The following installation methods are supported:
All install types are supported, including: Docker Compose, Linux Archive, RPM and Debian.
The installer script provides you an interactive way to install Insight and its dependencies. All install types are supported. This installer should be used for Docker Compose.
Extract the contents of the compressed archive and go to the extracted folder.
tar -xvf jfrog-insight-<version>-<compose|rpm|deb>.tar.gz cd jfrog-insight-<version>-<compose|rpm|deb> |
When running Insight, the installation script creates a user called insight by default which must have run and execute permissions on the installation directory. It is recommended to extract the Insight download file into a directory that gives run and execute permissions to all users such as |
mv jfrog-insight-<version>-linux.tar.gz /opt/ cd /opt tar -xf jfrog-insight-<version>-linux.tar.gz mv jfrog-insight-<version>-linux insight cd insight |
This .env file is used by docker-compose and is updated during installations and upgrades. Notice that some operating systems do not display dot files by default. If you've made any changes to the file, remember to backup before an upgrade. |
Run the installer script.
Note: the script will prompt you with a series of mandatory inputs, including the jfrogURL
(custom base URL) and joinKey
.
./config.sh |
./install.sh |
Refer to prerequisites for Insight in Linux Archive before running the install script. |
./install.sh --user <user name> --group <group name> -h | --help : [optional] display usage -u | --user : [optional] (default: insight) user which will be used to run the product, it will be created if its unavailable -g | --group : [optional] (default: insight) group which will be used to run the product, it will be created if its unavailable |
Start and manage the Insight service.
systemctl start|stop insight.service |
service insight start|stop |
cd jfrog-insight-<version>-compose docker-compose -p insight up -d docker-compose -p insight ps docker-compose -p insight down |
Insight can be installed and managed as a service in a Linux archive installation. Refer start Insight section under Linux Archive Manual Installation for more details. |
insight/app/bin/insight.sh start|stop |
http://<jfrogUrl>/ui/
and go to the Dashboard tab in the Application module in the UI.Check the Insight log.
tail -f $JFROG_HOME/insight/var/log/console.log |
The |
Extract the contents of the compressed archive and move it into /insight directory..
tar -xvf jfrog-insight-<version>-linux.tar.gz mv jfrog-insight-<version>-linux insight |
PostgreSQL is required and must be installed before continuing with the next installation steps. Set your PostgreSQL connection details in the Shared Configurations section of the |
Prepare for the Elasticsearch Installation by increasing the map count. For additional information refer to the Elastic Search documentation.
sudo sysctl -w vm.max_map_count=262144 |
To make this change permanent, remember to update the |
Install Elasticsearch. Instructions to install Elasticsearch are available here.
You can install the package available at <JFROG_HOME>/insight/app/third-party/elasticsearch/elasticsearch-<version>.tar.gz
or you can download a compatible version of Elasticsearch from this page.
Install Search Guard. The Search Guard package can be located in the extracted contents at <JFROG_HOME>/mc/app/third-party/elasticsearch/search-guard-<version>.tar.gz
. For installation steps, refer to the Search Guard documentation.
You must install the Search Guard plugin to ensure secure communication with Elasticsearch. |
Add an admin user to Search Guard, to ensure authenticated communication with Elasticsearch.
The Search Guard configuration accepts a hashed password. Use the following command to generate the hash for the password.
<JFROG_HOME>/insight/app/third-party/elasticsearch/elasticsearch-<version>/plugins/search-guard-7/tools/hash.sh -p <clear_text_password> #This will output a hashed password (<hash_password>), make a copy of it |
Prepare the configuration snippet to add a new(admin) user with the hashed password obtained from previous step.
<username>: hash: "<hashed_password>" backend_roles: - "admin" description: "Insight Elastic admin user" |
JFROG_HOME>/insight/app/third-party/elasticsearch/elasticsearch-<version>/plugins/search-guard-7/sgconfig/
.Enable the anonymous access to _cluster/health
endpoint. This is required to check the health of Elasticsearch cluster.
Enable the anonymous auth in this file sg_config.yml
at <JFROG_HOME>/insight/app/third-party/elasticsearch/elasticsearch-<version>/plugins/search-guard-7/sgconfig/
.
sg_config: dynamic: http: anonymous_auth_enabled: true #set this to true |
Map the anonymous user sg_anonymous
to the backend role "sg_anonymous_backendrole" in this file "sg_roles_mapping.yml" at <JFROG_HOME>/insight/app/third-party/elasticsearch/elasticsearch-<version>/plugins/search-guard-7/sgconfig/
.
sg_anonymous: backend_roles: - sg_anonymous_backendrole |
Add the following snippet to the end of this file sg_roles.yml
located at <JFROG_HOME>/insight/app/third-party/elasticsearch/elasticsearch-<version>/plugins/search-guard-7/sgconfig/
.
sg_anonymous: cluster_permissions: - cluster:monitor/health |
Add the following in the shared section of $JFROG_HOME/insight/var/etc/system.
yaml
file. Refer to Shared Configurations section.
shared: elasticsearch: external: true url: <URL_TO_ELASTICSEARCH_INSTANCE>:<ELASTICSEARCH_PORT> username: <USERNAME_SET_IN_SEARCHGUARD> password: <CLEAR_TEXT_PASSWORD_FOR_THE_ABOVE_USERNAME> |
If you use Amazon Elasticsearch Service, enter the following in the shared section of the YAML file.
