Configure Credentials for the JFrog Crossplane Providers

Connect the JFrog Crossplane providers to your JFrog Platform. You store a JFrog URL and access token in a Secret, then point each provider at that Secret through a ClusterProviderConfig.

Prerequisites

• The providers are installed and healthy. For more information, see Install the JFrog Crossplane Providers.

Step 1: Create an Access Token

Create a token for a dedicated automation identity. You can create the token in the following ways.

Choose the token scope based on the objects you manage:

• Platform-wide objects: Use an admin token (applied-permissions/admin). Platform-wide objects that need an admin token include users, groups, permissions, projects, Xray policies, and JFrog Platform settings.
• Project resources: Project-scoped administration works for project resources only when both of these conditions are met:
  • The project's adminPrivileges.manageResources setting is enabled.
  • The identity is a Project Admin.

Set an expiration date that matches your rotation schedule. Because the providers build the JFrog client on every reconcile, you only need to update the Secret to rotate credentials.

Step 2: Create the Credentials Secret

Apply the following Secret:

apiVersion: v1
kind: Secret
metadata:
  name: jfrog-creds
  namespace: crossplane-system
type: Opaque
stringData:
  credentials: |
    {"url": "https://mycompany.jfrog.io", "access_token": "<access-token>"}

Replace the following:

• https://mycompany.jfrog.io: Your JFrog Platform base URL, without /artifactory. The same host serves /artifactory, /access, /xray, and /lifecycle. The URL must be reachable from the provider pod.
• <access-token>: The access token you created in Step 1.

Supported formats for the JFrog Platform base URL include the following.

Both url and access_token are required strings. api_key isn't accepted.

Step 3: Create a ClusterProviderConfig for Each Provider

The ClusterProviderConfig is the recommended configuration. Create one per provider. All of them share the same Secret.

1. Apply the following ClusterProviderConfig for provider-artifactory:

   YAML

   apiVersion: artifactory.m.crossplane.io/v1beta1
   kind: ClusterProviderConfig
   metadata:
     name: jfrog
   spec:
     credentials:
       source: Secret
       secretRef: {name: jfrog-creds, namespace: crossplane-system, key: credentials}

2. Repeat the ClusterProviderConfig definition for each other provider you installed, using the following apiVersion values:

   • xray.m.crossplane.io/v1beta1
   • project.m.crossplane.io/v1beta1
   • platform.m.crossplane.io/v1beta1

Managed resources reference this configuration using providerConfigRef: {kind: ClusterProviderConfig, name: jfrog}. If you name the configuration default, managed resources can omit providerConfigRef.

Other Credential Options

The following options cover other credential setups.

Supported Credential Sources

All providers read the same credentials JSON. The supported credential sources depend on the configuration type.

Namespaced ProviderConfig

A namespaced ProviderConfig lets you set per-team credentials with Secret sources. The following rules apply:

• The Secret is always read from the namespace of the managed resource.
• Only managed resources in that namespace can use the configuration.

To create a namespaced ProviderConfig for namespace team-a:

1. Create the namespace:

   Shell

   kubectl create namespace team-a

2. Apply the following ProviderConfig. It reads the credentials from the Secret team-a-jfrog in namespace team-a.

   YAML

   apiVersion: artifactory.m.crossplane.io/v1beta1
   kind: ProviderConfig
   metadata: {name: team-a, namespace: team-a}
   spec:
     credentials:
       source: Secret
       secretRef: {name: team-a-jfrog, namespace: team-a, key: credentials}

Managed resources in team-a then use providerConfigRef: {kind: ProviderConfig, name: team-a}.

Environment or Filesystem Sources

These sources work with ClusterProviderConfig only.

1. Expose the credential JSON to the provider container through the DeploymentRuntimeConfig. Use either env[].valueFrom.secretKeyRef or a Secret volume mounted at a path like /creds.
2. Configure the credentials block with one of the following settings:
   • credentials: {source: Environment, env: {name: JFROG_CREDS}}
   • credentials: {source: Filesystem, fs: {path: /creds/credentials}}

Legacy Cluster-Scoped Managed Resources

Legacy cluster-scoped managed resources (*.<provider>.crossplane.io) need a legacy ProviderConfig. For example, create it with apiVersion: artifactory.crossplane.io/v1beta1. Make it cluster-scoped and use the same credentials block.

Reference the legacy ProviderConfig as providerConfigRef: {name: default}.

Tune the Providers

Provider flags such as --poll, --max-reconcile-rate, and --leader-election go in the args of the package-runtime container in the DeploymentRuntimeConfig.

Use the following settings to match your goal.

Provider Flags

Set the following flags through the DeploymentRuntimeConfig (containers[name=package-runtime].args).

The retry backoff for failing objects (1 s to 60 s) is fixed.

On first install, provider-artifactory may restart a few times (no matches for kind ...) while its CRDs are established. It recovers on its own within minutes.

Next Steps

• To confirm that the providers can reach JFrog and manage objects, see Verify the JFrog Crossplane Providers.