mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-10-08 00:27:35 +00:00
Merge remote-tracking branch 'origin/main' into feat/gitlabSecretSync
This commit is contained in:
carlosmonastyrski
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Available"
|
||||
openapi: "GET /api/v1/app-connections/cloudflare/available"
|
||||
---
|
||||
@@ -0,0 +1,10 @@
|
||||
---
|
||||
title: "Create"
|
||||
openapi: "POST /api/v1/app-connections/cloudflare"
|
||||
---
|
||||
|
||||
<Note>
|
||||
Check out the configuration docs for [Cloudflare
|
||||
Connections](/integrations/app-connections/cloudflare) to learn how to obtain
|
||||
the required credentials.
|
||||
</Note>
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Delete"
|
||||
openapi: "DELETE /api/v1/app-connections/cloudflare/{connectionId}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Get by ID"
|
||||
openapi: "GET /api/v1/app-connections/cloudflare/{connectionId}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Get by Name"
|
||||
openapi: "GET /api/v1/app-connections/cloudflare/connection-name/{connectionName}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "List"
|
||||
openapi: "GET /api/v1/app-connections/cloudflare"
|
||||
---
|
||||
@@ -0,0 +1,10 @@
|
||||
---
|
||||
title: "Update"
|
||||
openapi: "PATCH /api/v1/app-connections/cloudflare/{connectionId}"
|
||||
---
|
||||
|
||||
<Note>
|
||||
Check out the configuration docs for [Cloudflare
|
||||
Connections](/integrations/app-connections/cloudflare) to learn how to obtain
|
||||
the required credentials.
|
||||
</Note>
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Create"
|
||||
openapi: "POST /api/v1/secret-syncs/cloudflare-pages"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Delete"
|
||||
openapi: "DELETE /api/v1/secret-syncs/cloudflare-pages/{syncId}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Get by ID"
|
||||
openapi: "GET /api/v1/secret-syncs/cloudflare-pages/{syncId}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Get by Name"
|
||||
openapi: "GET /api/v1/secret-syncs/cloudflare-pages/sync-name/{syncName}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "List"
|
||||
openapi: "GET /api/v1/secret-syncs/cloudflare-pages"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Remove Secrets"
|
||||
openapi: "POST /api/v1/secret-syncs/cloudflare-pages/{syncId}/remove-secrets"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Sync Secrets"
|
||||
openapi: "POST /api/v1/secret-syncs/cloudflare-pages/{syncId}/sync-secrets"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Update"
|
||||
openapi: "PATCH /api/v1/secret-syncs/cloudflare-pages/{syncId}"
|
||||
---
|
||||
@@ -75,8 +75,90 @@ This flag is required.
|
||||
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="--ignore-if-bootstrapped">
|
||||
Whether to continue without error if the instance has already been bootstrapped. Useful for idempotent automation scripts.
|
||||
|
||||
```bash
|
||||
# Example
|
||||
infisical bootstrap --ignore-if-bootstrapped
|
||||
```
|
||||
|
||||
This flag is optional and defaults to `false`.
|
||||
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="--output">
|
||||
The type of output format for the bootstrap command. Supports `k8-secret` for Kubernetes secret integration. This flag is optional and defaults to "".
|
||||
|
||||
```bash
|
||||
# Kubernetes secret output
|
||||
infisical bootstrap --output=k8-secret --k8-secret-template='{"data":{"token":"{{.Identity.Credentials.Token}}"}}' --k8-secret-name=infisical-bootstrap --k8-secret-namespace=default
|
||||
```
|
||||
|
||||
When using `k8-secret`, the command will create or update a Kubernetes secret directly in your cluster. Note that this option requires the command to be executed from within a Kubernetes pod with appropriate service account permissions.
|
||||
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="--k8-secret-template">
|
||||
The template to use for rendering the Kubernetes secret data/stringData section. Required when using `--output=k8-secret`. The template uses Go template syntax and has access to the bootstrap response data.
|
||||
|
||||
```bash
|
||||
# Example template that stores the token
|
||||
infisical bootstrap --k8-secret-template='{"data":{"token":"{{.Identity.Credentials.Token}}"}}'
|
||||
|
||||
# Example template with multiple fields
|
||||
infisical bootstrap --k8-secret-template='{"stringData":{"token":"{{.Identity.Credentials.Token}}","org-id":"{{.Organization.ID}}","user-email":"{{.User.Email}}"}}'
|
||||
```
|
||||
|
||||
Available template functions:
|
||||
|
||||
- `encodeBase64`: Base64 encode a string
|
||||
|
||||
Available data fields:
|
||||
|
||||
- `.Identity.Credentials.Token`: The machine identity token
|
||||
- `.Identity.ID`: The identity ID
|
||||
- `.Identity.Name`: The identity name
|
||||
- `.Organization.ID`: The organization ID
|
||||
- `.Organization.Name`: The organization name
|
||||
- `.Organization.Slug`: The organization slug
|
||||
- `.User.Email`: The admin user email
|
||||
- `.User.ID`: The admin user ID
|
||||
- `.User.FirstName`: The admin user first name
|
||||
- `.User.LastName`: The admin user last name
|
||||
|
||||
This flag is required when using `k8-secret` output.
|
||||
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="--k8-secret-name">
|
||||
The name of the Kubernetes secret to create or update. Required when using `--output=k8-secret`.
|
||||
|
||||
```bash
|
||||
# Example
|
||||
infisical bootstrap --k8-secret-name=infisical-bootstrap-credentials
|
||||
```
|
||||
|
||||
This flag is required when using `k8-secret` output.
|
||||
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="--k8-secret-namespace">
|
||||
The namespace where the Kubernetes secret should be created or updated. Required when using `--output=k8-secret`.
|
||||
|
||||
```bash
|
||||
# Example
|
||||
infisical bootstrap --k8-secret-namespace=infisical-system
|
||||
```
|
||||
|
||||
This flag is required when using `k8-secret` output.
|
||||
|
||||
</Accordion>
|
||||
|
||||
## Response
|
||||
|
||||
### JSON Output (Default)
|
||||
|
||||
The command returns a JSON response with details about the created user, organization, and machine identity:
|
||||
|
||||
```json
|
||||
@@ -105,6 +187,47 @@ The command returns a JSON response with details about the created user, organiz
|
||||
}
|
||||
```
|
||||
|
||||
### Kubernetes Secret Output
|
||||
|
||||
When using `--output=k8-secret`, the command creates or updates a Kubernetes secret in your cluster and logs the operation result. This is particularly useful for automated bootstrapping scenarios such as Kubernetes Jobs, GitOps workflows, or when you need to immediately store the admin credentials for use by other applications in your cluster.
