May 2020 Summaries

Red Hat OpenShift and JFrog Artifactory offer a compelling combination for enterprises focusing on cloud-native, containerized software development. With the introduction of OpenShift operators certified for JFrog Enterprise, the integration is further streamlined, supporting expansive, multi-team organizations. OpenShift, a leading hybrid cloud Kubernetes platform, together with JFrog Artifactory, a standard for binary management used by over 5,000 companies, provides repositories for major package types, high availability, and global performance through push/pull replication. The OpenShift operator for JFrog Enterprise automates the deployment and management of Artifactory within Kubernetes clusters, ensuring secure and efficient operations. This operator supports OpenShift 4 and facilitates Artifactory's HA mode, RBAC policies, and necessary storage provisioning. Additionally, deploying JFrog Xray for continuous security in DevSecOps is simplified with a second operator. To deploy these operators, an external relational database and TLS configuration are required. Once installed, Artifactory enhances CI/CD processes across organizations, offering fine-grained access control and maintaining development continuity despite internet or site disruptions. A Red Hat webinar provides further insights into these integrations.

JFrog Artifactory can now be easily installed and configured on Google Cloud through the Google Cloud Marketplace, simplifying the complex process of setting it up on Kubernetes clusters. This approach leverages official JFrog Helm Charts, ensuring support and continuous improvements while making the installation fault-tolerant, highly available, secure, and easily upgradable. Users need an active Google Cloud account and a domain name with a corresponding SSL certificate to begin the installation, which involves selecting or creating a Kubernetes cluster, configuring settings like the app instance name and static IP, and deploying the application. Once deployed, users can access JFrog Artifactory with default credentials, which should be updated for security, and additional JFrog solutions are available on the platform.

The JFrog DevOps Platform integrates various solutions into a unified user experience, enhancing control and understanding of software build pipelines, particularly through its Artifactory 7 version. The platform's operations, powered by multiple microservices, generate numerous logs that need consolidation for effective monitoring, especially in high-availability deployments. To facilitate this, JFrog provides a log analytics integration using Fluentd, which collects and normalizes log data into JSON format, ready for analysis with tools like Splunk. Setting up this integration involves configuring Splunk's HTTP Event Collector and installing Fluentd on JFrog Platform nodes to manage log data. Users can analyze this data through the JFrog Logs app in Splunk, which offers dashboards and visualization tools to monitor key metrics. This integration is currently tailored for Artifactory 7 and is part of JFrog's broader strategy to support various analytics tools for enhanced operational insights.

JFrog Pipelines is a CI/CD tool designed with an emphasis on security, particularly in managing and safeguarding secrets for integrated services. Unlike many CI solutions that require additional plugins for secrets management, Pipelines integrates this feature natively, ensuring that sensitive data such as passwords or tokens remain hidden and encrypted within a central storage vault. This setup allows developers to use integrations without directly handling secrets, as administrators manage access and permissions, which can be tailored to specific teams and projects. Integrations with popular services like GitHub, Bitbucket, Docker, Kubernetes, and cloud platforms such as AWS, GCP, and Azure are facilitated through friendly names and API endpoints, with the JFrog Platform's unified permissions model offering granular control over who can access each service. By maintaining secrets securely and ensuring accessibility only to authorized users, JFrog Pipelines supports safe and efficient resource sharing, making it a robust solution for enterprise-scale DevOps operations.

Software development often involves managing dependencies and artifacts, which can be streamlined using an artifact repository manager like JFrog Artifactory. Artifactory is integral to managing binaries within CI/CD pipelines, addressing administrative challenges such as securely managing repository connection details. The blog post discusses using JFrog CLI, a tool that automates and enhances access to JFrog products, integrating with popular package managers like Maven. By incorporating JFrog CLI into CI/CD pipelines, developers can manage Maven repositories more efficiently without altering their workflow. This approach centralizes the resolution and deployment configurations, simplifying management across multiple projects and teams, while ensuring security and consistency. The post offers detailed instructions on setting up JFrog CLI and provides insights into its advantages, such as parallel deployments and enhanced functionality, encouraging readers to integrate it into their development processes for improved efficiency and security.

