mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-10-06 03:26:46 +00:00
Merge branch 'main' into feature/mongodb-secret-rotation
This commit is contained in:
Victor Santos
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Create AWS Secrets Manager PKI Sync"
|
||||
openapi: "POST /api/v1/pki/syncs/aws-secrets-manager"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Delete AWS Secrets Manager PKI Sync"
|
||||
openapi: "DELETE /api/v1/pki/syncs/aws-secrets-manager/{pkiSyncId}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Get AWS Secrets Manager PKI Sync by ID"
|
||||
openapi: "GET /api/v1/pki/syncs/aws-secrets-manager/{pkiSyncId}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "List AWS Secrets Manager PKI Syncs"
|
||||
openapi: "GET /api/v1/pki/syncs/aws-secrets-manager"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Remove Certificates from AWS Secrets Manager"
|
||||
openapi: "POST /api/v1/pki/syncs/aws-secrets-manager/{pkiSyncId}/remove-certificates"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Sync Certificates to AWS Secrets Manager"
|
||||
openapi: "POST /api/v1/pki/syncs/aws-secrets-manager/{pkiSyncId}/sync-certificates"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Update AWS Secrets Manager PKI Sync"
|
||||
openapi: "PATCH /api/v1/pki/syncs/aws-secrets-manager/{pkiSyncId}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Create Chef PKI Sync"
|
||||
openapi: "POST /api/v1/pki/syncs/chef"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Delete Chef PKI Sync"
|
||||
openapi: "DELETE /api/v1/pki/syncs/chef/{pkiSyncId}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Get Chef PKI Sync by ID"
|
||||
openapi: "GET /api/v1/pki/syncs/chef/{pkiSyncId}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "List Chef PKI Syncs"
|
||||
openapi: "GET /api/v1/pki/syncs/chef"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Remove Certificates from Chef"
|
||||
openapi: "POST /api/v1/pki/syncs/chef/{pkiSyncId}/remove-certificates"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Sync Certificates to Chef"
|
||||
openapi: "POST /api/v1/pki/syncs/chef/{pkiSyncId}/sync"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Update Chef PKI Sync"
|
||||
openapi: "PATCH /api/v1/pki/syncs/chef/{pkiSyncId}"
|
||||
---
|
||||
@@ -40,12 +40,12 @@ sudo infisical gateway start --name=<name> --auth-method=<auth-method>
|
||||
```
|
||||
|
||||
<Info>
|
||||
By default, the gateway automatically connects to the relay with the lowest latency. To target a specific relay, use the `--relay=<relay-name>` flag.
|
||||
By default, the gateway automatically connects to the relay with the lowest latency. To target a specific relay, use the `--target-relay-name=<relay-name>` flag.
|
||||
</Info>
|
||||
|
||||
Once started, the gateway component will:
|
||||
|
||||
- Automatically connect to a healthy relay with the lowest latency (unless the `--relay` flag is specified)
|
||||
- Automatically connect to a healthy relay with the lowest latency (unless the `--target-relay-name` flag is specified)
|
||||
- Establish outbound SSH reverse tunnel to relay server (no inbound firewall rules needed)
|
||||
- Authenticate using SSH certificates issued by Infisical
|
||||
- Automatically reconnect if the connection is lost
|
||||
@@ -252,14 +252,14 @@ The Gateway supports multiple authentication methods. Below are the available au
|
||||
### Other Flags
|
||||
|
||||
<AccordionGroup>
|
||||
<Accordion title="--relay">
|
||||
<Accordion title="--target-relay-name">
|
||||
The name of the relay that this gateway should connect to. The relay must be running and registered before starting the gateway.
|
||||
|
||||
If this flag is omitted, the gateway will automatically connect to a healthy relay with the lowest latency.
|
||||
|
||||
```bash
|
||||
# Example
|
||||
sudo infisical gateway start --relay=my-relay --name=my-gateway --token=<token>
|
||||
sudo infisical gateway start --target-relay-name=my-relay --name=my-gateway --token=<token>
|
||||
```
|
||||
|
||||
**Note:** For Infisical Cloud users using instance relays, the relay infrastructure is already running and managed by Infisical. If using organization relays or self-hosted instance relays, you must first start a relay server. For more information on deploying relays, refer to the [Relay Deployment Guide](/documentation/platform/gateways/relay-deployment).
|
||||
@@ -336,14 +336,14 @@ sudo infisical gateway systemd install --token=<token> --domain=<domain> --name=
|
||||
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="--relay">
|
||||
<Accordion title="--target-relay-name">
|
||||
The name of the relay that this gateway should connect to. The relay must be running and registered before starting the gateway.
|
||||
|
||||
If this flag is omitted, the gateway will automatically connect to a healthy relay with the lowest latency.
|
||||
|
||||
```bash
|
||||
# Example
|
||||
sudo infisical gateway systemd install --relay=my-relay --token=<token> --name=<name>
|
||||
sudo infisical gateway systemd install --target-relay-name=my-relay --token=<token> --name=<name>
|
||||
```
|
||||
|
||||
**Note:** For Infisical Cloud users using instance relays, the relay infrastructure is already running and managed by Infisical. If using organization relays or self-hosted instance relays, you must first start a relay server. For more information on deploying relays, refer to the [Relay Deployment Guide](/documentation/platform/gateways/relay-deployment).
|
||||
@@ -687,7 +687,7 @@ sudo systemctl disable infisical-gateway # Disable auto-start on boot
|
||||
|
||||
<AccordionGroup>
|
||||
<Accordion title="How are relays auto-selected?">
|
||||
If the `--relay` flag is omitted, the gateway automatically selects the optimal relay. It first checks for healthy organization relays and connects to the one with the lowest latency. If no organization relays are available, it then performs the same latency-based selection among the available managed relays.
|
||||
If the `--target-relay-name` flag is omitted, the gateway automatically selects the optimal relay. It first checks for healthy organization relays and connects to the one with the lowest latency. If no organization relays are available, it then performs the same latency-based selection among the available managed relays.