|
||||
|
||||
## Kubernetes Integration
|
||||
|
||||
### Prerequisites for k8-secret Output
|
||||
|
||||
When running with `--output=k8-secret`, the command must be executed from within a Kubernetes pod with proper service account permissions. The command automatically:
|
||||
|
||||
1. Reads the service account token from `/var/run/secrets/kubernetes.io/serviceaccount/token`
|
||||
2. Reads the CA certificate from `/var/run/secrets/kubernetes.io/serviceaccount/ca.crt`
|
||||
3. Gets the Kubernetes API server URL from environment variables (`KUBERNETES_SERVICE_HOST` and `KUBERNETES_SERVICE_PORT_HTTPS`)
|
||||
|
||||
### Required RBAC Permissions
|
||||
|
||||
Your service account needs the following permissions:
|
||||
|
||||
```yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: infisical-bootstrap
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
verbs: ["get", "create", "update"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: infisical-bootstrap
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: your-service-account
|
||||
roleRef:
|
||||
kind: Role
|
||||
name: infisical-bootstrap
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
```
|
||||
|
||||
## Usage with Automation
|
||||
|
||||
For automation purposes, you can extract just the machine identity token from the response:
|
||||
@@ -127,6 +250,8 @@ echo "Token has been captured and can be used for authentication"
|
||||
## Notes
|
||||
|
||||
- The bootstrap process can only be performed once on a fresh Infisical instance
|
||||
- All flags are required for the bootstrap process to complete successfully
|
||||
- All core flags (domain, email, password, organization) are required for the bootstrap process to complete successfully
|
||||
- Security controls prevent privilege escalation: instance admin identities cannot be managed by non-instance admin users and identities
|
||||
- The generated admin user account can be used to log in via the UI if needed
|
||||
- When using `k8-secret` output, the command must run within a Kubernetes pod with proper service account permissions
|
||||
- The `--ignore-if-bootstrapped` flag is useful for making bootstrap scripts idempotent
|
||||
|
||||
+2284
File diff suppressed because it is too large
Load Diff
@@ -127,8 +127,8 @@ Follow the instructions for your operating system to install the Infisical CLI.
|
||||
|
||||
</Tab>
|
||||
<Tab title="Debian/Ubuntu">
|
||||
Add Infisical repository
|
||||
|
||||
Add Infisical repository
|
||||
|
||||
```console
|
||||
$ curl -1sLf \
|
||||
'https://dl.cloudsmith.io/public/infisical/infisical-cli/setup.deb.sh' \
|
||||
@@ -143,7 +143,7 @@ Follow the instructions for your operating system to install the Infisical CLI.
|
||||
</Tab>
|
||||
<Tab title="Arch Linux">
|
||||
Use the `yay` package manager to install from the [Arch User Repository](https://aur.archlinux.org/packages/infisical-bin)
|
||||
|
||||
|
||||
```console
|
||||
$ yay -S infisical-bin
|
||||
```
|
||||
@@ -187,7 +187,7 @@ We'll now use the Infisical-Vercel integration send secrets from Infisical to Ve
|
||||
|
||||
### Infisical-Vercel integration
|
||||
|
||||
To begin we have to import the Next.js app into Vercel as a project. [Follow these instructions](https://nextjs.org/learn/basics/deploying-nextjs-app/deploy) to deploy the Next.js app to Vercel.
|
||||
To begin we have to import the Next.js app into Vercel as a project. [Follow these instructions](https://vercel.com/docs/frameworks/nextjs) to deploy the Next.js app to Vercel.
|
||||
|
||||
Next, navigate to your project's integrations tab in Infisical and press on the Vercel tile to grant Infisical access to your Vercel account.
|
||||
|
||||
@@ -237,7 +237,7 @@ At this stage, you know how to use the Infisical-Vercel integration to sync prod
|
||||
</Accordion>
|
||||
<Accordion title="Is opting out of end-to-end encryption for the Infisical-Vercel integration safe?">
|
||||
Yes. Your secrets are still encrypted at rest. To note, most secret managers actually don't support end-to-end encryption.
|
||||
|
||||
|
||||
Check out the [security guide](/security/overview).
|
||||
</Accordion>
|
||||
</AccordionGroup>
|
||||
|
||||
@@ -161,6 +161,11 @@ Replace **\<account id\>** with your AWS account id and **\<aws-scope-path\>** w
|
||||
{{replace identity.name 'user' 'replace'}} // testreplace
|
||||
```
|
||||
</ParamField>
|
||||
|
||||
<ParamField path="Tags" type="map<string, string>[]">
|
||||
Tags to be added to the created IAM User resource.
|
||||
</ParamField>
|
||||
|
||||
<ParamField path="Method" type="string" required>
|
||||
Select *Assume Role* method.
|
||||
</ParamField>
|
||||
@@ -304,6 +309,10 @@ Replace **\<account id\>** with your AWS account id and **\<aws-scope-path\>** w
|
||||
- `{{unixTimestamp}}`: Current Unix timestamp
|
||||
</ParamField>
|
||||
|
||||
<ParamField path="Tags" type="map[string]string">
|
||||
Tags to be added to the created IAM User resource.
|
||||
</ParamField>
|
||||
|
||||
</Step>
|
||||
|
||||
<Step title="Click 'Submit'">
|
||||
|
||||
@@ -0,0 +1,112 @@
|
||||
---
|
||||
title: "GitHub"
|
||||
description: "Learn how to dynamically generate GitHub App tokens."
|
||||
---
|
||||
|
||||
The Infisical GitHub dynamic secret allows you to generate short-lived tokens for a GitHub App on demand based on service account permissions.
|
||||
|
||||
## Setup GitHub App
|
||||
|
||||
<Steps>
|
||||
<Step title="Create an application on GitHub">
|
||||
Navigate to [GitHub App settings](https://github.com/settings/apps) and click **New GitHub App**.
|
||||
|
||||
|
||||
|
||||
Give the application a name and a homepage URL. These values do not need to be anything specific.
|
||||
|
||||
Disable webhook by unchecking the Active checkbox.
|
||||
|
||||
|
||||
Configure the app's permissions to grant the necessary access for the dynamic secret's short-lived tokens based on your use case.
|
||||
|
||||
Create the GitHub Application.
|
||||
|
||||
|
||||
<Note>
|
||||
If you have a GitHub organization, you can create an application under it
|
||||
in your organization Settings > Developer settings > GitHub Apps > New GitHub App.
