values.schema.json

{
  "$schema": "https://json-schema.org/draft-07/schema#",
  "properties": {
    "agentKey": {
      "description": "The ID of the agent",
      "type": "string"
    },
    "awsAccessKeyIdEncoded": {
      "description": "The AWS_ACCESS_KEY_ID provided by env0 used to perform agent specific actions in env0's AWS account",
      "type": "string"
    },
    "awsSecretAccessKeyEncoded": {
      "description": "The AWS_SECRET_ACCESS_KEY provided by env0 used to perform agent specific actions in env0's AWS account",
      "type": "string"
    },

    "podAdditionalLabels": {
      "description": "Additional labels to be set on deployment pods",
      "type": "object",
      "additionalProperties": {
        "type": "string"
      }
    },
    "agentAdditionalLabels": {
      "description": "Additional labels to be set on agent (trigger/proxy) pods",
      "type": "object",
      "additionalProperties": {
        "type": "string"
      }
    },
    "podAdditionalAnnotations": {
      "description": "Additional annotations to be set on deployment pods",
      "type": "object",
      "additionalProperties": {
        "type": "string"
      }
    },
    "agentAdditionalAnnotations": {
      "description": "Additional annotations to be set on agent (trigger/proxy) pods",
      "type": "object",
      "additionalProperties": {
        "type": "string"
      }
    },

    "deploymentJobServiceAccountName": {
      "description": "An optional K8s service account name you wish to set for the env0 deployment pods",
      "type": "string"
    },
    "storageClassName": {
      "description": "An optional K8s storage class name for the PVC",
      "type": "string"
    },
    "persistentVolume": {
      "description": "An optional persistent volume for existing storage",
      "type": "string"
    },
    "env0PvcStorageSize": {
      "description": "PVC request storage size (default: 300Gi)",
      "type": "string"
    },
    "env0ApiGwKeyEncoded": {
      "description": "env0 API GW API key",
      "type": "string"
    },
    "kmsKeyArn": {
      "description": "KMS key in env0",
      "type": "string"
    },
    "stage": {
      "description": "env0 stage",
      "type": "string"
    },
    "dockerImage": {
      "description": "The deployment docker image",
      "type": "string"
    },
    "deploymentPodWarmPoolSize": {
      "description": "When set, a number jobs/pods will be spun up to poll the queue and start env0 deployments faster",
      "type": "number"
    },
    "infracostApiKeyEncoded": {
      "description": "Infracost API KEY, base64 encoded",
      "type": "string"
    },
    "outputLogsLogGroupName": {
      "description": "Log group name in env0",
      "type": "string"
    },
    "assumerKeyIdEncoded": {
      "description": "AWS_ACCESS_KEY_ID used when assuming a role in env0",
      "type": "string"
    },
    "assumerSecretEncoded": {
      "description": "AWS_SECRET_ACCESS_KEY used when assuming a role in env0",
      "type": "string"
    },
    "stateMountPath": {
      "description": "State mount path - this will be overwritten when setting strictSecurityContext=true",
      "type": "string"
    },
    "isSelfHosted": {
      "description": "Is this a self hosted agent",
      "type": "string"
    },
    "limits": {
      "description": "Limits on the container",
      "properties": {
        "cpu": {
          "type": "string"
        },
        "memory": {
          "type": "string"
        }
      },
      "type": "object"
    },
    "requests": {
      "description": "resource requests on the container",
      "properties": {
        "cpu": {
          "type": "string"
        },
        "memory": {
          "type": "string"
        }
      },
      "type": "object"
    },
    "agentProxy": {
      "description": "Agent proxy for proxying VCS requests from env0 to on-prem VCS servers",
      "properties": {
        "install": {
          "type": "boolean",
          "description": "Install Agent Proxy"
        },
        "replicas": {
          "type": "integer",
          "description": "Number of replicas for the agent proxy"
        },
        "enableVcsWebhooksProxy": {
          "type": "boolean",
          "description": "Enable proxying of VCS webhook requests from the agent to env0"
        },
        "maxConcurrentRequests": {
          "type": "integer",
          "description": "Maximum number of concurrent requests each proxy instance can handle"
        },
        "limits": {
          "description": "Pod's limits",
          "properties": {
            "cpu": {
              "type": "string"
            },
            "memory": {
              "type": "string"
            }
          },
          "type": "object"
