| image | Docker image URL to auto-detect provider/account/location/registry | no | — |
| provider | Cloud provider (aws, gcp, azure, github, dockerhub, other) - auto-detected if image is provided. Use 'other' for BYOK/on-prem clusters with kubeconfig input. | no | — |
| account | AWS account ID / GCP project ID / Azure subscription ID | no | — |
| location | AWS region (e.g., us-east-1) or GCP location (e.g., us|europe|asia|us-central1|us-central1-a). Not used for Azure. | no | — |
| cluster | Kubernetes cluster name (EKS/GKE/AKS) | no | — |
| login_to_container_registry | Login to container registry (ECR/GAR/ACR/GHCR/Docker Hub) | no | false |
| repositories | AWS ECR: repositories to ensure exist (comma-separated) | no | — |
| acr_registry | Azure ACR registry name (e.g., 'myacrname') | no | — |
| aws_role_to_assume | AWS IAM role ARN to assume (OIDC recommended) | no | — |
| aws_access_key_id | AWS Access Key ID (if not using OIDC) | no | — |
| aws_secret_access_key | AWS Secret Access Key (if not using OIDC) | no | — |
| aws_session_duration | AWS session duration in seconds | no | 3600 |
| gcp_credentials_json | GCP Service Account JSON | no | — |
| gcp_workload_identity_provider | GCP Workload Identity Provider resource name | no | — |
| gcp_service_account | GCP Service Account email | no | — |
| azure_client_id | Azure client ID (Service Principal) | no | — |
| azure_client_secret | Azure client secret (Service Principal) | no | — |
| azure_tenant_id | Azure tenant ID | no | — |
| azure_resource_group | Azure resource group for AKS | no | — |
| kubeconfig | Base64-encoded kubeconfig for direct cluster access (BYOK/on-prem). Skips cloud-specific kubectl setup when provided. | no | — |
| registry_server | Container registry hostname (e.g., quay.io, ghcr.io, docker.io) | no | — |
| registry_username | Registry username | no | — |
| registry_password | Registry password or token | no | — |
| aws_codeartifact_domain | AWS CodeArtifact domain name | no | — |
| aws_codeartifact_repository | AWS CodeArtifact repository name | no | — |
| aws_codeartifact_tool | Tool to configure for CodeArtifact (npm, pip, twine, dotnet, nuget, swift, maven, gradle) | no | — |
| aws_codeartifact_region | Region for CodeArtifact (defaults to location/aws_region if not specified) | no | — |
| aws_codeartifact_domain_owner | AWS account ID that owns the CodeArtifact domain (defaults to authenticated account) | no | — |
| aws_codeartifact_duration | Duration of the CodeArtifact token in seconds | no | 43200 |
| aws_codeartifact_namespace | CodeArtifact namespace for the repository | no | — |
| aws_codeartifact_output_token | Output the CodeArtifact token instead of using aws codeartifact login (useful for Docker builds) | no | false |
| github_token | GitHub token for GHCR (defaults to GITHUB_TOKEN) | no | — |
| dockerhub_username | Docker Hub username (alias for registry_username when provider=dockerhub) | no | — |
| dockerhub_token | Docker Hub access token (alias for registry_password when provider=dockerhub) | no | — |
| quay_username | Quay username (alias for registry_username when provider=quay) | no | — |
| quay_token | Quay token (alias for registry_password when provider=quay) | no | — |