|
||||
</Note>
|
||||
</Step>
|
||||
<Step title="Save app credentials">
|
||||
Copy the **App ID** and generate a new **Private Key** for your GitHub Application.
|
||||
|
||||
|
||||
Save these for later steps.
|
||||
</Step>
|
||||
<Step title="Install app">
|
||||
Install your application to whichever repositories and organizations that you want the dynamic secret to access.
|
||||
|
||||
|
||||
|
||||
|
||||
Once you've installed the app, **copy the installation ID** from the URL and save it for later steps.
|
||||
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
## Set up Dynamic Secrets with GitHub
|
||||
|
||||
<Steps>
|
||||
<Step title="Open Secret Overview Dashboard">
|
||||
Open the Secret Overview dashboard and select the environment in which you would like to add a dynamic secret.
|
||||
</Step>
|
||||
<Step title="Click on the 'Add Dynamic Secret' button">
|
||||
|
||||
</Step>
|
||||
<Step title="Select 'GitHub'">
|
||||
|
||||
</Step>
|
||||
<Step title="Provide the inputs for dynamic secret parameters">
|
||||
<ParamField path="Secret Name" type="string" required>
|
||||
Name by which you want the secret to be referenced
|
||||
</ParamField>
|
||||
<ParamField path="App ID" type="string" required>
|
||||
The ID of the app created in earlier steps.
|
||||
</ParamField>
|
||||
<ParamField path="App Private Key PEM" type="string" required>
|
||||
The Private Key of the app created in earlier steps.
|
||||
</ParamField>
|
||||
<ParamField path="Installation ID" type="string" required>
|
||||
The ID of the installation from earlier steps.
|
||||
</ParamField>
|
||||
</Step>
|
||||
<Step title="Click `Submit`">
|
||||
After submitting the form, you will see a dynamic secret created in the dashboard.
|
||||
</Step>
|
||||
|
||||
<Step title="Generate dynamic secrets">
|
||||
Once you've successfully configured the dynamic secret, you're ready to generate on-demand credentials.
|
||||
To do this, simply click on the 'Generate' button which appears when hovering over the dynamic secret item.
|
||||
Alternatively, you can initiate the creation of a new lease by selecting 'New Lease' from the dynamic secret lease list section.
|
||||
|
||||
|
||||
|
||||
|
||||
When generating these secrets, the TTL will be fixed to 1 hour.
|
||||
|
||||
|
||||
|
||||
Once you click the `Submit` button, a new secret lease will be generated and the credentials from it will be shown to you.
|
||||
|
||||
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
## Audit or Revoke Leases
|
||||
|
||||
Once you have created one or more leases, you will be able to access them by clicking on the respective dynamic secret item on the dashboard.
|
||||
|
||||
This will allow you to see the expiration time of the lease or delete a lease before its set time to live.
|
||||
|
||||
|
||||
|
||||
<Warning>
|
||||
GitHub App tokens cannot be revoked. As such, revoking a token on Infisical does not invalidate the GitHub token; it remains active until it expires.
|
||||
</Warning>
|
||||
|
||||
## Renew Leases
|
||||
|
||||
<Note>
|
||||
GitHub App tokens cannot be renewed because they are fixed to a lifetime of 1 hour.
|
||||
</Note>
|
||||
@@ -49,11 +49,21 @@ In the following steps, we explore how to install the Infisical PKI Issuer using
|
||||
```
|
||||
</Step>
|
||||
<Step title="Install the Issuer Controller">
|
||||
Install the Infisical PKI Issuer controller into your Kubernetes cluster by running the following command:
|
||||
Install the Infisical PKI Issuer controller into your Kubernetes cluster using one of the following methods:
|
||||
|
||||
```bash
|
||||
kubectl apply -f https://raw.githubusercontent.com/Infisical/infisical-issuer/main/build/install.yaml
|
||||
```
|
||||
<Tabs>
|
||||
<Tab title="Helm">
|
||||
```bash
|
||||
helm repo add infisical-helm-charts 'https://dl.cloudsmith.io/public/infisical/helm-charts/helm/charts/'
|
||||
helm install infisical-pki-issuer infisical-helm-charts/infisical-pki-issuer
|
||||
```
|
||||
</Tab>
|
||||
<Tab title="kubectl">
|
||||
```bash
|
||||
kubectl apply -f https://raw.githubusercontent.com/Infisical/infisical-issuer/main/build/install.yaml
|
||||
```
|
||||
</Tab>
|
||||
</Tabs>
|
||||
</Step>
|
||||
<Step title="Create Kubernetes Secret for Infisical PKI Issuer">
|
||||
Start by creating a Kubernetes `Secret` containing the **Client Secret** from step 1. As mentioned previously, this will be used by the Infisical PKI issuer to authenticate with Infisical.
|
||||
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 429 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 976 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 607 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 735 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 300 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 270 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 396 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 337 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 610 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 147 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 205 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 518 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 47 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 145 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 998 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 608 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 604 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 657 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 632 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 591 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 689 KiB |
@@ -0,0 +1,94 @@
|
||||
---
|
||||
title: "Cloudflare Connection"
|
||||
description: "Learn how to configure a Cloudflare Connection for Infisical."
|
||||
---
|
||||
|
||||
Infisical supports connecting to Cloudflare using API tokens and Account ID for secure access to your Cloudflare services.
|
||||
|
||||
## Configure API Token and Account ID for Infisical
|
||||
|
||||
<Steps>
|
||||
<Step title="Create API Token">
|
||||
Navigate to your Cloudflare dashboard and go to **Profile**.
|
||||
|
||||
|
||||
|
||||
Click **API Tokens > Create Token** to generate a new API token.
|
||||
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Configure Token Permissions">
|
||||
Configure your API token with the necessary permissions for your Cloudflare services.
|
||||
|
||||
Depending on your use case, add one or more of the following permission sets to your API token:
|
||||
|
||||
<Tabs>
|
||||
<Tab title="Secret Sync">
|
||||
<AccordionGroup>
|
||||
<Accordion title="Cloudflare Pages">
|
||||
Use the following permissions to grant Infisical access to sync secrets to Cloudflare Pages:
|
||||
|
||||
|
||||
|
||||
**Required Permissions:**
|
||||
- **Account** - **Cloudflare Pages** - **Edit**
|
||||
- **Account** - **Account Settings** - **Read**
|
||||
|
||||
Add these permissions to your API token and click **Continue to summary**, then **Create Token** to generate your API token.
