Merge pull request #5006 from Infisical/daniel/update-gateway-helm

fix: gateway helm permission errors

helm-charts/infisical-gateway/CHANGELOG.md

@@ -1,3 +1,8 @@
+## 1.0.4 (December 9, 2025)
+* Updated default CLI image version from `0.43.0` to `0.43.39`.
+* Added new `gateway.pamSessionRecordingsDirectory`, allowing users to specify the folder where temporary session recording files for PAM are stored. Defaults to `/var/lib/infisical/session_recordings`
+* Added volume mounts for the user-specified `pamSessionRecordingsDirectory` path, and `/var/lib/infisical` for cached relay data.
+
 ## 1.0.3 (November 14, 2025)
 * Added support for setting the image repository by setting `image.repository`. Defaults to `infisical/cli`.
 

helm-charts/infisical-gateway/Chart.yaml

@@ -15,10 +15,10 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 1.0.3
+version: 1.0.4
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "1.0.3"
+appVersion: "1.0.4"

helm-charts/infisical-gateway/templates/deployment.yaml

@@ -29,6 +29,11 @@ spec:
       securityContext:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      volumes:
+        - name: infisical-gateway-session-recordings-data
+          emptyDir: {}
+        - name: infisical-gateway-cached-relay-data
+          emptyDir: {}
       containers:
         - name: {{ .Chart.Name }}
           {{- with .Values.securityContext }}
@@ -40,6 +45,7 @@ spec:
           args:
             - gateway
             - start
+            - --pam-session-recording-path={{ .Values.gateway.pamSessionRecordingsDirectory | default "/var/lib/infisical/session_recordings" }}
           envFrom:
             - secretRef:
                 name: {{ .Values.secret.name }}
@@ -47,6 +53,14 @@ spec:
             - name: http
               containerPort: {{ .Values.service.port }}
               protocol: TCP
+          volumeMounts:
+            - name: infisical-gateway-cached-relay-data
+              mountPath: /var/lib/infisical
+            {{- $sessionPath := .Values.gateway.pamSessionRecordingsDirectory | default "/var/lib/infisical/session_recordings" }}
+            {{- if not (hasPrefix "/var/lib/infisical" $sessionPath) }}
+            - name: infisical-gateway-session-recordings-data
+              mountPath: {{ $sessionPath }}
+            {{- end }}
           {{- with .Values.resources }}
           resources:
             {{- toYaml . | nindent 12 }}

helm-charts/infisical-gateway/values.yaml

@@ -1,12 +1,17 @@
 image:
   repository: infisical/cli
-  tag: "0.43.0"
+  tag: "0.43.39"
   pullPolicy: IfNotPresent
 
 secret:
   # The secret that contains the environment variables to be used by the gateway, such as INFISICAL_API_URL and TOKEN
   name: "infisical-gateway-environment"
 
+gateway:
+  # Specify where to save PAM session recordings. This directory will always be created when the gateway starts.
+  # Defaults to /var/lib/infisical/session_recordings.
+  pamSessionRecordingsDirectory: /var/lib/infisical/session_recordings
+
 resources:
   limits:
     cpu: 500m