awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore(doc): updated helm parameters doc + 0.1.16 upgrade instructions

Browse Source
This commit is contained in:
Grraahaam
2023-03-16 01:34:40 +01:00
parent 767943368e
commit 164da9d8e0
2 changed files with 146 additions and 52 deletions
Download Patch File Download Diff File Expand all files Collapse all files

190
helm-charts/infisical/README.md
View File

@@ -6,7 +6,7 @@ This is the Infisical application Helm chart. This chart includes the following
| ---------- | ----------------------------------- |
| `frontend` | Infisical's Web UI |
| `backend` | Infisical's API |
| `mongodb` | Infisical's local database |
| `mongodb` | Infisical's database |
| `mailhog` | Infisical's development SMTP server |
## Installation
@@ -36,6 +36,17 @@ helm upgrade --install --atomic \
infisical infisical/infisical
```
### Backup
If not provided, a lot of variables will be auto-generated by default. It's recommended to save them somewhere safe, here's how (:warning: it requires [`jq`](https://stedolan.github.io/jq/download/)) :
```sh
# export secrets to a given file (requires jq)
kubectl get secrets -n <namespace> <secret-name> \
-o json | jq '.data | map_values(@base64d)' > \
<dest-filename>.bak
```
## Parameters
### Common parameters
@@ -68,34 +79,35 @@ helm upgrade --install --atomic \
### Infisical backend parameters
| Name | Description | Value |
| ------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------- |
| `backend.enabled` | Enable backend | `true` |
| `backend.name` | Backend name | `backend` |
| `backend.fullnameOverride` | Backend fullnameOverride | `""` |
| `backend.podAnnotations` | Backend pod annotations | `{}` |
| `backend.deploymentAnnotations` | Backend deployment annotations | `{}` |
| `backend.replicaCount` | Backend replica count | `2` |
| `backend.image.repository` | Backend image repository | `infisical/backend` |
| `backend.image.tag` | Backend image tag | `latest` |
| `backend.image.pullPolicy` | Backend image pullPolicy | `IfNotPresent` |
| `backend.kubeSecretRef` | Backend secret resource reference name (containing required [backend configuration variables](https://infisical.com/docs/self-hosting/configuration/envars)) | `""` |
| `backend.service.annotations` | Backend service annotations | `{}` |
| `backend.service.type` | Backend service type | `ClusterIP` |
| `backend.service.nodePort` | Backend service nodePort (used if above type is `NodePort`) | `""` |
| `backendEnvironmentVariables.ENCRYPTION_KEY` | **Required** Backend encryption key (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)) | `MUST_REPLACE` |
| `backendEnvironmentVariables.JWT_SIGNUP_SECRET` | **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)) | `MUST_REPLACE` |
| `backendEnvironmentVariables.JWT_REFRESH_SECRET` | **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)) | `MUST_REPLACE` |
| `backendEnvironmentVariables.JWT_AUTH_SECRET` | **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)) | `MUST_REPLACE` |
| `backendEnvironmentVariables.JWT_SERVICE_SECRET` | **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)) | `MUST_REPLACE` |
| `backendEnvironmentVariables.SMTP_HOST` | **Required** Hostname to connect to for establishing SMTP connections | `MUST_REPLACE` |
| `backendEnvironmentVariables.SMTP_PORT` | Port to connect to for establishing SMTP connections | `587` |
| `backendEnvironmentVariables.SMTP_SECURE` | If true, use TLS when connecting to host. If false, TLS will be used if STARTTLS is supported | `false` |
| `backendEnvironmentVariables.SMTP_FROM_NAME` | Name label to be used in From field (e.g. Infisical) | `Infisical` |
| `backendEnvironmentVariables.SMTP_FROM_ADDRESS` | **Required** Email address to be used for sending emails (e.g. dev@infisical.com) | `MUST_REPLACE` |
| `backendEnvironmentVariables.SMTP_USERNAME` | **Required** Credential to connect to host (e.g. team@infisical.com) | `MUST_REPLACE` |
| `backendEnvironmentVariables.SMTP_PASSWORD` | **Required** Credential to connect to host | `MUST_REPLACE` |
| `backendEnvironmentVariables.SITE_URL` | Absolute URL including the protocol (e.g. https://app.infisical.com) | `infisical.local` |
| Name | Description | Value |
| ------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------- |
| `backend.enabled` | Enable backend | `true` |
| `backend.name` | Backend name | `backend` |