If you use the Amazon Elasticsearch Service, you must log in to the service using your Amazon AWS credentials. |
Start PostgreSQL and Elasticsearch
system.yam
l configuration file.Start and manage the Insight service as the user who extracted the tar.
As a process
insight/app/bin/insight.sh start |
Manage the process.
insight/app/bin/insight.sh start|stop|status|restart |
As a service
Insight is packaged as an archive file and an install script that can be used to install it as a service running under a custom user. Currently supported on Linux systems.
When running Insight as a service, the installation script creates a user called insight (by default) which must have run and execute permissions on the installation directory. It is recommended to extract the Insight download file into a directory that gives run and execute permissions to all users such as |
To install Insight as a service, execute the following command as root:
User and group can be passed through |
insight/app/bin/installService.sh --user <enter user, default value is insight> --group <enter group, default value is insight> -u | --user : [optional] (default: insight) user which will be used to run the product, it will be created if its unavailable -g | --group : [optional] (default: insight) group which will be used to run the product, it will be created if its unavailable |
The user and group will be stored in the insight/var/etc/system.yaml
at the end of the installation.
To manage the service, use the systemd
or init.d
commands depending on your system.
systemctl <start|stop|status> insight.service |
service insight <start|stop|status> |
http://<jfrogUrl>/ui/
and go to the Dashboard tab in the Application module in the UICheck the Insight log.
tail -f $JFROG_HOME/insight/var/log/console.log |
The RPM installation bundles Insight and all its dependencies. It is provided as native RPM packages, where Insight and its dependencies must be installed separately. Use this, if you are automating installations.
Extract the contents of the compressed archive, and go to the extracted folder:
tar -xvf jfrog-insight-<version>-rpm.tar.gz cd jfrog-insight-<version>-rpm |
Install Insight. You must run as a root user.
rpm -Uvh --replacepkgs ./insight/insight.rpm |
Install PostgreSQL and start the PostgreSQL service.
PostgreSQL is required and must be installed before continuing with the next installation steps. Set your PostgreSQL connection details in the Shared Configurations section of the |
Install Elasticsearch. Instructions to install Elasticsearch are available here.
You can install the package available at jfrog-insight-<version>-rpm
/third-party/elasticsearch/elasticsearch-<version>.tar.gz
or you can download a compatible version of Elasticsearch from this page.
When connecting an external instance of Elasticsearch to Insight, add the following flag in the Shared Configurations of $JFROG_HOME/insight/var/etc/system.
yaml
file.
shared: elasticsearch: external: true |
Install Search Guard. The Search Guard package can be located in the extracted contents at jfrog-insight-<version>-rpm
/third-party/elasticsearch/search-guard-<version>.tar.gz
. For installation steps, refer to the Search Guard documentation.
You must install the Search Guard plugin to ensure secure communication with Elasticsearch. |
Add an admin user to Search Guard, to ensure authenticated communication with Elasticsearch.
The Search Guard configuration accepts a hashed password. Use the following command to generate the hash for the password.
/etc/elasticsearch/plugins/search-guard-7/tools/hash.sh -p <clear_text_password> #This will output a hashed password (<hash_password>), make a copy of it |
Prepare the configuration snippet to add a new(admin) user with the hashed password obtained from previous step.
<username>: hash: "<hashed_password>" backend_roles: - "admin" description: "Insight Elastic admin user" |
/etc/elasticsearch/plugins/search-guard-7/sgconfig/
.Enable the anonymous access to _cluster/health
endpoint. This is required to check the health of Elasticsearch cluster.
Enable the anonymous auth in this file sg_config.yml
at /etc/elasticsearch/plugins/search-guard-7/sgconfig/
.
sg_config: dynamic: http: anonymous_auth_enabled: true #set this to true |
Map the anonymous user sg_anonymous
to the backend role "sg_anonymous_backendrole" in this file "sg_roles_mapping.yml" at /etc/elasticsearch/plugins/search-guard-7/sgconfig
.
sg_anonymous: backend_roles: - sg_anonymous_backendrole |
Add the following snippet to the end of this file sg_roles.yml
located at /etc/elasticsearch/plugins/search-guard-7
/sgconfig/
.
sg_anonymous: cluster_permissions: - cluster:monitor/health |
Add the following in the shared section of $JFROG_HOME/insight/var/etc/system.
yaml
file. Refer to Shared Configurations section.
shared: elasticsearch: url: <URL_TO_ELASTICSEARCH_INSTANCE>:<ELASTICSEARCH_PORT> username: <USERNAME_SET_IN_SEARCHGUARD> password: <CLEAR_TEXT_PASSWORD_FOR_THE_ABOVE_USERNAME> |
If you use Amazon Elasticsearch Service, enter the following in the shared section of the YAML file.
