From dffcca53757459cf2ca2b06c7df6f388bdfad7a8 Mon Sep 17 00:00:00 2001 From: Daniel Hougaard Date: Tue, 9 Dec 2025 12:20:48 +0400 Subject: [PATCH 1/3] fix: gateway helm permission errors --- helm-charts/infisical-gateway/Chart.yaml | 4 ++-- .../infisical-gateway/templates/deployment.yaml | 11 +++++++++++ helm-charts/infisical-gateway/values.yaml | 7 ++++++- 3 files changed, 19 insertions(+), 3 deletions(-) diff --git a/helm-charts/infisical-gateway/Chart.yaml b/helm-charts/infisical-gateway/Chart.yaml index 674cbb25e..e694f0ce4 100644 --- a/helm-charts/infisical-gateway/Chart.yaml +++ b/helm-charts/infisical-gateway/Chart.yaml @@ -15,10 +15,10 @@ type: application # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. # Versions are expected to follow Semantic Versioning (https://semver.org/) -version: 1.0.3 +version: 1.0.4 # This is the version number of the application being deployed. This version number should be # incremented each time you make changes to the application. Versions are not expected to # follow Semantic Versioning. They should reflect the version the application is using. # It is recommended to use it with quotes. -appVersion: "1.0.3" +appVersion: "1.0.4" diff --git a/helm-charts/infisical-gateway/templates/deployment.yaml b/helm-charts/infisical-gateway/templates/deployment.yaml index 175a69671..964d7fd43 100644 --- a/helm-charts/infisical-gateway/templates/deployment.yaml +++ b/helm-charts/infisical-gateway/templates/deployment.yaml @@ -29,6 +29,11 @@ spec: securityContext: {{- toYaml . | nindent 8 }} {{- end }} + volumes: + - name: infisical-gateway-session-recordings-data + emptyDir: {} + - name: infisical-gateway-cached-relay-data + emptyDir: {} containers: - name: {{ .Chart.Name }} {{- with .Values.securityContext }} @@ -40,6 +45,7 @@ spec: args: - gateway - start + - --pam-session-recording-path={{ .Values.gateway.pamSessionRecordingsDirectory | default "/var/lib/infisical/session_recordings" }} envFrom: - secretRef: name: {{ .Values.secret.name }} @@ -47,6 +53,11 @@ spec: - name: http containerPort: {{ .Values.service.port }} protocol: TCP + volumeMounts: + - name: infisical-gateway-session-recordings-data + mountPath: {{ .Values.gateway.pamSessionRecordingsDirectory | default "/var/lib/infisical/session_recordings" }} + - name: infisical-gateway-cached-relay-data + mountPath: /var/lib/infisical {{- with .Values.resources }} resources: {{- toYaml . | nindent 12 }} diff --git a/helm-charts/infisical-gateway/values.yaml b/helm-charts/infisical-gateway/values.yaml index d298c71a2..487dbdb15 100644 --- a/helm-charts/infisical-gateway/values.yaml +++ b/helm-charts/infisical-gateway/values.yaml @@ -1,12 +1,17 @@ image: repository: infisical/cli - tag: "0.43.0" + tag: "0.43.39" pullPolicy: IfNotPresent secret: # The secret that contains the environment variables to be used by the gateway, such as INFISICAL_API_URL and TOKEN name: "infisical-gateway-environment" +gateway: + # Specify where to save PAM session recordings. This directory will always be created when the gateway starts. + # Defaults to /var/lib/infisical/session_recordings. + pamSessionRecordingsDirectory: /var/lib/infisical/session_recordings + resources: limits: cpu: 500m From b2031064d1dd986f3801b86100b607ab50507905 Mon Sep 17 00:00:00 2001 From: Daniel Hougaard Date: Tue, 9 Dec 2025 12:40:59 +0400 Subject: [PATCH 2/3] Update CHANGELOG.md --- helm-charts/infisical-gateway/CHANGELOG.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/helm-charts/infisical-gateway/CHANGELOG.md b/helm-charts/infisical-gateway/CHANGELOG.md index f576c6551..5a091cef5 100644 --- a/helm-charts/infisical-gateway/CHANGELOG.md +++ b/helm-charts/infisical-gateway/CHANGELOG.md @@ -1,3 +1,8 @@ +## 1.0.4 (December 9, 2025) +* Updated default CLI image version from `0.43.0` to `0.43.39`. +* Added new `gateway.pamSessionRecordingsDirectory`, allowing users to specify the folder where temporary session recording files for PAM are stored. Defaults to `/var/lib/infisical/session_recordings` +* Added volume mounts for the user-specified `pamSessionRecordingsDirectory` path, and `/var/lib/infisical` for cached relay data. + ## 1.0.3 (November 14, 2025) * Added support for setting the image repository by setting `image.repository`. Defaults to `infisical/cli`. From e47f8e6ba63ef1ae6e23bb708d96fdb85f66dba8 Mon Sep 17 00:00:00 2001 From: Daniel Hougaard Date: Tue, 9 Dec 2025 12:56:43 +0400 Subject: [PATCH 3/3] Update deployment.yaml --- helm-charts/infisical-gateway/templates/deployment.yaml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/helm-charts/infisical-gateway/templates/deployment.yaml b/helm-charts/infisical-gateway/templates/deployment.yaml index 964d7fd43..b03fe9c98 100644 --- a/helm-charts/infisical-gateway/templates/deployment.yaml +++ b/helm-charts/infisical-gateway/templates/deployment.yaml @@ -54,10 +54,13 @@ spec: containerPort: {{ .Values.service.port }} protocol: TCP volumeMounts: - - name: infisical-gateway-session-recordings-data - mountPath: {{ .Values.gateway.pamSessionRecordingsDirectory | default "/var/lib/infisical/session_recordings" }} - name: infisical-gateway-cached-relay-data mountPath: /var/lib/infisical + {{- $sessionPath := .Values.gateway.pamSessionRecordingsDirectory | default "/var/lib/infisical/session_recordings" }} + {{- if not (hasPrefix "/var/lib/infisical" $sessionPath) }} + - name: infisical-gateway-session-recordings-data + mountPath: {{ $sessionPath }} + {{- end }} {{- with .Values.resources }} resources: {{- toYaml . | nindent 12 }}