        },
        "requests": {
          "description": "resource requests on the proxy container",
          "properties": {
            "cpu": {
              "type": "string"
            },
            "memory": {
              "type": "string"
            }
          },
          "type": "object"
        }
      },
      "type": "object"
    },
    "agentImagePullPolicy": {
      "description": "Agent image pull policy. Default is Always",
      "enum": [
        "Always",
        "Never",
        "IfNotPresent"
      ]
    },
    "agentImagePullSecret": {
      "description": "The agent Docker image pull secret. Required when the image is stored in a private registry and takes precedence over agentImagePullSecretRef",
      "type": "string"
    },
    "agentImagePullSecretRef": {
      "description": "The name of an existing k8s secret that holds the agent Docker image pull secret",
      "type": "string"
    },
    "tolerations": {
      "description": "Kubernetes tolerations on the containers",
      "type": "array"
    },
    "deploymentTolerations": {
      "description": "Kubernetes tolerations for the deployment pods, This will override the default tolerations for deployment pods",
      "type": "array"
    },
    "affinity": {
      "description": "The default Kubernetes affinity that will be applied to all pods",
      "$schema": "agent/helm/schemas/kubernetesjsonschema.dev/v1.10.3-standalone/affinity.json"
    },
    "deploymentAffinity": {
      "description": "Kubernetes affinity for deployment pods, This will override the default affinity for deployment pods",
      "$schema": "agent/helm/schemas/kubernetesjsonschema.dev/v1.10.3-standalone/affinity.json"
    },

    "customerAwsAccessKeyIdEncoded": {
      "description": "AWS access key used for SSM secret fetching, base64 encoded",
      "type": "string"
    },
    "customerAwsSecretAccessKeyEncoded": {
      "description": "AWS secret used for SSM secret fetching, base64 encoded",
      "type": "string"
    },
    "customerVaultTokenEncoded": {
      "description": "HCP Vault Token for secret fetching, base64 encoded. This is DEPRECATED, use vault.encodedToken instead",
      "type": "string"
    },
    "customerVaultUrl": {
      "description": "HCP Vault URL for secret fetching. This is DEPRECATED, use vault.address instead",
      "type": "string"
    },
    "vault": {
      "description": "vault configuration. Pick one of the authentication methods - VAULT_TOKEN, username/password or k8s service account",
      "properties": {
        "encodedToken": {
          "type": "string",
          "description": "BASE64 encoded vault token, similar to VAULT_TOKEN env var"
        },
        "method": {
          "type": "string",
          "description": "Vault method login: 'token', 'password', 'service_account', 'certificate'"
        },
        "caCertificateSecretName": {
          "type": "string",
          "description": "For certificate login, specify the Kubernetes secret name for the CA certificate (optional). The key must be ca-cert"
        },
        "caDisable": {
          "type": "boolean",
          "description": "For certificate login, disable CA authorization (optional)"
        },
        "clientCertificateSecretName": {
          "type": "string",
          "description": "For certificate login, specify the Kubernetes secret name (required). The keys must be client-cert and client-key.\n for example: `kubectl create secret generic <secret-name> -n env0-agent --from-file=client-key=vault.key  --from-file=client-cert=vault.crt --from-file=ca-cert=ca-cert.pem`"
        },
        "passphraseSecretName": {
          "type": "string",
          "description": "passphrase (used by the certificate), specify the Kubernetes secret name (required). The key must be passphrase.\n for example: `kubectl create secret generic <secret-name> -n env0-agent --from-literal=passphrase=my-password`"
        },
        "username": {
          "type": "string",
          "description": "vault username if you prefer to use username/password authentication"
        },
        "encodedPassword": {
          "type": "string",
          "description": "BASE64 encoded vault password if you prefer to use username/password authentication"
        },
        "role": {
          "type": "string",
          "description": "vault role name, use for k8s service account authentication or certificate"
        },
        "address": {
          "type": "string",
          "description": "vault address, similar to VAULT_ADDR env var"
        },
        "loginPath": {
          "type": "string",
          "description": "Authentication login path, default is vault default method path - kubernetes, userpass, etc."
