Managing Helm with JFrog CLI

The JFrog CLI provides seamless integration with the native Helm package manager, enabling you to push charts to OCI-compatible registries in Artifactory while automatically collecting build information.

When you use jf helm commands (for example, jf helm push, jf helm package), the CLI acts as a transparent wrapper that provides Artifactory-aware capabilities such as:

Centralized and consistent authentication
Automatic build-info collection
OCI registry integration

Helm runs in Native Mode by default. The CLI executes the upstream Helm client without modification, passing all arguments directly to the native Helm binary. There is no Wrapped Mode for Helm.

Mode of Operation

Native Mode (Default)

In Native Mode, the JFrog CLI executes the upstream Helm client directly. All Helm configuration (repositories, credentials) must be set up using standard Helm commands or OCI registry authentication.

The CLI intercepts specific commands to enable:

Build-info collection when --build-name and --build-number are provided
Server authentication via --server-id

Note: Dependencies will be collected as part of the jf helm dependency and jf helm package command, while chart's artifacts will be added into build info as part of jf helm push command.

To collect build-info for dependencies during the `jf helm dependency` and `jf helm package` commands, the chart directory must contain both a `Chart.yaml` and a `Chart.lock` file. If `Chart.lock` is missing, build-info collection will fail because the CLI cannot verify the specific version ranges of dependencies against Artifactory.

Chart dependencies are collected during the jf helm dependency and jf helm package commands. The packaged chart artifact itself is added to the build-info when you run jf helm push.

Command Reference

Syntax

jf helm <helm subcommand> [helm arguments] [command options]

Supported Subcommands

Subcommand	Description
install	Install a chart
upgrade	Upgrade a release
package	Package a chart directory into a chart archive
push	Push a chart to a remote OCI registry
pull	Download a chart from a remote registry
repo	Add, list, remove, update, and index chart repositories
dependency	Manage a chart's dependencies

All native Helm subcommands are supported and passed through to the Helm client.

Command Options

Flag	Description	Default
--build-name	Build name for build-info collection. Requires --build-number.	None
--build-number	Build number for build-info collection. Requires --build-name.	None
--module	Optional module name for the build-info. Requires build name and number.	None
--project	JFrog Project key for the build-info.	None
--server-id	Server ID configured using jf config. Uses default server if not specified.	Default server
--username	JFrog username for authentication.	None
--password	JFrog password for authentication.	None

Workflow

Step 1: Configure Artifactory Server

jf config add my-server \
  --url=https://mycompany.jfrog.io \
  --access-token=<ACCESS_TOKEN>

Step 2: Authenticate with OCI Registry (if using OCI charts)

helm registry login mycompany.jfrog.io \
  --username <USERNAME> \
  --password <PASSWORD>

Step 3: Package a Chart (Optional)

jf helm package ./mychart \
  --build-name=my-helm-build \
  --build-number=1

Step 4: Push Chart to Artifactory

jf helm push mychart-0.1.0.tgz oci://mycompany.jfrog.io/helm-local \
  --build-name=my-helm-build \
  --build-number=1

Step 5: Update Dependencies

jf helm dependency update ./mychart \
  --build-name=my-helm-build \
  --build-number=1

Step 6: Publish Build-Info

jf rt bp my-helm-build 1

Examples

Push a Helm Chart to OCI Registry with Build-Info

jf helm package ./my-application --build-name=app-chart --build-number=42

jf helm push my-application-1.0.0.tgz oci://acme.jfrog.io/helm-local \
  --build-name=app-chart \
  --build-number=42

jf rt bp app-chart 42

Pull a Chart from OCI Registry

jf helm pull oci://acme.jfrog.io/helm-local/my-application --version 1.0.0

Install a Chart with Custom Server

jf helm install my-release oci://acme.jfrog.io/helm-local/my-application \
  --server-id=production-server \
  --build-name=deploy-build \
  --build-number=1

Frequently Asked Questions

Q: Why do I use jf helm instead of just helm?

A: Using jf helm enables automatic build-info collection and centralized authentication management. If you don't need these features, you can use the native helm command directly.

Q: Does jf helm modify my charts or Helm configuration?

A: No. The CLI runs the native Helm client without modification. All arguments are passed through directly.

Q: Is there a jf helm-config command?

A: No. Helm in JFrog CLI runs in Native Mode only. Repository and authentication configuration should be done using standard Helm commands or OCI registry login.

Q: Can I use Helm with non-OCI repositories?

A: Yes. You can use jf helm repo add to configure traditional Helm repositories, then use standard Helm commands through jf helm.