values.yaml

# Default values for jfrog-credential-provider
# This is a YAML-formatted file.

# Download URL for the credential provider binary
# The chart will automatically append the architecture suffix (-amd64 or -arm64)
downloadUrl: "https://releases.jfrog.io/artifactory/run/jfrog-credentials-provider/1.4.0/jfrog-credential-provider-linux"

# Kubernetes distribution (optional). Omit for EKS, AKS, and GKE (default behavior).
# Set to "openshift" for OpenShift on AWS or Azure — see OpenShift.md.
# tokenAttributes (projected service accounts): OpenShift 4.21+ only (not 4.20).
# platform: openshift

# OpenShift only (ignored when platform is not openshift)
openshift:
  # RoleBinding to system:openshift:scc:privileged for the chart ServiceAccount.
  grantPrivilegedSCC: false
  # Apply privileged Pod Security labels on the release namespace (see OpenShift.md).
  # When true, create the namespace before helm install; do not use helm --create-namespace.
  labelNamespacePodSecurity: true
  # Writable host path for plugin binaries on OpenShift (RHCOS /usr is read-only; bind-mounted at runtime).
  stagingBinaryDir: /var/lib/jfrog-credential-provider/bin
  # Kubelet plugin directory on the node (bind-mount target). Override if your OpenShift version uses a different path.
  targetBinaryDir: /usr/libexec/kubelet-image-credential-provider-plugins
  # Directory containing the platform kubelet credential provider YAML (merged with JFrog config).
  targetProviderConfigDir: /etc/kubernetes/credential-providers

# Authentication for downloading the provider binary from a private Artifactory instance.
# Leave all fields empty for anonymous/public download (default behaviour).
binaryDownload:
  auth:
    # Name of an existing Kubernetes Secret containing download credentials.
    # The Secret must have fixed keys: username, password, accessToken.
    # When set, the inline username/password/accessToken fields below are ignored.
    existingSecret: ""
    # Inline credentials — the chart creates a Secret automatically from these values.
    # Use either username + password  OR  accessToken alone, not both.
    username: ""
    password: ""
    accessToken: ""

# Offline / AMI-baked binary mode.
# If set, the curl download is skipped entirely. The value must be the full file path on the node
# to the provider binary (baked into the AMI or placed by node bootstrap).
# Must be a file path without trailing slashes (e.g. /opt/jfrog-cp/binary-amd64, not /opt/jfrog-cp/).
# The binary must match the node's architecture; there is no automatic arch suffixing.
# Example: internalBinaryHostPath: "/opt/jfrog-cp/jfrog-credential-provider-linux-amd64"
internalBinaryHostPath: ""

# Affinity rules for pod scheduling
affinity: {}

# Tolerations for pod scheduling
tolerations: []

# Additional labels to apply to all resources
labels: {}

# Resources for the pause container
resources: {}

# Enable automatic upgrade of the credential provider binary
# Note: must be false when internalBinaryHostPath or binaryDownload.auth is used.
autoUpgrade: false

# Log level for the credential provider binary
# Supported values: "INFO" (default), "DEBUG"
logLevel: "INFO"

# Container logging configuration
# When enabled, the DaemonSet main container tails the credential provider log file
# from the host, making logs accessible via kubectl logs
containerLogging:
  enabled: false

# Init container configuration
initContainer:
  image:
    registry: releases-docker.jfrog.io
    repository: jfrog/alpine-with-tools
    tag: "3.21.0"
    # digest: sha256:...
    pullPolicy: IfNotPresent
  resources: {}

# Pause container image configuration
image:
  registry: releases-docker.jfrog.io
  repository: pause
  tag: "3.7"
  # digest: sha256:...
  pullPolicy: IfNotPresent