If you use the Amazon Elasticsearch Service, you must log in to the service using your Amazon AWS credentials. |
Customize the product configuration.
system.yaml
configuration file.Start and manage the Insight service.
systemctl start|stop insight.service |
service insight start|stop|status|restart |
http://<jfrogUrl>/ui/
and go to the Dashboard tab in the Application module in the UICheck the Insight log.
tail -f $JFROG_HOME/insight/var/log/console.log |
The Debian installation bundles Insight and all its dependencies. It is provided as native Debian packages, where Insight and its dependencies must be installed separately. Use this, if you are automating installations.
Extract the contents of the compressed archive, and go to the extracted folder:
tar -xvf jfrog-insight-<version>-deb.tar.gz cd jfrog-insight-<version>-deb |
Install Insight. You must run as a root user.
dpkg -i ./insight/insight.deb |
PostgreSQL is required and must be installed before continuing with the next installation steps. Set your PostgreSQL connection details in the Shared Configurations section of the |
Install Elasticsearch. Instructions to install Elasticsearch are available here.
You can install the package available at jfrog-insight-<version>-deb
/third-party/elasticsearch/elasticsearch-<version>.tar.gz
or you can download a compatible version of Elasticsearch from this page.
Install Search Guard. The Search Guard package can be located in the extracted contents at jfrog-insight-<version>-deb
/third-party/elasticsearch/search-guard-<version>.tar.gz
. For installation steps, refer to the Search Guard documentation.
You must install the Search Guard plugin to ensure secure communication with Elasticsearch. |
Add an admin user to Search Guard, to ensure authenticated communication with Elasticsearch.
The Search Guard configuration accepts a hashed password. Use the following command to generate the hash for the password.
/usr/share/elasticsearch/plugins/search-guard-7/tools/hash.sh -p <clear_text_password> #This will output a hashed password (<hash_password>), make a copy of it |
Prepare the configuration snippet to add a new(admin) user with the hashed password obtained from previous step.
<username>: hash: "<hashed_password>" backend_roles: - "admin" description: "Insight Elastic admin user" |
/usr/share/elasticsearch/plugins/search-guard-7/sgconfig/
.Enable the anonymous access to _cluster/health
endpoint. This is required to check the health of Elasticsearch cluster.
Enable the anonymous auth in this file sg_config.yml
at /usr/share/elasticsearch/plugins/search-guard-7/sgconfig/
.
sg_config: dynamic: http: anonymous_auth_enabled: true #set this to true |
Map the anonymous user sg_anonymous
to the backend role "sg_anonymous_backendrole" in this file "sg_roles_mapping.yml" at /usr/share/elasticsearch/plugins/search-guard-7/sgconfig/
.
sg_anonymous: backend_roles: - sg_anonymous_backendrole |
Add the following snippet to the end of this file sg_roles.yml
located at /usr/share/elasticsearch/plugins/search-guard-7/sgconfig/
.
sg_anonymous: cluster_permissions: - cluster:monitor/health |
Add the following in the shared section of $JFROG_HOME/insight/var/etc/system.
yaml
file. Refer to Shared Configurations section.
shared: elasticsearch: url: <URL_TO_ELASTICSEARCH_INSTANCE>:<ELASTICSEARCH_PORT> username: <USERNAME_SET_IN_SEARCHGUARD> password: <CLEAR_TEXT_PASSWORD_FOR_THE_ABOVE_USERNAME> |
If you use Amazon Elasticsearch Service, enter the following in the shared section of the YAML file.
If you use the Amazon Elasticsearch Service, you must log in to the service using your Amazon AWS credentials. |
Customize the product configuration.
system.yaml
configuration file.Start and manage the Insight service.
systemctl start|stop insight.service |
service insight start|stop|status|restart |
http://<jfrogUrl>/ui/
and go to the Dashboard tab in the Application module in the UI.Check the Insight log.
tail -f $JFROG_HOME/insight/var/log/console.log |
In the chart directory, includes three values files, one for each installation type - small/medium/large. These values files are recommendations for setting resources requests and limits for your installation. You can find the files in the corresponding chart directory: |
Add the ChartCenter Helm repository to your Helm client.
helm repo add jfrog https://charts.jfrog.io |
Update the repository.
helm repo update |
Initiate installation by providing a join key and JFrog url as a parameter to the Insight chart installation.
helm upgrade --install insight --set insightServer.joinKey=<YOUR_PREVIOUSLY_RETRIEVED_JOIN_KEY> \ --set insightServer.jfrogUrl=<YOUR_PREVIOUSLY_RETRIEVED_BASE_URL> --namespace insight jfrog/insight |
Alternatively, you can manually create a secret containing the join key and then pass it to the template during install/upgrade. The key must be named join-key.
kubectl create secret generic my-secret --from-literal=join-key=<YOUR_PREVIOUSLY_RETIREVED_JOIN_KEY> # Pass the created secret to helm helm upgrade --install insight --set insightServer.joinKeySecretName=my-secret --namespace insight jfrog/insight |
In either case, make sure to pass the same join key on all future calls to |
Customize the product configuration (optional) including database, Java Opts, and filestore.
