JFog Artifactory is widely used by enterprises as a centralized software repository for managing packages, dependencies, and build artifacts. Recently, we have had several customers asking whether Artifactory can be used as a VMware Cloud Foundation (VCF) Software Depot for both the VCF Installer and SDDC Manager?
Any software repository solution should work as long as the VCF software binaries and metadata can be accessed by either the VCF Installer or SDDC Manager over HTTP(S) with basic authentication. While I have been a consumer of Artifactory before, I have actually never set it up before and this was a good learning opportunity!
Step 1 - I will assume that you have an Artifactory instance already running. For my setup, I am using Nginx to provide TLS termination and my Artifactory instance is available as https://depot.vcf.lab/artifactory (see the bottom for a reference implementation of the nginx.conf that I had used)
Note: I originally tried installing Artifactory OSS on an Ubuntu 24.04 system but after spending several hours debugging on why Access Service on port 8046 will not start, I gave up and went with an evaluation of Artifactory Pro using Ubuntu 22.04, which mostly worked out of the box but I still had a few hoops to jump through while getting TLS configured.
Step 2 - Login to the Artifactory UI and navigate to Administration->Repositories and create a new repository called vcf
Step 3 - Navigate to Administration->User Management->User and create a new user that will be used by the VCF Installer and SDDC Manager to access the the repository that we had created from the previous step.
Step 4 - We can start uploading our VCF binaries and metadata that we had downloaded either manually or using the VCF Download Tool (VCFDT) to our Artifactory repository. Artifactory supports two methods to upload files to your repository, one is by using the Artifactory UI and the other by using the Artifactory CLI.
Using the Artifactory UI, navigate to Platform->Artifacts->(select your repo) and in the upper right hand corner, click on the three dots and click on the Deploy button.
While you can select multiple files to upload, they must reside in the same destination path, so this was not the most efficient method. In the example below, I am uploading the vSAN metadata files and we need to make sure it is placed in PROD/vsan/hcl, which you need to specify in the target path below.
In addition to being an efficient method of using the Artifactory UI to upload, there is also 100MB file limit, which will prevent you from uploading larger VCF binaries.
Luckily, we can download and install the JFrog CLI (jf) and use that to upload larger files to Artifactory.
Note: To establish a trust between JFrog CLI and your Artifactory instance, download the TLS certificate from your browser and then place that in ~/.jfrog/security/certs (e.g. .jfrog/security/certs/depot.vcf.lab.pem).
After authenticating to your Artifactory instance using the JFrog CLI, change into the top level directory where you see the /PROD directory that will contain your VCF binary and metadata.
.
└── PROD
├── COMP
├── metadata
└── vsan
5 directories, 0 files
From Step 2, our Artifactory repository is named vcf and when I logged in to create my session, I had also used vcf as my server ID, so to upload the SDDC Manager OVA, I would use the following command:
jf rt upload PROD/COMP/SDDC_MANAGER_VCF/VCF-SDDC-Manager-Appliance-9.0.1.0.24962180.ova --server-id=vcf
If everything was setup correctly, once the upload completes, you should see a success message along with the following path to SDDC Manager OVA as shown in the screenshot below.
Note: I had ran into a file limit size issue with Nginx, the solution was to ensure client_max_body_size was equal or greater to the largest file you plan to upload, which was ~25GB
After everything has been successfully uploaded, the VCF Software Depot should have the following structure as shown in the screenshot below.
It is important to understand that the default behavior of both the VCF Installer and SDDC Manager expects to access the VCF Software Depot with /PROD in the base of your URL (e.g. https://depot.vcf.lab/PROD)
With Artifactory, the URL will include an additional path (e.g. https://depot.vcf.lab/artifactory/vcf/PROD) which would not be understood by VCF Installer or SDDC Manager.
Fortunately, we can update the VCF Installer and SDDC Manager to make it aware of our new base path, which will then allow us to specify the Artifactory FQDN and it will know where to look for /PROD directory.
Step 5 - Login to VCF Installer or SDDC Manager using "vcf" username and the password that you had configured and then switch to root user. Edit /opt/vmware/vcf/lcm/lcm-app/conf/application-prod.properties and look for either lcm.depot.adapter.remote.v2.rootDir (VCF 9.x) or lcm.depot.adapter.remote.rootDir (VCF 5.x) property and update the value from /PROD to /artifactory/vcf/PROD
Step 6 - We also need to import the TLS root CA certificate from our Artifactory instance into the VCF Installer and SDDC Manager, so that it can properly establish trust. You will need to get a copy of the rootCA (e.g. depot.vcf.lab-rootCA.pem) and then update DEPOT_ALIAS and DEPOT_CERT variables and run the following which will automatically add root CA certificate into keystore.
STOREPASS=$(cat /etc/vmware/vcf/commonsvcs/trusted_certificates.key) DEPOT_ALIAS="vcf_offline_depot" DEPOT_CERT="depot.vcf.lab-rootCA.pem" keytool -importcert -alias $DEPOT_ALIAS -file $DEPOT_CERT -keystore /etc/vmware/vcf/commonsvcs/trusted_certificates.store -storepass $STOREPASS -noprompt
Step 7 - For the changes to go into effect, we need to restart the VCF Installer and SDDC Manager services which you can run the following command:
echo 'Y' | /opt/vmware/vcf/operationsmanager/scripts/cli/sddcmanager_restart_services.sh
Step 8 - Once the VCF Installer or SDDC Manager services has successfully restarted, we can now configure the VCF Offline Depot to point to our Artifactory instance using the credentials that was created from Step 3 and it should be able to login to download the VCF metadata files and allow you to download VCF binaries from your Artifactory instance!
While the requirements for setting up a VCF Software Depot is not unique to Artifactory, the need for a custom base URL is something Artifactory users will face (see Step 5) and this is an area that we plan to improve in a future VCF update, where users will be able to specify the full URL path to /PROD, not just the FQDN and thus removing the need to make edits directly within the VCF Installer or SDDC Manager.
Ngnix reference example configuration for providing TLS termination in front of Artifactory:
# /etc/nginx/conf.d/artifactory.conf
server {
listen 443 ssl http2;
server_name depot.vcf.lab;
# TLS certificate paths
ssl_certificate /etc/nginx/ssl/depot.crt;
ssl_certificate_key /etc/nginx/ssl/depot.key;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers 'HIGH:!aNULL:!MD5';
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
client_max_body_size 30G;
proxy_max_temp_file_size 0;
proxy_connect_timeout 300s;
proxy_send_timeout 300s;
proxy_read_timeout 300s;
send_timeout 300s;
# Redirect bare domain to /artifactory (optional)
location = / {
return 301 https://$host/artifactory/;
}
# Proxy ALL JFrog Router traffic
location / {
proxy_pass http://127.0.0.1:8082;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Port $server_port;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_buffering off;
proxy_request_buffering off;
}
}
# Optional HTTP → HTTPS redirect
server {
listen 80;
server_name depot.vcf.lab;
return 301 https://$host$request_uri;
}
Thanks for the comment!