--- updatedAt: 2026-07-30T11:33:08.000Z agentTools: siteIndex: https://docs.jfrog.com/llms.txt projectIndex: https://docs.jfrog.com/installation/llms.txt --- # Configure Nginx Service and Load Balancer for Helm Configure the Kubernetes service type, load balancer IP, source ranges, external traffic policy, and cloud-provider annotations for Artifactory Helm deployments. The JFrog Artifactory Helm chart exposes Artifactory through an Nginx pod. The `nginx.service.*` values control how Kubernetes exposes that Nginx pod to clients — the service type, IP assignment, access restrictions, and cloud-provider behavior. Configure these values in your `values.yaml` before or during installation. ## Service Type The `nginx.service.type` value determines how Kubernetes exposes the Nginx pod. The default is `LoadBalancer`. | Service Type | When to Use | | -------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `LoadBalancer` | Cloud environments (AWS, GKE, AKS). The cloud provider provisions an external load balancer automatically. | | `NodePort` | On-premises or bare-metal clusters without a cloud load balancer controller. Traffic enters on a fixed port on every node. Requires an external LB or DNS to distribute traffic. | | `ClusterIP` | When you bring your own Ingress controller and do not want a public service. The Nginx service is only reachable from within the cluster. | To change the service type, set it in your `values.yaml`: ```yaml nginx: service: type: NodePort ``` Or pass it inline: ```bash helm upgrade --install artifactory jfrog/artifactory \ --set nginx.service.type=NodePort ``` ## nginx.service Parameters The following parameters are all nested under `nginx.service` in `values.yaml`. | Parameter | Type | Default | Description | | -------------------------- | ------ | ----------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `type` | string | `LoadBalancer` | Kubernetes service type. Valid values: `LoadBalancer`, `NodePort`, `ClusterIP`. | | `loadBalancerIP` | string | `""` | Pin a specific static IP to the LoadBalancer service. The IP must be reserved in your cloud provider before install. Ignored when `type` is not `LoadBalancer`. | | `loadBalancerSourceRanges` | list | `[]` | Restrict which source CIDRs can reach the load balancer. Example: `['10.0.0.0/8', '192.168.0.0/16']`. Enforced as cloud provider firewall rules at the LB — effective regardless of `externalTrafficPolicy`. An empty list allows all sources. | | `externalTrafficPolicy` | string | `Cluster` | Only applies when `type` is `LoadBalancer`. `Cluster` (default): traffic is distributed evenly across all nodes; original client IPs are not preserved in the pod. `Local`: routes only to nodes running an Artifactory pod and preserves the original client source IP. | | `annotations` | map | `{}` | Cloud-provider annotations for the service. Used to control internal vs external LB, SSL certificates, DNS labels, and more. See [Cloud-Provider Annotations](#cloud-provider-annotations) below. | | `ssloffload` | bool | `false` | Set to `true` to offload TLS termination at the load balancer layer. The chart routes the HTTPS service port (443) to Nginx's HTTP internal port (8080) so the LB handles TLS and forwards plain HTTP. Also set `nginx.https.enabled: false` to disable HTTPS inside the Nginx configuration. See [Nginx SSL Termination at the Load Balancer](install-artifactory-and-artifactory-ha-with-nginx-and-terminate-ssl-in-nginx-service-load-balancer). | | `ssloffloadForceHttps` | bool | `false` | Only applies when `ssloffload` is `true`. Forces all requests from Nginx to the upstream Artifactory over HTTPS. Use when internal traffic must remain encrypted. | | `nodePort` | int | *(auto-assigned)* | Fixed node port when `type` is `NodePort`. If not set, Kubernetes assigns a port in the default range (30000–32767). | | `ipFamilyPolicy` | string | `""` | Dual-stack policy. Valid values: `SingleStack`, `PreferDualStack`, `RequireDualStack`. Leave empty for single-stack IPv4 (default). | | `ipFamilies` | list | `[]` | IP families for the service. Examples: `["IPv4"]`, `["IPv6"]`, `["IPv4", "IPv6"]`. Leave empty to use cluster defaults. | | `customPorts` | list | `[]` | Additional ports to expose on the Nginx service. Each entry follows Kubernetes service port syntax (`port`, `targetPort`, `protocol`, `name`). | ## nginx.http and nginx.https Parameters These values control the HTTP and HTTPS listeners inside the Nginx pod. The internal ports were renamed from 80/443 to 8080/8443 to support OpenShift's non-root port restrictions. | Parameter | Type | Default | Description | | -------------------------- | ---- | ------- | ---------------------------------------------------------------------------------------------------------------------------- | | `nginx.http.enabled` | bool | `true` | Enable the HTTP listener. Set to `false` to require HTTPS-only access. | | `nginx.http.externalPort` | int | `80` | External port exposed by the Kubernetes service for HTTP traffic. | | `nginx.http.internalPort` | int | `8080` | Port inside the Nginx container that receives HTTP traffic. Do not change unless your Nginx image uses a different port. | | `nginx.https.enabled` | bool | `true` | Enable the HTTPS listener. Set to `false` when offloading TLS at the load balancer layer (`nginx.service.ssloffload: true`). | | `nginx.https.externalPort` | int | `443` | External port exposed by the Kubernetes service for HTTPS traffic. | | `nginx.https.internalPort` | int | `8443` | Port inside the Nginx container that receives HTTPS traffic. | ## Cloud-Provider Annotations Use `nginx.service.annotations` to pass cloud-provider-specific instructions to the load balancer controller. Annotations are key-value strings added to the Kubernetes Service object. ```yaml AWS nginx: service: annotations: # Provision an internal ALB (accessible only within VPC) service.beta.kubernetes.io/aws-load-balancer-internal: "true" # Use NLB instead of the default Classic LB service.beta.kubernetes.io/aws-load-balancer-type: "nlb" # Terminate TLS at the LB using an ACM certificate service.beta.kubernetes.io/aws-load-balancer-ssl-cert: "arn:aws:acm:us-east-1:123456789:certificate/xxxx" service.beta.kubernetes.io/aws-load-balancer-backend-protocol: "http" service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https" ``` ```yaml GKE nginx: service: annotations: # Provision an internal load balancer (accessible only within VPC) cloud.google.com/load-balancer-type: "Internal" # Pin a static IP reserved in your GCP project networking.gke.io/load-balancer-ip: "10.128.0.50" ``` ```yaml AKS nginx: service: annotations: # Provision an internal load balancer (accessible only within VNet) service.beta.kubernetes.io/azure-load-balancer-internal: "true" # Assign a DNS label to the public LB IP service.beta.kubernetes.io/azure-dns-label-name: "my-artifactory" # Pin a specific static IP from your subnet service.beta.kubernetes.io/azure-load-balancer-ipv4: "10.240.0.10" ``` ```yaml MetalLB (Bare-Metal) nginx: service: annotations: # Assign an IP from a named MetalLB address pool metallb.universe.tf/address-pool: "production-public-ips" ``` ## Static IP Assignment To use a fixed IP address instead of letting the cloud provider assign one dynamically: 1. Reserve a static IP in your cloud provider console. 2. Add it to `nginx.service.loadBalancerIP` in your `values.yaml`: ```yaml nginx: service: loadBalancerIP: "34.120.50.10" ``` **Static IP and Helm Upgrades** If you run `helm upgrade` without specifying `loadBalancerIP`, the field defaults to empty and your cloud provider may reassign a different IP. Always include the IP in your `values.yaml` or pass it with `--set` on every upgrade. ## Restrict Access by Source IP To limit which IP ranges can reach the load balancer, set `loadBalancerSourceRanges`. This is enforced at the cloud provider level, not by Kubernetes or Nginx. ```yaml nginx: service: loadBalancerSourceRanges: - "10.0.0.0/8" - "172.16.0.0/12" - "192.168.0.0/16" ``` An empty list (the default) allows all sources. **Source Ranges vs. Client IP Preservation** `loadBalancerSourceRanges` creates firewall rules at the cloud