Unlike other installations, Helm Chart configurations are made to the Follow these steps to apply the configuration changes.
|
Access Insight from your browser at: http://<jfrogUrl>/ui/
and go to the Dashboard tab in the Application module in the UI.
Check the status of your deployed Helm releases.
helm status insight |
The following describes how to set up a Insight HA cluster with more than one node. For more information about HA, see System Architecture .
All nodes within the same Insight HA installation must be running the same Artifactory version.
For a Insight HA cluster to work correctly, you must have at least three nodes in the cluster. |
Insight HA requires an external PostgreSQL database. Make sure to install it before proceeding to install the first node. There are several ways to setup PostgreSQL for redundancy. Including: HA, Load Balancing and Replication. For more information, see the PostgreSQL documentation
All the Insight HA components (Insight cluster nodes, database server and Elasticsearch) must be within the same fast LAN.
All the HA nodes must communicate with each other through dedicated TCP ports.
The following installation methods are supported:
All install types are supported, including: Docker Compose, Linux Archive, RPM, and Debian.
The installer script provides you an interactive way to install Insight and its dependencies. All install types are supported. Use this installer for Docker Compose.
Install the first node. The installation is identical to the single node installation.
Do not start the Insight service. |
Start the Insight service.
systemctl start insight.service |
service insight start |
cd jfrog-insight-<version>-compose docker-compose -p insight up -d |
You can install and manage Insight as a service in a Linux archive installation. Refer the Start Insight section under Manual Linux Archive Installation for more details. |
insight/app/bin/insight.sh start |
Access Insight from your browser at: http://<jfrogUrl>/ui/
and go to the Dashboard tab in the Application module in the UI.
Check the Insight log.
tail -f $JFROG_HOME/insight/var/log/console.log |
docker-compose -p insight logs |
For a node to join a cluster, the node must have the same database configuration and the master key.
If you installed Search Guard along with Elasticsearch , you must copy the client and node certificates from Elasticsearch's configuration folder in the primary node to all the additional nodes.
If you want to use the bundled Elasticsearch installation with Insight in RPM and Debian installations, copy the client and node certificates from Elasticsearch's configuration folder from the master node to a new directory named as "sg-certs" under the extracted folder on additional node.
Create the folder, Copy localhost.key, localhost.pem, and root-ca.pem from the Elasticsearch source folder, |
Create the folder, Copy localhost.key, localhost.pem, and root-ca.pem from the Elasticsearch source folder, |
Docker Compose installer uses pre-generated certificates for Search Guard. You do not need to manually copy the client and node certificates. |
insight
.$JFROG_HOME/etc/security/master.key
.http://<jfrogUrl>/ui/
and go to the Dashboard tab in the Application module in the UI. Check the Insight log.
tail -f $JFROG_HOME/insight/var/log/console.log |
docker-compose -p insight logs |
Install the first node. The installation is identical to the single node installation.
Do not start the Insight service. |
Configure the
system.yaml
file with the database and first node configuration details. For example,
shared: database: type: postgresql driver: org.postgresql.Driver url: jdbc:postgresql://<ip:port>/insight?sslmode=disable username: <username> password: <password> jfrogUrl: <JFrog URL> security: joinKey: <Artifactory Join Key> |
Start and manage the Insight service.
systemctl start|stop insight.service |
service insight start|stop |
http://<jfrogUrl>/ui/
and go to the Dashboard tab in the Application module in the UI Check the Insight log.
tail -f $JFROG_HOME/insight/var/log/console.log |
For a node to join a cluster, the node must have the same database configuration and the master key. Install all additional nodes using the same steps described above, with the following additional steps:
Configure the
system.yaml
file for the additional node with master key, database and active node configurations.
For example:
shared: database: type: postgresql driver: org.postgresql.Driver url: jdbc:postgresql://<ip:port>/insight?sslmode=disable username: <username> password: <password> jfrogUrl: <JFrog URL> security: joinKey: <Artifactory Join Key> # Configure the following property values when Elasticsearch is installed from the bundled Insight package. elasticsearch: clusterSetup: "YES" unicastFile: "$JFROG_HOME/insight/data/elasticsearch/config/unicast_hosts.txt" |
master.key
from the first node to the additional node located at $JFROG_HOME/insight/var/etc/security/master.key.
