Platform Provider Kinds

This page lists every Kind of the provider-platform package releases-authenticated-docker.jfrog.io/jfrog/crossplane-provider-platform:v0.0.1. The package requires registry credentials. For more information, see Install the JFrog Crossplane Providers. The provider configuration API group is platform.m.crossplane.io. The provider has 17 Kinds, all version v1alpha1.

The apiVersion of each Kind is <group>/v1alpha1. The legacy cluster-scoped variant drops .m from the group. For more information about how to read an entry, see JFrog Crossplane Kinds Reference.

Access

Groups, group membership, global roles, permissions (the successor of permission targets), and System for Cross-domain Identity Management (SCIM) users and groups. API group access.platform.m.crossplane.io, 6 Kinds.

GlobalRole

Provides a JFrog global role resource to manage custom global roles.

• kubectl: globalroles.access.platform.m.crossplane.io.
• Identifier: metadata.name is the name.
• Upstream: platform_global_role.
• Fields: required actions, environments, type. Optional: description.

Group

Provides a group resource to create and manage groups, and manages membership.

• kubectl: groups.access.platform.m.crossplane.io.
• Identifier: metadata.name is the name.
• Upstream: platform_group.
• Fields: optional adminPrivileges, autoJoin, description, externalId, manageResources, manageWebhook, members, policyManager, policyViewer, reportsManager, useGroupMembersResource, watchManager.
• members is deprecated upstream and ignored by default (useGroupMembersResource defaults to true), so values there read back as drift. Manage membership with GroupMembers.
• externalId is only meaningful for Azure AD-federated groups.
• Role flags such as manageResources, policyManager, and the related flags require Artifactory 7.128.0 or later.
• name (metadata.name) is immutable.

GroupMembers

Provides a resource to manage group membership.

• kubectl: groupmembers.access.platform.m.crossplane.io.
• Identifier: spec field name. metadata.name is free.
• Upstream: platform_group_members.
• Fields: required members, name.
• Immutable: name.
• References: nameRef to Group.
• Manages the membership of a group that it doesn't own. name stays a spec field, so it can use nameRef or nameSelector to a platform Group.
• Membership is authoritative for the listed group. Don't also set the same membership through the Artifactory provider's User.groups field in forProvider (move it to initProvider). Otherwise, membership flaps on every poll.
• Never list or modify the built-in admin account through automation.

Permission

Provides a JFrog permission resource to manage how users and groups access JFrog resources.

• kubectl: permissions.access.platform.m.crossplane.io.
• Identifier: metadata.name is the name.
• Upstream: platform_permission.
• Fields: optional artifact, build, destination, pipelineSource, releaseBundle.
• Every repository, build, Release Bundle, user, and group named in the targets and actions must exist. Otherwise, create fails.
• name is immutable.

SCIMGroup

Provides a JFrog SCIM Group resource to manage groups with the SCIM protocol.

• kubectl: scimgroups.access.platform.m.crossplane.io.
• Identifier: metadata.name is the id.
• Upstream: platform_scim_group.
• Fields: required displayName, members.
• Immutable: displayName.
• Requires the SCIM service. metadata.name is the SCIM group ID. id and displayName are immutable.

SCIMUser

Provides a JFrog SCIM User resource to manage users with the SCIM protocol.

• kubectl: scimusers.access.platform.m.crossplane.io.
• Identifier: spec field username. metadata.name is free.
• Upstream: platform_scim_user.
• Fields: required emails, username. Optional: active.
• Immutable: username, emails[].primary.
• Requires the SCIM service to be provisioned on the JFrog Platform. username and emails[].primary are immutable.

Authentication

OpenID Connect (OIDC) providers and identity mappings, SAML, Crowd, HTTP SSO, and AWS IAM role mapping. API group authentication.platform.m.crossplane.io, 6 Kinds.

AWSIAMRole

Provides a resource to manage AWS IAM roles for users of your JFrog Platform.

• kubectl: awsiamroles.authentication.platform.m.crossplane.io.
• Identifier: spec field username. metadata.name is free.
• Upstream: platform_aws_iam_role.
• Fields: required iamRole, username.
• Immutable: username.
• Requires Passwordless Access for Amazon EKS (Artifactory 7.90.10 or later) and a real IAM role Amazon Resource Name (ARN).
• The external name is the JFrog username. It is immutable.

CrowdSettings

Provides a JFrog Crowd Settings resource.

• kubectl: crowdsettings.authentication.platform.m.crossplane.io.
• Identifier: singleton (crowd-settings).
• Upstream: platform_crowd_settings.
• Fields: required applicationName, enable, passwordSecretRef, serverUrl, sessionValidationInterval. Optional: allowUserToAccessProfile, autoUserCreation, directAuthentication, overrideAllGroupsUponLogin, useDefaultProxy.
• Secrets: passwordSecretRef.
• Instance-wide singleton.

HTTPSSOSettings

Provides a JFrog HTTP SSO Settings resource.

• kubectl: httpssosettings.authentication.platform.m.crossplane.io.
• Identifier: singleton (http-sso-settings).
• Upstream: platform_http_sso_settings.
• Fields: required proxied. Optional: allowUserToAccessProfile, autoCreateUser, remoteUserRequestVariable, syncLdapGroups.
• Instance-wide singleton.

OIDCConfiguration

Manage the OIDC configuration in the JFrog Platform.