        }
      },
      "type": "object"
    },
    "awsSecretsRegion": {
      "description": "AWS region used for SSM secret fetching",
      "type": "string",
      "enum": [
        null,
        "us-east-1",
        "us-east-2",
        "us-west-1",
        "us-west-2",
        "ap-south-1",
        "ap-northeast-3",
        "ap-northeast-2",
        "ap-southeast-1",
        "ap-southeast-2",
        "ap-northeast-1",
        "ca-central-1",
        "eu-central-1",
        "eu-west-1",
        "eu-west-2",
        "eu-west-3",
        "eu-north-1",
        "sa-east-1",
        "me-south-1",
        "ap-southeast-3",
        "ap-east-1",
        "af-south-1"
      ]
    },
    "customerGoogleProject": {
      "description": "GCP project used for GCP secret fetching, base64 encoded",
      "type": "string"
    },
    "customerGoogleCredentials": {
      "description": "GCP credentials used for GCP secret fetching, base64 encoded",
      "type": "string"
    },
    "customerAzureClientId": {
      "description": "Azure client ID used for Azure secret fetching, base64 encoded",
      "type": "string"
    },
    "customerAzureClientSecret": {
      "description": "Azure client secret used for Azure secret fetching, base64 encoded",
      "type": "string"
    },
    "customerAzureTenantId": {
      "description": "Azure tenant ID used for Azure secret fetching, base64 encoded",
      "type": "string"
    },
    "bitbucketServerCredentialsEncoded": {
      "description": "Bitbucket server credentials, in the format of 'username:token', base64 encoded",
      "type": "string"
    },
    "gitlabEnterpriseCredentialsEncoded": {
      "description": "Gitlab Enterprise credentials, base64 encoded",
      "type": "string"
    },
    "gitlabEnterpriseBaseUrlSuffix": {
      "description": "Gitlab Enterprise base url additional suffix",
      "type": "string"
    },
    "githubEnterpriseCredentialsEncoded": {
      "description": "GitHub Enterprise credentials, base64 encoded",
      "type": "string"
    },
    "customerOracleCredentials": {
      "description": "Oracle credentials used for Oracle secret fetching, base64 encoded",
      "properties": {
        "tenancyOCIDEncoded": {
          "description": "The OCI Tenancy OCID encoded in base64",
          "type": "string"
        },
        "userOCIDEncoded": {
          "description": "The OCID of the accessing user encoded in base64",
          "type": "string"
        },
        "apiKeyFingerprintEncoded": {
          "description": "The fingerprint of the API key associated with the user for authentication, base64 encoded",
          "type": "string"
        },
        "apiKeyPrivateKeyEncoded": {
          "description": "The private key content used for OCI API key authentication, base64 encoded",
          "type": "string"
        },
        "secretsRegion": {
          "description": "The OCI region where the secrets are stored",
          "type": "string"
        }
      },
      "type": "object"
    },
    "environmentOutputEncryptionKey": {
      "description": "Key for encrypting environment sensitive outputs",
      "type": "string"
    },
    "alternativeLogLocation": {
      "description": "Configuration for alternative log storage",
      "properties": {
        "dynamoWriterExternalIdEncoded": {
          "description": "The ExternalID used to Assume the Dynamo Writer Role, base64 encoded",
          "type": "string"
        }
      },
      "type": "object"
    },
    "allowedVcsUrlRegex": {
      "description": "When set, cloning a git repository will only be permitted if the git url matches the regular expression set.",
      "type": "string",
      "foramt": "regex"
    },
    "jobHistoryLimitFailure": {
      "description": "Maximal amount of failed completed Jobs that will be shown to the user",
      "type": "integer"
    },
    "jobHistoryLimitSuccess": {
      "description": "Maximal amount of successfully completed Jobs that will be shown to the user",
      "type": "integer"
    },
    "httpProxy": {
      "type": "string"
    },
    "httpsProxy": {
      "type": "string"
    },
    "noProxy": {
      "type": "string"
    },
    "gitSslNoVerify": {
      "type": "string",
      "description": "will be passed to the GIT_SSL_NO_VERIFY environment variable"
    },
    "strictSecurityContext": {
      "type": "boolean",
      "description": "Enable security policy for agent pods that prevent from write to the system folders and run the pod as none admin"
    },
    "runAsUser": {
      "type": "integer",
      "default": 1000,
      "description": "The UID to run the entrypoint of the container process. Only works when `strictSecurityContext` is set to true. Note: The `node` user UID also needs to be updated to match in your custom image."
    },
    "runAsGroup": {
      "type": "integer",
      "default": 1000,
      "description": "The GID to run the entrypoint of the container process. Only works when `strictSecurityContext` is set to true. Note: The `node` user GID also needs to be updated to match in your custom image."