|
||||
</Accordion>
|
||||
</AccordionGroup>
|
||||
</Tab>
|
||||
</Tabs>
|
||||
|
||||
</Step>
|
||||
<Step title="Save Your API Token">
|
||||
After creation, copy and securely store your API token as it will not be shown again.
|
||||
|
||||
|
||||
|
||||
<Warning>
|
||||
Keep your API token secure and do not share it. Anyone with access to this token can manage your Cloudflare resources based on the permissions granted.
|
||||
</Warning>
|
||||
|
||||
</Step>
|
||||
<Step title="Get Account ID">
|
||||
From your Cloudflare Account Home page, click on the account information dropdown and select **Copy account ID**.
|
||||
|
||||
|
||||
|
||||
Save your Account ID for use in the next step.
|
||||
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
## Setup Cloudflare Connection in Infisical
|
||||
|
||||
<Steps>
|
||||
<Step title="Navigate to App Connections">
|
||||
Navigate to the **App Connections** tab on the **Organization Settings**
|
||||
page. 
|
||||
</Step>
|
||||
<Step title="Add Connection">
|
||||
Select the **Cloudflare Connection** option from the connection options
|
||||
modal. 
|
||||
</Step>
|
||||
<Step title="Input Credentials">
|
||||
Enter your Cloudflare API token and Account ID in the provided fields and
|
||||
click **Connect to Cloudflare** to establish the connection. 
|
||||
</Step>
|
||||
<Step title="Connection Created">
|
||||
Your **Cloudflare Connection** is now available for use in your Infisical
|
||||
projects. 
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
<Info>
|
||||
API token connections require manual token rotation when your Cloudflare API
|
||||
token expires or is regenerated. Monitor your connection status and update the
|
||||
token as needed.
|
||||
</Info>
|
||||
@@ -53,7 +53,22 @@ Infisical supports two methods for connecting to GitHub.
|
||||
Obtain the necessary Github application credentials. This would be the application slug, client ID, app ID, client secret, and private key.
|
||||
|
||||
|
||||
Back in your Infisical instance, add the five new environment variables for the credentials of your GitHub application:
|
||||
Back in your Infisical instance, you can configure the GitHub App credentials in one of two ways:
|
||||
|
||||
**Option 1: Server Admin Panel (Recommended)**
|
||||
|
||||
Navigate to the server admin panel > **Integrations** > **GitHub App** and enter the GitHub application credentials:
|
||||
|
||||
|
||||
- **Client ID**: The Client ID of your GitHub application
|
||||
- **Client Secret**: The Client Secret of your GitHub application
|
||||
- **App Slug**: The Slug of your GitHub application (found in the URL)
|
||||
- **App ID**: The App ID of your GitHub application
|
||||
- **Private Key**: The Private Key of your GitHub application
|
||||
|
||||
**Option 2: Environment Variables**
|
||||
|
||||
Alternatively, you can add the new environment variables for the credentials of your GitHub application:
|
||||
|
||||
- `INF_APP_CONNECTION_GITHUB_APP_CLIENT_ID`: The **Client ID** of your GitHub application.
|
||||
- `INF_APP_CONNECTION_GITHUB_APP_CLIENT_SECRET`: The **Client Secret** of your GitHub application.
|
||||
@@ -61,7 +76,7 @@ Infisical supports two methods for connecting to GitHub.
|
||||
- `INF_APP_CONNECTION_GITHUB_APP_ID`: The **App ID** of your GitHub application.
|
||||
- `INF_APP_CONNECTION_GITHUB_APP_PRIVATE_KEY`: The **Private Key** of your GitHub application.
|
||||
|
||||
Once added, restart your Infisical instance and use the GitHub integration via app authentication.
|
||||
Once configured, you can use the GitHub integration via app authentication. If you configured the credentials using environment variables, restart your Infisical instance for the changes to take effect. If you configured them through the server admin panel, allow approximately 5 minutes for the changes to propagate.
|
||||
</Step>
|
||||
</Steps>
|
||||
</Accordion>
|
||||
@@ -158,4 +173,5 @@ Infisical supports two methods for connecting to GitHub.
|
||||
</Step>
|
||||
</Steps>
|
||||
</Tab>
|
||||
|
||||
</Tabs>
|
||||
|
||||
@@ -0,0 +1,133 @@
|
||||
---
|
||||
title: "Cloudflare Pages Sync"
|
||||
description: "Learn how to configure a Cloudflare Pages Sync for Infisical."
|
||||
---
|
||||
|
||||
**Prerequisites:**
|
||||
|
||||
- Set up and add secrets to [Infisical Cloud](https://app.infisical.com)
|
||||
- Create a [Cloudflare Connection](/integrations/app-connections/cloudflare)
|
||||
|
||||
<Tabs>
|
||||
<Tab title="Infisical UI">
|
||||
1. Navigate to **Project** > **Integrations** and select the **Secret Syncs** tab. Click on the **Add Sync** button.
|
||||
|
||||
|
||||
2. Select the **Cloudflare Pages** option.
|
||||
|
||||
|
||||
3. Configure the **Source** from where secrets should be retrieved, then click **Next**.
|
||||
|
||||
|
||||
- **Environment**: The project environment to retrieve secrets from.
|
||||
- **Secret Path**: The folder path to retrieve secrets from.
|
||||
|
||||
<Tip>
|
||||
If you need to sync secrets from multiple folder locations, check out [secret imports](/documentation/platform/secret-reference#secret-imports).
|
||||
</Tip>
|
||||
|
||||
4. Configure the **Destination** to where secrets should be deployed, then click **Next**.
|
||||
|
||||
|
||||
- **Cloudflare Connection**: The Cloudflare Connection to authenticate with.
|
||||
- **Cloudflare Pages Project**: Choose the Cloudflare Pages project you want to sync secrets to.
|
||||
- **Environment**: Select the deployment environment (preview or production).
|
||||
|
||||
5. Configure the **Sync Options** to specify how secrets should be synced, then click **Next**.
|
||||
|
||||
|
||||
- **Initial Sync Behavior**: Determines how Infisical should resolve the initial sync.
|
||||
- **Overwrite Destination Secrets**: Removes any secrets at the destination endpoint not present in Infisical.
|
||||
- **Key Schema**: Template that determines how secret names are transformed when syncing, using `{{secretKey}}` as a placeholder for the original secret name and `{{environment}}` for the environment.
|
||||
- **Auto-Sync Enabled**: If enabled, secrets will automatically be synced from the source location when changes occur. Disable to enforce manual syncing only.
