Install JFrog Platform via Helm [Quick Start]

Choose Your Install Path

Path	When to Use	What It Needs
Production	Real workloads, team use	`customvalues.yaml` with external DB, filestore, and security keys For OpenShift - `openshift-values.yaml` overlay
Evaluation	Fast exploration, POC, demos	Nothing — chart defaults work out of the box

Path

When to Use

What It Needs

Production

Real workloads, team use

customvalues.yaml with external DB, filestore, and security keys

For OpenShift - openshift-values.yaml overlay

Evaluation

Fast exploration, POC, demos

Nothing — chart defaults work out of the box

What You Need

You need the following before deploying JFrog products with Helm charts.

Requirement	Values
Kubernetes (including OpenShift)	1.27+ (OpenShift 4.14+)
Dynamic Storage Provisioning	Enable
Default Storage Class	Persistent Storage
kubectl	Target cluster
Helm	3.17+
License	If you do not have a license yet, request a trial: JFrog Platform Free Trial
Baseline capacity	`16 GB RAM`, `8 CPU`, `50 GB` disk. For guidance on the sizing, see Hardware Sizing Matrix Sizing GitHub

📘
AWS EBS CSI Driver Required On EKS
When deploying a JFrog application on an AWS EKS cluster, the AWS EBS CSI Driver is required for dynamic volume provisioning. However, this driver is not included in the JFrog Helm Charts. For more information, see Store Kubernetes volumes with Amazon EBS.

Platform Deployment via Helm - Workflow Diagram

Chart Defaults Vs Production

Area	Chart Defaults	Production
Artifactory + Xray	Enabled	Disable Xray if not required
Distribution, Catalog, Worker	Disabled (bundled subcharts)	Enable in `customvalues.yaml` per your license — see License Matrix
JAS (Advanced Security)	License-gated (built into Xray)	Set `xray.serviceAccount.create: true` + `xray.rbac.create: true`; activates when JPD is connected to MyJFrog with E+ / E X license
Curation	License-gated (component of Xray; requires Catalog)	Enable with `catalog.enabled: true`; activates when JPD is connected to MyJFrog with E+ / E X license. See Installing Catalog
AppTrust, Runtime	Not in umbrella chart (separate addon charts)	Install separately with `helm install jfrog/<chart>` after the core platform is running
Database	Bundled PostgreSQL	External PostgreSQL — see Database Selection
Filestore	Local/PVC-backed	External object storage — see Filestore Selection

📘
If distribution.enabled: true
Verify entitlement in the License Matrix and prepare an external PostgreSQL distribution database. See Database and Third-Party Applications in Distribution.

How Do I Install?

Add Helm Repository

helm repo add jfrog https://charts.jfrog.io
helm repo update

Deploy Platform

What Do I Need for Production?

Production Preparation Steps

Complete these steps before deploying to production:

1. Set up external database

Create databases for each product on your external PostgreSQL server and configure them in customvalues.yaml. See Platform Helm Chart - External Database for full instructions and the SQL setup commands.

2. Set up external filestore

Configure S3, GCS, or Azure Blob for artifact storage. See Platform Helm Chart - External FileStore.

3. Build your customvalues.yaml

Start from the sample below and replace the placeholder values. For the full reference, see Configure customvalues.yaml.

GitHub Example Values

Ready-to-use examples from the jfrog/charts repository:

Example	Description
external-postgres-values.yaml	External PostgreSQL for all products
HA-with-distribution-S3	Full HA: 3-node Artifactory, Distribution, external PostgreSQL, S3
values-catalog-jas.yaml	Enable Catalog and JAS

Key points:

Database is at the subchart level (artifactory.database), not artifactory.artifactory.database
Each subchart needs its own postgresql.enabled: false
Artifactory uses JDBC format (jdbc:postgresql://); Xray uses libpq format (postgres://)
Filestore is at the application level (artifactory.artifactory.persistence)
JAS (Advanced Security) requires xray.serviceAccount.create: true and xray.rbac.create: true in Helm values (already included in the sample above). Once set, JAS activates automatically when your JPD is connected to MyJFrog with an Enterprise+ or Enterprise X license (source)
Curation is a component of Xray (not Artifactory) and requires Catalog to function. Curation is installed when Xray is installed. Enable catalog.enabled: true so Curation can access package vulnerability data, then activate Curation via the UI with the required entitlement. See Installing Catalog
Catalog is a separate subchart enabled with catalog.enabled: true alongside Xray's serviceAccount.create and rbac.create (example). Catalog requires its own catalog database (JDBC format) — it does not share the Xray database
AppTrust is a separate addon chart (jfrog/apptrust) installed alongside the platform after the core is running — not configured in customvalues.yaml. Install with: helm upgrade --install apptrust jfrog/apptrust -n jfrog-platform --set global.joinKey=<KEY> --set global.masterKey=<KEY> --set global.jfrogUrl=<URL>
Alternative approach: Instead of per-product DB URLs, you can set global.database.host and global.database.port — the chart template auto-generates jdbc:postgresql:// (or postgres:// for Xray) URLs with the product name as the database name. The sample above uses explicit per-product URLs for clarity
Uncomment optional products only if your license covers them (License Matrix)
For production, store passwords in Kubernetes Secrets instead of plain text — see External Database

