Platform Installation with Helm [Quick Start]

Complete these steps before deploying to production:

1. Set up external database

Create databases for each product on your external PostgreSQL server and configure them in customvalues.yaml. See Platform Helm Chart - External Database for full instructions and the SQL setup commands.

2. Set up external filestore

Configure S3, GCS, or Azure Blob for artifact storage. See Platform Helm Chart - External FileStore.

3. Build your customvalues.yaml

Start from the sample below and replace the placeholder values.

# customvalues.yaml — JFrog Platform Quick Start (Production)
# Overrides only what differs from platform chart defaults.
# Full defaults: https://github.com/jfrog/charts/blob/master/stable/jfrog-platform/values.yaml

# ── Security keys ────────────────────────────────────────────────────
# Reference the K8s secrets created in step 4.
# Setting under global: propagates to ALL subcharts (Artifactory, Xray,
# Distribution, Catalog) — each chart checks global.masterKeySecretName
# first, ensuring all products share the same master and join key.
global:
  masterKeySecretName: master-key
  joinKeySecretName: join-key

  # External PostgreSQL host — the chart auto-generates per-product URLs:
  #   Artifactory/Distribution/Catalog: jdbc:postgresql://<host>:<port>/<product>?sslmode=<mode>
  #   Xray:                             postgres://<host>:<port>/xray?sslmode=<mode>
  # Note: <product> is the chart name (artifactory, xray, distribution, catalog).
  # Your PostgreSQL databases must be named exactly after the product.
  # If your DB names differ, override database.url per product instead.
  # For cert-based SSL, override database.url per product with full connection params.
  database:
    host: <DB_HOST>
    port: 5432
    sslMode: disable
    initDBCreation: false   # required when postgresql.enabled: false

# ── Disable bundled PostgreSQL ────────────────────────────────────────
postgresql:
  enabled: false

# ── Artifactory ───────────────────────────────────────────────────────
# url/type/driver/postgresql.enabled/waitForDatabase already set in
# platform chart defaults — only credentials need overriding here.
artifactory:
  database:
    user: artifactory
    password: <ARTIFACTORY_DB_PASSWORD>
  # Optional: Mission Control (E+ license required)
  # mc:
  #   enabled: true
  # Optional: AppTrust (both keys required together)
  # apptrust:
  #   enabled: true
  # unifiedpolicy:
  #   enabled: true

# ── Xray ─────────────────────────────────────────────────────────────
# url/postgresql.enabled/rabbitmq.enabled already set in platform defaults.
xray:
  database:
    user: xray
    password: <XRAY_DB_PASSWORD>
  # Optional: JAS (Advanced Security) — E+ / Enterprise X license required
  # serviceAccount:
  #   create: true
  # rbac:
  #   create: true

# To skip Xray entirely:
# xray:
#   enabled: false
# rabbitmq:
#   enabled: false   # RabbitMQ is only used by Xray

# ── Optional products (disabled by default; require license) ──────────
# distribution:
#   enabled: true
#   database:
#     user: distribution
#     password: <DISTRIBUTION_DB_PASSWORD>

# catalog:
#   enabled: true
#   database:
#     user: catalog
#     password: <CATALOG_DB_PASSWORD>

# worker:
#   enabled: true

# bridge:
#   enabled: true

Ready-to-use examples from the jfrog/charts repository:

Key points:

• Database config is at the subchart level (artifactory.database), not artifactory.artifactory.database — because database: is a top-level key in the standalone Artifactory chart
• postgresql.enabled: false is already set per-subchart in the platform chart defaults — you do not need to repeat it in customvalues.yaml
• Artifactory uses JDBC format (jdbc:postgresql://); Xray uses libpq format (postgres://) — the chart auto-generates the correct format per product from global.database.host
• Filestore is at the application level (artifactory.artifactory.persistence) — because persistence: is inside the artifactory: application section of the standalone Artifactory chart
• JAS (Advanced Security) requires xray.serviceAccount.create: true and xray.rbac.create: true — uncomment the JAS block in the sample above. Once set, JAS activates automatically when your JPD is connected to MyJFrog with an Enterprise+ or Enterprise X license (source)
• Curation is a component of Xray (not Artifactory) and requires Catalog to function. Curation is installed when Xray is installed. Enable catalog.enabled: true so Curation can access package vulnerability data, then activate Curation via the UI with the required entitlement. See Installing Catalog
• Catalog is a separate subchart enabled with catalog.enabled: true. It requires its own catalog database (JDBC format) — it does not share the Xray database. See values-catalog-jas.yaml for a combined Catalog + JAS example
• AppTrust is a component (container deployment) within the Artifactory chart, not a separate subchart. Enable it with artifactory.apptrust.enabled: true and artifactory.unifiedpolicy.enabled: true — both keys are required together
• Explicit per-product URLs: If you need a different host per product or want full control, you can override artifactory.database.url, xray.database.url, etc. with explicit connection strings instead of using global.database.host
• Uncomment optional products only if your license covers them (License Matrix)
• For production, store passwords in Kubernetes Secrets instead of plain text — see External Database

4. Create security key secrets

export MASTER_KEY=$(openssl rand -hex 32)
export JOIN_KEY=$(openssl rand -hex 16)

kubectl create namespace jfrog-platform
kubectl -n jfrog-platform create secret generic master-key --from-literal=master-key=$MASTER_KEY
kubectl -n jfrog-platform create secret generic join-key --from-literal=join-key=$JOIN_KEY

Save these keys securely — you need them for upgrades and disaster recovery.

5. Apply a sizing profile (recommended)

The chart ships six pre-built sizing profiles in the jfrog/charts sizing directory. Each profile sets replica counts, HPA bounds, resource requests/limits, JVM options, and DB connection pool sizes for Artifactory, Xray, RabbitMQ, and Distribution.

Apply a profile by adding it as an additional -f flag. Place it before customvalues.yaml — in Helm, the last -f file wins, so customvalues.yaml takes final precedence over the sizing profile for any overlapping keys:

helm upgrade --install jfrog-platform jfrog/jfrog-platform \
  --namespace jfrog-platform \
  --create-namespace \
  --version <CHART_VERSION> \
  -f https://raw.githubusercontent.com/jfrog/charts/master/stable/jfrog-platform/sizing/platform-small.yaml \
  -f customvalues.yaml

6. Pre-install checklist

Before deploying, confirm:

• External PostgreSQL is reachable from inside the cluster
• Databases and users for each product are created
• A default StorageClass exists in the cluster (kubectl get sc)
• Security key secrets are created (step 4 above)
• If using external filestore, the binarystore secret is created (step 2 above)