awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #314 from Grraahaam/feat/helm-mongodb-persistence

Browse Source 
feat(chart): mongodb persistence
This commit is contained in:
Maidul Islam
2023-02-18 18:06:39 -05:00
committed by GitHub
parent d88599714f b5d4cfed03
commit 1659dab87d
10 changed files with 638 additions and 107 deletions
Download Patch File Download Diff File Expand all files Collapse all files

43
helm-charts/README.md
View File

@@ -1,17 +1,36 @@
### helm repository Setup
Assuming you have helm already installed, it is straight-forward to add a Cloudsmith-based chart repository:
# Infisical Helm Charts
```
helm repo add infisical-helm-charts 'https://dl.cloudsmith.io/public/infisical/helm-charts/helm/charts/'
Welcome to Infisical Helm Charts repository! Find instructions below to setup and install our charts.
```sh
# Add the Infisical repository
helm repo add infisical 'https://dl.cloudsmith.io/public/infisical/helm-charts/helm/charts/' && helm repo update
# Install Infisical
helm upgrade --install --atomic \
-n infisical-dev --create-namespace \
infisical infisical/infisical
helm repo update
# Install Infisical Secrets Operator
helm upgrade --install --atomic \
-n infisical-dev --create-namespace \
infisical-secrets-operator infisical/secrets-operator
```
### Installing a Helm Chart
```
helm install infisical-helm-charts/<name-of-helm-chart>
```
## Charts
#### Available chart names
- infisical
- secrets-operator
Here's the link to our charts corresponding documentation :
- **`[infisical](./infisical/README.md)`**
- **`secrets-operator`**
## Documentation
We're trying to follow a documentation convention across our charts, allowing us to auto-generate markdown documentation thanks to [this tool](https://github.com/bitnami-labs/readme-generator-for-helm)
Steps to update the documentation :
1. `cd helm-charts/<chart>`
1. `git clone https://github.com/bitnami-labs/readme-generator-for-helm`
2. `npm install ./readme-generator-for-helm`
3. `npm exec readme-generator -- --readme README.md --values values.yaml`
- It'll insert the table below the `## Parameters` title
- It'll output errors if some of the path aren't documented

3
helm-charts/infisical/.gitignore vendored Normal file
View File

@@ -0,0 +1,3 @@
charts/
node_modules/
package*.json

9
helm-charts/infisical/Chart.lock Normal file
View File

@@ -0,0 +1,9 @@
dependencies:
- name: mongodb
repository: https://charts.bitnami.com/bitnami
version: 13.6.7
- name: mailhog
repository: https://codecentric.github.io/helm-charts
version: 5.2.3
digest: sha256:a54ae9ee60775f6f1aa916b59aee55b3ed5234b6bd88185fcb118b7f69539d70
generated: "2023-02-13T14:13:27.525541038+01:00"

12
helm-charts/infisical/Chart.yaml
View File

@@ -7,10 +7,20 @@ type: application
# This is the chart version. This version number should be incremented each time you make changes
# to the chart and its templates, including the app version.
# Versions are expected to follow Semantic Versioning (https://semver.org/)
version: 0.1.13
version: 0.1.14
# This is the version number of the application being deployed. This version number should be
# incremented each time you make changes to the application. Versions are not expected to
# follow Semantic Versioning. They should reflect the version the application is using.
# It is recommended to use it with quotes.
appVersion: "1.17.0"
dependencies:
- name: mongodb
version: "~13.6.7"
repository: "https://charts.bitnami.com/bitnami"
condition: mongodb.enabled
- name: mailhog
version: "~5.2.3"
repository: "https://codecentric.github.io/helm-charts"
condition: mailhog.enabled

187
helm-charts/infisical/README.md Normal file
View File

@@ -0,0 +1,187 @@
# Infisical - Helm Chart
This is the Infisical application Helm chart.