| `backend.fullnameOverride` | Backend fullnameOverride | `""` |
| `backend.podAnnotations` | Backend pod annotations | `{}` |
| `backend.deploymentAnnotations` | Backend deployment annotations | `{}` |
| `backend.replicaCount` | Backend replica count | `2` |
| `backend.image.repository` | Backend image repository | `infisical/backend` |
| `backend.image.tag` | Backend image tag | `latest` |
| `backend.image.pullPolicy` | Backend image pullPolicy | `IfNotPresent` |
| `backend.kubeSecretRef` | Backend secret resource reference name (containing required [backend configuration variables](https://infisical.com/docs/self-hosting/configuration/envars)) | `""` |
| `backend.service.annotations` | Backend service annotations | `{}` |
| `backend.service.type` | Backend service type | `ClusterIP` |
| `backend.service.nodePort` | Backend service nodePort (used if above type is `NodePort`) | `""` |
| `backendEnvironmentVariables.ENCRYPTION_KEY` | **Required** Backend encryption key (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057))</br><kbd>auto-generated</kbd> variable (if not provided, and not found in an existing secret) | `""` |
| `backendEnvironmentVariables.JWT_SIGNUP_SECRET` | **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057))</br><kbd>auto-generated</kbd> variable (if not provided, and not found in an existing secret) | `""` |
| `backendEnvironmentVariables.JWT_REFRESH_SECRET` | **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057))</br><kbd>auto-generated</kbd> variable (if not provided, and not found in an existing secret) | `""` |
| `backendEnvironmentVariables.JWT_AUTH_SECRET` | **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057))</br><kbd>auto-generated</kbd> variable (if not provided, and not found in an existing secret) | `""` |
| `backendEnvironmentVariables.JWT_SERVICE_SECRET` | **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057))</br><kbd>auto-generated</kbd> variable (if not provided, and not found in an existing secret) | `""` |
| `backendEnvironmentVariables.JWT_MFA_SECRET` | **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057))</br><kbd>auto-generated</kbd> variable (if not provided, and not found in an existing secret) | `""` |
| `backendEnvironmentVariables.SMTP_HOST` | **Required** Hostname to connect to for establishing SMTP connections | `""` |
| `backendEnvironmentVariables.SMTP_PORT` | Port to connect to for establishing SMTP connections | `587` |
| `backendEnvironmentVariables.SMTP_SECURE` | If true, use TLS when connecting to host. If false, TLS will be used if STARTTLS is supported | `false` |
| `backendEnvironmentVariables.SMTP_FROM_NAME` | Name label to be used in From field (e.g. Infisical) | `Infisical` |
| `backendEnvironmentVariables.SMTP_FROM_ADDRESS` | **Required** Email address to be used for sending emails (e.g. dev@infisical.com) | `""` |
| `backendEnvironmentVariables.SMTP_USERNAME` | **Required** Credential to connect to host (e.g. team@infisical.com) | `""` |
| `backendEnvironmentVariables.SMTP_PASSWORD` | **Required** Credential to connect to host | `""` |
| `backendEnvironmentVariables.SITE_URL` | Absolute URL including the protocol (e.g. https://app.infisical.com) | `infisical.local` |
### MongoDB(&reg;) parameters
@@ -112,11 +124,25 @@ helm upgrade --install --atomic \
| `mongodb.image.repository` | MongoDB(&reg;) image registry | `bitnami/mongodb` |
| `mongodb.image.tag` | MongoDB(&reg;) image tag (immutable tags are recommended) | `6.0.4-debian-11-r0` |
| `mongodb.image.pullPolicy` | MongoDB(&reg;) image pull policy | `IfNotPresent` |
| `mongodb.livenessProbe.enabled` | Enable livenessProbe | `true` |
| `mongodb.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `30` |
| `mongodb.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `20` |
| `mongodb.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `10` |
| `mongodb.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `6` |
| `mongodb.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` |
| `mongodb.readinessProbe.enabled` | Enable readinessProbe | `true` |
| `mongodb.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` |
| `mongodb.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` |
| `mongodb.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `10` |
| `mongodb.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `6` |
| `mongodb.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` |
