nginx.livenessProbe.initialDelaySecondsDelay before liveness probe is initiated60
nginx.livenessProbe.periodSecondsHow often to perform the probe10
nginx.livenessProbe.timeoutSecondsWhen the probe times out10
nginx.livenessProbe.successThresholdMinimum consecutive successes for the probe to be considered successful after having failed.10
nginx.livenessProbe.failureThresholdMinimum consecutive failures for the probe to be considered failed after having succeeded.1
nginx.readinessProbe.enabledwould you like a readinessProbe to be enabledtrue
nginx.readinessProbe.initialDelaySecondsDelay before readiness probe is initiated60
nginx.readinessProbe.periodSecondsHow often to perform the probe10
nginx.readinessProbe.timeoutSecondsWhen the probe times out10
nginx.readinessProbe.successThresholdMinimum consecutive successes for the probe to be considered successful after having failed.10
nginx.readinessProbe.failureThresholdMinimum consecutive failures for the probe to be considered failed after having succeeded.1
nginx.tlsSecretNameSSL secret that will be used by the Nginx pod
nginx.env.artUrlNginx Environment variable Artifactory URL"http://artifactory:8081/artifactory"
nginx.env.sslNginx Environment enable ssltrue
nginx.env.skipAutoConfigUpdateNginx Environment to disable auto configuration updatefalse
nginx.customConfigMapNginx CustomeConfigMap name for nginx.conf
nginx.persistence.mountPathNginx persistence volume mount path"/var/opt/jfrog/nginx"
nginx.persistence.enabledNginx persistence volume enabledtrue
nginx.persistence.accessModeNginx persistence volume access modeReadWriteOnce
nginx.persistence.sizeNginx persistence volume size5Gi
nginx.resources.requests.memoryNginx initial memory request
nginx.resources.requests.cpuNginx initial cpu request
nginx.resources.limits.memoryNginx memory limit
nginx.resources.limits.cpuNginx cpu limit

Specify each parameter using the --set key=value[,key=value] argument to helm install.

Ingress and TLS

To get Helm to create an ingress object with a hostname, add these two lines to your Helm command:

helm install --name artifactory \
  --set ingress.enabled=true \
  --set ingress.hosts[0]="artifactory.company.com" \
  --set artifactory.service.type=NodePort \
  --set nginx.enabled=false \
  stable/artifactory

If your cluster allows automatic creation/retrieval of TLS certificates (e.g. cert-manager), please refer to the documentation for that mechanism.

To manually configure TLS, first create/retrieve a key & certificate pair for the address(es) you wish to protect. Then create a TLS secret in the namespace:

console
kubectl create secret tls artifactory-tls --cert=path/to/tls.cert --key=path/to/tls.key

Include the secret's name, along with the desired hostnames, in the Artifactory Ingress TLS section of your custom values.yaml file:

  ingress:
    ## If true, Artifactory Ingress will be created
    ##
    enabled: true

    ## Artifactory Ingress hostnames
    ## Must be provided if Ingress is enabled
    ##
    hosts:
      - artifactory.domain.com
    annotations:
      kubernetes.io/tls-acme: "true"
    ## Artifactory Ingress TLS configuration
    ## Secrets must be manually created in the namespace
    ##
    tls:
      - secretName: artifactory-tls
        hosts:
          - artifactory.domain.com

https://www.jfrog.com https://www.jfrog.com/confluence/