## Parameters
### Common parameters
| Name | Description | Value |
| ------------------ | ------------------------- | ----- |
| `nameOverride` | Override release name | `""` |
| `fullnameOverride` | Override release fullname | `""` |
### Infisical frontend parameters
| Name | Description | Value |
| --------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------- |
| `frontend.enabled` | Enable frontend | `true` |
| `frontend.name` | Backend name | `frontend` |
| `frontend.fullnameOverride` | Backend fullnameOverride | `""` |
| `frontend.podAnnotations` | Backend pod annotations | `{}` |
| `frontend.deploymentAnnotations` | Backend deployment annotations | `{}` |
| `frontend.replicaCount` | Backend replica count | `2` |
| `frontend.image.repository` | Backend image repository | `infisical/frontend` |
| `frontend.image.tag` | Backend image tag | `latest` |
| `frontend.image.pullPolicy` | Backend image pullPolicy | `IfNotPresent` |
| `frontend.kubeSecretRef` | Backend secret resource reference name (containing required [frontend configuration variables](https://infisical.com/docs/self-hosting/configuration/envars)) | `""` |
| `frontend.service.annotations` | Backend service annotations | `{}` |
| `frontend.service.type` | Backend service type | `ClusterIP` |
| `frontend.service.nodePort` | Backend service nodePort (used if above type is `NodePort`) | `""` |
| `frontendEnvironmentVariables.SITE_URL` | Absolute URL including the protocol (e.g. https://app.infisical.com) | `infisical.local` |
### Infisical backend parameters
| Name | Description | Value |
| ------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------- |
| `backend.enabled` | Enable backend | `true` |
| `backend.name` | Backend name | `backend` |
| `backend.fullnameOverride` | Backend fullnameOverride | `""` |
| `backend.podAnnotations` | Backend pod annotations | `{}` |
| `backend.deploymentAnnotations` | Backend deployment annotations | `{}` |
| `backend.replicaCount` | Backend replica count | `2` |
| `backend.image.repository` | Backend image repository | `infisical/backend` |
| `backend.image.tag` | Backend image tag | `latest` |
| `backend.image.pullPolicy` | Backend image pullPolicy | `IfNotPresent` |
| `backend.kubeSecretRef` | Backend secret resource reference name (containing required [backend configuration variables](https://infisical.com/docs/self-hosting/configuration/envars)) | `""` |
| `backend.service.annotations` | Backend service annotations | `{}` |
| `backend.service.type` | Backend service type | `ClusterIP` |
| `backend.service.nodePort` | Backend service nodePort (used if above type is `NodePort`) | `""` |
| `backendEnvironmentVariables.ENCRYPTION_KEY` | **Required** Backend encryption key (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)) | `MUST_REPLACE` |
| `backendEnvironmentVariables.JWT_SIGNUP_SECRET` | **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)) | `MUST_REPLACE` |
| `backendEnvironmentVariables.JWT_REFRESH_SECRET` | **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)) | `MUST_REPLACE` |
| `backendEnvironmentVariables.JWT_AUTH_SECRET` | **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)) | `MUST_REPLACE` |
| `backendEnvironmentVariables.JWT_SERVICE_SECRET` | **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)) | `MUST_REPLACE` |
| `backendEnvironmentVariables.SMTP_HOST` | **Required** Hostname to connect to for establishing SMTP connections | `MUST_REPLACE` |
| `backendEnvironmentVariables.SMTP_PORT` | Port to connect to for establishing SMTP connections | `587` |
| `backendEnvironmentVariables.SMTP_SECURE` | If true, use TLS when connecting to host. If false, TLS will be used if STARTTLS is supported | `false` |
| `backendEnvironmentVariables.SMTP_FROM_NAME` | Name label to be used in From field (e.g. Infisical) | `Infisical` |
| `backendEnvironmentVariables.SMTP_FROM_ADDRESS` | **Required** Email address to be used for sending emails (e.g. dev@infisical.com) | `MUST_REPLACE` |
| `backendEnvironmentVariables.SMTP_USERNAME` | **Required** Credential to connect to host (e.g. team@infisical.com) | `MUST_REPLACE` |
| `backendEnvironmentVariables.SMTP_PASSWORD` | **Required** Credential to connect to host | `MUST_REPLACE` |
| `backendEnvironmentVariables.SITE_URL` | Absolute URL including the protocol (e.g. https://app.infisical.com) | `infisical.local` |
### MongoDB(&reg;) parameters
| Name | Description | Value |
| --------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------- |
| `mongodb.enabled` | Enable MongoDB(&reg;) | `true` |
| `mongodb.name` | Name used to build variables (deprecated) | `mongodb` |
| `mongodb.fullnameOverride` | Fullname override | `mongodb` |
| `mongodb.nameOverride` | Name override | `mongodb` |
| `mongodb.podAnnotations` | Pod annotations | `{}` |
