apiVersion: kubelet.config.k8s.io/v1
kind: CredentialProviderConfig
providers:
  - name: k8s-image-cred-spire-identity-exchange
    matchImages:
      - "zot.production.other"
    defaultCacheDuration: "0s"
    apiVersion: credentialprovider.kubelet.k8s.io/v1
    args:
      - "--username=zot"
      - "--mode=spire-identity-exchange"
      - "--url=https://spire-identity-exchange-rest-spiffe.production.other"
      - "--stack=image_pull"
      - "--registry-audience=zot"
      - "--spiffe-audience=spire-identity-exchange"
      - "--spiffe-hint=image-pull"
      - "--spiffe-id=spiffe://production.other/service/spire-identity-exchange"
      - "--timeout=10s"
    env:
      - name: SPIFFE_ENDPOINT_SOCKET
        value: unix:///var/run/spire/agent/sockets/main/public/api.sock
    tokenAttributes:
      serviceAccountTokenAudience: "spire-identity-exchange"
      cacheType: "Token"
      requireServiceAccount: true