ARTIFACTORY: How to resolve an issue when the Nginx pod fails to start after upgrading Artifactory to 7.77.x version using Helm Chart

Subject: Following the upgrade of Artifactory to version 7.77.x using the Helm Chart, the Nginx pod experiences startup issues. Our goal is to implement necessary modifications to the Nginx configuration to ensure successful startup of the pod.

Affected Versions: Artifactory 7.77.x / Helm Chart (artifactory-107.77.3 and above, artifactory-ha-107.77.3 and above, jfrog-platform-10.17.0 and above)

Description

With the Artifactory deployment using the Helm Chart, if you have a custom Nginx configuration set up either using a ConfigMap

nginx:
  customArtifactoryConfigMap: custom-nginx-conf

Or by directly adding the configuration to the values.yaml file, you might encounter an issue where Nginx fails to start after upgrading Artifactory to version 7.77.3 and above.

NAME                                             READY   STATUS             RESTARTS       AGE
artifactory-0                                    7/7     Running            0              4h10m
artifactory-artifactory-nginx-7bf57fc5cc-4bz85   0/1     CrashLoopBackOff   5 (65s ago)    4m25s

Below is an excerpt from the Nginx logs displaying the encountered error:

2024-03-25 22:47:14   [14 entrypoint-nginx.sh] Dockerfile for this image can found inside the container.
2024-03-25 22:47:14   [15 entrypoint-nginx.sh] To view the Dockerfile: 'cat /docker/nginx-artifactory-pro/Dockerfile.nginx'.
2024-03-25 22:47:14   [19 entrypoint-nginx.sh] Setting up directories if missing
2024-03-25 22:47:14  [160 entrypoint-nginx.sh] Generating ssl example.key and example.crt
2024-03-25 22:47:14   [83 entrypoint-nginx.sh] Artifactory configuration already in /var/opt/jfrog/nginx/conf.d/artifactory.conf
mkdir: can't create directory '/var/opt/jfrog/nginx/logrotate': File exists
2024-03-25 22:47:14   [92 entrypoint-nginx.sh] Adding logrotate to crontab
2024-03-25 22:47:14  [187 entrypoint-nginx.sh] Starting updateConf.sh in the background
Using deprecated password for user _internal.
2024-03-25 22:47:14  [192 entrypoint-nginx.sh] Starting nginx daemon...
nginx: [emerg] bind() to 0.0.0.0:80 failed (13: Permission denied)

Security context settings for the Nginx service have been updated so that it operates as a non-root user. Nginx's internal ports have been adjusted to values greater than 1024 to comply with Linux restrictions (Ref)

 http:
    enabled: true
    externalPort: 80
    internalPort: 8080
  https:
    enabled: true
    externalPort: 443
    internalPort: 8443

With the default settings, the Nginx pod will start successfully. However, if you’re using the custom Nginx configuration, you may run into the above error.

Resolution

To resolve this issue, we need to modify the following lines in the Nginx Artifactory configuration file.

From

listen 80;
listen 443;
proxy_set_header X-JFrog-Override-Base-Url $http_x_forwarded_proto://$host:$server_port;

listen 8080;
listen 8443;
proxy_set_header X-JFrog-Override-Base-Url $http_x_forwarded_proto://$host;

After making this adjustment:

Restart the Nginx pod, if the change was made on the ConfigMap.
Redeploy Artifactory, if the change was made directly on the values.yaml’s “artifactoryConf” block.

You should observe that the Nginx pod starts up successfully.

NAME                                             READY   STATUS    RESTARTS        AGE
artifactory-0                                    7/7     Running   1 (5m45s ago)   9m14s
artifactory-artifactory-nginx-6c4499c6cc-sx9cx   1/1     Running   0               10s

Defaulted container "nginx" out of: nginx, setup (init)
Using deprecated password for user _internal.
2024-03-25 23:57:07  [169 entrypoint-nginx.sh] Preparing to run Nginx in Docker
2024-03-25 23:57:07   [14 entrypoint-nginx.sh] Dockerfile for this image can found inside the container.
2024-03-25 23:57:07   [15 entrypoint-nginx.sh] To view the Dockerfile: 'cat /docker/nginx-artifactory-pro/Dockerfile.nginx'.
2024-03-25 23:57:07   [19 entrypoint-nginx.sh] Setting up directories if missing
2024-03-25 23:57:07  [160 entrypoint-nginx.sh] Generating ssl example.key and example.crt
2024-03-25 23:57:07   [83 entrypoint-nginx.sh] Artifactory configuration already in /var/opt/jfrog/nginx/conf.d/artifactory.conf
2024-03-25 23:57:07  [177 entrypoint-nginx.sh] Adding logrotate configuration
2024-03-25 23:57:07   [92 entrypoint-nginx.sh] Adding logrotate to crontab
2024-03-25 23:57:07  [187 entrypoint-nginx.sh] Starting updateConf.sh in the background
Using deprecated password for user _internal.
2024-03-25 23:57:07  [192 entrypoint-nginx.sh] Starting nginx daemon...