4. Create security key secrets

export MASTER_KEY=$(openssl rand -hex 16)
export JOIN_KEY=$(openssl rand -hex 16)

kubectl create namespace jfrog-platform
kubectl -n jfrog-platform create secret generic master-key --from-literal=master-key=$MASTER_KEY
kubectl -n jfrog-platform create secret generic join-key --from-literal=join-key=$JOIN_KEY

Save these keys securely — they are required for upgrades and disaster recovery.

5. Pre-install checklist

Confirm before deploying:

External PostgreSQL is reachable from inside the cluster
Databases and users for each product are created
A default StorageClass exists in the cluster (kubectl get sc)
Security key secrets are created (step 4 above)
If using external filestore, the binarystore secret is created (step 2 above)

Pin the chart version with --version for repeatable deployments.

helm upgrade --install jfrog-platform jfrog/jfrog-platform \
  --namespace jfrog-platform \
  --create-namespace \
  --version <CHART_VERSION> \
  -f customvalues.yaml

Find available versions: helm search repo jfrog/jfrog-platform --versions

How Do I Verify the Installation?

Check Platform Health

curl -f http://<JFROG_URL>/router/api/v1/system/health

A healthy response returns "status": "HEALTHY" for all services. If any service shows unhealthy, retry after 2-3 minutes — some services take time to initialize.

Access the UI

Open http://<JFROG_URL> in your browser. Log in with the default credentials (admin / password), change the password immediately, and complete the Onboarding Wizard.

Common Errors and Fixes

Error	Cause	Fix
Pods stuck in `Pending`	Insufficient cluster resources or missing storage class	Verify CPU/memory requests and confirm a default `StorageClass` exists (`kubectl get sc`)
Artifactory `CrashLoopBackOff`	Database not reachable or wrong credentials	Check `database.url`, `user`, `password` in `customvalues.yaml`; test DB connectivity from inside the cluster
`UnknownHostException: jfrog-platform-postgresql`	Artifactory still connecting to bundled PostgreSQL	Set `artifactory.postgresql.enabled: false` and `artifactory.waitForDatabase: false`. Verify DB config is at `artifactory.database`, not `artifactory.artifactory.database`
`Failed to load binary provider config - invalid XML`	Empty `binarystore.xml` from inline persistence values	Use `customBinarystoreXmlSecret` instead of inline S3/GCS/Azure values — see External FileStore
Catalog / Curation not visible in UI	JPD not connected to MyJFrog, missing E+ license, or Catalog not enabled	Check Administration → Platform Management → MyJFrog; Curation requires `catalog.enabled: true` (source)
`Master key mismatch` on startup	Databases were initialized with a different master key (e.g., after reinstall or key rotation)	Drop and recreate the product databases on the external PostgreSQL, or restore the original master key. Scale down all workloads first to release active DB connections
`helm upgrade` fails with "release not found"	First install requires `--install` flag	Use `helm upgrade --install` (both flags together)
Health check returns unhealthy after deploy	Services still starting	Wait 3-5 minutes for all services to initialize; check pod logs with `kubectl logs -n jfrog-platform`

For common questions about databases, licensing, upgrades, and more, see the Quick Start FAQ.

Next Steps

After verifying that all services are healthy:

Complete the Onboarding Wizard to configure repositories and security.
Set TLS on the JFrog Platform to enable HTTPS.
Connect your JPD to MyJFrog to activate license-gated features (JAS, Curation, Catalog).
Review the System YAML Configuration for advanced tuning.

Topic	Description
Configure customvalues.yaml	Full reference for the Platform Helm chart values file
Platform Helm Chart - External Database	Set up external PostgreSQL for Helm deployments
Platform Helm Chart - External FileStore	Configure S3, GCS, or Azure Blob for artifact storage
Helm Charts for Advanced Users	Advanced Helm topics: sizing, HA, custom init containers
Install JFrog Platform via Ansible [Quick Start]	Alternative installation path for Linux VMs
General System Requirements	CPU, memory, and storage requirements per product

Choose Your Install Path

How Do I Install?

What Do I Need for Production?

1. Set up external database

2. Set up external filestore

3. Build your customvalues.yaml

4. Create security key secrets

5. Pre-install checklist

How Do I Verify the Installation?

Next Steps

Related Topics