|
||||
</Accordion>
|
||||
<Accordion title="When restarting the gateway without a relay flag, does it select a new relay every time?">
|
||||
No. The first time the gateway starts, it selects the optimal relay (based on latency) and caches that selection. On subsequent restarts, it will prioritize connecting to the cached relay. If it's unable to connect, it will then re-evaluate and connect to the next most optimal relay available.
|
||||
|
||||
+27
-1
@@ -768,7 +768,9 @@
|
||||
"pages": [
|
||||
"documentation/platform/pki/certificate-syncs/overview",
|
||||
"documentation/platform/pki/certificate-syncs/aws-certificate-manager",
|
||||
"documentation/platform/pki/certificate-syncs/azure-key-vault"
|
||||
"documentation/platform/pki/certificate-syncs/aws-secrets-manager",
|
||||
"documentation/platform/pki/certificate-syncs/azure-key-vault",
|
||||
"documentation/platform/pki/certificate-syncs/chef"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -2644,6 +2646,18 @@
|
||||
"api-reference/endpoints/pki/syncs/aws-certificate-manager/remove-certificates"
|
||||
]
|
||||
},
|
||||
{
|
||||
"group": "AWS Secrets Manager",
|
||||
"pages": [
|
||||
"api-reference/endpoints/pki/syncs/aws-secrets-manager/list",
|
||||
"api-reference/endpoints/pki/syncs/aws-secrets-manager/get-by-id",
|
||||
"api-reference/endpoints/pki/syncs/aws-secrets-manager/create",
|
||||
"api-reference/endpoints/pki/syncs/aws-secrets-manager/update",
|
||||
"api-reference/endpoints/pki/syncs/aws-secrets-manager/delete",
|
||||
"api-reference/endpoints/pki/syncs/aws-secrets-manager/sync-certificates",
|
||||
"api-reference/endpoints/pki/syncs/aws-secrets-manager/remove-certificates"
|
||||
]
|
||||
},
|
||||
{
|
||||
"group": "Azure Key Vault",
|
||||
"pages": [
|
||||
@@ -2655,6 +2669,18 @@
|
||||
"api-reference/endpoints/pki/syncs/azure-key-vault/sync-certificates",
|
||||
"api-reference/endpoints/pki/syncs/azure-key-vault/remove-certificates"
|
||||
]
|
||||
},
|
||||
{
|
||||
"group": "Chef",
|
||||
"pages": [
|
||||
"api-reference/endpoints/pki/syncs/chef/list",
|
||||
"api-reference/endpoints/pki/syncs/chef/get-by-id",
|
||||
"api-reference/endpoints/pki/syncs/chef/create",
|
||||
"api-reference/endpoints/pki/syncs/chef/update",
|
||||
"api-reference/endpoints/pki/syncs/chef/delete",
|
||||
"api-reference/endpoints/pki/syncs/chef/sync-certificates",
|
||||
"api-reference/endpoints/pki/syncs/chef/remove-certificates"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@@ -127,7 +127,7 @@ To successfully deploy an Infisical Gateway for use, follow these steps in order
|
||||
```
|
||||
|
||||
<Info>
|
||||
By default, the gateway connects to the most optimal relay. Use the `--relay` flag to manually specify a different relay server.
|
||||
By default, the gateway connects to the most optimal relay. Use the `--target-relay-name` flag to manually specify a different relay server.
|
||||
</Info>
|
||||
|
||||
<Warning>
|
||||
@@ -177,7 +177,7 @@ To successfully deploy an Infisical Gateway for use, follow these steps in order
|
||||
```
|
||||
|
||||
<Info>
|
||||
By default, the gateway connects to the most optimal relay. Use the `--relay` flag to manually specify a different relay server.
|
||||
By default, the gateway connects to the most optimal relay. Use the `--target-relay-name` flag to manually specify a different relay server.
|
||||
</Info>
|
||||
</Tab>
|
||||
</Tabs>
|
||||
|
||||
@@ -39,6 +39,7 @@ These permissions allow Infisical to list, import, tag, and manage certificates
|
||||
|
||||
- **Enable Removal of Expired/Revoked Certificates**: If enabled, Infisical will remove certificates from the destination if they are no longer active in Infisical.
|
||||
- **Preserve ARN on Renewal**: If enabled, Infisical will sync renewed certificates to the destination under the same ARN as the original synced certificate instead of creating a new certificate with a new ARN.
|
||||
- **Include Root CA**: If enabled, the Root CA certificate will be included in the certificate chain when syncing to AWS Certificate Manager. If disabled, only intermediate certificates will be included.
|
||||
- **Certificate Name Schema** (Optional): Customize how certificate tags are generated in AWS Certificate Manager. Must include `{{certificateId}}` as a placeholder for the certificate ID to ensure proper certificate identification and management. If not specified, defaults to `Infisical-{{certificateId}}`.
|
||||
- **Auto-Sync Enabled**: If enabled, certificates will automatically be synced when changes occur. Disable to enforce manual syncing only.
|
||||
|
||||
@@ -86,6 +87,7 @@ These permissions allow Infisical to list, import, tag, and manage certificates
|
||||
"syncOptions": {
|
||||
"canRemoveCertificates": true,
|
||||
"preserveArnOnRenewal": true,
|
||||
"includeRootCa": false,
|
||||
"certificateNameSchema": "myapp-{{certificateId}}"
|
||||
},
|
||||
"destinationConfig": {
|
||||
@@ -110,6 +112,7 @@ These permissions allow Infisical to list, import, tag, and manage certificates
|
||||
"syncOptions": {
|
||||
"canRemoveCertificates": true,
|
||||
"preserveArnOnRenewal": true,
|
||||
"includeRootCa": false,
|
||||
"certificateNameSchema": "myapp-{{certificateId}}"
|
||||
},
|
||||
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
|
||||
@@ -0,0 +1,251 @@
|
||||
---
|
||||
title: "AWS Secrets Manager"
|
||||
description: "Learn how to configure an AWS Secrets Manager Certificate Sync for Infisical PKI."
