Try JFrog
Guides
Contact SupportTry JFrog
  1. Integrations
  2. JFrog Crossplane Providers
  3. JFrog Crossplane Kinds Reference

Xray Provider Kinds

Look up the fields, identifiers, and caveats of every Kind in the JFrog Crossplane Xray provider.

This page lists every Kind of the provider-xray package releases-authenticated-docker.jfrog.io/jfrog/crossplane-provider-xray:v0.0.1. The package requires registry credentials. For more information, see Install the JFrog Crossplane Providers. The provider configuration API group is xray.m.crossplane.io. The provider has 21 Kinds, all version v1alpha1.

The apiVersion of each Kind is <group>/v1alpha1. The legacy cluster-scoped variant drops .m from the group. For more information about how to read an entry, see JFrog Crossplane Kinds Reference.

Policies

Rules (criteria and actions) for security vulnerabilities, licenses, operational risk, and curation. Policies take effect when a Watch assigns them. API group policy.xray.m.crossplane.io, 7 Kinds.

CurationPolicy

Provides an Xray curation policy resource.

  • kubectl: curationpolicies.policy.xray.m.crossplane.io.
  • Identifier: server-assigned ID (never edit the external-name annotation).
  • Upstream: xray_curation_policy.
  • Fields: required conditionId, name, policyAction, scope. Optional: blockFromCache, decisionOwners, labelWaivers, notifyEmails, pkgTypesInclude, repoExclude, repoInclude, shareWithFederation, waiverRequestConfig, waivers.
  • With scope: all_repos, the server rejects the policy unless at least one remote repository has curation enabled (curated: true on the remote repository). The error is policy cannot have empty effective scope. Use scope: specific_repos with repoInclude listing curated remote repositories.
  • waiverRequestConfig: manual requires decisionOwners. forbidden doesn't.
  • The external name is the numeric policy ID that the server assigns. forProvider.name is a normal field. If you create a second managed resource with the same name, it fails with already exists. To adopt the existing policy, set the crossplane.io/external-name annotation to its ID.
  • Requires the JFrog Curation entitlement.

CustomCurationCondition

Provides an Xray custom curation condition resource.

  • kubectl: customcurationconditions.policy.xray.m.crossplane.io.
  • Identifier: server-assigned ID (never edit the external-name annotation).
  • Upstream: xray_custom_curation_condition.
  • Fields: required conditionTemplateId, name, paramValues.
  • The external name is the server-assigned ID. Requires the JFrog Curation entitlement.
  • forProvider.name is a normal field here, not the identifier. If you create two managed resources with the same name, the second fails with an already exists error. To adopt an existing object, use the external-name annotation.

CustomIssue

Provides an Xray custom issue event resource.

  • kubectl: customissues.policy.xray.m.crossplane.io.
  • Identifier: metadata.name is the name.
  • Upstream: xray_custom_issue.
  • Fields: required description, packageType, providerName, severity, summary, type. Optional: component, cve, source.
  • name is immutable.

IgnoreRule

Provides an Xray ignore rule resource.

  • kubectl: ignorerules.policy.xray.m.crossplane.io.
  • Identifier: server-assigned ID (never edit the external-name annotation).
  • Upstream: xray_ignore_rule.
  • Fields: required notes. Optional: artifact, build, component, cves, dockerLayers, expirationDate, exposures, licenses, operationalRisk, policies, projectKey, releaseBundle, releaseBundlesV2, vulnerabilities, watches.
  • Immutable: all fields.
  • Any change after creation is refused with diff contains fields that require resource replacement. Delete and recreate the managed resource instead.
  • The external name is the server-assigned ID.

LicensePolicy

Creates an Xray policy using V2 of the underlying APIs.

  • kubectl: licensepolicies.policy.xray.m.crossplane.io.
  • Identifier: metadata.name is the name.
  • Upstream: xray_license_policy.
  • Fields: required type. Optional: description, projectKey, rule.
  • Delete the Watches that use the policy before you delete the policy. A delete can intermittently stay stuck, as with SecurityPolicy. Confirm in Xray that the policy is gone, and then clear the finalizer.
  • name is immutable.

OperationalRiskPolicy

Creates an Xray policy using V2 of the underlying APIs.

  • kubectl: operationalriskpolicies.policy.xray.m.crossplane.io.
  • Identifier: metadata.name is the name.
  • Upstream: xray_operational_risk_policy.
  • Fields: required type. Optional: description, projectKey, rule.
  • Webhooks referenced in rule[].actions[].webhooks must exist. Otherwise, you get the error Found Invalid Policy: rule <rule> triggers an unrecognized webhook <name>.
  • name is immutable.

