Cannot import https package to use cert for external endpoint.

[zheng-gao]

Jfrog worker's PlatformContext interface provide an AxiosInstance to user to communicate with external web resources. The cert of the external web can be passed through httpsAgent in axios request config

import https from 'https';
const agent = new https.Agent({ cert: "..." });
response = await context.clients.axios.get("https://external-website", { httpsAgent: agent });

The problem is jfrog worker code does not allow import statement, only JavaScript natives are allowed.
However the https library is not javascript native.
I've also tried "fetch" and "XMLHttpRequest", but none of them is defined.
How to send request to external endpoint with cert in jfrog worker?

[trey-ivy]

we also need some way to access sites that are secured via our private certificate authority. We are running Enterprise Plus 7.111.7 rev 81107900 fully on premise and we want to update a prometheus metric whenever a docker image is pushed. When we try to access a site like google, everything works just fine, but if we instead try to access a site like my-internal-metrics-service.example.io we get an error message similar to:
[error] - Request failed with status code 500 caused by : Host 10.XXX.XXX.32 is not allowed
or if we try using cluster dns for example:
[error] - Request failed with status code 500 caused by : Host my-internal-metrics-service.metrics.svc.cluster.local is not allowed
Are there any existing mechanisms for this? is there a way we could inject certificates into the worker or....?

[ehl-jf]

Jfrog workers supports custom certificates through folders.
The CAs can be placed in <JFROG_HOME>/var/etc/security/keys/trusted or <JFROG_HOME>/var/etc/worker/keys/trusted. They will be picked up by the service at boot time.
It is also possible to set a custom list of folders by setting or modifying the key worker.security.trustedCAFiles in the service system-yaml.

[zheng-gao]

Hi @ehl-jf,
I've tried the following solutions:

1. Add our cert bundle to "/opt/jfrog/worker/var/etc/security/keys/trusted/ca.crt" (JF_PRODUCT_HOME="/opt/jfrog/worker")
   The worker service didn't pick it up at boot time. The linux system didn't pick it up, either.
2. Following this doc to run "update-ca-trust extract" in customInitContainers, the linux system picked up the key, so in the worker pod I could curl our internal url without giving the cert explicitly.
3. I also tied to add extra environment variables for node.

   extraEnvironmentVariables:
    - name: NODE_EXTRA_CA_CERTS
      value: "/opt/jfrog/worker/var/etc/security/keys/trusted/ca.crt"
    - name: SSL_CERT_FILE
      value: "/opt/jfrog/worker/var/etc/security/keys/trusted/ca.crt"

However, none of these solutions works for the worker code in the UI, I still got error from the worker's execution log:
{"message": "Host XX.XX.XX.XX is not allowed", "status": 500}
And here is my worker code:
const result = await context.clients.axios.get("https://my-service.com");
BTW, We are using the jfrog helm chart, https://github.com/jfrog/charts/blob/master/stable/worker/values.yaml

[zheng-gao]

Hi There, I've tried the following solutions: 1. Add our cert bundle to "/opt/jfrog/worker/var/etc/security/keys/trusted/ca.crt" (JF_PRODUCT_HOME="/opt/jfrog/worker"). The worker service didn't pick it up at boot time. The linux system didn't pick it up, either. 2. Following this doc ( https://jfrog.com/help/r/artifactory-how-to-add-custom-ssl-certificates-to-an-artifactory-pod-using-helm-charts/how-to-update-the-ca-certificates-within-the-artifactory-pod) to run "update-ca-trust extract" in customInitContainers, the linux system picked up the key, so in the worker pod I could curl our internal url without giving the cert explicitly. 3. I also tied to add extra environment variables for node. extraEnvironmentVariables: - name: NODE_EXTRA_CA_CERTS value: "/opt/jfrog/worker/var/etc/security/keys/trusted/ca.crt" - name: SSL_CERT_FILE value: "/opt/jfrog/worker/var/etc/security/keys/trusted/ca.crt" However, none of these solutions works for the worker code in the UI, I still got error from the worker's execution log: {"message": "Host XX.XX.XX.XX is not allowed", "status": 500} And here is my worker code: const result = await context.clients.axios.get("https://my-service.com"); BTW, We are using the jfrog helm chart, ***@***.*** /stable/worker/values.yaml

…

On Fri, Jun 27, 2025 at 5:05 AM Hervé ESTEGUET ***@***.***> wrote: *ehl-jf* left a comment (jfrog/workers-sample#29) <#29 (comment)> Jfrog workers supports custom certificates through folders. The CAs can be placed in <JFROG_HOME>/var/etc/security/keys/trusted or <JFROG_HOME>/var/etc/security/keys/trusted. They will be picked up by the service at boot time. It is also possible to set a custom list of folders by setting or modifying the key worker.security.trustedCAFiles in the service system-yaml <https://jfrog.com/help/r/jfrog-installation-setup-documentation/artifactory-system-yaml> . — Reply to this email directly, view it on GitHub <#29 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AHRHBOVDDOQWXLVL7WQOXZ33FUXPVAVCNFSM6AAAAAB6ZDYEZKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTAMJSG44DMMBSGM> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[zgao-stackav]

The issue is fixed by disabling local network validation and it can be set in the following ways

    extraSystemYaml:
      worker:
        execution:
          enableLocalNetworkValidation: false

    extraEnvironmentVariables:
      - name: JF_WORKER_EXECUTION_ENABLELOCALNETWORKVALIDATION
        value: "false"