|
||||
---
|
||||
|
||||
**Prerequisites:**
|
||||
|
||||
- Create an [AWS Connection](/integrations/app-connections/aws)
|
||||
- Ensure your network security policies allow incoming requests from Infisical to this certificate sync provider, if network restrictions apply.
|
||||
|
||||
<Note>
|
||||
The AWS Secrets Manager Certificate Sync requires the following permissions to be set on the AWS IAM user
|
||||
for Infisical to sync certificates to AWS Secrets Manager: `secretsmanager:CreateSecret`, `secretsmanager:UpdateSecret`,
|
||||
`secretsmanager:GetSecretValue`, `secretsmanager:DeleteSecret`, `secretsmanager:ListSecrets`.
|
||||
|
||||
Any role with these permissions would work such as a custom policy with **SecretsManager** permissions.
|
||||
|
||||
</Note>
|
||||
|
||||
<Note>
|
||||
Certificates synced to AWS Secrets Manager will be stored as JSON secrets,
|
||||
preserving both the certificate and private key components as separate fields within the secret value.
|
||||
</Note>
|
||||
|
||||
<Tabs>
|
||||
<Tab title="Infisical UI">
|
||||
1. Navigate to **Project** > **Integrations** > **Certificate Syncs** and press **Add Sync**.
|
||||
|
||||
|
||||
2. Select the **AWS Secrets Manager** option.
|
||||
|
||||
|
||||
3. Configure the **Destination** to where certificates should be deployed, then click **Next**.
|
||||
|
||||
|
||||
- **AWS Connection**: The AWS Connection to authenticate with.
|
||||
- **Region**: The AWS region where secrets will be stored.
|
||||
|
||||
4. Configure the **Sync Options** to specify how certificates should be synced, then click **Next**.
|
||||
|
||||
|
||||
- **Enable Removal of Expired/Revoked Certificates**: If enabled, Infisical will remove certificates from the destination if they are no longer active in Infisical.
|
||||
- **Preserve Secret on Renewal**: Only applies to certificate renewals. When a certificate is renewed in Infisical, this option controls how the renewed certificate is handled. If enabled, the renewed certificate will update the existing secret, preserving the same secret name. If disabled, the renewed certificate will be created as a new secret with a new name.
|
||||
- **Include Root CA**: If enabled, the Root CA certificate will be included in the certificate chain when syncing to AWS Secrets Manager. If disabled, only intermediate certificates will be included.
|
||||
- **Certificate Name Schema** (Optional): Customize how secret names are generated in AWS Secrets Manager. Use `{{certificateId}}` as a placeholder for the certificate ID.
|
||||
- **Auto-Sync Enabled**: If enabled, certificates will automatically be synced when changes occur. Disable to enforce manual syncing only.
|
||||
|
||||
5. Configure the **Field Mappings** to customize how certificate data is stored in AWS Secrets Manager secrets, then click **Next**.
|
||||
|
||||
|
||||
- **Certificate Field**: The field name where the certificate will be stored in the secret value (default: `certificate`)
|
||||
- **Private Key Field**: The field name where the private key will be stored in the secret value (default: `private_key`)
|
||||
- **Certificate Chain Field**: The field name where the full certificate chain excluding the root CA certificate will be stored (default: `certificate_chain`)
|
||||
- **CA Certificate Field**: The field name where the root CA certificate will be stored (default: `ca_certificate`)
|
||||
|
||||
<Tip>
|
||||
**AWS Secrets Manager Secret Structure**: Certificates are stored in AWS Secrets Manager as JSON secrets with the following structure (field names can be customized via field mappings):
|
||||
```json
|
||||
{
|
||||
"certificate": "-----BEGIN CERTIFICATE-----\n...",
|
||||
"private_key": "-----BEGIN PRIVATE KEY-----\n...",
|
||||
"certificate_chain": "-----BEGIN CERTIFICATE-----\n...",
|
||||
"ca_certificate": "-----BEGIN CERTIFICATE-----\n..."
|
||||
}
|
||||
```
|
||||
|
||||
**Example with Custom Field Mappings**:
|
||||
```json
|
||||
{
|
||||
"ssl_cert": "-----BEGIN CERTIFICATE-----\n...",
|
||||
"ssl_key": "-----BEGIN PRIVATE KEY-----\n...",
|
||||
"ssl_chain": "-----BEGIN CERTIFICATE-----\n...",
|
||||
"ssl_ca": "-----BEGIN CERTIFICATE-----\n..."
|
||||
}
|
||||
```
|
||||
</Tip>
|
||||
|
||||
6. Configure the **Details** of your AWS Secrets Manager Certificate Sync, then click **Next**.
|
||||
|
||||
|
||||
- **Name**: The name of your sync. Must be slug-friendly.
|
||||
- **Description**: An optional description for your sync.
|
||||
|
||||
7. Select which certificates should be synced to AWS Secrets Manager.
|
||||
|
||||
|
||||
8. Review your AWS Secrets Manager Certificate Sync configuration, then click **Create Sync**.
|
||||
|
||||
|
||||
9. If enabled, your AWS Secrets Manager Certificate Sync will begin syncing your certificates to the destination endpoint.
|
||||
|
||||
</Tab>
|
||||
<Tab title="API">
|
||||
To create an **AWS Secrets Manager Certificate Sync**, make an API request to the [Create AWS Secrets Manager Certificate Sync](/api-reference/endpoints/pki/syncs/aws-secrets-manager/create) API endpoint.
|
||||
|
||||
### Sample request
|
||||
|
||||
<Note>
|
||||
You can optionally specify `certificateIds` during sync creation to immediately add certificates to the sync.
|
||||
If not provided, you can add certificates later using the certificate management endpoints.
