Self-Managed Installation

Set up JFrog ML on your own infrastructure with full control and security

About

This guide walks you through installing the self-hosted version of JFrog ML. It outlines the required infrastructure and resources for a successful deployment.

Overview

JFrog ML is an end-to-end platform for managing the machine learning lifecycle — from experimentation to production. It provides built-in security, governance, and streamlined collaboration across teams.

Architecture

The diagram below illustrates the core architecture of JFrog ML in a self-hosted setup:

Prerequisites

JFrog ML currently supports cloud-based installations on Amazon EKS and Google GKE, integrated with an existing JFrog Platform Deployment (JPD).

Support for Azure AKS and on-premise (data center) environments is planned for later this year.

To install JFrog ML self-hosted, ensure the following requirements are met:

AWS Prerequisites

Before installing JFrog ML on AWS, ensure the following resources and configurations are in place:

AWS Resources to Create

During installation, you’ll need to create the following:

GCP Prerequisites

Before installing JFrog ML on GCP, ensure the following services and resources are configured:

Installing JFrog ML

The JFrog ML installation consists of several steps, including running Helm charts and provisioning cloud resources in your cloud of choice. To begin, please use the installation wizard available in the JFrog Platform UI, which guides you step-by-step through the process.

1. Log In to Your JFrog Self-Hosted Platform

2. Install JFrog Bridge

The JFrog Bridge facilitates secure communication between your JFrog Platform Deployment (JPD) and the JFrog ML Control Plane. Please refer to the JFrog Bridge Installation documentation for detailed instructions.

3. Create JFrog ML Account

After the Bridge is successfully installed, you’ll need to create a JFrog ML account. This account uniquely identifies your JFrog ML installation.

You’ll be asked to provide the following information:

Connect Kubernetes Cluster

Once the JFrog ML account is created, you can proceed to install JFrog ML services on your Kubernetes cluster.

To connect your cluster:

The wizard will then generate the necessary configuration and Helm commands based on your selections.

JFrog ML Cluster Installation Wizard

Before proceeding:

Run Setup Script

Before installing JFrog ML, you must run a setup script on your Kubernetes cluster. This step ensures that the installation will not conflict with your existing infrastructure.

The setup script performs the following tasks:

The following CRDs may be installed as part of this step:

Run this command on the Kubernetes cluster where JFrog ML will be installed:

curl -O https://raw.githubusercontent.com/qwak-ai/jfrogml-helm-chart-crds/main/install.sh && chmod +x install.sh && bash install.sh --cloud-provider <aws/gcp>

JFrog ML on AWS

Make sure the following are ready before you install JFrog ML on AWS:

Create a role with the below policy:

{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Action": "s3:*",
        "Resource": [
            "arn:aws:s3:::",
            "arn:aws:s3:::/*"
        ],
        "Effect": "Allow"
      },
      ...
    ]
}

Create a trust policy attached to the role:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam:::oidc-provider/oidc.eks..amazonaws.com/id/"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "oidc.eks..amazonaws.com/id/:aud": "sts.amazonaws.com"
        }
      }
    }
  ]
}

JFrog ML on GCP

Ensure the following prerequisites are met before installing JFrog ML on GCP:

Ingress Configuration

JFrog ML uses Istio-based ingress to enable secure external access to the platform.

Option 1: Let JFrog ML Install Istio for You

Option 2: Use Your Existing Istio Installation

If you already have Istio deployed in your cluster, you must update your Istio mesh configuration to support JFrog ML authentication. Add the following to your Istio mesh configuration:

extensionProviders:
  - name: ext-authz-grpc
    envoyExtAuthzGrpc:
      service: "auth.jfrogml.svc.cluster.local"
      port: "6578"
  

Cluster DNS Configuration

Certificate Configuration

Install Infrastructure

Run this command on your Kubernetes cluster to install the relevant JFrog ML infrastructure:

Installing on GCP

helm repo add jfrog-charts https://charts.jfrog.io/artifactory/api/helm/enterprise-helm --username --password
helm repo update
helm upgrade --install jfrogml jfrog-charts/jfrogml --namespace jfrogml \
--set jfrogUrl="" \
--set cloud="gcp" \
... [shortened for brevity]
  

Installed Components

The following components are installed as part of the JFrog ML self-managed setup:

JPD-Related

JFrog ML Data Plane

Open-source Tools

JFrog ML Services