$JFROG_HOME/insight/var/etc/system.yaml
file. If you installed Search Guard along with Elasticsearch, copy the client and node certificates from Elasticsearch's config folder from the primary node to a new directory, sg-certs
, under the extracted folder on the additional node.
Start the additional node.
http://<jfrogUrl>/ui/
and go to the Dashboard tab in the Application module in the UI. Check the Insight log.
tail -f $JFROG_HOME/insight/var/log/console.log |
Currently, it is not possible to connect a JFrog product (like Insight) that is within a Kubernetes cluster with another JFrog product (like Artifactory) that is outside of the cluster, as this is considered a separate network. Therefore, JFrog products cannot be joined together if one of them is in a cluster. |
In the chart directory, includes three values files, one for each installation type–small/medium/large. These values files are recommendations for setting resources requests and limits for your installation. You can find the files in the corresponding chart directory: |
For high availability of Insight, set the replicaCount in the values.yaml file to >1 (the recommended value is 3).
|
Add the ChartCenter Helm repository to your Helm client.
helm repo add jfrog https://charts.jfrog.io |
Update the repository.
helm repo update |
Initiate installation by providing a join key and JFrog url as a parameter to the Insight chart installation.
helm upgrade --install insight --set insight.joinKey=<YOUR_PREVIOUSLY_RETIREVED_JOIN_KEY> \ --set insight.jfrogUrl=<YOUR_PREVIOUSLY_RETIREVED_BASE_URL> --namespace insight jfrog/insight |
Alternatively, you can manually create a secret containing the join key and then pass it to the template during install/upgrade. the key must be named join-key.
# Create a secret containing the key: kubectl create secret generic my-secret --from-literal=join-key=<YOUR_PREVIOUSLY_RETIREVED_JOIN_KEY> # Pass the created secret to helm helm upgrade --install insight --set insight.joinKeySecretName=my-secret --namespace insight jfrog/insight |
In either case, make sure to pass the same join key on all future calls to |
Unlike other installations, Helm Chart configurations are made to the Follow these steps to apply the configuration changes.
|
Access Insight from your browser at: http://<jfrogUrl>/ui/
and go to the Dashboard tab in the Application module in the UI
Check the status of your deployed Helm releases.
helm status insight |
After installing and before running Insight, you may set the following configurations.
You can configure all your system settings using the If you don't have a System YAML file in your folder, copy the template available in the folder and name it For the Helm charts, the |
Insight requires a working Artifactory server and a suitable license. The Insight connection to Artifactory requires 2 parameters:
$JFROG_HOME/insight/etc/system.yaml
file.joinKey
(join Key) from the JPD UI in the Administration module | User Management | Settings | Join Key. join.key
used by your Artifactory server in the Shared Configurations section of the $JFROG_HOME/insight/etc/system.yaml
file.Insight comes bundled with a PostgreSQL Database out-of-the-box, which comes pre-configured with default credentials.
These commands are indicative and assume some familiarity with PostgreSQL. Please do not copy and paste them. For docker-compose, you will need to ssh into the PostgreSQL container before you run them |
To change the default credentials:
#Change password for Insight user # Access PostgreSQL as the insight user adding the optional -W flag to invoke the password prompt $ psql -d insight -U insight -W # Securely change the password for user "mission_control". Enter and then retype the password at the prompt. \password insight # Verify the update was successful by logging in with the new credentials $ psql -d insight -U insight -W |
Search Guard tool is used to manage authentication. To change password for the default user, Search Guard accepts a hash password to be provided in the configuration.
Generate the hash password by providing the password(in text format) as input
$ELASTICSEARCH_HOME/plugins/search-guard-<major_version_number>/tools/hash.sh -p <password_in_text_format> |
The output from the previous step should be updated in the configuration for the default user
vi $ELASTICSEARCH_HOME/plugins/search-guard-<major_version_number>/sgconfig/sg_internal_users.yml #Scroll in the file to find an entry for the username of the default user #Update the value for "hash" with the hash content obtained from previous step <default_username>: hash: <hash_output_from_previous_step> |
Run the command to initialise Search Guard.
Stop Docker services.
docker-compose -p insight down |
Change the password in docker-compose.yaml and system.yaml to the new password.
In docker-compose.yaml under: - ELASTICSEARCH_PASSWORD=<new_password> In system.yaml under: shared.elasticsearch.password |
Move the following file to a backup directory.
mv <JFROG_HOME>/insight/var/data/elasticsearch/sgconfig/sg_internal_users.yml /$HOME/sg_internal_users.yml.backup |
Restart Docker services.
docker-compose -p insight up -d |
cd $JFROG_HOME/insight/var/etc/security/keys/trusted #Copy the certificates to this location and restart insight services |
Set your PostgreSQL and Elasticsearch connection details in the Shared Configurations section of the $JFROG_HOME/insight/var/etc/system.yaml
file.