|
||||
</Note>
|
||||
|
||||
```bash Request
|
||||
curl --request POST \
|
||||
--url https://app.infisical.com/api/v1/pki/syncs/aws-secrets-manager \
|
||||
--header 'Authorization: Bearer <access-token>' \
|
||||
--header 'Content-Type: application/json' \
|
||||
--data '{
|
||||
"name": "my-aws-secrets-manager-cert-sync",
|
||||
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"description": "an example certificate sync",
|
||||
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"destination": "aws-secrets-manager",
|
||||
"isAutoSyncEnabled": true,
|
||||
"certificateIds": [
|
||||
"550e8400-e29b-41d4-a716-446655440000",
|
||||
"660f1234-e29b-41d4-a716-446655440001"
|
||||
],
|
||||
"syncOptions": {
|
||||
"canRemoveCertificates": true,
|
||||
"preserveSecretOnRenewal": true,
|
||||
"canImportCertificates": false,
|
||||
"includeRootCa": false,
|
||||
"certificateNameSchema": "myapp-{{certificateId}}",
|
||||
"fieldMappings": {
|
||||
"certificate": "ssl_cert",
|
||||
"privateKey": "ssl_key",
|
||||
"certificateChain": "ssl_chain",
|
||||
"caCertificate": "ssl_ca"
|
||||
}
|
||||
},
|
||||
"destinationConfig": {
|
||||
"region": "us-east-1",
|
||||
"keyId": "alias/my-kms-key"
|
||||
}
|
||||
}'
|
||||
```
|
||||
|
||||
### Example with Default Field Mappings
|
||||
|
||||
```bash Request
|
||||
curl --request POST \
|
||||
--url https://app.infisical.com/api/v1/pki/syncs/aws-secrets-manager \
|
||||
--header 'Authorization: Bearer <access-token>' \
|
||||
--header 'Content-Type: application/json' \
|
||||
--data '{
|
||||
"name": "my-aws-secrets-manager-cert-sync-default",
|
||||
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"description": "AWS Secrets Manager sync with default field mappings",
|
||||
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"destination": "aws-secrets-manager",
|
||||
"isAutoSyncEnabled": true,
|
||||
"syncOptions": {
|
||||
"canRemoveCertificates": true,
|
||||
"preserveSecretOnRenewal": true,
|
||||
"canImportCertificates": false,
|
||||
"includeRootCa": false,
|
||||
"certificateNameSchema": "infisical-{{certificateId}}",
|
||||
"fieldMappings": {
|
||||
"certificate": "certificate",
|
||||
"privateKey": "private_key",
|
||||
"certificateChain": "certificate_chain",
|
||||
"caCertificate": "ca_certificate"
|
||||
}
|
||||
},
|
||||
"destinationConfig": {
|
||||
"region": "us-west-2"
|
||||
}
|
||||
}'
|
||||
```
|
||||
|
||||
### Sample response
|
||||
|
||||
```json Response
|
||||
{
|
||||
"pkiSync": {
|
||||
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"name": "my-aws-secrets-manager-cert-sync",
|
||||
"description": "an example certificate sync",
|
||||
"destination": "aws-secrets-manager",
|
||||
"isAutoSyncEnabled": true,
|
||||
"destinationConfig": {
|
||||
"region": "us-east-1",
|
||||
"keyId": "alias/my-kms-key"
|
||||
},
|
||||
"syncOptions": {
|
||||
"canRemoveCertificates": true,
|
||||
"preserveSecretOnRenewal": true,
|
||||
"canImportCertificates": false,
|
||||
"includeRootCa": false,
|
||||
"certificateNameSchema": "myapp-{{certificateId}}",
|
||||
"fieldMappings": {
|
||||
"certificate": "ssl_cert",
|
||||
"privateKey": "ssl_key",
|
||||
"certificateChain": "ssl_chain",
|
||||
"caCertificate": "ssl_ca"
|
||||
}
|
||||
},
|
||||
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"createdAt": "2023-01-01T00:00:00.000Z",
|
||||
"updatedAt": "2023-01-01T00:00:00.000Z"
|
||||
}
|
||||
}
|
||||
```
|
||||
</Tab>
|
||||
|
||||
</Tabs>
|
||||
|
||||
## Certificate Management
|
||||
|
||||
Your AWS Secrets Manager Certificate Sync will:
|
||||
|
||||
- **Automatic Deployment**: Deploy certificates in Infisical to AWS Secrets Manager as JSON secrets with customizable field names
|
||||
- **Certificate Updates**: Update certificates in AWS Secrets Manager when renewals occur
|
||||
- **Expiration Handling**: Optionally remove expired certificates from AWS Secrets Manager (if enabled)
|
||||
- **Format Preservation**: Maintain certificate format during sync operations
|
||||
- **Field Customization**: Map certificate data to custom field names that match your application requirements
|
||||
- **CA Certificate Support**: Include CA certificates in secrets for complete certificate chain management
|
||||
- **KMS Encryption**: Optionally use custom KMS keys for secret encryption
|
||||
- **Regional Deployment**: Deploy secrets to specific AWS regions
|
||||
|
||||
<Note>
|
||||
AWS Secrets Manager Certificate Syncs support both automatic and manual
|
||||
synchronization modes. When auto-sync is enabled, certificates are
|
||||
automatically deployed as they are issued or renewed.
|
||||
</Note>
|
||||
|
||||
## Manual Certificate Sync
|
||||
|
||||
You can manually trigger certificate synchronization to AWS Secrets Manager using the sync certificates functionality. This is useful for:
|
||||
|
||||
- Initial setup when you have existing certificates to deploy
|
||||
- One-time sync of specific certificates
|
||||
- Testing certificate sync configurations
|
||||
- Force sync after making changes
|
||||
|
||||
To manually sync certificates, use the [Sync Certificates](/api-reference/endpoints/pki/syncs/aws-secrets-manager/sync-certificates) API endpoint or the manual sync option in the Infisical UI.
|
||||
|
||||
<Note>
|
||||
AWS Secrets Manager does not support importing certificates back into Infisical
|
||||
due to the nature of AWS Secrets Manager where certificates are stored as JSON secrets
|
||||
rather than managed certificate objects.