| `mongodb.service.annotations` | Service annotations | `{}` |
| `mongodb.auth.enabled` | Enable custom authentication | `true` |
| `mongodb.auth.usernames` | Custom usernames list ([special characters warning](https://www.mongodb.com/docs/manual/reference/connection-string/#standard-connection-string-format)) | `["infisical"]` |
| `mongodb.auth.passwords` | Custom passwords list, match the above usernames order ([special characters warning](https://www.mongodb.com/docs/manual/reference/connection-string/#standard-connection-string-format)) | `["infisical"]` |
| `mongodb.auth.databases` | Custom databases list ([special characters warning](https://www.mongodb.com/docs/manual/reference/connection-string/#standard-connection-string-format)) | `["infisical"]` |
| `mongodb.auth.rootUser` | Database root user name | `root` |
| `mongodb.auth.rootPassword` | Database root user password | `root` |
| `mongodb.persistence.enabled` | Enable database persistence | `true` |
| `mongodb.persistence.existingClaim` | Existing persistent volume claim name | `""` |
| `mongodb.persistence.resourcePolicy` | Keep the persistent volume even on deletion (`keep` or `""`) | `keep` |
@@ -127,11 +153,13 @@ helm upgrade --install --atomic \
### Ingress parameters
| Name | Description | Value |
| ------------------ | ------------------------------------------- | ----------------- |
| `ingress.enabled` | Enable ingress | `true` |
| `ingress.hostName` | Ingress hostname (your custom domain name) | `infisical.local` |
| `ingress.tls` | Ingress TLS hosts (matching above hostName) | `[]` |
| Name | Description | Value |
| -------------------------- | ------------------------------------------- | ----------------- |
| `ingress.enabled` | Enable ingress | `true` |
| `ingress.ingressClassName` | Ingress class name | `nginx` |
| `ingress.annotations` | Ingress annotations | `{}` |
| `ingress.hostName` | Ingress hostname (your custom domain name) | `infisical.local` |
| `ingress.tls` | Ingress TLS hosts (matching above hostName) | `[]` |
### Mailhog parameters
@@ -152,7 +180,7 @@ helm upgrade --install --atomic \
| `mailhog.ingress.labels` | Ingress labels | `{}` |
| `mailhog.ingress.hosts[0].host` | Mailhog host | `mailhog.infisical.local` |
Learn more in our [docs](https://infisical.com/docs/self-hosting/deployments/kubernetes)
## Persistence
@@ -185,32 +213,37 @@ Below example will deploy the following :
- The corresponding IP will depend on the tool or the way you're exposing the services ([learn more](https://minikube.sigs.k8s.io/docs/handbook/host-access/))
- [**mailhog.infisical.local**](https://mailhog.infisical.local)
- Local SMTP server used to receive the signup verification code
- Local SMTP server used to receive the emails (e.g. signup verification code)
- You may have to add `mailhog.infisical.local` to your `/etc/hosts` or similar depending your OS
- The corresponding IP will depend on the tool or the way you're exposing the services ([learn more](https://minikube.sigs.k8s.io/docs/handbook/host-access/))
Use below values to setup a local development environment, adapt those variables as you need
#### TL;DR
If you're running a k8s cluster with `ingress-nginx`, you can run one of the below scripts :
```sh
# With 'kind' + 'helm', to create a local cluster and deploy the chart
./examples.local-kind.sh
# With 'helm' only, if you already have a cluster to deploy the chart
./examples.local-helm.sh
```
#### Instructions
Here's the step-by-step instructions to setup your local development environment. First create the below file :
```yaml
# values.dev.yaml
# Enable all services for local development
frontend:
enabled: true
backend:
enabled: true
mongodb:
enabled: true
# Enable mailhog for local development
mailhog:
enabled: true
# Configure backend development variables (required)
backendEnvironmentVariables:
ENCRYPTION_KEY: 6c1fe4e407b8911c104518103505b218
JWT_AUTH_SECRET: 4be6ba5602e0fa0ac6ac05c3cd4d247f
JWT_REFRESH_SECRET: 5f2f3c8f0159068dc2bbb3a652a716ff
JWT_SERVICE_SECRET: f32f716d70a42c5703f4656015e76200
JWT_SIGNUP_SECRET: 3679e04ca949f914c03332aaaeba805a
SITE_URL: https://infisical.local
SMTP_FROM_ADDRESS: dev@infisical.local
SMTP_FROM_NAME: Local Infisical
@@ -240,6 +273,63 @@ helm upgrade --install --atomic \
## Upgrading
### 1.15.0
Find the chart upgrade instructions below. When upgrading from your version to one of the listed below, please follow every instructions in between.