load balancer level — it works regardless of `externalTrafficPolicy`. If you also need the original client IP visible inside the Artifactory pod (for logging or access control), set `externalTrafficPolicy: Local`. These are independent settings: source ranges restrict who can reach the LB; traffic policy controls whether the pod sees the real client IP or the node's IP. ## Discover All Available Parameters To see the full default `values.yaml` for the Artifactory Helm chart — including every parameter with its inline description — run: ```bash helm show values jfrog/artifactory ``` To filter the output to Nginx-related parameters: ```bash helm show values jfrog/artifactory | grep -A 30 "^nginx:" ``` This is the authoritative source for current defaults. Parameters in the Helm chart may be updated between chart versions. ## Frequently Asked Questions This section provides answers to frequently asked questions. ##### Q: What is the default Kubernetes service type for the Nginx pod in an Artifactory Helm deployment? **A:** The default service type is `LoadBalancer`. In cloud environments such as AWS, GKE, and AKS, this causes the cloud provider to provision an external load balancer automatically. You can change it to `NodePort` or `ClusterIP` by setting `nginx.service.type` in your `values.yaml`. ##### Q: How do I assign a static IP address to the Artifactory load balancer in a Helm deployment? **A:** Reserve a static IP in your cloud provider console, then set `nginx.service.loadBalancerIP` to that IP in your `values.yaml`. You must include this value on every `helm upgrade` run — if you omit it, the field defaults to empty and the cloud provider may reassign a different IP. ##### Q: What is the difference between `externalTrafficPolicy: Cluster` and `externalTrafficPolicy: Local`? **A:** With `Cluster` (the default), traffic is distributed evenly across all nodes but the original client IP is not preserved in the pod. With `Local`, traffic is routed only to nodes running an Artifactory pod and the original client source IP is preserved. Choose `Local` when Artifactory needs to see real client IPs for logging or access control. ##### Q: Does `loadBalancerSourceRanges` depend on `externalTrafficPolicy` to restrict access? **A:** No. `loadBalancerSourceRanges` creates firewall rules at the cloud load balancer level and is enforced independently of `externalTrafficPolicy`. An empty list (the default) allows all sources. These are independent settings: source ranges restrict who can reach the load balancer, while traffic policy controls whether the pod sees the real client IP. See [Nginx SSL Termination at the Load Balancer](install-artifactory-and-artifactory-ha-with-nginx-and-terminate-ssl-in-nginx-service-load-balancer) for TLS offloading options. ##### Q: Why were the Nginx internal ports changed from 80/443 to 8080/8443? **A:** The internal Nginx ports were renamed from 80/443 to 8080/8443 to support OpenShift's non-root port restrictions, which do not allow processes to bind to ports below 1024. ## Related Topics * [JFrog Platform Installation with NGINX Ingress Controller](install-jfrog-platform-with-nginx-ingress-controller): Expose the platform through your own ingress controller instead of the bundled Nginx pod * [Kubernetes Gateway API Configuration for Artifactory](expose-artifactory-using-kubernetes-gateway-api): Route traffic using Gateway and HTTPRoute resources as an alternative to Ingress * [Nginx SSL Termination at the Load Balancer](install-artifactory-and-artifactory-ha-with-nginx-and-terminate-ssl-in-nginx-service-load-balancer) — Offload TLS to the load balancer using AWS ACM or equivalent * [Ingress Behind Another Load Balancer](run-ingress-behind-another-load-balancer) — Preserve `X-Forwarded-*` headers when a load balancer sits in front of the Nginx Ingress Controller * [Load Balancer Health Checks](load-balancer) — Configure health check endpoints for your external load balancer * [TLS in Artifactory and JFrog Platform](establish-tls-in-artifactory-and-jfrog-platform) — End-to-end TLS configuration