SecurityPolicy

Creates an Xray policy using V2 of the underlying APIs.

  • kubectl: securitypolicies.policy.xray.m.crossplane.io.
  • Identifier: metadata.name is the name.
  • Upstream: xray_security_policy.
  • Fields: required type. Optional: description, projectKey, rule.
  • Xray rejects the delete of a policy that is still assigned to a Watch. Delete the Watch first.
  • A policy delete can intermittently stay stuck in Deleting. The delete stays stuck because the read after the delete returns an error instead of not found. Confirm that the policy is gone in Xray (GET /xray/api/v2/policies/<name>), and then clear the finalizer.
  • name is immutable (it's the external name).

Watches

Watches connect policies to repositories, builds, Release Bundles, or projects. API group watch.xray.m.crossplane.io, 1 Kind.

Watch

Provides an Xray Watch resource.

  • kubectl: watches.watch.xray.m.crossplane.io.
  • Identifier: metadata.name is the name.
  • Upstream: xray_watch.
  • Fields: optional active, assignedPolicy, description, projectKey, watchRecipients, watchResource.
  • Immutable: projectKey.
  • References: assignedPolicy[].nameRef to SecurityPolicy.
  • Every policy in assignedPolicy must already exist in Xray. Otherwise, create fails with policy <name> doesn't exist.
  • assignedPolicy[].nameRef and nameSelector can only target SecurityPolicy objects. Reference license and operational-risk policies by literal name.
  • watchResource[].repoType defaults to local. For a remote repository, set repoType: remote. Otherwise, create fails with repository <key> doesn't exist.
  • Repositories, builds, or projects in watchResource must exist and be indexed by Xray.
  • name (from metadata.name or the external name) and projectKey are immutable.

Reports

One-time or scheduled reports. API group report.xray.m.crossplane.io, 5 Kinds.

These notes apply to every report Kind in this section:

  • Reports can't be updated. Xray doesn't support updating a report. Any change to spec.forProvider fails with <Report> Update Not Supported: Direct updates to <Report> are not supported by the public API. The resource needs to be destroyed and recreated to apply changes. Delete the managed resource and create a new one with a new name.
  • The external name is the numeric report ID that Xray assigns (for example, 1). forProvider.name is the report display name.
  • forProvider.name is a normal field here, not the identifier. If you create two managed resources with the same name, the second fails with an already exists error. To adopt an existing object, use the external-name annotation.

ExposuresReport

Creates an Xray Exposures report.

  • kubectl: exposuresreports.report.xray.m.crossplane.io.
  • Identifier: server-assigned ID (never edit the external-name annotation).
  • Upstream: xray_exposures_report.
  • Fields: required name. Optional: cronSchedule, cronScheduleTimezone, emails, filters, projectKey, resources.

LicensesReport

Creates an Xray License Due Diligence report.

  • kubectl: licensesreports.report.xray.m.crossplane.io.
  • Identifier: server-assigned ID (never edit the external-name annotation).
  • Upstream: xray_licenses_report.
  • Fields: required name. Optional: cronSchedule, cronScheduleTimezone, emails, filters, projectKey, resources.

OperationalRisksReport

Creates an Xray Operational Risks report.

  • kubectl: operationalrisksreports.report.xray.m.crossplane.io.
  • Identifier: server-assigned ID (never edit the external-name annotation).
  • Upstream: xray_operational_risks_report.
  • Fields: required name. Optional: cronSchedule, cronScheduleTimezone, emails, filters, projectKey, resources.

ViolationsReport

Creates an Xray Violations report.

  • kubectl: violationsreports.report.xray.m.crossplane.io.
  • Identifier: server-assigned ID (never edit the external-name annotation).
  • Upstream: xray_violations_report.
  • Fields: required name. Optional: cronSchedule, cronScheduleTimezone, emails, filters, projectKey, resources.

VulnerabilitiesReport

Creates an Xray Vulnerabilities report.

  • kubectl: vulnerabilitiesreports.report.xray.m.crossplane.io.
  • Identifier: server-assigned ID (never edit the external-name annotation).
  • Upstream: xray_vulnerabilities_report.
  • Fields: required name. Optional: cronSchedule, cronScheduleTimezone, emails, filters, projectKey, resources.

Configuration

Global settings, indexing of repositories, builds, and Release Bundles, repository scanning configuration, workers, and catalog labels. API group configuration.xray.m.crossplane.io, 7 Kinds.

BinaryManagerBuilds

Provides an Xray Binary Manager Builds Indexing configuration resource.