| `mongodb.useStatefulSet` | Set to true to use a StatefulSet instead of a Deployment (only when `architecture: standalone`) | `true` |
| `mongodb.architecture` | MongoDB(&reg;) architecture (`standalone` or `replicaset`) | `standalone` |
| `mongodb.image.repository` | MongoDB(&reg;) image registry | `bitnami/mongodb` |
| `mongodb.image.tag` | MongoDB(&reg;) image tag (immutable tags are recommended) | `6.0.4-debian-11-r0` |
| `mongodb.image.pullPolicy` | MongoDB(&reg;) image pull policy | `IfNotPresent` |
| `mongodb.service.annotations` | Service annotations | `{}` |
| `mongodb.auth.enabled` | Enable custom authentication | `true` |
| `mongodb.auth.usernames` | Custom usernames list ([special characters warning](https://www.mongodb.com/docs/manual/reference/connection-string/#standard-connection-string-format)) | `["infisical"]` |
| `mongodb.auth.passwords` | Custom passwords list, match the above usernames order ([special characters warning](https://www.mongodb.com/docs/manual/reference/connection-string/#standard-connection-string-format)) | `["infisical"]` |
| `mongodb.auth.databases` | Custom databases list ([special characters warning](https://www.mongodb.com/docs/manual/reference/connection-string/#standard-connection-string-format)) | `["infisical"]` |
| `mongodb.persistence.enabled` | Enable database persistence | `true` |
| `mongodb.persistence.existingClaim` | Existing persistent volume claim name | `""` |
| `mongodb.persistence.resourcePolicy` | Keep the persistent volume even on deletion (`keep` or `""`) | `keep` |
| `mongodb.persistence.accessModes` | Persistent volume access modes | `["ReadWriteOnce"]` |
| `mongodb.persistence.size` | Persistent storage request size | `8Gi` |
| `mongodbConnection.externalMongoDBConnectionString` | External MongoDB connection string | `""` |
### Ingress parameters
| Name | Description | Value |
| ------------------ | ------------------------------------------- | ----------------- |
| `ingress.enabled` | Enable ingress | `true` |
| `ingress.hostName` | Ingress hostname (your custom domain name) | `infisical.local` |
| `ingress.tls` | Ingress TLS hosts (matching above hostName) | `[]` |
### Mailhog parameters
| Name | Description | Value |
| ---------------------------------- | -------------------------- | ------------------------- |
| `mailhog.enabled` | Enable Mailhog | `false` |
| `mailhog.fullnameOverride` | Fullname override | `mailhog` |
| `mailhog.nameOverride` | Name override | `""` |
| `mailhog.image.repository` | Image repository | `lytrax/mailhog` |
| `mailhog.image.tag` | Image tag | `latest` |
| `mailhog.image.pullPolicy` | Image pull policy | `IfNotPresent` |
| `mailhog.containerPort.http.port` | Mailhog HTTP port (Web UI) | `8025` |
| `mailhog.containerPort.smtp.port` | Mailhog SMTP port (Mail) | `1025` |
| `mailhog.ingress.enabled` | Enable ingress | `true` |
| `mailhog.ingress.ingressClassName` | Ingress class name | `nginx` |
| `mailhog.ingress.annotations` | Ingress annotations | `{}` |
| `mailhog.ingress.labels` | Ingress labels | `{}` |
| `mailhog.ingress.hosts[0].host` | Mailhog host | `mailhog.infisical.local` |
## Persistence
The database persistence is enabled by default, your volumes will remain on your cluster even after uninstalling the chart. To disable persistence, set this value `mongodb.persistence.enabled: false`
## Local development
Use below values if you want to setup a local development environment, and adapt those variables as you need. Below example will deploy the following :
- https://infisical.local
- Your local Infisical instance
- You may have to add `infisical.local` to your `/etc/hosts` or similar depending your OS
- https://mailhog.infisical.local
- Local SMTP server used to receive the signup verification code
- You may have to add `mailhog.infisical.local` to your `/etc/hosts` or similar depending your OS
```yaml
# values.dev.yaml
# Enable all services for local development
frontend:
enabled: true
backend:
enabled: true
mongodb:
enabled: true
mailhog:
enabled: true
# Configure backend development variables
backendEnvironmentVariables:
ENCRYPTION_KEY: 6c1fe4e407b8911c104518103505b218
JWT_AUTH_SECRET: 4be6ba5602e0fa0ac6ac05c3cd4d247f
JWT_REFRESH_SECRET: 5f2f3c8f0159068dc2bbb3a652a716ff
JWT_SERVICE_SECRET: f32f716d70a42c5703f4656015e76200
JWT_SIGNUP_SECRET: 3679e04ca949f914c03332aaaeba805a
SITE_URL: https://infisical.local
SMTP_FROM_ADDRESS: dev@infisical.local
SMTP_FROM_NAME: Local Infisical
SMTP_HOST: mailhog
SMTP_PASSWORD: ""
SMTP_PORT: 1025
SMTP_SECURE: false
SMTP_USERNAME: dev@infisical.local
# Configure frontend development variables
frontendEnvironmentVariables:
SITE_URL: https://infisical.local
```
After creating the above file, run :
```sh
# Fetch the required charts
helm dep update
# Install/upgrade Infisical
helm upgrade --install --atomic \
-n infisical-dev --create-namespace \
-f ./values.dev.yaml \
infisical-dev .
