diff --git a/helm-charts/infisical/README.md b/helm-charts/infisical/README.md index 4e20bbc86..d45b89f22 100644 --- a/helm-charts/infisical/README.md +++ b/helm-charts/infisical/README.md @@ -6,7 +6,7 @@ This is the Infisical application Helm chart. This chart includes the following | ---------- | ----------------------------------- | | `frontend` | Infisical's Web UI | | `backend` | Infisical's API | -| `mongodb` | Infisical's local database | +| `mongodb` | Infisical's database | | `mailhog` | Infisical's development SMTP server | ## Installation @@ -36,6 +36,17 @@ helm upgrade --install --atomic \ infisical infisical/infisical ``` +### Backup + +If not provided, a lot of variables will be auto-generated by default. It's recommended to save them somewhere safe, here's how (:warning: it requires [`jq`](https://stedolan.github.io/jq/download/)) : + +```sh +# export secrets to a given file (requires jq) +kubectl get secrets -n \ + -o json | jq '.data | map_values(@base64d)' > \ + .bak +``` + ## Parameters ### Common parameters @@ -68,34 +79,35 @@ helm upgrade --install --atomic \ ### Infisical backend parameters -| Name | Description | Value | -| ------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------- | -| `backend.enabled` | Enable backend | `true` | -| `backend.name` | Backend name | `backend` | -| `backend.fullnameOverride` | Backend fullnameOverride | `""` | -| `backend.podAnnotations` | Backend pod annotations | `{}` | -| `backend.deploymentAnnotations` | Backend deployment annotations | `{}` | -| `backend.replicaCount` | Backend replica count | `2` | -| `backend.image.repository` | Backend image repository | `infisical/backend` | -| `backend.image.tag` | Backend image tag | `latest` | -| `backend.image.pullPolicy` | Backend image pullPolicy | `IfNotPresent` | -| `backend.kubeSecretRef` | Backend secret resource reference name (containing required [backend configuration variables](https://infisical.com/docs/self-hosting/configuration/envars)) | `""` | -| `backend.service.annotations` | Backend service annotations | `{}` | -| `backend.service.type` | Backend service type | `ClusterIP` | -| `backend.service.nodePort` | Backend service nodePort (used if above type is `NodePort`) | `""` | -| `backendEnvironmentVariables.ENCRYPTION_KEY` | **Required** Backend encryption key (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)) | `MUST_REPLACE` | -| `backendEnvironmentVariables.JWT_SIGNUP_SECRET` | **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)) | `MUST_REPLACE` | -| `backendEnvironmentVariables.JWT_REFRESH_SECRET` | **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)) | `MUST_REPLACE` | -| `backendEnvironmentVariables.JWT_AUTH_SECRET` | **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)) | `MUST_REPLACE` | -| `backendEnvironmentVariables.JWT_SERVICE_SECRET` | **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)) | `MUST_REPLACE` | -| `backendEnvironmentVariables.SMTP_HOST` | **Required** Hostname to connect to for establishing SMTP connections | `MUST_REPLACE` | -| `backendEnvironmentVariables.SMTP_PORT` | Port to connect to for establishing SMTP connections | `587` | -| `backendEnvironmentVariables.SMTP_SECURE` | If true, use TLS when connecting to host. If false, TLS will be used if STARTTLS is supported | `false` | -| `backendEnvironmentVariables.SMTP_FROM_NAME` | Name label to be used in From field (e.g. Infisical) | `Infisical` | -| `backendEnvironmentVariables.SMTP_FROM_ADDRESS` | **Required** Email address to be used for sending emails (e.g. dev@infisical.com) | `MUST_REPLACE` | -| `backendEnvironmentVariables.SMTP_USERNAME` | **Required** Credential to connect to host (e.g. team@infisical.com) | `MUST_REPLACE` | -| `backendEnvironmentVariables.SMTP_PASSWORD` | **Required** Credential to connect to host | `MUST_REPLACE` | -| `backendEnvironmentVariables.SITE_URL` | Absolute URL including the protocol (e.g. https://app.infisical.com) | `infisical.local` | +| Name | Description | Value | +| ------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------- | +| `backend.enabled` | Enable backend | `true` | +| `backend.name` | Backend name | `backend` | +| `backend.fullnameOverride` | Backend fullnameOverride | `""` | +| `backend.podAnnotations` | Backend pod annotations | `{}` | +| `backend.deploymentAnnotations` | Backend deployment annotations | `{}` | +| `backend.replicaCount` | Backend replica count | `2` | +| `backend.image.repository` | Backend image repository | `infisical/backend` | +| `backend.image.tag` | Backend image tag | `latest` | +| `backend.image.pullPolicy` | Backend image pullPolicy | `IfNotPresent` | +| `backend.kubeSecretRef` | Backend secret resource reference name (containing required [backend configuration variables](https://infisical.com/docs/self-hosting/configuration/envars)) | `""` | +| `backend.service.annotations` | Backend service annotations | `{}` | +| `backend.service.type` | Backend service type | `ClusterIP` | +| `backend.service.nodePort` | Backend service nodePort (used if above type is `NodePort`) | `""` | +| `backendEnvironmentVariables.ENCRYPTION_KEY` | **Required** Backend encryption key (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057))
auto-generated variable (if not provided, and not found in an existing secret) | `""` | +| `backendEnvironmentVariables.JWT_SIGNUP_SECRET` | **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057))
auto-generated variable (if not provided, and not found in an existing secret) | `""` | +| `backendEnvironmentVariables.JWT_REFRESH_SECRET` | **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057))
auto-generated variable (if not provided, and not found in an existing secret) | `""` | +| `backendEnvironmentVariables.JWT_AUTH_SECRET` | **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057))
auto-generated variable (if not provided, and not found in an existing secret) | `""` | +| `backendEnvironmentVariables.JWT_SERVICE_SECRET` | **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057))
auto-generated variable (if not provided, and not found in an existing secret) | `""` | +| `backendEnvironmentVariables.JWT_MFA_SECRET` | **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057))
auto-generated variable (if not provided, and not found in an existing secret) | `""` | +| `backendEnvironmentVariables.SMTP_HOST` | **Required** Hostname to connect to for establishing SMTP connections | `""` | +| `backendEnvironmentVariables.SMTP_PORT` | Port to connect to for establishing SMTP connections | `587` | +| `backendEnvironmentVariables.SMTP_SECURE` | If true, use TLS when connecting to host. If false, TLS will be used if STARTTLS is supported | `false` | +| `backendEnvironmentVariables.SMTP_FROM_NAME` | Name label to be used in From field (e.g. Infisical) | `Infisical` | +| `backendEnvironmentVariables.SMTP_FROM_ADDRESS` | **Required** Email address to be used for sending emails (e.g. dev@infisical.com) | `""` | +| `backendEnvironmentVariables.SMTP_USERNAME` | **Required** Credential to connect to host (e.g. team@infisical.com) | `""` | +| `backendEnvironmentVariables.SMTP_PASSWORD` | **Required** Credential to connect to host | `""` | +| `backendEnvironmentVariables.SITE_URL` | Absolute URL including the protocol (e.g. https://app.infisical.com) | `infisical.local` | ### MongoDB(®) parameters @@ -112,11 +124,25 @@ helm upgrade --install --atomic \ | `mongodb.image.repository` | MongoDB(®) image registry | `bitnami/mongodb` | | `mongodb.image.tag` | MongoDB(®) image tag (immutable tags are recommended) | `6.0.4-debian-11-r0` | | `mongodb.image.pullPolicy` | MongoDB(®) image pull policy | `IfNotPresent` | +| `mongodb.livenessProbe.enabled` | Enable livenessProbe | `true` | +| `mongodb.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `30` | +| `mongodb.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `20` | +| `mongodb.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `10` | +| `mongodb.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `6` | +| `mongodb.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | +| `mongodb.readinessProbe.enabled` | Enable readinessProbe | `true` | +| `mongodb.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` | +| `mongodb.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | +| `mongodb.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `10` | +| `mongodb.