JFrog Platform on Azure Government

The customer needed a hardened binary repository inside Azure Government for a regulated software-supply-chain workload. The platform had to host signed container images, Helm charts, and language-package mirrors used by downstream pipelines that never touch the public internet.

JFrog Artifactory was the chosen product. The work was the delivery — landing it in Azure Government to a standard that would survive an authorization-to-operate review.

Compliance

MS-ISR baseline applied across identity, networking, encryption, and logging surfaces.

Cryptography

FIPS 140-2 validated modules required end-to-end — at rest and in transit.

Key custody

Customer-managed keys (CMK) only. Microsoft-managed keys were not acceptable for the data classes in scope.

Network posture

No public ingress, no public egress. Private endpoints for every PaaS dependency, internal load balancer in front of Artifactory.

Reproducibility

The platform had to be reconstructible from source — no console drift, no undocumented ClickOps.

The stack is fully declarative. Terraform provisions the Azure Government resources and AKS cluster; Helm renders the JFrog chart against the resulting cluster.

Compute

AKS in Azure Government with private API server, system-assigned managed identities, and Workload Identity for pod-level access to Key Vault.

Storage

Azure Files (premium) for Artifactory binaries, encrypted with CMKs from a Premium Key Vault HSM.

Database

Azure Database for PostgreSQL Flexible Server, private endpoint only, TDE backed by the same CMK chain.

Ingress

Internal Application Gateway terminating TLS with a FIPS-validated profile; mTLS to backing pods via the service mesh.

Identity

Microsoft Entra ID (Government) groups mapped to Artifactory roles via SAML; no local accounts in production.

Observability

Container logs and Artifactory audit events shipped to Log Analytics in a separate subscription boundary, retained per the controlling SSP.

• Platform reached production behind the air gap with a single terraform apply from a clean state.
• All cryptography material chains back to a customer-controlled HSM — Microsoft never holds a key.
• Disaster-recovery rehearsal: full rebuild from source completed inside the change window with parity verification on artifact hashes.
• The Terraform + Helm pattern became the reference for follow-on regulated workloads in the same boundary.

The Helm chart provided by upstream JFrog assumes a more permissive posture than this environment allows; templating around it works but produces a values file that's harder to audit than a from-scratch chart would be. A future iteration would maintain a small internal chart that wraps the upstream images directly, trading reuse for clarity at the boundary.