|
||||
- **Disable Secret Deletion**: If enabled, Infisical will not remove secrets from the sync destination. Enable this option if you intend to manage some secrets manually outside of Infisical.
|
||||
|
||||
6. Configure the **Details** of your Cloudflare Pages Sync, then click **Next**.
|
||||
|
||||
|
||||
- **Name**: The name of your sync. Must be slug-friendly.
|
||||
- **Description**: An optional description for your sync.
|
||||
|
||||
7. Review your Cloudflare Pages Sync configuration, then click **Create Sync**.
|
||||
|
||||
|
||||
8. If enabled, your Cloudflare Pages Sync will begin syncing your secrets to the destination endpoint.
|
||||
|
||||
|
||||
</Tab>
|
||||
<Tab title="API">
|
||||
To create a **Cloudflare Pages Sync**, make an API request to the [Create Cloudflare Pages Sync](/api-reference/endpoints/secret-syncs/cloudflare-pages/create) API endpoint.
|
||||
|
||||
### Sample request
|
||||
|
||||
```bash Request
|
||||
curl --request POST \
|
||||
--url https://app.infisical.com/api/v1/secret-syncs/cloudflare-pages \
|
||||
--header 'Content-Type: application/json' \
|
||||
--data '{
|
||||
"name": "my-cloudflare-pages-sync",
|
||||
"projectId": "your-project-id",
|
||||
"description": "an example sync",
|
||||
"connectionId": "your-cloudflare-connection-id",
|
||||
"environment": "production",
|
||||
"secretPath": "/my-secrets",
|
||||
"isEnabled": true,
|
||||
"syncOptions": {
|
||||
"initialSyncBehavior": "overwrite-destination"
|
||||
},
|
||||
"destinationConfig": {
|
||||
"projectId": "your-cloudflare-pages-project-id",
|
||||
"projectName": "my-pages-project",
|
||||
"environment": "production"
|
||||
}
|
||||
}'
|
||||
```
|
||||
|
||||
### Sample response
|
||||
|
||||
```bash Response
|
||||
{
|
||||
"secretSync": {
|
||||
"id": "your-sync-id",
|
||||
"name": "my-cloudflare-pages-sync",
|
||||
"description": "an example sync",
|
||||
"isEnabled": true,
|
||||
"version": 1,
|
||||
"folderId": "your-folder-id",
|
||||
"connectionId": "your-cloudflare-connection-id",
|
||||
"createdAt": "2024-05-01T12:00:00Z",
|
||||
"updatedAt": "2024-05-01T12:00:00Z",
|
||||
"syncStatus": "succeeded",
|
||||
"lastSyncJobId": "123",
|
||||
"lastSyncMessage": null,
|
||||
"lastSyncedAt": "2024-05-01T12:00:00Z",
|
||||
"syncOptions": {
|
||||
"initialSyncBehavior": "overwrite-destination"
|
||||
},
|
||||
"projectId": "your-project-id",
|
||||
"connection": {
|
||||
"app": "cloudflare",
|
||||
"name": "my-cloudflare-connection",
|
||||
"id": "your-cloudflare-connection-id"
|
||||
},
|
||||
"environment": {
|
||||
"slug": "production",
|
||||
"name": "Production",
|
||||
"id": "your-env-id"
|
||||
},
|
||||
"folder": {
|
||||
"id": "your-folder-id",
|
||||
"path": "/my-secrets"
|
||||
},
|
||||
"destination": "cloudflare-pages",
|
||||
"destinationConfig": {
|
||||
"projectId": "your-cloudflare-pages-project-id",
|
||||
"projectName": "my-pages-project",
|
||||
"environment": "production"
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
</Tab>
|
||||
</Tabs>
|
||||
@@ -0,0 +1,128 @@
|
||||
---
|
||||
title: "Infisical Cloud"
|
||||
description: "Architecture overview of Infisical's US and EU cloud deployments"
|
||||
---
|
||||
|
||||
This document provides an overview of Infisical's cloud architecture for our US and EU deployments, detailing the core components and how they interact to provide security and infrastructure services.
|
||||
|
||||
## Overview
|
||||
|
||||
Infisical Cloud operates on AWS infrastructure using containerized services deployed via Amazon ECS (Elastic Container Service). Our US and EU deployments use identical architectural patterns to ensure consistency and reliability across regions.
|
||||
|
||||
|
||||
|
||||
## Components
|
||||
|
||||
A typical Infisical Cloud deployment consists of the following components:
|
||||
|
||||
### Application Services
|
||||
|
||||
- **Infisical Core**: Main application server running the Infisical backend API
|
||||
- **License API**: Dedicated API service for license management with separate RDS instance (shared between US/EU)
|
||||
- **Application Load Balancer**: Routes incoming traffic to application containers with SSL termination and host-based routing
|
||||
|
||||
### Data Layer
|
||||
|
||||
- **Amazon RDS (PostgreSQL)**:
|
||||
- **Main RDS Instance**: Primary database for secrets, users, and metadata (Multi-AZ, encryption enabled)
|
||||
- **License API RDS Instance**: Dedicated database for license management services
|
||||
- **Amazon ElastiCache (Redis)**:
|
||||
- **Main Redis Cluster**: Multi-AZ replication group for core application caching and queuing
|
||||
- **License API Redis**: Dedicated cache for license services
|
||||
- Redis 7 engine with CloudWatch logging and snapshot backups
|
||||
|
||||
### Infrastructure
|
||||
|
||||
- **ECS Fargate**: Serverless container platform running application services
|
||||
- **AWS Global Accelerator**: Global traffic routing and performance optimization
|
||||
- **Cloudflare**: DNS management and routing
|
||||
- **AWS SSM Parameter Store**: Stores application configuration and secrets
|
||||
- **CloudWatch**: Centralized logging and monitoring
|
||||
|
||||
## System Layout
|
||||
|
||||
### Service Architecture
|
||||
|
||||
The Infisical application runs as multiple containerized services on ECS:
|
||||
|
||||
- **Main Server**: Auto-scaling containerized application services
|
||||
- **License API**: Dedicated service with separate infrastructure (shared globally)
|
||||
- **Monitoring**: AWS OTel Collector and Datadog Agent sidecars
|
||||
|
||||
Container images are pulled from Docker Hub and managed via GitHub Actions for deployments.
