JFrog Artifactory and GCP Artifact Registry: Native Pull, No Sync Required

Teams running containerized workloads on Google Cloud have relied on JFrog as their source of truth for container images. The missing piece has been getting GCP’s own runtime services to pull from JFrog without workarounds. That gap just closed.

What Happened

JFrog released the Artifact Registry Connector, a passthrough proxy that routes container image requests from Cloud Run and Google Kubernetes Engine directly to JFrog Artifactory in real time. No image copies stored in Artifact Registry. No scheduled sync jobs. No parallel registries to maintain.

The technical path is straightforward: create a Docker repository in Artifactory, store a JFrog access token in Google Secret Manager with auto-rotation enabled, configure an Artifact Registry Connector repository pointing at the JFrog Docker registry URL, and reference the Connector in workload configurations. When a Cloud Run deployment or GKE pod requests an image, the request forwards live to Artifactory, which serves it and enforces policy.

Why It Matters

The previous workarounds — scheduled image syncing, custom Cloud Functions for mirroring, or maintaining parallel registries — each introduced a version of the same problem: lag. Policy changes in JFrog didn’t propagate to GCP workloads immediately. If a critical CVE was discovered in a production image, “Artifactory blocks the next pull immediately” only applied to JFrog-native pulls. GCP workloads continued pulling from their cached or synced copy until the next sync cycle ran.

The Connector closes that gap by making every GCP pull a live JFrog pull. CVE blocks, license policy violations, and quarantine rules take effect the next time a container image is requested — not the next time a sync job runs. This is the model that enterprise security postures require: a single source of truth with point-in-time enforcement, not a best-effort sync with a latency window.

JFrog has been expanding this governance-at-pull model across integrations — the MCP registry for AI agent governance follows the same principle: enforce at consumption time, not at publication time.

What This Means for Builders

Platform teams managing GCP workloads now have a clean answer to the “JFrog is our registry standard but GCP services need Artifact Registry” problem. The Connector makes Artifact Registry a transparent pass-through rather than a competing registry, preserving governance tooling without requiring workflow changes from application teams.

The practical implication: teams can retire sync pipelines, consolidate incident response to a single JFrog control plane, and give security teams one dashboard view of what’s running where. For GKE specifically, this matters for clusters where image pull speed and governance enforcement are both first-class concerns.

Source: JFrog Blog

Content created with AI assistance and reviewed for accuracy.