Curation Federation

Follow this procedure to define a federation that syncs curation policies, labels, and related entities in your JFrog environment.

JFrog Federations ensure uniform settings across sites in your subscription. For example, an Access Federation syncs user and permission definitions across all servers in the federation.

This section describes how to define a federation that syncs Curation policies and metadata across servers in your JFrog subscription. This Curation Federation simplifies deployment of Curation policies, and enforces a consistent security posture. Repositories on servers across your subscription are protected by a uniform, centrally managed set of Curation policies.

Topology Options and Configuration Overview

The federation has a star topology - one JPD acts as the Controller, and the other JPDs act as Followers. The Controller can be a SaaS or a Self-managed site, serving both SaaS and Self-managed Follower sites.

As an option, a JFrog Bridge can be deployed to connect a Self-managed Follower to a SaaS Controller if security or compliance requirements restrict network communication in one direction.

To configure a Curation Federation:

1. Prepare Self-managed Sites for Curation Federation.
2. (Optional) To support self-managed Followers without network access, Install the Bridge Service on the Follower and Define a Bridge from the Follower to the SaaS Controller.
3. Define the Curation Federation on the Controller.

Prepare a Self-managed Site for Curation Federation

This procedure verifies prerequisite releases and activates Federation services on the site. Repeat these steps on all Self-managed sites you want to add to the Curation Federation.

To prepare a Self-managed Site for Curation Federation:

1. Verify that the Self-managed site runs the following JFrog releases, and upgrade if necessary:

   • JFrog Artifactory 7.146.22 and above. Artifactory cannot be running on Windows.

   • JFrog Xray 3.143.31 and above.

   • JFrog Catalog 1.42.0 and above. Verify that Catalog is running with the Valkey cache manager.

2. On the Artifactory server, enable the PlatformFederation and JFBUS Microservices in the Artifactory system.yaml file, as follows:

   YAML

   platformFederation:
     enabled: true
     jpdUrlValidator:
       allowPrivateNetwork: true
   
   jfbus:
     enabled: true

   For the JFrog Platform Helm Chart, update your custom values.yaml with the following and run helm upgrade:

   YAML

   
   artifactory:
     platformFederation:
       enabled: true
     jfbus:
       enabled: true
   
     artifactory:
       extraSystemYaml:
         platformFederation:
           jpdUrlValidator:
             allowPrivateNetwork: true
   

3. On the Xray server, enable federation features of the Curation service in the Xray system.yaml file as follows:

   YAML

   curation:
     federation:
       enabled: true

   For the JFrog Platform Helm Chart, update your custom values.yaml with the following and run helm upgrade:

   YAML

   xray:
     xray:
       extraSystemYaml:
         curation:
           federation:
             enabled: true

4. On the Catalog server, enable federation features of the Catalog service in the Catalog system.yaml file as follows:

   YAML

   shared:
     federation:
       enabled: true

   For the JFrog Platform Helm Chart, update your custom values.yaml with the following and run helm upgrade:

   YAML

   catalog:
     extraSystemYaml:
       shared:
         federation:
           enabled: true

The Self-managed site can now be added to a Curation Federation.

Define a Curation Federation

The Curation Federation is defined on the site the will act as the Controller of the Federation.

Before you Begin, verify that you have prepared any Self-managed sites as described in Topology Options and Configuration Overview.

API commands are used to define the Federation. There are no parallel methods using the JFrog Platform Interface. Because of this, the entire procedure is described using JFrog API endpoints, even steps like token generation that can be done in the user interface.

To define a Curation Federation:

1. Register Follower JPDs on the Controller JPD. For each Follower JPD:

   Log in to the Follower JPD and generate a pairing token with scope platform-federation. Authenticate the request with an Admin token. For example:

   cURL

   curl --location --request POST 'https://<followerJPD>.jfrog.io/access/api/v1/service_trust/pairing/platform-federation' --header 'Authorization: Bearer <admin_token>'

2. Log in to the Controller site and Define this Follower JPD. Authenticate the request with an Admin token, and use the pairing token you defined on that Follower JPD in step 1. For example:

   cURL

   curl --location --request POST 'https://<controllerJPD>.jfrog.io/pfed/api/v1/jpd' \
   --header 'Content-Type: application/json' \
   --header 'Authorization: Bearer ADMIN-TOKEN' \
   --data '{
     "id": "follower_1",
     "url": "https://follower1.jfrog.io/",
     "pairing_token": "<pairing_token>"
   }'

   Where

   • id is a unique label for this Follower in the federation
   • url is the URL of the Follower JPD
   • pairing_token is the pairing token you received from this Follower JPD.

3. Repeat these steps for each Follower JPD in the federation. To simplify management and troubleshooting, use a consistent naming convention for all Followers.

4. On the Controller site, create the Federation and define its Followers. Authenticate the request with an Admin token. For example:

   cURL

   curl --location --request POST 'https://<controllerJPD>.jfrog.io/pfed/api/v1/federations' \
   --header 'Content-Type: application/json' \
   --header 'Authorization: Bearer ADMIN-TOKEN' \
   --data '{
    "name": "curation federation",
    "description": "manage curation over multisite architecture",
    "connection_groups": {
        "source-jpd": {
            "target_jpd_ids": [
                "follower_1",  ...  ,"follower_n"
            ]
          }
       },
    "entities": [
        {"type": "catalog.customLabels"},
        {"type": "xray.curationCondition"},
        {"type": "xray.curationPkgType"},
        {"type": "xray.curationPolicy"}
     ]
    }'

   Where

   • name is a unique name for this federation.
   • description is a brief description of the federation.
   • target_jpd_ids is a list of the IDs you defined on each Follower JPD.

5. On the Controller JPD, submit a request to the /federation/fullsync endpoint to initiate data sync across the Federation. For example:

   cURL

   curl --location --request POST 'https://<controllerJPD>.jfrog.io/pfed/api/v1/federation/fullsync' \
   --header 'Content-Type: application/json' \
   --header 'Authorization: Bearer ADMIN-TOKEN' \
   --data '{
     "federation_id": "my-federation"
     }'

   Where federation_id is the unique ID returned by the POST /pfed/api/v1/federations endpoint in the previous step.

When the configuration federation is successfully defined:

• The Controller JPD is indicated in Curation pages of the JFrog Platform user interface.
• Audit pages list sync actions performed in the background by the Federation service.

For more details about defining and working with federated Curation policies, see Curation Federation.