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `6` | +| `mongodb.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | | `mongodb.service.annotations` | Service annotations | `{}` | | `mongodb.auth.enabled` | Enable custom authentication | `true` | | `mongodb.auth.usernames` | Custom usernames list ([special characters warning](https://www.mongodb.com/docs/manual/reference/connection-string/#standard-connection-string-format)) | `["infisical"]` | | `mongodb.auth.passwords` | Custom passwords list, match the above usernames order ([special characters warning](https://www.mongodb.com/docs/manual/reference/connection-string/#standard-connection-string-format)) | `["infisical"]` | | `mongodb.auth.databases` | Custom databases list ([special characters warning](https://www.mongodb.com/docs/manual/reference/connection-string/#standard-connection-string-format)) | `["infisical"]` | +| `mongodb.auth.rootUser` | Database root user name | `root` | +| `mongodb.auth.rootPassword` | Database root user password | `root` | | `mongodb.persistence.enabled` | Enable database persistence | `true` | | `mongodb.persistence.existingClaim` | Existing persistent volume claim name | `""` | | `mongodb.persistence.resourcePolicy` | Keep the persistent volume even on deletion (`keep` or `""`) | `keep` | @@ -127,11 +153,13 @@ helm upgrade --install --atomic \ ### Ingress parameters -| Name | Description | Value | -| ------------------ | ------------------------------------------- | ----------------- | -| `ingress.enabled` | Enable ingress | `true` | -| `ingress.hostName` | Ingress hostname (your custom domain name) | `infisical.local` | -| `ingress.tls` | Ingress TLS hosts (matching above hostName) | `[]` | +| Name | Description | Value | +| -------------------------- | ------------------------------------------- | ----------------- | +| `ingress.enabled` | Enable ingress | `true` | +| `ingress.ingressClassName` | Ingress class name | `nginx` | +| `ingress.annotations` | Ingress annotations | `{}` | +| `ingress.hostName` | Ingress hostname (your custom domain name) | `infisical.local` | +| `ingress.tls` | Ingress TLS hosts (matching above hostName) | `[]` | ### Mailhog parameters @@ -152,7 +180,7 @@ helm upgrade --install --atomic \ | `mailhog.ingress.labels` | Ingress labels | `{}` | | `mailhog.ingress.hosts[0].host` | Mailhog host | `mailhog.infisical.local` | -Learn more in our [docs](https://infisical.com/docs/self-hosting/deployments/kubernetes) + ## Persistence @@ -185,32 +213,37 @@ Below example will deploy the following : - The corresponding IP will depend on the tool or the way you're exposing the services ([learn more](https://minikube.sigs.k8s.io/docs/handbook/host-access/)) - [**mailhog.infisical.local**](https://mailhog.infisical.local) - - Local SMTP server used to receive the signup verification code + - Local SMTP server used to receive the emails (e.g. signup verification code) - You may have to add `mailhog.infisical.local` to your `/etc/hosts` or similar depending your OS - The corresponding IP will depend on the tool or the way you're exposing the services ([learn more](https://minikube.sigs.k8s.io/docs/handbook/host-access/)) Use below values to setup a local development environment, adapt those variables as you need +#### TL;DR + +If you're running a k8s cluster with `ingress-nginx`, you can run one of the below scripts : + +```sh +# With 'kind' + 'helm', to create a local cluster and deploy the chart +./examples.local-kind.sh + +# With 'helm' only, if you already have a cluster to deploy the chart +./examples.local-helm.sh +``` + +#### Instructions + +Here's the step-by-step instructions to setup your local development environment. First create the below file : + ```yaml # values.dev.yaml -# Enable all services for local development -frontend: - enabled: true -backend: - enabled: true -mongodb: - enabled: true +# Enable mailhog for local development mailhog: enabled: true # Configure backend development variables (required) backendEnvironmentVariables: - ENCRYPTION_KEY: 6c1fe4e407b8911c104518103505b218 - JWT_AUTH_SECRET: 4be6ba5602e0fa0ac6ac05c3cd4d247f - JWT_REFRESH_SECRET: 