# Image pull secrets for the daemonset
imagePullSecrets: []

# RBAC configuration
# Note: RBAC is only required for AWS when using service account token projection (KEP 4412)
# The chart will automatically create RBAC resources only when AWS and rbac.create is true
rbac:
  create: false  # Set to true to enable RBAC (only needed for AWS with tokenAttributes enabled)
  role:
    ## Rules to create. It follows the role specification
    # This applies to the subject system:nodes
    # Required for AWS IRSA (IAM Roles for Service Accounts) with service account token projection
    additionalRules: []

# Custom volumes to add to the daemonset
customVolumes: |

# Custom volume mounts to add to the init container
customVolumeMounts: |

## Allows to add additional kubernetes resources
## Use --- as a separator between multiple resources
additionalResources: |

# Provider configuration
# Supports multiple providers, each with cloud-specific settings
providerConfig:
  - name: jfrog-credentials-provider
    artifactoryUrl: your-org.jfrog.io
    # http_timeout_seconds: 30
    matchImages:
      - "*.jfrog.io"
    defaultCacheDuration: 15m
    # KEP 4412: Service Account Token Projection
    # Enable service account token projection for this provider
    # Only supported for AWS at the moment
    tokenAttributes:
      enabled: false
    # AWS configuration
    aws:
      enabled: false
      aws_auth_method: "assume_role"  # Options: "assume_role", "assume_external_role", or "cognito_oidc"
      # aws_region: ""  # Optional: explicit AWS region (e.g. "us-east-1"). If empty, resolved from EC2 metadata.
      # IAM role ARN for assume_role (EKS node role or fallback). Not used on OpenShift with
      # tokenAttributes.requireServiceAccount — omit aws_role_name there; IRSA uses SA annotations.
      aws_role_name: "dummy"
      # Secret TTL should be greater than defaultCacheDuration
      # only applicable for assume_role / assume_external_role methods
      secret_ttl_seconds: 14400
      # For assume_external_role method, the node's IAM role directly assumes
      # aws_external_role_arn (typically in another AWS account) via STS to
      # obtain the credentials used to fetch the Artifactory token.
      # aws_role_name is not used in this flow.
      # aws_external_role_arn: ""
      # aws_external_role_session_duration_seconds: 3600  # max 43200
      # For OIDC method, additional variables can be added here
      # aws_cognito_user_pool_secret_name: ""
      # aws_cognito_user_pool_name: ""
      # aws_cognito_resource_server_name: ""
      # aws_cognito_user_pool_resource_scope: ""
      # jfrog_oidc_provider_name: ""
    # GCP configuration
    gcp:
      enabled: false
      # GCP-specific environment variables
      # google_service_account_email: ""
      # jfrog_oidc_audience: ""
      # jfrog_oidc_provider_name: ""
    # Azure configuration
    azure:
      enabled: false
      # If you are installing this for the first time, set azure_auth_method to "imds_direct" for non-projected token appraoch
      # More information: https://github.com/jfrog/jfrog-credentials-provider/blob/main/AZURE.md#imds-direct-authentication
      # azure_auth_method: "imds_direct"
      # If you are using a custom app uri, set azure_app_uri to the custom app uri, default is api://<azure_app_client_id> if not set
      # azure_app_uri: "api://<azure_app_client_id>"
      azure_app_client_id: ""
      # azure_cloud_name: "AzureCloud"
      azure_tenant_id: ""
      # audience must match artifactory's oidc configuration
      azure_app_audience: ""
      jfrog_oidc_provider_name: ""
      azure_nodepool_client_id: ""
      # Audience requested for the resulting Artifactory token during the OIDC token exchange.
      # Defaults to "*@*" when unset, which matches the documented identity mapping token_spec.audience.
      # Only set this if your Artifactory OIDC identity mapping uses a non-wildcard token_spec.audience.
      # jfrog_token_audience: "*@*"


# Update strategy for the daemonset
updateStrategy: {}

# Node selector for daemonset
nodeSelector: {}

# Priority class name for the daemonset
priorityClassName: ""

# Service account configuration
serviceAccount:
  create: true
  name: ""
  annotations: {}