From b7ea375844c8203ede1fc0848a3d14e31fa1797e Mon Sep 17 00:00:00 2001 From: Victor Santos Date: Fri, 31 Oct 2025 11:07:05 -0300 Subject: [PATCH 1/4] docs: add sidecar-init method to Kubernetes Injector annotations --- docs/integrations/platforms/kubernetes-injector.mdx | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/integrations/platforms/kubernetes-injector.mdx b/docs/integrations/platforms/kubernetes-injector.mdx index d5d48598b..635dd3af4 100644 --- a/docs/integrations/platforms/kubernetes-injector.mdx +++ b/docs/integrations/platforms/kubernetes-injector.mdx @@ -63,6 +63,7 @@ The Infisical Agent Injector supports the following annotations: - `init`: The init method will create an init container for the pod that will render the secrets into a shared volume mount within the pod. The agent init container will run before any other containers in the pod runs, including other init containers. - `sidecar`: The sidecar method will create a sidecar container for the pod that will render the secrets into a shared volume mount within the pod. The agent sidecar container will run alongside the main container in the pod. This means that the secrets rendered will always be in sync with your Infisical secrets. + - `sidecar-init`: The sidecar-init method will create the init container and the sidecar container from the other two methods. The agent config map annotation is used to specify the name of the config map that contains the configuration for the injector. The config map must be in the same namespace as the pod. From 5a6cc80d4f63051ea5ccf98d4ba8ea2679801efa Mon Sep 17 00:00:00 2001 From: Victor Santos Date: Fri, 31 Oct 2025 11:17:55 -0300 Subject: [PATCH 2/4] docs: update Kubernetes integration overview to include global configuration for all CRD instances --- docs/integrations/platforms/kubernetes/overview.mdx | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/docs/integrations/platforms/kubernetes/overview.mdx b/docs/integrations/platforms/kubernetes/overview.mdx index 7a381d996..71ae05c46 100644 --- a/docs/integrations/platforms/kubernetes/overview.mdx +++ b/docs/integrations/platforms/kubernetes/overview.mdx @@ -204,14 +204,17 @@ The Infisical Secrets Operator integrates with the [Sprig library](https://githu ## Global configuration -To configure global settings that will apply to all instances of `InfisicalSecret`, you can define these configurations in a Kubernetes ConfigMap. -For example, you can configure all `InfisicalSecret` instances to fetch secrets from a single backend API without specifying the `hostAPI` parameter for each instance. +To configure global settings that will apply to all CRD instances (`InfisicalSecret`, `InfisicalPushSecret`, and `InfisicalDynamicSecret`), you can define these configurations in a Kubernetes ConfigMap. +For example, you can configure all CRD instances to fetch secrets from a single backend API without specifying the `hostAPI` parameter for each instance. ### Available global properties | Property | Description | Default value | | -------- | --------------------------------------------------------------------------------- | ----------------------------- | -| hostAPI | If `hostAPI` in `InfisicalSecret` instance is left empty, this value will be used | https://app.infisical.com/api | +| hostAPI | If `hostAPI` in a CRD instance is left empty, this value will be used | https://app.infisical.com/api | +| tls.caRef.secretName | If `tls.caRef.secretName` in a CRD instance is left empty, this value will be used | - | +| tls.caRef.secretNamespace | If `tls.caRef.secretNamespace` in a CRD instance is left empty, this value will be used | - | +| tls.caRef.key | If `tls.caRef.key` in a CRD instance is left empty, this value will be used | - | ### Applying global configurations @@ -231,6 +234,9 @@ metadata: namespace: infisical-operator-system data: hostAPI: https://example.com/api # <-- global hostAPI + tls.caRef.secretName: custom-ca-certificate # <-- global TLS CA secret name + tls.caRef.secretNamespace: default # <-- global TLS CA secret namespace + tls.caRef.key: ca.crt # <-- global TLS CA secret key ``` Then apply this change via kubectl by running the following From 465b42102ea710f32ef16f640cc98ac796425144 Mon Sep 17 00:00:00 2001 From: Victor Santos Date: Fri, 31 Oct 2025 12:24:19 -0300 Subject: [PATCH 3/4] docs: clarify sidecar-init method in Kubernetes Injector annotations to explain container behavior --- docs/integrations/platforms/kubernetes-injector.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/integrations/platforms/kubernetes-injector.mdx b/docs/integrations/platforms/kubernetes-injector.mdx index 635dd3af4..eda9d36c3 100644 --- a/docs/integrations/platforms/kubernetes-injector.mdx +++ b/docs/integrations/platforms/kubernetes-injector.mdx @@ -63,7 +63,7 @@ The Infisical Agent Injector supports the following annotations: - `init`: The init method will create an init container for the pod that will render the secrets into a shared volume mount within the pod. The agent init container will run before any other containers in the pod runs, including other init containers. - `sidecar`: The sidecar method will create a sidecar container for the pod that will render the secrets into a shared volume mount within the pod. The agent sidecar container will run alongside the main container in the pod. This means that the secrets rendered will always be in sync with your Infisical secrets. - - `sidecar-init`: The sidecar-init method will create the init container and the sidecar container from the other two methods. + - `sidecar-init`: The sidecar-init method will create the init container and the sidecar container from the other two methods. The init container will run before any other container and fetch the secrets from the start and the sidecar container will keep the secrets in sync. The agent config map annotation is used to specify the name of the config map that contains the configuration for the injector. The config map must be in the same namespace as the pod. From 854f054fc0a689d119208c0e6f7fe86a4e5d5418 Mon Sep 17 00:00:00 2001 From: Victor Santos Date: Fri, 31 Oct 2025 13:48:59 -0300 Subject: [PATCH 4/4] docs: enhance sidecar-init method description in Kubernetes Injector annotations to clarify secret synchronization throughout deployment lifecycle --- docs/integrations/platforms/kubernetes-injector.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/integrations/platforms/kubernetes-injector.mdx b/docs/integrations/platforms/kubernetes-injector.mdx index eda9d36c3..b7ecf5815 100644 --- a/docs/integrations/platforms/kubernetes-injector.mdx +++ b/docs/integrations/platforms/kubernetes-injector.mdx @@ -63,7 +63,7 @@ The Infisical Agent Injector supports the following annotations: - `init`: The init method will create an init container for the pod that will render the secrets into a shared volume mount within the pod. The agent init container will run before any other containers in the pod runs, including other init containers. - `sidecar`: The sidecar method will create a sidecar container for the pod that will render the secrets into a shared volume mount within the pod. The agent sidecar container will run alongside the main container in the pod. This means that the secrets rendered will always be in sync with your Infisical secrets. - - `sidecar-init`: The sidecar-init method will create the init container and the sidecar container from the other two methods. The init container will run before any other container and fetch the secrets from the start and the sidecar container will keep the secrets in sync. + - `sidecar-init`: The sidecar-init method will create the init container and the sidecar container from the other two methods. The init container will run before any other container and fetch the secrets from the start and the sidecar container will keep the secrets in sync throughout the lifecycle of the deployment. The agent config map annotation is used to specify the name of the config map that contains the configuration for the injector. The config map must be in the same namespace as the pod.