|
||||
|
||||
### Network Configuration
|
||||
|
||||
Services are deployed in private subnets with the following connectivity:
|
||||
|
||||
- External traffic → Application Load Balancer → ECS Services
|
||||
- Main server exposes port 8080
|
||||
- License API exposes port 4000 (portal.infisical.com, license.infisical.com)
|
||||
- Service-to-service communication via AWS Service Connect
|
||||
|
||||
### Data Flow
|
||||
|
||||
1. **DNS resolution** via Cloudflare routes traffic to AWS Global Accelerator
|
||||
2. **Global Accelerator** optimizes routing to the nearest AWS region
|
||||
3. **Client requests** are routed through the Application Load Balancer to ECS containers
|
||||
4. **Application logic** processes requests in the Infisical Core service
|
||||
5. **Data persistence** occurs via encrypted connections to RDS
|
||||
6. **Caching** utilizes ElastiCache for performance optimization
|
||||
7. **Configuration** is retrieved from AWS SSM Parameter Store
|
||||
|
||||
## Regional Deployments
|
||||
|
||||
Each region operates in a separate AWS account, providing strong isolation boundaries for security, compliance, and operational independence.
|
||||
|
||||
### US Cloud (us.infisical.com or app.infisical.com)
|
||||
|
||||
- **AWS Account**: Dedicated US AWS account
|
||||
- **Infrastructure**: ECS-based containerized deployment
|
||||
- **Monitoring**: Integrated with Datadog for observability and security monitoring
|
||||
|
||||
### EU Cloud (eu.infisical.com)
|
||||
|
||||
- **AWS Account**: Dedicated EU AWS account
|
||||
- **Infrastructure**: ECS-based containerized deployment
|
||||
- **Monitoring**: Integrated with Datadog for observability and security monitoring
|
||||
|
||||
## Configuration Management
|
||||
|
||||
Application configuration and secrets are managed through AWS SSM Parameter Store, with deployment automation handled via GitHub Actions.
|
||||
|
||||
## Monitoring and Observability
|
||||
|
||||
### Logging
|
||||
|
||||
- **CloudWatch**: 365-day retention for application logs
|
||||
- **Health Checks**: HTTP endpoint monitoring for service health
|
||||
|
||||
### Metrics
|
||||
|
||||
- **AWS OTel Collector**: Prometheus metrics collection
|
||||
- **Datadog Agent**: Application performance monitoring and infrastructure metrics
|
||||
|
||||
## Container Management
|
||||
|
||||
- **Images**: `infisical/staging_infisical` and `infisical/license-api` from Docker Hub
|
||||
- **Deployment**: Automated via GitHub Actions updating SSM parameter for image tags
|
||||
- **Registry Access**: Docker Hub credentials stored in AWS Secrets Manager
|
||||
- **Platform**: ECS Fargate serverless container platform
|
||||
|
||||
## Security Overview
|
||||
|
||||
### Data Protection
|
||||
|
||||
- **Encryption**: All secrets encrypted at rest and in transit
|
||||
- **Network Isolation**: Services deployed in private subnets with controlled access
|
||||
- **Authentication**: API tokens and service accounts for secure access
|
||||
- **Audit Logging**: Comprehensive audit trails for all secret operations
|
||||
|
||||
### Network Architecture
|
||||
|
||||
- **VPC Design**: Dedicated VPC with public and private subnets across multiple Availability Zones
|
||||
- **NAT Gateway**: Controlled outbound connectivity from private subnets
|
||||
- **Load Balancing**: Application Load Balancer with SSL termination and health checks
|
||||
- **Security Groups**: Restrictive firewall rules and controlled network access
|
||||
- **High Availability**: Multi-AZ deployment with automatic failover
|
||||
- **Network Monitoring**: VPC Flow Logs with 365-day retention for traffic analysis
|
||||
@@ -5,13 +5,13 @@ description: "Learn how to provision and configure Infisical instances programma
|
||||
|
||||
Infisical's Automated Bootstrapping feature enables you to provision and configure an Infisical instance without using the UI, allowing for complete automation through static configuration files, API calls, or CLI commands. This is especially valuable for enterprise environments where automated deployment and infrastructure-as-code practices are essential.
|
||||
|
||||
## Overview
|
||||
The bootstrapping workflow automates creating an admin user account, initializing an organization for the entire instance, establishing an **instance admin machine identity** with full administrative permissions, and returning the machine identity credentials for further automation.
|
||||
|
||||
The Automated Bootstrapping workflow automates the following processes:
|
||||
- Creating an admin user account
|
||||
- Initializing an organization for the entire instance
|
||||
- Establishing an **instance admin machine identity** with full administrative permissions
|
||||
- Returning the machine identity credentials for further automation
|
||||
## Prerequisites
|
||||
|
||||
- An Infisical instance launched with all required configuration variables
|
||||
- Access to the Infisical CLI or the ability to make API calls to the instance
|
||||
- Network connectivity to the Infisical instance
|
||||
|
||||
## Key Concepts
|
||||
|
||||
@@ -20,15 +20,9 @@ The Automated Bootstrapping workflow automates the following processes:
|
||||
|
||||
- **Token Auth**: The instance admin machine identity uses [Token Auth](/documentation/platform/identities/token-auth), providing a JWT token that can be used directly to make authenticated requests to the Infisical API.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- An Infisical instance launched with all required configuration variables
|
||||
- Access to the Infisical CLI or the ability to make API calls to the instance
|
||||
- Network connectivity to the Infisical instance
|
||||
|
||||
## Bootstrap Methods
|
||||
|
||||
You can bootstrap an Infisical instance using either the API or the CLI.
|
||||
You can bootstrap an Infisical instance using the API, CLI, or Helm chart.
|
||||
|
||||
<Tabs>
|
||||
<Tab title="Using the API">
|
||||
@@ -51,6 +45,37 @@ You can bootstrap an Infisical instance using either the API or the CLI.