|
||||
</Note>
|
||||
|
||||
## Secret Naming Constraints
|
||||
|
||||
AWS Secrets Manager has specific naming requirements for secrets:
|
||||
|
||||
- **Allowed Characters**: Letters, numbers, hyphens (-), and underscores (_) only
|
||||
- **Length**: 1-512 characters
|
||||
@@ -40,6 +40,7 @@ Any role with these permissions would work such as the **Key Vault Certificates
|
||||
|
||||
- **Enable Removal of Expired/Revoked Certificates**: If enabled, Infisical will remove certificates from the destination if they are no longer active in Infisical.
|
||||
- **Enable Versioning on Renewal**: If enabled, Infisical will sync renewed certificates to the destination under a new version of the original synced certificate instead of creating a new certificate.
|
||||
- **Include Root CA**: If enabled, the Root CA certificate will be included in the certificate chain when syncing to Azure Key Vault. If disabled, only intermediate certificates will be included.
|
||||
- **Certificate Name Schema** (Optional): Customize how certificate names are generated in Azure Key Vault. Use `{{certificateId}}` as a placeholder for the certificate ID. If not specified, defaults to `Infisical-{{certificateId}}`.
|
||||
- **Auto-Sync Enabled**: If enabled, certificates will automatically be synced when changes occur. Disable to enforce manual syncing only.
|
||||
|
||||
@@ -93,6 +94,7 @@ Any role with these permissions would work such as the **Key Vault Certificates
|
||||
"syncOptions": {
|
||||
"canRemoveCertificates": true,
|
||||
"enableVersioningOnRenewal": true,
|
||||
"includeRootCa": false,
|
||||
"certificateNameSchema": "myapp-{{certificateId}}"
|
||||
},
|
||||
"destinationConfig": {
|
||||
@@ -117,6 +119,7 @@ Any role with these permissions would work such as the **Key Vault Certificates
|
||||
"syncOptions": {
|
||||
"canRemoveCertificates": true,
|
||||
"enableVersioningOnRenewal": true,
|
||||
"includeRootCa": false,
|
||||
"certificateNameSchema": "myapp-{{certificateId}}"
|
||||
},
|
||||
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
|
||||
@@ -0,0 +1,241 @@
|
||||
---
|
||||
title: "Chef"
|
||||
description: "Learn how to configure a Chef Certificate Sync for Infisical PKI."
|
||||
---
|
||||
|
||||
**Prerequisites:**
|
||||
|
||||
- Create a [Chef Connection](/integrations/app-connections/chef)
|
||||
- Ensure your network security policies allow incoming requests from Infisical to this certificate sync provider, if network restrictions apply.
|
||||
|
||||
<Note>
|
||||
The Chef Certificate Sync requires the following permissions to be set on the Chef user
|
||||
for Infisical to sync certificates to Chef: `data bag read`, `data bag create`, `data bag update`, `data bag delete`.
|
||||
|
||||
Any role with these permissions would work such as a custom role with **Data Bag** permissions.
|
||||
|
||||
</Note>
|
||||
|
||||
<Note>
|
||||
Certificates synced to Chef will be stored as data bag items within the specified data bag,
|
||||
preserving both the certificate and private key components as separate fields.
|
||||
</Note>
|
||||
|
||||
<Tabs>
|
||||
<Tab title="Infisical UI">
|
||||
1. Navigate to **Project** > **Integrations** > **Certificate Syncs** and press **Add Sync**.
|
||||
|
||||
|
||||
2. Select the **Chef** option.
|
||||
|
||||
|
||||
3. Configure the **Destination** to where certificates should be deployed, then click **Next**.
|
||||
|
||||
|
||||
- **Chef Connection**: The Chef Connection to authenticate with.
|
||||
- **Data Bag Name**: The name of the Chef data bag where certificates will be stored.
|
||||
|
||||
4. Configure the **Sync Options** to specify how certificates should be synced, then click **Next**.
|
||||
|
||||
|
||||
- **Enable Removal of Expired/Revoked Certificates**: If enabled, Infisical will remove certificates from the destination if they are no longer active in Infisical.
|
||||
- **Preserve Data Bag Item on Renewal**: Only applies to certificate renewals. When a certificate is renewed in Infisical, this option controls how the renewed certificate is handled. If enabled, the renewed certificate will update the existing data bag item, preserving the same item name. If disabled, the renewed certificate will be created as a new data bag item with a new name.
|
||||
- **Include Root CA**: If enabled, the Root CA certificate will be included in the certificate chain when syncing to Chef data bags. If disabled, only intermediate certificates will be included.
|
||||
- **Certificate Name Schema** (Optional): Customize how certificate item names are generated in Chef data bags. Use `{{certificateId}}` as a placeholder for the certificate ID.
|
||||
- **Auto-Sync Enabled**: If enabled, certificates will automatically be synced when changes occur. Disable to enforce manual syncing only.
|
||||
|
||||
5. Configure the **Field Mappings** to customize how certificate data is stored in Chef data bag items, then click **Next**.
|
||||
|
||||
|
||||
- **Certificate Field**: The field name where the certificate will be stored in the data bag item (default: `certificate`)
|
||||
- **Private Key Field**: The field name where the private key will be stored in the data bag item (default: `private_key`)
|
||||
- **Certificate Chain Field**: The field name where the full certificate chain excluding the root CA certificate will be stored (default: `certificate_chain`)
|
||||
- **CA Certificate Field**: The field name where the root CA certificate will be stored (default: `ca_certificate`)
|
||||
|
||||
<Tip>
|
||||
**Chef Data Bag Item Structure**: Certificates are stored in Chef data bags as items with the following structure (field names can be customized via field mappings):
|
||||
```json
|
||||
{
|
||||
"id": "certificate-item-name",
|
||||
"certificate": "-----BEGIN CERTIFICATE-----\n...",
|
||||
"private_key": "-----BEGIN PRIVATE KEY-----\n...",
|
||||
"certificate_chain": "-----BEGIN CERTIFICATE-----\n...",
|
||||
"ca_certificate": "-----BEGIN CERTIFICATE-----\n..."