• kubectl: oidcconfigurations.authentication.platform.m.crossplane.io.
• Identifier: metadata.name is the name.
• Upstream: platform_oidc_configuration.
• Fields: required issuerUrl, providerType. Optional: audience, azureAppId, description, enablePermissiveConfiguration, organization, projectKey, tokenIssuer, useDefaultProxy.
• Immutable: projectKey.
• name and projectKey are immutable.

OIDCIdentityMapping

Manage the OIDC identity mapping for an OIDC configuration in the JFrog Platform.

• kubectl: oidcidentitymappings.authentication.platform.m.crossplane.io.
• Identifier: metadata.name is the name.
• Upstream: platform_oidc_identity_mapping.
• Fields: required claimsJson, priority, providerName, tokenSpec. Optional: description, projectKey.
• Immutable: projectKey.
• References: providerNameRef to OIDCConfiguration.
• claimsJson must be a literal JSON string, for example '{"repository":"my-org/my-repo"}'. Crossplane doesn't evaluate Terraform expressions such as ${jsonencode(...)}.
• providerName must name an existing OIDCConfiguration (use providerNameRef).
• tokenSpec.username must be an existing user. name and projectKey are immutable.

SAMLSettings

Provides a JFrog SAML SSO Settings resource.

• kubectl: samlsettings.authentication.platform.m.crossplane.io.
• Identifier: metadata.name is the name.
• Upstream: platform_saml_settings.
• Fields: required certificateSecretRef, loginUrl, logoutUrl, serviceProviderName. Optional: allowUserToAccessProfile, autoRedirect, autoUserCreation, emailAttribute, enable, groupAttribute, ldapGroupSettings, nameIdAttribute, syncGroups, useEncryptedAssertion, verifyAudienceRestriction.
• Secrets: certificateSecretRef.
• Instance-wide authentication setting.
• name is immutable.
• Instance-wide singleton: create at most one per JFrog instance.

Configuration

License, reverse proxy, and JFrog Workers. API group configuration.platform.m.crossplane.io, 3 Kinds.

License

Provides a JFrog license resource to install or update the license.

• kubectl: licenses.configuration.platform.m.crossplane.io.
• Identifier: singleton (license).
• Upstream: platform_license.
• Fields: required keySecretRef. Optional: name.
• Secrets: keySecretRef.
• Applying a license re-licenses the JFrog Platform. key is a Secret reference (keySecretRef).
• Instance-wide singleton.

ReverseProxy

Provides a JFrog Reverse Proxy resource.

• kubectl: reverseproxies.configuration.platform.m.crossplane.io.
• Identifier: singleton (reverse-proxy).
• Upstream: platform_reverse_proxy.
• Fields: required serverProvider. Optional: dockerReverseProxyMethod, httpPort, httpsPort, internalHostname, publicServerName, sslCertificatePath, sslKeyPath, useHttps.
• Self-managed deployments only. Instance-wide singleton.

WorkersService

Provides a JFrog Workers Service resource.

• kubectl: workersservices.configuration.platform.m.crossplane.io.
• Identifier: spec field key. metadata.name is free.
• Upstream: platform_workers_service.
• Fields: required action, enabled, key, sourceCode. Optional: description, filterCriteria, secrets.
• Immutable: key.
• Secrets: secrets[].valueSecretRef.
• Requires Enterprise X or Enterprise+ (Artifactory 7.94 or later).
• secrets[].value is a Secret reference (secrets[].valueSecretRef). key is immutable.

Release Lifecycle

Release lifecycle stages and the promotion pipeline (global or per project). API group lifecycle.platform.m.crossplane.io, 2 Kinds.

Lifecycle

Provides a lifecycle resource to manage the lifecycle configuration for a project or globally.

• kubectl: lifecycles.lifecycle.platform.m.crossplane.io.
• Identifier: one per project (projectKey) or global.
• Upstream: platform_lifecycle.
• Fields: required promoteStages. Optional: projectKey, promoteStagesSelector.
• Immutable: projectKey.
• References: promoteStagesRefs to LifecycleStage.
• Replaces the instance-wide (or project) promotion pipeline. The external name is the project key, or global when you omit projectKey.
• Deleting the managed resource doesn't delete the lifecycle. The lifecycle stays as it is.
• promoteStages can reference LifecycleStage objects (promoteStagesRefs).
• Instance-wide singleton: create at most one per JFrog instance.

LifecycleStage

Provides a lifecycle stage resource to create and manage lifecycle stages.

• kubectl: lifecyclestages.lifecycle.platform.m.crossplane.io.
• Identifier: metadata.name is the name.
• Upstream: platform_lifecycle_stage.
• Fields: optional category, detachOnDestroy, projectKey.
• Immutable: projectKey.
• Stage names are an instance-wide, case-sensitive namespace (dev probably already exists). A project-scoped stage name must be prefixed with an existing project key.
• name and projectKey are immutable.

Next Steps

• To create users, groups, membership, and a global role, see Set Up JFrog Identity and Projects with Crossplane.
• To set up OIDC for GitHub Actions with OIDCConfiguration and OIDCIdentityMapping, see Configure GitHub Actions OIDC and Safe Teardown with Crossplane.
• To look up the Kinds of the other providers, see JFrog Crossplane Kinds Reference.
• If a managed resource doesn't become ready, see Troubleshoot the JFrog Crossplane Providers.