Onboarding JFrog Artifactory

1. In the CloudGuard portal, navigate to Asset > Environments.

2. From the top menu, select Add > Container Registry and follow the setup steps.

   Alternatively, in Kubernetes Kubernetes, often abbreviated as “K8s”, orchestrates containerized applications to run on a cluster of hosts. cluster scanning environment, open the hosting cluster page and click Scan Registry on the top menu.

3. In the Container A lightweight and portable executable image that contains software and all of its dependencies. Containers decouple applications from underlying host infrastructure to make deployment easier in different cloud or OS environments, and for easier scaling. Registry Onboarding wizard, enter the registry details:

   1. Environment Name - Enter a new name for the registry or use the default name. This name allows you to identify the registry later in CloudGuard.

   2. Environment Description - Optionally, enter a description.

   3. Select an Organizational Unit.

   4. Select the type of environment to host your scanner - Kubernetes or AWS Amazon® Web Services. Public cloud platform that offers global compute, storage, database, application and other cloud services. ECS Scanner.

   5. Select a Kubernetes cluster or an AWS environment on which you can run the registry scanner:

      • For Kubernetes, select from the list of clusters with enabled Image Assurance. For a new cluster, click Onboard a new Kubernetes Cluster and see Onboarding Kubernetes Clusters. In this case, you quit the registry onboarding and, after onboarding a new cluster, you need to start the registry onboarding from the beginning.

      • For AWS ECS Amazon Elastic Container Service (ECS) - a fully managed container orchestration service that helps you deploy, manage, and scale Docker containers running applications, services, and batch processes. Scanner, select from the list of all AWS environments onboarded to CloudGuard.

   6. Registry Type - Select JFrog Artifactory.

   7. Registry URI - Enter the FQDN of your registry endpoint, without the protocol (https):

      • For Artifactory instances hosted in the JFrog Cloud, use a URI in the format <company>.jfrog.io.

      • For self-hosted Artifactory instances, use a URI with a resolvable host name or the IP of your JFrog Artifactory instance.

   8. Authentication Method - With at least read permissions, select one of the authentication methods below.

      For the Kubernetes scanner, enter the details below each method. For the AWS ECS scanner, only select the method and enter the details later in Step 3.

      • JFrog Artifactory Basic Authentication

        Pull Secret Name - Enter the image pull secret name that you create on the hosting cluster with your credentials.

        Make sure that the <secret-name> is a valid Kubernetes name. For more details, see the Kubernetes Documentation.

        To create the secret, run:

        Copy

        kubectl create secret docker-registry <secret-name> \
            --namespace <cloudguard-namespace> \
            --docker-server=<artifactory-registry-URI>\
            --docker-username=<username> \
            --docker-password=<password>

      • JFrog Artifactory Access Token

        Enter the token that you generate per user or with Admin permission:

        1. In the JFrog platform, navigate to Platform Configuration and go to User Management.

        2. Configure a Scoped Access Token with the Reference Token option.

        3. Configure a secret on your cluster with the received Reference Token. For this, run:

           Copy

           kubectl create secret docker-registry <secret-name> \
               --namespace <cloudguard_namespace> \
               --docker-server=<artifactory-registry-URI>\
               --docker-username=jfrog \
               --docker-password=<reference-token>

4. Click Next to continue with Cluster Configurations.

In this step, you configure the CloudGuard Service Account credentials if in Step 1 you selected to onboard with a new cluster or with an existing cluster that requires an agent update.

For onboarding with the hosting cluster that has updated agents, this step is skipped.

1. Configure a Service Account by one of these methods:

   • Select an existing Service Account with its corresponding API Key.

   • Enter a Service Account manually.

   • Click Add Service Account to create a new account.

2. Click Next to continue to the next step.