```
## Upgrading
### 1.15.0
Refactoring in progress, instructions are coming soon

80
helm-charts/infisical/templates/NOTES.txt
View File

@@ -0,0 +1,80 @@
##
-- Infisical Helm Chart --
__ __
( _) ( _)
/ / \\ / /\_\_
/ / \\ / / | \ \
/ / \\ / / |\ \ \
/ / , \ , / / /| \ \
/ / |\_ /| / / / \ \_\
/ / |\/ _ '_|\ / / / \ \\
| / |/ 0 \0\\ / | | \ \\
| |\| \_\_ / / | \ \\
| | |/ \.\ o\o) / \ | \\
\ | /\\`v-v / | | \\
| \/ /_| \\_| / | | \ \\
| | /__/_ / _____ | | \ \\
\| [__] \_/ |_________ \ | \ ()
/ [___] ( \ \ |\ | | //
| [___] |\| \| / |/
/| [____] \ |/\ / / ||
( \ [____ / ) _\ \ \ \| | ||
\ \ [_____| / / __/ \ / / //
| \ [_____/ / / \ | \/ //
| / '----| /=\____ _/ | / //
__ / / | / ___/ _/\ \ | ||
(/-(/-\) / \ (/\/\)/ | / | /
(/\/\) / / //
_________/ / /
\____________/ (
██╗███╗ ██╗███████╗██╗███████╗██╗ ██████╗ █████╗ ██╗
██║████╗ ██║██╔════╝██║██╔════╝██║██╔════╝██╔══██╗██║
██║██╔██╗ ██║█████╗ ██║███████╗██║██║ ███████║██║
██║██║╚██╗██║██╔══╝ ██║╚════██║██║██║ ██╔══██║██║
██║██║ ╚████║██║ ██║███████║██║╚██████╗██║ ██║███████╗
╚═╝╚═╝ ╚═══╝╚═╝ ╚═╝╚══════╝╚═╝ ╚═════╝╚═╝ ╚═╝╚══════╝
{{ .Chart.Name }} ({{ .Chart.Version }})
╭―― Thank you for installing Infisical! 👋 ―――――――――――――――――――――――――――――――――――――――――――――――――――――――――――┤
│
│ Infisical / All-in-one open-source SecretOps solution to manage your secrets across your infra! 🔒🔑
│
│ Visit < https://infisical.com/docs/self-hosting/overview > for further documentation about self-hosting!
│
│ Current installation (infisical) :
│ • infisical-frontend : {{ .Values.frontend.enabled }}
│ • infisical-backend : {{ .Values.backend.enabled }}
│ • mongodb : {{ .Values.mongodb.enabled }}
│ • mailhog : {{ .Values.mailhog.enabled }}
│
╰―――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――┤
╭―― Here's a list of helpfull commands to get you started 📝 ―――――――――――――――――――――――――――――――――――――――――┤
│
│ → Get all the Infisical resources (excluding secrets/pvcs)
│ $ kubectl get all -n {{ .Release.Namespace }}
│
│ → Get your release status
│ $ helm status {{ .Release.Namespace }} {{ .Release.Name }}
│
│ → Get your release resources
│ $ helm get all {{ .Release.Namespace }} {{ .Release.Name }}
│
│ → Uninstall your release
│ $ helm uninstall {{ .Release.Namespace }} {{ .Release.Name }}
│
│ → Get MongoDB root password
│ $ kubectl get secret {{ .Release.Namespace }} mongodb
│ -o jsonpath="{.data['mongodb-root-password']}" | base64 -d
│
│ → Get MongoDB users passwords
│ $ kubectl get secret {{ .Release.Namespace }} mongodb
│ -o jsonpath="{.data['mongodb-passwords']}" | base64 -d
│
╰―――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――┤
##

7
helm-charts/infisical/templates/_helpers.tpl
View File

@@ -118,9 +118,10 @@ Create the mongodb connection string.
