Geo-Location LB Setup Steps

To get Access Federation and Repository Federation to work on 2 or more Artifactory clusters while using the same Base URL, you need to set things up just right.

While the <federatedRepoUrlBase> XML tag is another method to setting up Federated Repositories with a Geo-LB, other features such as Release Bundles and Access Federation would also require custom changes. The steps below achieve a full solution with a more straightforward method.

The guide below goes over how you're supposed to properly set up two or more HA clusters to communicate internally while using a proper external URL.

Here's the setup as a diagram:


 

The overall idea is to set the Override Base URL header for users going through the Geo-LB, while underneath the system still uses separate Custom Base URL settings to talk to one another. This Override header affects all of the aspects of the Artifactory application: 

• Redirects
• Download URLs in the UI
• Metadata and metadata URLs
• The "Set Me Up" panel

As long as it is set to the Geo-LB URL, Artifactory will use this URL for all its interactions.  This guide assumes the Geo-LB you plan to use can set an HTTP header, this is a requirement for the setup.

A] Internal Infrastructure Setup

1. Install the first Artifactory cluster and activate its bundled Mission Control. This will be Artifactory-1

2. Locate the Custom Base URL found in Admin -> General -> Settings, set this field to be the Internal URL, not the Geo-LB URL. You can refer to this as the Local Load Balancer URL.

3. Install the second Artifactory cluster, Artifactory-2, and apply a similar Local Load Balancer URL:

    <urlBase>http://10.128.0.150:8082</urlBase>

4. Set up Circle-of-Trust between Artifactory-1 and Artifactory-2 as normal. Take the /var/opt/jfrog/artifactory/etc/access/keys/root.crt file from Artifactory-1 and put it in Artifactory-2's /var/opt/jfrog/artifactory/etc/access/keys/trusted folder, and vice-versa.

5. Register Artifactory-2 in Artifactory-1's Mission Control - Use the Internal URL for the prompt




Setting up Federated Repositories should work normally at this point. The UI can be used as Mission Control is tracking separate Base URLs for each HA cluster:



Access Federation is also set up normally. The Access Fed system uses the 2 internal Base URL parameters and the the UI will work just like with Federated Repos:


 

B] Load Balancer / Networking Setup

To get the Load Balancer URL to work, you need to set an HTTP Header. This is the X-JFrog-Override-Base-Url, it has to be the Load Balancer URL. This header causes Artifactory to use its value for metadata and redirects. 

The default configuration determines the Base URL based on incoming traffic information. This is usually wrong because the reverse proxy receives the request on an internal URL. Simply hard-code the value to be the desired LB URL instead:

[Nginx configuration line]

##Comment out##
##proxy_set_header    X-JFrog-Override-Base-Url $http_x_forwarded_proto://$host:$server_port;
## "$host" is usually the reverse proxy host, not the Geo-LB ##
  proxy_set_header    X-JFrog-Override-Base-Url https://load-balancer.com;

That's it, after setting the header you're all set!

Helm Installations

If the setup uses a Kubernetes Nginx Ingress Controller, use an annotation:

nginx.ingress.kubernetes.io/configuration-snippet: |
    proxy_set_header    X-JFrog-Override-Base-Url https://<global-domain>;

If the setup uses a Kubernetes Nginx Pod, edit the configMap instead:

a. Edit the config files

export KUBE_EDITOR="vim"

kubectl edit configmap arti-artifactory-nginx-artifactory-conf

     #proxy_set_header    X-JFrog-Override-Base-Url $http_x_forwarded_proto://$host:$server_port;
        proxy_set_header    X-JFrog-Override-Base-Url http://load-balancer.com;

b. Reboot the Nginx pod

kubectl delete pod arti-artifactory-nginx-67fd6b668c-24znw