Platform Installation with Helm
Deploy the JFrog Platform via a single Helm Chart. Artifactory and Xray are available by default. Other products (Distribution, Catalog, Worker, Bridge, AppTrust) require configuration in customvalues.yaml. Includes evaluation and production installation paths.
Choose Your Install Path
Select the path that matches your use case before running the install command.
| Path | When to Use | What It Needs |
|---|---|---|
| Production | Real workloads, team use | customvalues.yaml with external DB, filestore, and security keys. For OpenShift: openshift-values.yaml overlay. |
| Evaluation | Fast exploration, POC, demos | Nothing: chart defaults work out of the box. |
Before installing, verify you have a Kubernetes 1.27+ cluster (OpenShift 4.14+), Helm 3.17+, kubectl configured with cluster access, and a default StorageClass.
Check Requirements
What You Need
You need the following before deploying JFrog products with Helm charts.
| Requirement | Values |
|---|---|
| Kubernetes (including OpenShift) | 1.27+ (OpenShift 4.14+) |
| Dynamic Storage Provisioning | Enable |
| Default Storage Class | Persistent Storage |
| kubectl | Target cluster |
| Helm | 3.17+ |
| License | Requires a valid license. |
| Sizing | For guidance on the sizing, see |
AWS EBS CSI Driver Required On EKS
When deploying a JFrog application on an AWS EKS cluster, the AWS EBS CSI Driver is required for dynamic volume provisioning. However, this driver is not included in the JFrog Helm Charts. For more information, see Store Kubernetes volumes with Amazon EBS.
Platform Deployment via Helm - Workflow Diagram

Chart Defaults Vs Production
| Area | Chart Defaults | Production |
|---|---|---|
| Artifactory + Xray | Enabled | Disable Xray if not required: xray.enabled: false and rabbitmq.enabled: false (RabbitMQ is only used by Xray) |
| Distribution | Disabled (bundled subchart) | Enable: distribution.enabled: true |
| Catalog | Disabled (bundled subchart) | Enable: catalog.enabled: true |
| Worker | Disabled (bundled subchart) | Enable: worker.enabled: true |
| Bridge | Disabled (bundled subchart) | Enable: bridge.enabled: true |
| RabbitMQ | Enabled (bundled, 1 replica — used by Xray) | For HA Xray: use sizing/platform-medium.yaml or higher, or enable quorum queues with rabbitmq/ha-quorum.yaml |
| JAS (Advanced Security) | License-gated (built into Xray) | Set xray.serviceAccount.create: true + xray.rbac.create: true; activates when JPD is connected to MyJFrog with E+ / E X license |
| Curation | License-gated (component of Xray; requires Catalog) | Enable catalog.enabled: true; activates when JPD is connected to MyJFrog with E+ / E X license. See Installing Catalog |
| AppTrust | - | Enable: artifactory.apptrust.enabled: true and artifactory.unifiedpolicy.enabled: true NOTE: AppTrust requires both JFrog Xray and SBOM. |
| Database | Bundled PostgreSQL | External PostgreSQL — see Database Selection |
| Filestore | Local/PVC-backed | External object storage — see Filestore Selection |
For license requirements by product, see the License Matrix.
If
distribution.enabled: trueVerify entitlement in the License Matrix and prepare an external PostgreSQL
distributiondatabase. See Database and Third-Party Applications in Distribution.
How Do I Install?
The installation takes two steps: add the JFrog Helm repository, then deploy the platform using your chosen configuration.
End-to-End Install Flow
flowchart TD
A[Start] --> B[Check prerequisites: K8s, Helm, kubectl, StorageClass]
B --> C[Add JFrog Helm repo]
C --> D{Install path?}
D -->|Evaluation| E[helm upgrade --install with chart defaults]
D -->|Production| F[1 - Set up external PostgreSQL]
F --> G[2 - Configure external filestore]
G --> H[3 - Build customvalues.yaml]
H --> I[4 - Create master-key and join-key secrets]
I --> J[5 - Apply sizing profile]
J --> K[6 - Run pre-install checklist]
K --> L[helm upgrade --install with customvalues.yaml]
E --> M[curl /router/api/v1/system/health]
L --> M
M --> N{HEALTHY?}
N -->|No - wait 3 to 5 min| M
N -->|Yes| O[Open UI - change admin password - complete Onboarding Wizard]
O --> P[Done - tune and enable products]How Do I Verify the Installation?
