[Bug] jfrog-credential-provider chart renders invalid jfrog-provider.json when aws_auth_method=cognito_oidc

[kenny-mel]

Chart version
jfrog-credential-provider-0.1.0-beta.6 (also reproducible on beta.3~beta.5 if tested)
Environment
EKS: v1.33.x
Auth mode: AWS Cognito OIDC
Install method: Helm (jfrog/jfrog-credential-provider)

What happened
When deploying with aws_auth_method: cognito_oidc, pods in DaemonSet stay in Init:CrashLoopBackOff.
Init container log shows:
Updating the kubelet configuration failed
The rendered ConfigMap jfrog-provider.json is invalid JSON (missing closing ] and } in env/root object).
Expected behavior
Chart should render valid JSON for both assume_role and cognito_oidc branches.

Values used (sanitized)

`providerConfig:

• name: jfrog-credentials-provider
  artifactoryUrl: "xxxxx.jfrog.io"
  matchImages:
  • "xxxxx.jfrog.io/*"
    defaultCacheDuration: 5h
    aws:
    enabled: true
    aws_auth_method: "cognito_oidc"
    secret_name: "xxxxx"
    user_pool_name: "xxxxx"
    resource_server_name: "xxxxx"
    user_pool_resource_scope: "xxxxx"
    jfrog_oidc_provider_name: "xxxxx"`

Reproduction steps
Install chart with values above:
helm upgrade --install secret-provider jfrog/jfrog-credential-provider -n jfrog --create-namespace -f aws-cognito-values.yaml --devel
Check pods:
kubectl get pods -n jfrog
Check init logs:
kubectl logs -n jfrog -c jfrog-credential-provider-injector --previous
Inspect configmap:
kubectl get configmap -n jfrog secret-provider-jfrog-credential-provider-config -o yaml
Observe invalid JSON in data.jfrog-provider.json.
Possible root cause
Template templates/configmap-provider.yaml in cognito_oidc branch does not close JSON array/object, while assume_role branch does.

[kenny-mel]

does anyone test below part:

Key Components (Cognito OIDC):
AWS Secrets Manager: Securely stores Cognito client credentials
AWS Cognito: Issues OIDC access tokens via client_credentials flow
Resource Server: Defines scopes for OIDC token access
OIDC Exchange: Artifactory validates the Cognito token and issues a registry token

does it work? I tried but still ErrImagePull.

[kenny-mel]

kubectl get configmap -n jfrog secret-provider-jfrog-credential-provider-config -o jsonpath='{.data.jfrog-provider.json}' | jq .
jq: parse error: Unfinished JSON term at EOF at line 35, column 0
kubectl edit configmap -n jfrog secret-provider-jfrog-credential-provider-config
configmap/secret-provider-jfrog-credential-provider-config edited

[RobinDuhan]

Thanks for raising this issue.

This is fixed in master, ab66b51. A new version with the fix will be released this week.

[kenny-mel]

@RobinDuhan would you have a look at issue 41, I think that's a critical issue.

[RobinDuhan]

Closing this, since this is fixed in 1.0.0.