|
||||
}
|
||||
```
|
||||
|
||||
**Example with Custom Field Mappings**:
|
||||
```json
|
||||
{
|
||||
"id": "certificate-item-name",
|
||||
"ssl_cert": "-----BEGIN CERTIFICATE-----\n...",
|
||||
"ssl_key": "-----BEGIN PRIVATE KEY-----\n...",
|
||||
"ssl_chain": "-----BEGIN CERTIFICATE-----\n...",
|
||||
"ssl_ca": "-----BEGIN CERTIFICATE-----\n..."
|
||||
}
|
||||
```
|
||||
</Tip>
|
||||
|
||||
6. Configure the **Details** of your Chef Certificate Sync, then click **Next**.
|
||||
|
||||
|
||||
- **Name**: The name of your sync. Must be slug-friendly.
|
||||
- **Description**: An optional description for your sync.
|
||||
|
||||
7. Select which certificates should be synced to Chef.
|
||||
|
||||
|
||||
8. Review your Chef Certificate Sync configuration, then click **Create Sync**.
|
||||
|
||||
|
||||
9. If enabled, your Chef Certificate Sync will begin syncing your certificates to the destination endpoint.
|
||||
|
||||
</Tab>
|
||||
<Tab title="API">
|
||||
To create a **Chef Certificate Sync**, make an API request to the [Create Chef Certificate Sync](/api-reference/endpoints/pki/syncs/chef/create) API endpoint.
|
||||
|
||||
### Sample request
|
||||
|
||||
<Note>
|
||||
You can optionally specify `certificateIds` during sync creation to immediately add certificates to the sync.
|
||||
If not provided, you can add certificates later using the certificate management endpoints.
|
||||
</Note>
|
||||
|
||||
```bash Request
|
||||
curl --request POST \
|
||||
--url https://app.infisical.com/api/v1/pki/syncs/chef \
|
||||
--header 'Authorization: Bearer <access-token>' \
|
||||
--header 'Content-Type: application/json' \
|
||||
--data '{
|
||||
"name": "my-chef-cert-sync",
|
||||
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"description": "an example certificate sync",
|
||||
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"destination": "chef",
|
||||
"isAutoSyncEnabled": true,
|
||||
"certificateIds": [
|
||||
"550e8400-e29b-41d4-a716-446655440000",
|
||||
"660f1234-e29b-41d4-a716-446655440001"
|
||||
],
|
||||
"syncOptions": {
|
||||
"canRemoveCertificates": true,
|
||||
"preserveSecretOnRenewal": true,
|
||||
"canImportCertificates": false,
|
||||
"includeRootCa": false,
|
||||
"certificateNameSchema": "myapp-{{certificateId}}",
|
||||
"fieldMappings": {
|
||||
"certificate": "ssl_cert",
|
||||
"privateKey": "ssl_key",
|
||||
"certificateChain": "ssl_chain",
|
||||
"caCertificate": "ssl_ca"
|
||||
}
|
||||
},
|
||||
"destinationConfig": {
|
||||
"dataBagName": "ssl_certificates"
|
||||
}
|
||||
}'
|
||||
```
|
||||
|
||||
### Example with Default Field Mappings
|
||||
|
||||
```bash Request
|
||||
curl --request POST \
|
||||
--url https://app.infisical.com/api/v1/pki/syncs/chef \
|
||||
--header 'Authorization: Bearer <access-token>' \
|
||||
--header 'Content-Type: application/json' \
|
||||
--data '{
|
||||
"name": "my-chef-cert-sync-default",
|
||||
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"description": "Chef sync with default field mappings",
|
||||
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"destination": "chef",
|
||||
"isAutoSyncEnabled": true,
|
||||
"syncOptions": {
|
||||
"canRemoveCertificates": true,
|
||||
"preserveSecretOnRenewal": true,
|
||||
"canImportCertificates": false,
|
||||
"includeRootCa": false,
|
||||
"certificateNameSchema": "{{commonName}}-{{certificateId}}",
|
||||
"fieldMappings": {
|
||||
"certificate": "certificate",
|
||||
"privateKey": "private_key",
|
||||
"certificateChain": "certificate_chain",
|
||||
"caCertificate": "ca_certificate"
|
||||
}
|
||||
},
|
||||
"destinationConfig": {
|
||||
"dataBagName": "certificates"
|
||||
}
|
||||
}'
|
||||
```
|
||||
|
||||
### Sample response
|
||||
|
||||
```json Response
|
||||
{
|
||||
"pkiSync": {
|
||||
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"name": "my-chef-cert-sync",
|
||||
"description": "an example certificate sync",
|
||||
"destination": "chef",
|
||||
"isAutoSyncEnabled": true,
|
||||
"destinationConfig": {
|
||||
"dataBagName": "ssl_certificates"
|
||||
},
|
||||
"syncOptions": {
|
||||
"canRemoveCertificates": true,
|
||||
"preserveSecretOnRenewal": true,
|
||||
"canImportCertificates": false,
|
||||
"includeRootCa": false,
|
||||
"certificateNameSchema": "myapp-{{certificateId}}",
|
||||
"fieldMappings": {
|
||||
"certificate": "ssl_cert",
|
||||
"privateKey": "ssl_key",
|
||||
"certificateChain": "ssl_chain",
|
||||
"caCertificate": "ssl_ca"
|
||||
}
|
||||
},
|
||||
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"createdAt": "2023-01-01T00:00:00.000Z",
|
||||
"updatedAt": "2023-01-01T00:00:00.000Z"
|
||||
}
|
||||
}
|
||||
```
|
||||
</Tab>
|
||||
|
||||
</Tabs>
|
||||
|
||||
## Certificate Management
|
||||
|
||||
Your Chef Certificate Sync will:
|
||||
|
||||
- **Automatic Deployment**: Deploy certificates in Infisical to Chef data bags with customizable field names
|
||||
- **Certificate Updates**: Update certificates in Chef data bags when renewals occur
|
||||
- **Expiration Handling**: Optionally remove expired certificates from Chef data bags (if enabled)
|
||||
- **Format Preservation**: Maintain certificate format during sync operations
|
||||
- **Field Customization**: Map certificate data to custom field names that match your Chef cookbook requirements
|
||||
- **CA Certificate Support**: Include CA certificates in data bag items for complete certificate chain management
|
||||
|
||||
<Note>
|
||||
Chef Certificate Syncs support both automatic and manual
|
||||
synchronization modes. When auto-sync is enabled, certificates are
|
||||
automatically deployed as they are issued or renewed.