    },
    "customCertificates": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "minItems": 1,
      "uniqueItems": true,
      "description": "Add custom certificates inside the containers. Array of K8S secret names, each containing a key that represents a certificate file name"
    },
    "env0StateEncryptionKey": {
      "type": "string",
      "description": "The ENV0_STATE_ENCRYPTION_KEY when provided will be used to encrypt the state file and store it in the state bucket"
    },
    "logger": {
      "description": "console logger config",
      "properties": {
        "level": {
          "type": "string",
          "description": "log level",
          "enum": [
            "debug",
            "info",
            "warn",
            "error"
          ]
        },
        "format": {
          "type": "string",
          "description": "log format",
          "enum": [
            "json",
            "cli"
          ]
        }
      },
      "type": "object"
    },

    "providerInstallation": {
      "description": "provider installation configuration for opentf / terraform, appended to terraformrc ( https://opentofu.org/docs/cli/config/config-file/#provider-installation )",
      "type": "object",
      "properties": {
        "networkMirror": {
          "description": "Configuration for network mirror",
          "type": "object",
          "properties": {
            "url": {
              "type": "string",
              "description": "The URL of the network mirror"
            },
            "include": {
              "type": "array",
              "items": {
                "type": "string"
              },
              "description": "The list of providers to include"
            },
            "exclude": {
              "type": "array",
              "items": {
                "type": "string"
              },
              "description": "The list of providers to exclude"
            }
          },
          "required": [
            "url"
          ]
        },
        "filesystemMirror": {
          "description": "configuration for filesystem mirror",
          "type": "object",
          "properties": {
            "path": {
              "type": "string",
              "description": "The path of the filesystem mirror"
            },
            "include": {
              "type": "array",
              "items": {
                "type": "string"
              },
              "description": "The list of providers to include"
            },
            "exclude": {
              "type": "array",
              "items": {
                "type": "string"
              },
              "description": "The list of providers to exclude"
            }
          },
          "required": [
            "path"
          ]
        },
        "direct": {
          "type": "object",
          "description": "Direct provider installation configuration",
          "properties": {
            "include": {
              "type": "array",
              "items": {
                "type": "string"
              },
              "description": "The list of providers to include"
            },
            "exclude": {
              "type": "array",
              "items": {
                "type": "string"
              },
              "description": "The list of providers to exclude"
            }
          },
          "anyOf": [
            {
              "required": [
                "include"
              ]
            },
            {
              "required": [
                "exclude"
              ]
            }
          ]
        }
      }
    },

    "podAdditionalEnvVars": {
      "description": "Additional Environment variables to be passed to the deployment pod, which will also be passed to the deployment process",
      "type": "object",
      "additionalProperties": {
        "type": "string"
      }
    },
    "customSecrets": {
      "description": "Custom Environment Variable Secrets.",
      "type": "array",
      "items": { 
        "type": "object",
        "required": [ "envVarName", "secretName", "key" ],
        "properties": {
          "envVarName": {
            "type": "string",
            "description": "The environment variable key name (e.g. DB_PASSWORD)"
          },
          "secretName": {
            "type": "string",
            "description": "The name of the kubernetes secret (e.g. my-secret)"
          },
          "key": {
            "type": "string",
            "description": "The secret key from secretName (e.g. db_password)"
          }
        }
      }
    },
    "customSecretMounts": {
      "description": "Custom Secrets Mounts",
      "type": "array",
      "items": {
        "type": "object",
        "required": [ "volumeName", "secretName", "mountPath" ],
        "properties": {
          "volumeName": {
            "type": "string",
            "description": "The name of the volume mount (any string)"
          },
          "secretName": {
            "type": "string",
            "description": "The name of the kubernetes secret (e.g. my-secret)"
          },
          "mountPath": {
            "type": "string",
            "description": "The mount path within the container (e.g. /opt/secret)"
          }
        }
      }
    },
    "env0ConfigSecretName": {
      "description": "K8s Secret Name that contains secrets and credentials used to configure env0",
      "type": "string"
    },
    "initContainer": {
      "description": "array of custom init containers",
      "type": "array",
      "items": {
        "$schema": "agent/helm/schemas/kubernetesjsonschema.dev/v1.10.3-standalone/init-container-v1.json"
      } 
    },
    "customVolumeMounts": {
      "description": "array of custom volume mounts, optionally to be used with the init container",
      "type": "array",
      "items": {
        "$schema": "agent/helm/schemas/kubernetesjsonschema.dev/v1.10.3-standalone/volumemount-v1.json"
      }
    },
    "useOidcForAwsSsm": {
      "type": "boolean",
      "description": "Use Env0 OIDC for AWS SSM secret fetching"
    },
    "customRoleForOidcAwsSsm": {
      "description": "Custom role for AWS SSM secret fetching, Note: only used when useOidcForAwsSsm=true",
      "properties": {
        "duration": {
          "type": "number",
          "description": "The duration of the OIDC token in seconds"
        },
        "arn": {
          "type": "string",
          "description": "Custom role to assume via OIDC for AWS SSM secret fetching"
        }
      },
      "required": ["arn"],
      "type": "object"
    }
  },
  "required": ["agentKey", "stage", "dockerImage", "stateMountPath", "limits", "agentProxy"],
  "allOf": [
    {
      "if": {
        "properties": {
          "env0ConfigSecretName": { "type": "null" }
        }
      },
      "then": {
        "required": ["awsAccessKeyIdEncoded", "awsSecretAccessKeyEncoded", "env0ApiGwKeyEncoded"]
      }
    }
  ],
  "title": "Values",
  "type": "object"
}