If you prefer to use the custom certificates when Search Guard enabled with tls in Elasticsearch, you can use the search-guard-tlstool
to generate Search Guard certificates.
The tool to generate Search Guard certificates is be available in $JFROG_HOME/app/third-party/elasticsearch/search-guard-tlstool-1.6.tar.gz
. For more information about generating certificates, see Search Guard TLS Tool.
Run the tool to generate the certificates.
tar -xvf $JFROG_HOME/app/third-party/elasticsearch/search-guard-tlstool-1.6.tar.gz cp $JFROG_HOME/app/third-party/elasticsearch/config/tlsconfig.yml $JFROG_HOME/app/third-party/elasticsearch/search-guard-tlstool-1.8/config cd $JFROG_HOME/app/third-party/elasticsearch/search-guard-tlstool-1.8/tools ./sgtlstool.sh -c ../config/tlsconfig.yml -ca -crt # folder named "out" will be created with all the required certificates, cd out |
Copy the generated certificates [[ localhost.key, localhost.pem, root-ca.pem, sgadmin.key, sgadmin.pem ]] to the target location based on the installer type.
cp localhost.key localhost.pem root-ca.pem sgadmin.key sgadmin.pem /etc/elasticsearch/certs/ |
cp localhost.key localhost.pem root-ca.pem sgadmin.key sgadmin.pem $JFROG_HOME/insight/var/data/elasticsearch/certs |
The Search Guard tool is used to manage authentication. By default, an admin user is required to authenticate Elasticsearch. As an alternative to this, a new user can be configured to authenticate Elasticsearch by assigning a custom role with permissions for the application to work.
Add the following snippet to define a new role with custom permissions:
vi $ELASTICSEARCH_HOME/plugins/search-guard-<major_version_number>/sgconfig/sg_roles.yml #Add the following snippet to define a new role with custom permissions <role_name>: cluster_permissions: - cluster:monitor/health - cluster:monitor/main - cluster:monitor/state - "indices:admin/template/get" - "indices:admin/template/delete" - "indices:admin/template/put" - "indices:admin/aliases" - "indices:admin/create" index_permissions: - index_patterns: - "active_*" allowed_actions: - "indices:monitor/health" - "indices:monitor/stats" - "indices:monitor/settings/get" - "indices:admin/aliases/get" - "indices:admin/get" - "indices:admin/aliases" - "indices:admin/create" - "indices:admin/delete" - "indices:admin/rollover" - SGS_CRUD |
Add the following snippet to add a new user:
vi $ELASTICSEARCH_HOME/plugins/search-guard-<major_version_number>/sgconfig/sg_roles.yml/sg_internal_users.yml # Add the following snippet to add a new user <user_name>: hash: <Hash_password> backend_roles: - "<role_name>" //role_name defined in previous step description: "<description>" |
Run the following command to generate a hash password:
$ELASTICSEARCH_HOME/plugins/search-guard-<major_version_number>/tools/hash.sh -p <clear_text_password> |
Add the following snippet to map the new username to the role defined in the previous step:
vi $ELASTICSEARCH_HOME/plugins/search-guard-<major_version_number>/sgconfig/sg_roles.yml/sg_roles_mapping.yml # Add the following snippet to map the new username to the role defined in the previous step <role_name>: users: - "<user_name>" |
Set the new credentials in $JFROG_HOME/insight/etc/system.yam
l file:
shared: elasticsearch: username: <user_name> password: <clear_text_password> |
Some managed databases, such as Azure, have a different username for accessing the database than the actual one inside the database. For Azure-managed PostgreSQL, the |
Do not use a password for PostgreSQL that has special characters: Xray may not work if you configure a password that has special characters, such as |
Install PostgreSQL.
# Run the following commands from the extracted jfrog-xray-<version>-rpm directory. # Note : Use postgreSQL rpms with el6 when installing on Centos 6 and RHEL 6 and use postgresql13-13.2-1 packages # Note : Use postgreSQL rpms with el8 when installing on Centos 8 and RHEL 8 mkdir -p /var/opt/postgres/data rpm -ivh --replacepkgs ./third-party/postgresql/libicu-50.2-3.el7.x86_64.rpm (only AWS instance) rpm -ivh --replacepkgs ./third-party/postgresql/postgresql13-libs-13.2-5PGDG.rhel7.x86_64.rpm rpm -ivh --replacepkgs ./third-party/postgresql/postgresql13-13.2-5PGDG.rhel7.x86_64.rpm rpm -ivh --replacepkgs ./third-party/postgresql/postgresql13-server-13.2-5PGDG.rhel7.x86_64.rpm chown -R postgres:postgres /var/opt/postgres export PGDATA="/var/opt/postgres/data" export PGSETUP_INITDB_OPTIONS="-D /var/opt/postgres/data" # For centos 7&8 / rhel 7&8 sed -i "s~^Environment=PGDATA=.*~Environment=PGDATA=/var/opt/postgres/data~" /lib/systemd/system/postgresql-13.service systemctl daemon-reload /usr/pgsql-13/bin/postgresql-13-setup initdb # For centos 6 / rhel 6 sed -i "s~^PGDATA=.*~PGDATA=/var/opt/postgres/data~" /etc/init.d/postgresql-13 service postgresql-13 initdb Replace "ident" and "peer" with "trust" in postgres hba configuration files ie /var/opt/postgres/data/pg_hba.conf |
Configure PostgreSQL to allow external IP connections.