|
||||
</Note>
|
||||
|
||||
## Manual Certificate Sync
|
||||
|
||||
You can manually trigger certificate synchronization to Chef using the sync certificates functionality. This is useful for:
|
||||
|
||||
- Initial setup when you have existing certificates to deploy
|
||||
- One-time sync of specific certificates
|
||||
- Testing certificate sync configurations
|
||||
- Force sync after making changes
|
||||
|
||||
To manually sync certificates, use the [Sync Certificates](/api-reference/endpoints/pki/syncs/chef/sync-certificates) API endpoint or the manual sync option in the Infisical UI.
|
||||
|
||||
<Note>
|
||||
Chef does not support importing certificates back into Infisical
|
||||
due to the nature of Chef data bags where certificates are stored as data
|
||||
rather than managed certificate objects.
|
||||
</Note>
|
||||
@@ -83,6 +83,7 @@ should be synced. Follow these steps to start syncing:
|
||||
- <strong>Certificates:</strong> The certificates you wish to push to the destination.
|
||||
- <strong>Options:</strong> Customize how certificates should be synced, including:
|
||||
- Whether certificates should be removed from the destination when they expire.
|
||||
- Whether to include the Root CA certificate in the certificate chain.
|
||||
- Certificate naming schema to control how certificate names are generated in
|
||||
the destination.
|
||||
|
||||
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 420 KiB After Width: | Height: | Size: 378 KiB |
BIN
Binary file not shown.
|
After Width: | Height: | Size: 318 KiB |
BIN
Binary file not shown.
|
After Width: | Height: | Size: 303 KiB |
BIN
Binary file not shown.
|
After Width: | Height: | Size: 309 KiB |
BIN
Binary file not shown.
|
After Width: | Height: | Size: 362 KiB |
BIN
Binary file not shown.
|
After Width: | Height: | Size: 381 KiB |
BIN
Binary file not shown.
|
After Width: | Height: | Size: 331 KiB |
BIN
Binary file not shown.
|
After Width: | Height: | Size: 272 KiB |
BIN
Binary file not shown.
|
After Width: | Height: | Size: 271 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 432 KiB After Width: | Height: | Size: 375 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 311 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 287 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 296 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 345 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 370 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 311 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 255 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 269 KiB |
@@ -43,6 +43,9 @@ description: "Learn how to configure a Vercel Sync for Infisical."
|
||||
- **Overwrite Destination Secrets**: Removes any secrets at the destination endpoint not present in Infisical.
|
||||
- **Import Secrets (Prioritize Infisical)**: Imports secrets from the destination endpoint before syncing, prioritizing values from Infisical over Vercel when keys conflict.
|
||||
- **Import Secrets (Prioritize Vercel)**: Imports secrets from the destination endpoint before syncing, prioritizing values from Vercel over Infisical when keys conflict.
|
||||
<Note>
|
||||
Vercel does not expose the values of [sensitive environment variables](https://vercel.com/docs/environment-variables/sensitive-environment-variables), so Infisical cannot import them during the initial sync. As a result, these secrets are created in Infisical with empty values. After the first sync, you'll need to manually re-enter their values in Infisical to ensure both platforms stay aligned.
|
||||
</Note>
|
||||
- **Key Schema**: Template that determines how secret names are transformed when syncing, using `{{secretKey}}` as a placeholder for the original secret name and `{{environment}}` for the environment.
|
||||
<Note>
|
||||
We highly recommend using a Key Schema to ensure that Infisical only manages the specific keys you intend, keeping everything else untouched.
|
||||
@@ -149,4 +152,5 @@ description: "Learn how to configure a Vercel Sync for Infisical."
|
||||
}
|
||||
```
|
||||
</Tab>
|
||||
|
||||
</Tabs>
|
||||
|
||||
@@ -118,6 +118,22 @@ var _ = await sdk.Auth().UniversalAuth().LoginAsync(
|
||||
- `clientId` (string): The client ID of your Machine Identity.
|
||||
- `clientSecret` (string): The client secret of your Machine Identity.
|
||||
|
||||
### LDAP Auth
|
||||
|
||||
#### Authenticating
|
||||
```cs
|
||||
var _ = await sdk.Auth().LdapAuth().LoginAsync(
|
||||
"IDENTITY_ID",
|
||||
"USERNAME",
|
||||
"PASSWORD"
|
||||
);
|
||||
```
|
||||
|
||||
**Parameters:**
|
||||
- `identityId` (string): The ID of your Machine Identity .
|
||||
- `username` (string): The LDAP username for authentication.
|
||||
- `password` (string): The LDAP password for authentication.
|
||||
|
||||
### `Secrets()`
|
||||
|
||||
The `Secrets()` sub-class handles operations related to the Infisical secrets management product.
|
||||
|
||||
@@ -284,6 +284,114 @@ if err != nil {
|
||||
}
|
||||
```
|
||||
|
||||
#### JWT Auth
|
||||
|
||||
<Info>
|
||||
Please note that this authentication method requires a valid JWT token from your JWT issuer. Please [read
|
||||
more](/documentation/platform/identities/jwt-auth) about this authentication
|
||||
method.
|
||||
</Info>
|
||||
|
||||
**Using the SDK**
|
||||
|
||||
```go
|
||||
credential, err := client.Auth().JwtAuthLogin("MACHINE_IDENTITY_ID", "JWT_TOKEN")
|
||||
|
||||
if err != nil {
|
||||
fmt.Println(err)
|
||||
os.Exit(1)
|
||||
}
|
||||
```
|
||||
|
||||
#### LDAP Auth
|
||||
|
||||
<Info>
|
||||
Please note that this authentication method requires LDAP credentials. Please [read
|
||||
more](/documentation/platform/identities/ldap-auth/general) about this authentication
|
||||
method.