|
||||
-d '{"email":"[email protected]","password":"your-secure-password","organization":"your-org-name"}' \
|
||||
http://your-infisical-instance.com/api/v1/admin/bootstrap
|
||||
```
|
||||
|
||||
### API Response Structure
|
||||
|
||||
The bootstrap process returns a JSON response with details about the created user, organization, and machine identity:
|
||||
|
||||
```json
|
||||
{
|
||||
"identity": {
|
||||
"credentials": {
|
||||
"token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZGVudGl0eUlkIjoiZGIyMjQ3OTItZWQxOC00Mjc3LTlkYWUtNTdlNzUyMzE1ODU0IiwiaWRlbnRpdHlBY2Nlc3NUb2tlbklkIjoiZmVkZmZmMGEtYmU3Yy00NjViLWEwZWEtZjM5OTNjMTg4OGRlIiwiYXV0aFRva2VuVHlwZSI6ImlkZW50aXR5QWNjZXNzVG9rZW4iLCJpYXQiOjE3NDIzMjI0ODl9.mqcZZqIFqER1e9ubrQXp8FbzGYi8nqqZwfMvz09g-8Y"
|
||||
},
|
||||
"id": "db224792-ed18-4277-9dae-57e752315854",
|
||||
"name": "Instance Admin Identity"
|
||||
},
|
||||
"message": "Successfully bootstrapped instance",
|
||||
"organization": {
|
||||
"id": "b56bece0-42f5-4262-b25e-be7bf5f84957",
|
||||
"name": "dog",
|
||||
"slug": "dog-v-e5l"
|
||||
},
|
||||
"user": {
|
||||
"email": "[email protected]",
|
||||
"firstName": "Admin",
|
||||
"id": "a418f355-c8da-453c-bbc8-6c07208eeb3c",
|
||||
"lastName": "User",
|
||||
"superAdmin": true,
|
||||
"username": "[email protected]"
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
</Tab>
|
||||
<Tab title="Using the CLI">
|
||||
Use the [Infisical CLI](/cli/commands/bootstrap) to bootstrap the instance and extract the token for immediate use in automation:
|
||||
@@ -60,39 +85,126 @@ You can bootstrap an Infisical instance using either the API or the CLI.
|
||||
```
|
||||
|
||||
This example command pipes the output through `jq` to extract only the machine identity token, making it easy to capture and use directly in automation scripts or export as an environment variable for tools like Terraform.
|
||||
|
||||
### API Response Structure
|
||||
|
||||
The bootstrap process returns a JSON response with details about the created user, organization, and machine identity:
|
||||
|
||||
```json
|
||||
{
|
||||
"identity": {
|
||||
"credentials": {
|
||||
"token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZGVudGl0eUlkIjoiZGIyMjQ3OTItZWQxOC00Mjc3LTlkYWUtNTdlNzUyMzE1ODU0IiwiaWRlbnRpdHlBY2Nlc3NUb2tlbklkIjoiZmVkZmZmMGEtYmU3Yy00NjViLWEwZWEtZjM5OTNjMTg4OGRlIiwiYXV0aFRva2VuVHlwZSI6ImlkZW50aXR5QWNjZXNzVG9rZW4iLCJpYXQiOjE3NDIzMjI0ODl9.mqcZZqIFqER1e9ubrQXp8FbzGYi8nqqZwfMvz09g-8Y"
|
||||
},
|
||||
"id": "db224792-ed18-4277-9dae-57e752315854",
|
||||
"name": "Instance Admin Identity"
|
||||
},
|
||||
"message": "Successfully bootstrapped instance",
|
||||
"organization": {
|
||||
"id": "b56bece0-42f5-4262-b25e-be7bf5f84957",
|
||||
"name": "dog",
|
||||
"slug": "dog-v-e5l"
|
||||
},
|
||||
"user": {
|
||||
"email": "[email protected]",
|
||||
"firstName": "Admin",
|
||||
"id": "a418f355-c8da-453c-bbc8-6c07208eeb3c",
|
||||
"lastName": "User",
|
||||
"superAdmin": true,
|
||||
"username": "[email protected]"
|
||||
}
|
||||
}
|
||||
```
|
||||
</Tab>
|
||||
<Tab title="Helm Chart">
|
||||
When deploying Infisical using the official [Helm chart](/self-hosting/deployment-options/kubernetes-helm#kubernetes-via-helm-chart), you can enable automatic bootstrapping that runs as part of the deployment process. This eliminates the need to manually bootstrap the instance after deployment.
|
||||
|
||||
The bootstrapping process automatically generates a Kubernetes secret containing the instance admin token, which can then be referenced by Crossplane providers, Terraform operators, or other automation systems for further infrastructure provisioning and configuration.
|
||||
|
||||
### Configuration
|
||||
|
||||
Enable auto bootstrapping in your Helm values by setting `autoBootstrap.enabled: true` and providing the necessary configuration:
|
||||
|
||||
```yaml
|
||||
autoBootstrap:
|
||||
enabled: true
|
||||
organization: "My Organization"
|
||||
secretTemplate: '{"data":{"token":"{{.Identity.Credentials.Token}}"}}'
|
||||
|
||||
secretDestination:
|
||||
name: "infisical-bootstrap-secret"
|
||||
namespace: "default" # defaults to release namespace if not specified
|
||||
|
||||
credentialSecret:
|
||||
name: "infisical-bootstrap-credentials"
|
||||
```
|
||||
|
||||
You'll also need to create a secret containing the bootstrap credentials before deployment. The secret must contain `INFISICAL_ADMIN_EMAIL` and `INFISICAL_ADMIN_PASSWORD` keys:
|
||||
|
||||
```bash
|
||||
kubectl create secret generic infisical-bootstrap-credentials \
|
||||
--from-literal=INFISICAL_ADMIN_EMAIL="[email protected]" \
|
||||
--from-literal=INFISICAL_ADMIN_PASSWORD="your-secure-password" \
|
||||
--namespace=release-namespace
|
||||
```
|
||||
|
||||
### How It Works
|
||||
|
||||
The Helm chart auto bootstrap feature:
|
||||
|
||||
1. **Post-Install Hook**: Runs automatically after the main Infisical deployment is complete
|
||||
2. **Readiness Check**: Uses an init container with curl to wait for Infisical to be ready by polling the `/api/status` endpoint
|
||||
3. **Bootstrap Execution**: Uses the Infisical CLI to bootstrap the instance
|
||||
4. **Kubernetes Secret Creation**: Creates a Kubernetes secret directly via the Kubernetes API using the rendered template
|
||||
5. **RBAC**: Automatically configures the necessary permissions (`get`, `create`, `update` on secrets) for the bootstrap job
|
||||
|
||||
### Template System
|
||||
|
||||
The `secretTemplate` field allows you to customize the data section of the created Kubernetes secret. The template has access to the full bootstrap response with the following available data fields:
|
||||
|
||||
- `{{ .Identity.Credentials.Token }}`: The admin machine identity token
|
||||
- `{{ .Identity.ID }}`: The identity ID
|
||||
- `{{ .Identity.Name }}`: The identity name
|
||||
- `{{ .Organization.ID }}`: The organization ID
|
||||
- `{{ .Organization.Name }}`: The organization name
|
||||
- `{{ .Organization.Slug }}`: The organization slug
|
||||
- `{{ .User.Email }}`: The admin user email
|
||||
- `{{ .User.ID }}`: The admin user ID
|
||||
- `{{ .User.FirstName }}`: The admin user first name
|
||||
- `{{ .User.LastName }}`: The admin user last name
|
||||
|
||||
The template also supports the `encodeBase64` function for base64 encoding values.