JFrog Pipelines offers a seamless integration for organizations looking to transition from Jenkins-based continuous integration (CI) workflows to a more modernized CI/CD system without disrupting existing processes. As part of the comprehensive JFrog DevOps Platform, JFrog Pipelines enables the connection of current Jenkins pipelines, allowing them to continue executing essential tasks while passing control to new workflows in JFrog Pipelines. This integration is facilitated by Artifactory, the industry-standard for binary repository management, which many Jenkins pipelines already utilize for artifact storage. The platform's integrated system provides end-to-end solutions, including artifact distribution, security scanning, and automation, all managed under a unified permissions model. The example provided demonstrates how a Jenkins pipeline can build, test, and publish a Go REST application to a Docker repository, which is then deployed by JFrog Pipelines to a Kubernetes cluster, exemplifying the ease of connecting the two systems. This approach allows enterprises to maintain their existing Jenkins infrastructure while gradually adopting JFrog Pipelines, leveraging its enterprise-scale capabilities to support numerous CI/CD pipelines and streamline software delivery.

JFrog CLI has introduced autocomplete support for both bash and zsh, enhancing efficiency by allowing users to start typing commands and receive suggestions for completion, navigable via the tab key. This feature is part of JFrog CLI's broader functionality, which streamlines automation tasks in JFrog solutions, such as managing software releases through JFrog Distribution workflows. Key features include parallel uploads and downloads, checksum optimization, file specifications for generic builds, and build integration for various tools like Maven, Gradle, and Docker, along with security enhancements. To configure autocomplete, users can either utilize Homebrew or perform manual installations for bash, and similarly, use oh-my-zsh or manual installation for zsh.

With the sunsetting of JFrog GoCenter, Go modules have become the standard package manager in Golang, automatically enabled with a default GOPROXY upon installation. A GOPROXY serves as a repository to control the source of Go module downloads, ensuring builds are deterministic and secure by caching module versions to maintain immutability and availability. Developers can use public GOPROXYs like proxy.golang.org for open-source modules, while the GOPRIVATE environment variable allows for the secure retrieval of private modules directly from VCS repositories without exposing them through public networks. Alternatively, private GOPROXYs can be installed to store both public and private modules on local infrastructure, ensuring immutability and availability while preventing sensitive information from being leaked. Tools like JFrog Artifactory support these setups and can be deployed on-premise, in the cloud, or as a SaaS solution, accommodating multiple languages and package managers to promote a stable and secure software development process.

In the rapidly evolving digital landscape, the maturity, speed, quality, and security of software delivery processes are crucial differentiators, especially with the shift to remote work due to COVID-19. Companies are racing to adopt comprehensive cloud DevOps platforms to streamline operations and reduce dependence on multiple vendors. Key considerations for selecting a DevOps platform include an end-to-end solution, universal package management, hybrid capabilities, multi-cloud support, integrated security, and cloud-ready CI/CD capabilities. JFrog, a notable player in this space, highlights the limitations of other platforms like GitHub, Azure DevOps, AWS, GCP, and GitLab in terms of package support, security, hybrid functionality, and scalability, advocating for a seamless, all-encompassing DevOps experience that supports diverse technologies, regions, and deployment environments. The emphasis is on a robust, flexible, and scalable platform that caters to the complex needs of modern enterprises, facilitating efficient and secure software delivery across varied infrastructures.

With Google's introduction of support for Windows containers on Google Kubernetes Engine (GKE), organizations can now deploy .NET-compatible Docker workloads to the Google Cloud Platform with increased flexibility. JFrog's Artifactory is positioned to facilitate this transition by providing comprehensive support for DevOps in .NET application development, including package management with NuGet and Chocolatey. Artifactory enables the creation of private and remote repositories for NuGet packages, enhancing accessibility and reliability. It also supports Docker images for Windows and integrates seamlessly with GKE, offering full traceability and management of Windows applications through a unified Kubernetes registry. This integration allows for the deployment of Windows containers from both public and private registries using secure credentials, thereby simplifying the process and enhancing scalability. JFrog's services are readily available through the Google Cloud Marketplace, offering a streamlined SaaS billing experience for users expanding their operations in the cloud.