ARTIFACTORY: Installing JFrog Platform with Istio Ingress Controller

Introduction 

This document describes how to deploy a JFrog Artifactory on Kubernetes and expose it using the Istio Ingress Gateway. The setup disables Artifactory’s bundled NGINX and relies entirely on Istio for ingress traffic management.
This article will guide you through: Installing the required Istio components, Deploying JFrog Artifactory on Kubernetes using Helm, Disabling Artifactory’s embedded NGINX, Configuring Istio Gateway and VirtualService to expose Artifactory and Verifying access to Artifactory through the Istio Ingress Gateway

Resolution 

Prerequisites

• A running Kubernetes cluster
  
• kubectl is configured to access the cluster
  
• helm v3 installed
  
• Istio Helm repository added:
  

  helm repo add istio https://istio-release.storage.googleapis.com/charts
  helm repo update

  
  
• JFrog Helm repository added:
  

  helm repo add jfrog https://charts.jfrog.io
  helm repo update

  
  
• A DNS hostname pointing to the Istio Ingress Gateway external IP

Step 1: Install Istio Components
Note: 

This step is performed and managed by the customer. JFrog does not install, configure, or manage, and has no control over it.

Install the required Istio components in the istio-system namespace.

helm install istio-base istio/base -n istio-system --create-namespace

Installs Istio CRDs and base cluster resources required by all Istio components.

helm install istiod istio/istiod -n istio-system

Deploys the Istio control plane responsible for sidecar injection, traffic management, and security.

helm install istio-ingress istio/gateway -n istio-system

Deploys the Istio Ingress Gateway to handle external traffic entering the service mesh.
Verify that Istio pods are running:

kubectl get pods -n istio-system

Step 2: Prepare the Artifactory Namespace
Create a dedicated namespace for Artifactory and enable automatic Istio sidecar injection.

kubectl create namespace artifactory
kubectl label namespace artifactory istio-injection=enabled

Step 3: Install Artifactory
Install Artifactory using Helm. Disable the embedded NGINX since Istio will handle ingress traffic.

helm install artifactory jfrog/artifactory \
  --namespace artifactory \
  --set nginx.enabled=false

Verify that Artifactory pods are running:

kubectl get pods -n artifactory

Step 4: Configure Istio Gateway and VirtualService
Create an Istio Gateway and VirtualService to expose Artifactory through the Istio Ingress Gateway.
Create a file named artifactory-istio.yaml:

apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: artifactory-gateway
spec:
  selector:
    istio: ingress
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "<hostname>"
---
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: artifactory
spec:
  hosts:
  - "<hostname>"
  gateways:
  - artifactory-gateway
  http:
  - match:
    - uri:
        prefix: "/"
    route:
    - destination:
        host: artifactory
        port:
          number: 8082
    timeout: 600s

Note: 

Replace <hostname> with the DNS name mapped to the Istio Ingress Gateway.

Apply the configuration:

kubectl apply -f artifactory-istio.yaml -n artifactory

Step 5: Verify Istio Ingress Service
Check the Istio Ingress Gateway service to identify the external IP or load balancer address:

kubectl get svc -n istio-system

Step 6: Validate Artifactory Access
Verify that Artifactory is reachable through Istio by calling the system ping API:

curl http://<hostname>/artifactory/api/system/ping

A successful setup should return:

OK

Conclusion

In this setup:

• Istio manages ingress traffic using Gateway and VirtualService
  
• Artifactory runs without its embedded NGINX
  
• Traffic flows as:

Client → Istio Ingress Gateway → Artifactory Service (8082)