|
||||
|
||||
Example template for storing multiple values:
|
||||
|
||||
```yaml
|
||||
secretTemplate: |
|
||||
{
|
||||
"data": {
|
||||
"infisical_token": "{{ .Identity.Credentials.Token }}",
|
||||
"admin_email": "{{ .User.Email }}",
|
||||
"organization": "{{ .Organization.Name }}"
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### Benefits
|
||||
|
||||
- **Zero-Touch Deployment**: Complete Infisical setup without manual intervention
|
||||
- **Infrastructure as Code**: Bootstrap configuration is versioned with your Helm values
|
||||
- **Secure Token Storage**: Admin identity credentials are immediately stored in Kubernetes secrets
|
||||
- **Integration Ready**: The created secret can be referenced by other applications or automation tools
|
||||
|
||||
### Security Considerations
|
||||
|
||||
- The bootstrap job requires permissions to create secrets in the specified namespace
|
||||
- Bootstrap credentials should be stored securely and rotated regularly
|
||||
- The generated admin token has full instance privileges and should be protected accordingly
|
||||
- Consider using Kubernetes RBAC to restrict access to the generated secret
|
||||
|
||||
</Tab>
|
||||
</Tabs>
|
||||
|
||||
## API Response Structure
|
||||
|
||||
The bootstrap process returns a JSON response with details about the created user, organization, and machine identity:
|
||||
|
||||
```json
|
||||
{
|
||||
"identity": {
|
||||
"credentials": {
|
||||
"token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZGVudGl0eUlkIjoiZGIyMjQ3OTItZWQxOC00Mjc3LTlkYWUtNTdlNzUyMzE1ODU0IiwiaWRlbnRpdHlBY2Nlc3NUb2tlbklkIjoiZmVkZmZmMGEtYmU3Yy00NjViLWEwZWEtZjM5OTNjMTg4OGRlIiwiYXV0aFRva2VuVHlwZSI6ImlkZW50aXR5QWNjZXNzVG9rZW4iLCJpYXQiOjE3NDIzMjI0ODl9.mqcZZqIFqER1e9ubrQXp8FbzGYi8nqqZwfMvz09g-8Y"
|
||||
},
|
||||
"id": "db224792-ed18-4277-9dae-57e752315854",
|
||||
"name": "Instance Admin Identity"
|
||||
},
|
||||
"message": "Successfully bootstrapped instance",
|
||||
"organization": {
|
||||
"id": "b56bece0-42f5-4262-b25e-be7bf5f84957",
|
||||
"name": "dog",
|
||||
"slug": "dog-v-e5l"
|
||||
},
|
||||
"user": {
|
||||
"email": "[email protected]",
|
||||
"firstName": "Admin",
|
||||
"id": "a418f355-c8da-453c-bbc8-6c07208eeb3c",
|
||||
"lastName": "User",
|
||||
"superAdmin": true,
|
||||
"username": "[email protected]"
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
## Using the Instance Admin Machine Identity Token
|
||||
|
||||
The bootstrap process automatically creates a machine identity with Token Auth configured. The returned token has instance-level admin privileges (the highest level of access) and should be treated with the same security considerations as a root credential.
|
||||
|
||||
+7
-46
@@ -1,3 +1,7 @@
|
||||
* {
|
||||
border-radius: 0 !important;
|
||||
}
|
||||
|
||||
#navbar .max-w-8xl {
|
||||
max-width: 100%;
|
||||
border-bottom: 1px solid #ebebeb;
|
||||
@@ -26,24 +30,20 @@
|
||||
}
|
||||
|
||||
#sidebar li > div.mt-2 {
|
||||
border-radius: 0;
|
||||
padding: 5px;
|
||||
}
|
||||
|
||||
#sidebar li > a.text-primary {
|
||||
border-radius: 0;
|
||||
background-color: #FBFFCC;
|
||||
border-left: 4px solid #EFFF33;
|
||||
padding: 5px;
|
||||
}
|
||||
|
||||
#sidebar li > a.mt-2 {
|
||||
border-radius: 0;
|
||||
padding: 5px;
|
||||
}
|
||||
|
||||
#sidebar li > a.leading-6 {
|
||||
border-radius: 0;
|
||||
padding: 0px;
|
||||
}
|
||||
|
||||
@@ -68,65 +68,26 @@
|
||||
}
|
||||
|
||||
#content-area .mt-8 .block{
|
||||
border-radius: 0;
|
||||
border-width: 1px;
|
||||
background-color: #FCFBFA;
|
||||
border-color: #ebebeb;
|
||||
}
|
||||
|
||||
/* #content-area:hover .mt-8 .block:hover{
|
||||
border-radius: 0;
|
||||
|
||||
border-width: 1px;
|
||||
background-color: #FDFFE5;
|
||||
border-color: #EFFF33;
|
||||
} */
|
||||
|
||||
#content-area .mt-8 .rounded-xl{
|
||||
border-radius: 0;
|
||||
}
|
||||
|
||||
#content-area .mt-8 .rounded-lg{
|
||||
border-radius: 0;
|
||||
}
|
||||
|
||||
#content-area .mt-6 .rounded-xl{
|
||||
border-radius: 0;
|
||||
}
|
||||
|
||||
#content-area .mt-6 .rounded-lg{
|
||||
border-radius: 0;
|
||||
}
|
||||
|
||||
#content-area .mt-6 .rounded-md{
|
||||
border-radius: 0;
|
||||
}
|
||||
|
||||
#content-area .mt-8 .rounded-md{
|
||||
border-radius: 0;
|
||||
}
|
||||
|
||||
#content-area div.my-4{
|
||||
border-radius: 0;
|
||||
border-width: 1px;
|
||||
}
|
||||
|
||||
#content-area div.flex-1 {
|
||||
/* text-transform: uppercase; */
|
||||
/* #content-area div.flex-1 {
|
||||
opacity: 0.8;
|
||||
font-weight: 400;
|
||||
}
|
||||
|
||||
#content-area button {
|
||||
border-radius: 0;
|
||||
}
|
||||
|
||||
#content-area a {
|
||||
border-radius: 0;
|
||||
}
|
||||
|
||||
#content-area .not-prose {
|
||||
border-radius: 0;
|
||||
}
|
||||
} */
|
||||
|
||||
/* .eyebrow {
|
||||
text-transform: uppercase;
|
||||
|
||||
Reference in New Issue
Block a user