|
||||
</Info>
|
||||
|
||||
**Using environment variables**
|
||||
|
||||
You can set the `INFISICAL_LDAP_AUTH_IDENTITY_ID` environment variable and pass empty string for the identity ID:
|
||||
|
||||
```go
|
||||
credential, err := client.Auth().LdapAuthLogin("", "LDAP_USERNAME", "LDAP_PASSWORD")
|
||||
|
||||
if err != nil {
|
||||
fmt.Println(err)
|
||||
os.Exit(1)
|
||||
}
|
||||
```
|
||||
|
||||
**Using the SDK directly**
|
||||
|
||||
```go
|
||||
credential, err := client.Auth().LdapAuthLogin("MACHINE_IDENTITY_ID", "LDAP_USERNAME", "LDAP_PASSWORD")
|
||||
|
||||
if err != nil {
|
||||
fmt.Println(err)
|
||||
os.Exit(1)
|
||||
}
|
||||
```
|
||||
|
||||
#### OCI Auth
|
||||
|
||||
<Info>
|
||||
Please note that this authentication method will only work if you're running
|
||||
your application on Oracle Cloud Infrastructure. Please [read
|
||||
more](/documentation/platform/identities/oci-auth) about this authentication
|
||||
method.
|
||||
</Info>
|
||||
|
||||
**Using environment variables**
|
||||
|
||||
You can set the `INFISICAL_OCI_AUTH_IDENTITY_ID` environment variable and omit the `IdentityID` field:
|
||||
|
||||
```go
|
||||
credential, err := client.Auth().OciAuthLogin(infisical.OciAuthLoginOptions{
|
||||
UserID: "USER_OCID",
|
||||
TenancyID: "TENANCY_OCID",
|
||||
Fingerprint: "FINGERPRINT",
|
||||
PrivateKey: "PRIVATE_KEY",
|
||||
Region: "REGION",
|
||||
})
|
||||
|
||||
if err != nil {
|
||||
fmt.Println(err)
|
||||
os.Exit(1)
|
||||
}
|
||||
```
|
||||
|
||||
**Using the SDK directly**
|
||||
|
||||
```go
|
||||
credential, err := client.Auth().OciAuthLogin(infisical.OciAuthLoginOptions{
|
||||
IdentityID: "MACHINE_IDENTITY_ID",
|
||||
UserID: "USER_OCID",
|
||||
TenancyID: "TENANCY_OCID",
|
||||
Fingerprint: "FINGERPRINT",
|
||||
PrivateKey: "PRIVATE_KEY",
|
||||
Region: "REGION",
|
||||
Passphrase: nil, // Optional: pointer to string if your private key has a passphrase
|
||||
})
|
||||
|
||||
if err != nil {
|
||||
fmt.Println(err)
|
||||
os.Exit(1)
|
||||
}
|
||||
```
|
||||
|
||||
**OciAuthLoginOptions fields:**
|
||||
|
||||
- `IdentityID` (string) - Your Infisical Machine Identity ID. Can be set via `INFISICAL_OCI_AUTH_IDENTITY_ID` environment variable.
|
||||
- `UserID` (string) - Your OCI user OCID.
|
||||
- `TenancyID` (string) - Your OCI tenancy OCID.
|
||||
- `Fingerprint` (string) - Your OCI API key fingerprint.
|
||||
- `PrivateKey` (string) - Your OCI private key (PEM format).
|
||||
- `Region` (string) - Your OCI region (e.g., `us-ashburn-1`).
|
||||
- `Passphrase` (*string) - Optional: pointer to passphrase string if your private key is encrypted.
|
||||
|
||||
## Secrets
|
||||
|
||||
### List Secrets
|
||||
|
||||
@@ -14,14 +14,13 @@ This guide walks through how you can use these paid features on a self-hosted in
|
||||
Once purchased, you will be issued a license key.
|
||||
</Step>
|
||||
<Step title="Activate the license">
|
||||
Depending on whether or not the environment where Infisical is deployed has internet access, you may be issued a regular license or an offline license.
|
||||
Set your license key as the value of the **LICENSE_KEY** environment variable within your Infisical instance.
|
||||
|
||||
|
||||
<Tabs>
|
||||
<Tab title="Regular License">
|
||||
- Assign the issued license key to the `LICENSE_KEY` environment variable in your Infisical instance.
|
||||
|
||||
- Your Infisical instance will need to communicate with the Infisical license server to validate the license key.
|
||||
- Your Infisical instance will need to communicate with the Infisical license server to validate the license key.
|
||||
If you want to limit outgoing connections only to the Infisical license server, you can use the following IP addresses: `13.248.249.247` and `35.71.190.59`
|
||||
|
||||
<Note>
|
||||
@@ -29,16 +28,18 @@ This guide walks through how you can use these paid features on a self-hosted in
|
||||
</Note>
|
||||
</Tab>
|
||||
<Tab title="Offline License">
|
||||
- Assign the issued license key to the `LICENSE_KEY_OFFLINE` environment variable in your Infisical instance.
|
||||
- Assign the issued offline license key to the `LICENSE_KEY` environment variable in your Infisical instance.
|
||||
|
||||
- The system will automatically detect that it's an offline license based on the key format.
|
||||
|
||||
<Note>
|
||||
How you set the environment variable will depend on the deployment method you used. Please refer to the documentation of your deployment method for specific instructions.
|
||||
While the LICENSE_KEY_OFFLINE environment variable continues to be supported for compatibility with existing configurations, we recommend transitioning to LICENSE_KEY for all license types going forward.
|
||||
</Note>
|
||||
</Tab>
|
||||
</Tabs>
|
||||
|
||||
Once your instance starts up, the license key will be validated and you’ll be able to use the paid features.
|
||||
Once your instance starts up, the license key will be validated and you'll be able to use the paid features.
|
||||
However, when the license expires, Infisical will continue to run, but EE features will be disabled until the license is renewed or a new one is purchased.
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
</Steps>
|
||||
|
||||
Reference in New Issue
Block a user