Run both checks in sequence once pods are ready.
Common Errors and Fixes
| Error | Cause | Fix |
|---|---|---|
Pods stuck in Pending | Insufficient cluster resources or missing storage class | Verify CPU/memory requests and confirm a default StorageClass exists (kubectl get sc) |
Artifactory CrashLoopBackOff | Database not reachable or wrong credentials | Check database.url, user, password in customvalues.yaml; test DB connectivity from inside the cluster |
UnknownHostException: jfrog-platform-postgresql | Artifactory still connecting to bundled PostgreSQL | Set artifactory.postgresql.enabled: false and artifactory.waitForDatabase: false. Verify DB config is at artifactory.database, not artifactory.artifactory.database |
Failed to load binary provider config - invalid XML | Empty binarystore.xml from inline persistence values | Use customBinarystoreXmlSecret instead of inline S3/GCS/Azure values — see External FileStore |
| Catalog / Curation not visible in UI | JPD not connected to MyJFrog, missing E+ license, or Catalog not enabled | Check Administration → Platform Management → MyJFrog; Curation requires catalog.enabled: true (source) |
Master key mismatch on startup | Databases were initialized with a different master key (e.g., after reinstall or key rotation) | Drop and recreate the product databases on the external PostgreSQL, or restore the original master key. Scale down all workloads first to release active DB connections |
helm upgrade fails with "release not found" | First install requires --install flag | Use helm upgrade --install (both flags together) |
| Health check returns unhealthy after deploy | Services still starting | Wait 3-5 minutes for all services to initialize; check pod logs with kubectl logs -n jfrog-platform |
For common questions about databases, licensing, upgrades, and more, see the Quick Start FAQ.
Next Steps
After all services are healthy:
- Complete the Onboarding Wizard to configure repositories and security.
- Install your license, enable additional products, and tune your deployment — see JFrog Platform Helm chart — Advanced Configuration.
- Set TLS on the JFrog Platform to enable HTTPS.
- To install and enable Catalog, see Installing Catalog.
- Review the System YAML Configuration for advanced tuning.
Related Topics
- Configure customvalues.yaml
- Platform Helm Chart - External Database
- Platform Helm Chart - External FileStore
- JFrog Platform Helm chart — Advanced Configuration
- Helm Charts for Advanced Users
- Install JFrog Platform via Ansible [Quick Start]
- System Requirements
Frequently Asked Questions
This section provides answers to frequently asked questions.
FAQs
Q: What is the minimum setup needed to install the JFrog Platform via Helm?
A: For evaluation, run helm upgrade --install jfrog-platform jfrog/jfrog-platform --namespace jfrog-platform --create-namespace. No configuration files are required — the chart defaults install Artifactory and Xray with a bundled PostgreSQL and local storage. Other products (Distribution, Catalog, Worker, Bridge) must be enabled via customvalues.yaml.
Q: How do I verify the JFrog Platform is running after a Helm install?
A: Run curl -f http://<JFROG_URL>/router/api/v1/system/health. A healthy response returns "status": "HEALTHY" for all services. If services appear unhealthy, wait 3–5 minutes — some services take time to initialize.
Q: Do I need an external database for a JFrog Platform Helm installation?
A: Not for evaluation — the chart includes a bundled PostgreSQL database. For production, configure an external PostgreSQL database before deploying. The bundled database is not suitable for production workloads. See JFrog Platform Helm chart — Advanced Configuration.
Q: What is the default admin password after a Helm install?
A: The default credentials are username admin and password password. Change the password immediately after the first login and complete the Onboarding Wizard.
Updated 16 days ago