By default PostgreSQL will only allow localhost clients communications. To enable different IPs to communicate with the database you will need to configure the pg_hba.conf file.
|
To grant all IPs access you may add the below, under the IPv4 local connections section.
host all all 0.0.0.0/0 trust |
Add the following line to /var/opt/postgres/data
/postgresql.conf.
listen_addresses='*' port=5432 |
Start PostgreSQL.
systemctl start postgresql-13.service or service postgresql-13 start |
Setup the database and user.
## run the script to seed the tables and schemas needed by Xray cp -f ./third-party/postgresql/createPostgresUsers.sh /tmp source /etc/locale.conf cd /tmp && su postgres -c "POSTGRES_PATH=/usr/pgsql-13/bin PGPASSWORD=postgres DB_PASSWORD=password bash /tmp/createPostgresUsers.sh" |
It is recommended to ensure your apt-get
libraries are up-to-date, using the following commands.
apt-get update apt-get install -f -y apt-get update |
# Create the file repository configuration to pull postgresql dependencies cp -f /etc/apt/sources.list /etc/apt/sources.list.origfile sh -c 'echo "deb http://ftp.de.debian.org/debian/ $(lsb_release -cs) main non-free contrib" >> /etc/apt/sources.list' sh -c 'echo "deb-src http://ftp.de.debian.org/debian/ $(lsb_release -cs) main non-free contrib" >> /etc/apt/sources.list' cp -f /etc/apt/sources.list.d/pgdg.list /etc/apt/sources.list.d/pgdg.list.origfile sh -c 'echo "deb http://apt.postgresql.org/pub/repos/apt/ $(lsb_release -cs)-pgdg main" >> /etc/apt/sources.list.d/pgdg.list' sh -c 'echo "deb http://apt.postgresql.org/pub/repos/apt/ precise-pgdg main" >> /etc/apt/sources.list.d/pgdg.list' wget --no-check-certificate --quiet -O - https://www.postgresql.org/media/keys/ACCC4CF8.asc | sudo apt-key add - |
Install PostgreSQL.
Run the following commands from the extracted jfrog-xray-<version>-deb directory.
mkdir -p /var/opt/postgres/data |
dpkg -i ./third-party/postgresql/postgresql-13_13.2-1.pgdg16.04+1_amd64.deb |
dpkg -i ./third-party/postgresql/postgresql-13_13.2-1.pgdg18.04+1_amd64.deb |
dpkg -i ./third-party/postgresql/postgresql-13_13.2-1.pgdg20.04+1_amd64.deb |
## Before installing Postgres dependencies mv /etc/apt/sources.list.d/backports.list /etc/apt >/dev/null apt-get update dpkg -i ./third-party/postgresql/postgresql-13_13.2-1.pgdg80+1_amd64.deb # After installing Postgres dependencies mv /etc/apt/backports.list /etc/apt/sources.list.d/backports.list >/dev/null apt-get update |
dpkg -i ./third-party/postgresql/postgresql-13_13.2-1.pgdg90+1_amd64.deb |
apt update -y apt-get install wget sudo -y apt-get install -y gnupg gnupg1 gnupg2 dpkg -i ./third-party/postgresql/postgresql-13_13.2-1.pgdg100+1_amd64.deb |
Stop the Xray service.
systemctl stop postgresql.service |
Change permissions for the postgres folder.
chown -R postgres:postgres /var/opt/postgres sed -i "s~^data_directory =.*~data_directory = '/var/opt/postgres/data'~" "/etc/postgresql/13/main/postgresql.conf" sed -i "s~^hba_file =.*~hba_file = '/var/opt/postgres/data/pg_hba.conf'~" "/etc/postgresql/13/main/postgresql.conf" sed -i "s~^ident_file =.*~ident_file = '/var/opt/postgres/data/pg_ident.conf'~" "/etc/postgresql/13/main/postgresql.conf" su postgres -c "/usr/lib/postgresql/13/bin/initdb --pgdata=/var/opt/postgres/data" |
Configure PostgreSQL to allow external IP connections.
By default PostgreSQL will only allow localhost clients communications. To enable different IPs to communicate with the database you will need to configure the pg_hba.conf file.
|
To grant all IPs access you may add the below, under the IPv4 local connections section:
host all all 0.0.0.0/0 trust |
Add the following line to /etc/postgresql/13/main/postgresql.conf
listen_addresses='*' |
Start PostgreSQL
systemctl start postgresql.service or service postgresql start |
Set up the database and user.