5f2f3c8f0159068dc2bbb3a652a716ff - JWT_SERVICE_SECRET: f32f716d70a42c5703f4656015e76200 - JWT_SIGNUP_SECRET: 3679e04ca949f914c03332aaaeba805a SITE_URL: https://infisical.local SMTP_FROM_ADDRESS: dev@infisical.local SMTP_FROM_NAME: Local Infisical @@ -240,6 +273,63 @@ helm upgrade --install --atomic \ ## Upgrading -### 1.15.0 +Find the chart upgrade instructions below. When upgrading from your version to one of the listed below, please follow every instructions in between. -Refactoring in progress, instructions are coming soon \ No newline at end of file +Here's a snippet to upgrade your installation manually : + +```sh +# replace below '' with your own values +helm upgrade --install --atomic \ + -n "" --create-namespace \ + -f "" \ + . +``` + +### 0.1.16 + +- Auto-generation for the following variables, to ease your future upgrades or setups : + - `ENCRYPTION_KEY` + - `JWT_SIGNUP_SECRET` + - `JWT_REFRESH_SECRET` + - `JWT_AUTH_SECRET` + - `JWT_SERVICE_SECRET` + - `JWT_MFA_SECRET` + +We've migrated the applications' environment variables into `secrets` resources, shared within the deployments through `envFrom`. If you upgrade your installation make sure to backup your deployments' environment variables (e.g. encryption key and jwt secrets). + +The preference order is : +- **user-defined** (values file or inline) + - **existing-secret** (for existing installations, you don't have to specify the secrets when upgrading if they already exist) + - **auto-generated** (if none of the values above have been found, we'll auto-generate a value for the user, only for the above mentioned variables) + +#### Instructions + +1. Make sure **you have all the required environment variables** defined in the value file (or inline `--set`) you'll provide to `helm` + 1. e.g. All the above mentioned variables +1. **Backup your existing secrets** (safety precaution) + 1. with below [snippets](#snippets) +1. **Upgrade the chart**, with the [instructions](#upgrading) + 1. It'll create a secret per service, and store the secrets/conf within (auto-generate if you don't provide the required ones) + 1. It'll link the secret to the deployment through `envFrom` + 1. It'll automatically remove the hard-coded `env.*` variables from your infisical deployments +1. Make sure that the **created secrets match the ones in your backups** + 1. e.g. `kubectl get secret -n -backend --template={{.data.ENCRYPTION_KEY}} | base64 -d` +1. You're all set! + +#### Snippets + +Here's some snippets to backup your current secrets **before the upgrade** (:warning: it requires [`jq`](https://stedolan.github.io/jq/download/)) : + +```sh +# replace the below variables with yours (namespace + app) +namespace=infisical; app=infisical; components="frontend backend" + +for component in $components; do + dpl=$(kubectl get deployment -n $namespace -l app=$app -l component=$component \ + -o jsonpath="{.items[0].metadata.name}") + + kubectl get deployments -n $namespace $dpl \ + -o jsonpath='{.spec.template.spec.containers[0].env[*]}' | \ + jq -r '.name + ":" + .value' > infisical-$component-conf.bak +done +``` \ No newline at end of file diff --git a/helm-charts/infisical/templates/NOTES.txt b/helm-charts/infisical/templates/NOTES.txt index 027ecde67..142fa202d 100644 --- a/helm-charts/infisical/templates/NOTES.txt +++ b/helm-charts/infisical/templates/NOTES.txt @@ -68,13 +68,17 @@ │ $ helm uninstall {{ .Release.Namespace }} {{ .Release.Name }} │ │ → Get MongoDB root password -│ $ kubectl get secret {{ .Release.Namespace }} mongodb +│ $ kubectl get secret -n {{ .Release.Namespace }} mongodb │ -o jsonpath="{.data['mongodb-root-password']}" | base64 -d │ │ → Get MongoDB users passwords -│ $ kubectl get secret {{ .Release.Namespace }} mongodb +│ $ kubectl get secret -n {{ .Release.Namespace }} mongodb │ -o jsonpath="{.data['mongodb-passwords']}" | base64 -d │ +│ → Export your backend secrets (requires jq) +│ $ kubectl get secrets/{{ include infisical.backend.fullname . }} -n {{ .Release.Namespace }} \ +│ -o json | jq '.data | map_values(@base64d)' > {{ include infisical.backend.fullname . }}.bak +│ ╰―――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――┤ ## \ No newline at end of file