Refactoring in progress, instructions are coming soon
Here's a snippet to upgrade your installation manually :
```sh
# replace below '<placeholders>' with your own values
helm upgrade --install --atomic \
-n "<your-namesapce>" --create-namespace \
-f "<your-values.yaml>" \
<your-release-name> .
```
### 0.1.16
- Auto-generation for the following variables, to ease your future upgrades or setups :
- `ENCRYPTION_KEY`
- `JWT_SIGNUP_SECRET`
- `JWT_REFRESH_SECRET`
- `JWT_AUTH_SECRET`
- `JWT_SERVICE_SECRET`
- `JWT_MFA_SECRET`
We've migrated the applications' environment variables into `secrets` resources, shared within the deployments through `envFrom`. If you upgrade your installation make sure to backup your deployments' environment variables (e.g. encryption key and jwt secrets).
The preference order is :
- **user-defined** (values file or inline)
- **existing-secret** (for existing installations, you don't have to specify the secrets when upgrading if they already exist)
- **auto-generated** (if none of the values above have been found, we'll auto-generate a value for the user, only for the above mentioned variables)
#### Instructions
1. Make sure **you have all the required environment variables** defined in the value file (or inline `--set`) you'll provide to `helm`
1. e.g. All the above mentioned variables
1. **Backup your existing secrets** (safety precaution)
1. with below [snippets](#snippets)
1. **Upgrade the chart**, with the [instructions](#upgrading)
1. It'll create a secret per service, and store the secrets/conf within (auto-generate if you don't provide the required ones)
1. It'll link the secret to the deployment through `envFrom`
1. It'll automatically remove the hard-coded `env.*` variables from your infisical deployments
1. Make sure that the **created secrets match the ones in your backups**
1. e.g. `kubectl get secret -n <namespace> <release-name>-backend --template={{.data.ENCRYPTION_KEY}} | base64 -d`
1. You're all set!
#### Snippets
Here's some snippets to backup your current secrets **before the upgrade** (:warning: it requires [`jq`](https://stedolan.github.io/jq/download/)) :
```sh
# replace the below variables with yours (namespace + app)
namespace=infisical; app=infisical; components="frontend backend"
for component in $components; do
dpl=$(kubectl get deployment -n $namespace -l app=$app -l component=$component \
-o jsonpath="{.items[0].metadata.name}")
kubectl get deployments -n $namespace $dpl \
-o jsonpath='{.spec.template.spec.containers[0].env[*]}' | \
jq -r '.name + ":" + .value' > infisical-$component-conf.bak
done
```

8
helm-charts/infisical/templates/NOTES.txt
View File

@@ -68,13 +68,17 @@
│ $ helm uninstall {{ .Release.Namespace }} {{ .Release.Name }}
│
│ → Get MongoDB root password
│ $ kubectl get secret {{ .Release.Namespace }} mongodb
│ $ kubectl get secret -n {{ .Release.Namespace }} mongodb
│ -o jsonpath="{.data['mongodb-root-password']}" | base64 -d
│
│ → Get MongoDB users passwords
│ $ kubectl get secret {{ .Release.Namespace }} mongodb
│ $ kubectl get secret -n {{ .Release.Namespace }} mongodb
│ -o jsonpath="{.data['mongodb-passwords']}" | base64 -d
│
│ → Export your backend secrets (requires jq)
│ $ kubectl get secrets/{{ include infisical.backend.fullname . }} -n {{ .Release.Namespace }} \
│ -o json | jq '.data | map_values(@base64d)' > {{ include infisical.backend.fullname . }}.bak
│
╰―――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――┤
##