## run the script to seed the tables and schemas needed by Xray cp -f ./third-party/postgresql/createPostgresUsers.sh /tmp source /etc/default/locale cd /tmp && su postgres -c "POSTGRES_PATH=/usr/lib/postgresql/13/bin PGPASSWORD=postgres DB_PASSWORD=password bash /tmp/createPostgresUsers.sh" |
Put back the original pgdg.list.
mv /etc/apt/sources.list.d/pgdg.list /etc/apt/sources.list.d/pgdg.list.tmp && cp -f /etc/apt/sources.list.d/pgdg.list.origfile /etc/apt/sources.list.d/pgdg.list |
Remove backup files.
rm -f /etc/apt/sources.list.d/pgdg.list.tmp rm -f /etc/apt/sources.list.d/pgdg.list.origfile |
Put back the original sources.list.
mv /etc/apt/sources.list /etc/apt/sources.list.tmp && cp -f /etc/apt/sources.list.origfile /etc/apt/sources.list |
Remove the backup files.
rm -f /etc/apt/sources.list.tmp && rm -f /etc/apt/sources.list.origfile |
Postgres binaries are no longer bundled with linux archive installer for Xray. Remember to install Postgres manually. |
# Create the psql database (the script "insight/app/third-party/postgresql/createPostgresUsers.sh" , responsible for seeding Postgres assumes this database exists) <pgsql bin path>/psql template1 <postgres prompt>: CREATE DATABASE <user_name>; <postgres prompt>: \q ## run the script to seed the tables and schemas needed by Xray POSTGRES_PATH=<pgsql bin path> insight/app/third-party/postgresql/createPostgresUsers.sh |
Database can only be changed for a new installation. Changing the names during an upgrade will result in the loss of existing data. |
Create a user with permission. Use this user's credentials during your Helm installation on this page. |
Log in to the PostgreSQL database as an admin and execute the following commands.
CREATE DATABASE insight WITH ENCODING='UTF8' TABLESPACE=pg_default; # Exit from current login \q # Login to $DB_NAME database using admin user (by default its postgres) psql -U postgres insight CREATE USER insight WITH PASSWORD 'password'; GRANT ALL ON DATABASE insight TO insight; |
Configure the system.yaml
file with the database configuration details according to the information above. For example.
shared: database: type: postgresql driver: org.postgresql.Driver url: jdbc:postgresql://localhost:5432/insight username: insight password: password |
Extract the contents of the compressed archive and go to the extracted folder.
tar -xvf jfrog-insight-<version>-compose.tar.gz |
This .env file is used by docker-compose and is updated during installations and upgrades. Notice that some operating systems do not display dot files by default. If you've made any changes to the file, remember to backup before an upgrade. |
Create the following folder structure under $JFROG_HOME/insight
.
$JFROG_HOME/insight/var $JFROG_HOME/insight/var/data $JFROG_HOME/insight/var/etc $JFROG_HOME/insight/var/data/elasticsearch $JFROG_HOME/insight/var/data/postgres |
Provide folder permissions to the folders as follows.
chown -R 1040:1040 $JFROG_HOME/insight/var chown -R 1040:1040 $JFROG_HOME/insight/var/data chown -R 1040:1040 $JFROG_HOME/insight/var/etc chown -R 1000:1000 $JFROG_HOME/insight/var/data/elasticsearch chown -R 999:999 $JFROG_HOME/insight/var/data/postgres |
Copy the appropriate docker-compose templates from the templates folder to the extracted folder. Rename it as docker-compose.yaml
.
NOTE: The commands below assume you are using the template: docker-compose-postgres-es.yaml
Requirement | Template |
---|---|
Insight with externalised databases | docker-compose.yaml |
Insight with Elasticsearch and PostgreSQL | docker-compose-postgres-es.yaml |
When you use Docker Compose in Mac, You can remove the following line from the selected
|
Update the .env
file
## The Installation directory for Insight. IF not entered, the script will prompt you for this input. Default [$HOME/.jfrog/insight] ROOT_DATA_DIR= ## Public IP of this machine HOST_IP= |
Set any additional configurations (for example: ports, node id) using the Insight system.yaml
configuration file.
Verify that the host's ID and IP are added to the |
For Elasticsearch to work correctly, increase the map count. For additional information, see Elasticsearch documentation.
Start the PostgreSQL container.
docker-compose -p insight up -d postgres |
Start Insight using docker-compose commands.
docker-compose -p insight logs docker-compose -p insight ps docker-compose -p insight up -d docker-compose -p insight down |
Access Insight from your browser at: http://SERVER_HOSTNAME/ui/
. For example, on your local machine: http://localhost/ui/
.
Check the Insight log.
docker-compose -p insight logs |
The This is not done for manual Docker Compose installations. Learn more on how to configure the log rotation. |