  • kubectl: binarymanagerbuilds.configuration.xray.m.crossplane.io.
  • Identifier: metadata.name is the id.
  • Upstream: xray_binary_manager_builds.
  • Fields: required indexedBuilds. Optional: projectKey.
  • metadata.name is the binary manager ID. It must be an existing binary manager, normally default.
  • indexedBuilds is required and must not be empty. An empty list is dropped and reported as a missing required parameter.

BinaryManagerReleaseBundlesV2

Provides an Xray Binary Manager Release Bundles V2 Indexing configuration resource.

  • kubectl: binarymanagerreleasebundlesv2s.configuration.xray.m.crossplane.io.
  • Identifier: metadata.name is the id.
  • Upstream: xray_binary_manager_release_bundles_v2.
  • Fields: required indexedReleaseBundleV2. Optional: projectKey.
  • metadata.name is the binary manager ID, normally default.
  • indexedReleaseBundleV2 must list real Release Bundle v2 names. The server drops unknown names.
  • Use the short bundle name (my-bundle), not the stored [release-bundles-v2]/my-bundle form. Otherwise, the managed resource drifts permanently.

BinaryManagerRepos

Provides an Xray Binary Manager Repository Indexing configuration resource.

  • kubectl: binarymanagerrepos.configuration.xray.m.crossplane.io.
  • Identifier: metadata.name is the id.
  • Upstream: xray_binary_manager_repos.
  • Fields: required indexedRepos. Optional: projectKey.
  • metadata.name is the binary manager ID, normally default.
  • Each entry in indexedRepos must be a repository available for indexing, with the correct type and packageType. GET /xray/api/v1/binMgr/default/repos lists these repositories.

CatalogLabels

Manages JFrog Catalog labels and their assignments using the GraphQL API mutations.

  • kubectl: cataloglabels.configuration.xray.m.crossplane.io.
  • Identifier: singleton (catalog-labels).
  • Upstream: xray_catalog_labels.
  • Fields: optional labels, packageAssignments, versionAssignments.
  • Immutable: name.
  • Instance-wide singleton (external name catalog-labels).

RepositoryConfig

Provides an Xray repository configuration resource.

  • kubectl: repositoryconfigs.configuration.xray.m.crossplane.io.
  • Identifier: spec field repoName. metadata.name is free.
  • Upstream: xray_repository_config.
  • Fields: required repoName. Optional: config, jasEnabled, pathsConfig.
  • Immutable: repoName.
  • If jasEnabled: true and the package type of the repository supports exposures scanning, the config[].exposures block is required. Otherwise, the server reports Request payload is invalid as exposure analysis config is missing. Package types that support exposures scanning include docker, oci, npm, pypi, maven, and others. Generic repositories don't support exposures.
  • On Docker repositories, don't set config[].retentionInDays together with pathsConfig. The server only echoes retention under pathsConfig, which causes permanent drift.
  • repoName is immutable and is the external name.

Settings

Provides an Xray resource for managing basic settings and database sync time.

  • kubectl: settings.configuration.xray.m.crossplane.io.
  • Identifier: singleton (db-sync).
  • Upstream: xray_settings.
  • Fields: required dbSyncUpdatesTime. Optional: allowBlocked, allowWhenUnavailable, blockUnfinishedScansTimeout, blockUnscannedTimeout, enabled.
  • Instance-wide singleton (external name db-sync). Create at most one.

WorkersCount

Provides an Xray Workers Count resource.

  • kubectl: workerscounts.configuration.xray.m.crossplane.io.
  • Identifier: singleton (workers-count).
  • Upstream: xray_workers_count.
  • Fields: optional analysis, impactAnalysis, index, migrationSbom, notification, panoramic, persist, policyEnforcer, sbom, sbomDeleter, sbomDependencies, sbomEnricher, sbomImpactAnalysis, userCatalog.
  • Instance-wide singleton (external name workers-count).
  • Xray may not persist arbitrary values. It returns its live defaults, which causes permanent drift. Use values that match what GET /xray/api/v1/configuration/workersCount returns, or change one pool at a time and verify.
  • Changes may require an Xray restart to take effect.

Webhooks

Webhooks used by policy actions to notify external systems. API group webhook.xray.m.crossplane.io, 1 Kind.

Webhook

Provides an Xray webhook resource.

  • kubectl: webhooks.webhook.xray.m.crossplane.io.
  • Identifier: metadata.name is the name.
  • Upstream: xray_webhook.
  • Fields: required url. Optional: description, headers, passwordSecretRef, useProxy, userName.
  • Secrets: passwordSecretRef.
  • The webhook name (metadata.name or the external-name annotation) must be alphanumeric. Hyphens are rejected. Use a name such as mywebhook, or set crossplane.io/external-name.
  • Set passwordSecretRef when the destination requires a password. The resource requires only url.

Next Steps

Updated about 1 hour ago

Did this page help you?