{{- define "infisical.mongodb.connectionString" -}}
{{- $host := include "infisical.mongodb.fullname" . -}}
{{- $port := 27017 -}}
{{- $user := "root" -}}
{{- $pass := "root" -}}
{{- $connectionString := printf "mongodb://%s:%s@%s:%d/" $user $pass $host $port -}}
{{- $user := first .Values.mongodb.auth.usernames | default "root" -}}
{{- $pass := first .Values.mongodb.auth.passwords | default "root" -}}
{{- $database := first .Values.mongodb.auth.databases | default "test" -}}
{{- $connectionString := printf "mongodb://%s:%s@%s:%d/%s" $user $pass $host $port $database -}}
{{- if .Values.mongodbConnection.externalMongoDBConnectionString -}}
{{- $connectionString = .Values.mongodbConnection.externalMongoDBConnectionString -}}
{{- end -}}

4
helm-charts/infisical/templates/backend-deployment.yaml
View File

@@ -64,9 +64,13 @@ metadata:
{{- toYaml . | nindent 4 }}
{{- end }}
spec:
type: {{ .Values.backend.service.type }}
selector:
{{- include "infisical.backend.matchLabels" . | nindent 8 }}
ports:
- protocol: TCP
port: 4000
targetPort: 4000 # container port
{{- if eq .Values.backend.service.type "NodePort" }}
nodePort: {{ .Values.backend.service.nodePort }}
{{- end }}

49
helm-charts/infisical/templates/mongodb-deployment.yaml
View File

@@ -1,49 +0,0 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: {{ include "infisical.mongodb.fullname" . }}
labels:
{{- include "infisical.mongodb.labels" . | nindent 4 }}
spec:
replicas: 1 # Cannot be scaled. To scale, you must set up Stateful Set
selector:
matchLabels:
{{- include "infisical.mongodb.matchLabels" . | nindent 6 }}
template:
metadata:
labels:
{{- include "infisical.mongodb.matchLabels" . | nindent 8 }}
{{- with .Values.mongodb.podAnnotations }}
annotations:
{{- toYaml . | nindent 8 }}
{{- end }}
spec:
containers:
- name: {{ template "infisical.name" . }}-{{ .Values.mongodb.name }}
image: "{{ .Values.mongodb.image.repository }}:{{ .Values.mongodb.image.tag | default .Chart.AppVersion }}"
imagePullPolicy: {{ .Values.mongodb.image.pullPolicy }}
ports:
- containerPort: 27017
env:
- name: MONGO_INITDB_ROOT_USERNAME
value: root
- name: MONGO_INITDB_ROOT_PASSWORD
value: root
---
apiVersion: v1
kind: Service
metadata:
name: {{ include "infisical.mongodb.fullname" . }}
labels:
{{- include "infisical.mongodb.labels" . | nindent 4 }}
{{- with .Values.mongodb.service.annotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
spec:
selector:
{{- include "infisical.mongodb.matchLabels" . | nindent 8 }}
ports:
- protocol: TCP
port: 27017
targetPort: 27017 # container port

351
helm-charts/infisical/values.yaml
View File

@@ -1,88 +1,355 @@
#####
# INFISICAL K8 DEFAULT VALUES FILE
# PLEASE REPLACE VALUES/EDIT AS REQUIRED
#####
## @section Common parameters
##
## @param nameOverride Override release name
##
nameOverride: ""
## @param fullnameOverride Override release fullname
##
fullnameOverride: ""
## @section Infisical frontend parameters
## Documentation : https://infisical.com/docs/self-hosting/deployments/kubernetes
##
frontend:
## @param frontend.enabled Enable frontend
##
enabled: true
## @param frontend.name Backend name
##
name: frontend
## @param frontend.fullnameOverride Backend fullnameOverride
##
fullnameOverride: ""
## @param frontend.podAnnotations Backend pod annotations
##
podAnnotations: {}
## @param frontend.deploymentAnnotations Backend deployment annotations
##
deploymentAnnotations: {}
## @param frontend.replicaCount Backend replica count
##
replicaCount: 2
## Backend image parameters
##
image:
## @param frontend.image.repository Backend image repository
##
repository: infisical/frontend
pullPolicy: IfNotPresent
## @param frontend.image.tag Backend image tag
##
tag: "latest"
# kubeSecretRef: some-kube-secret-name
## @param frontend.image.pullPolicy Backend image pullPolicy
##
pullPolicy: IfNotPresent
## @param frontend.kubeSecretRef Backend secret resource reference name (containing required [frontend configuration variables](https://infisical.com/docs/self-hosting/configuration/envars))
##
kubeSecretRef: ""
service:
# type of the frontend service
type: ClusterIP
# define the nodePort if service type is NodePort
# nodePort:
## @param frontend.service.annotations Backend service annotations
##
annotations: {}
## @param frontend.service.type Backend service type
##
type: ClusterIP
## @param frontend.service.nodePort Backend service nodePort (used if above type is `NodePort`)
##
nodePort: ""
## Frontend variables configuration
## Documentation : https://infisical.com/docs/self-hosting/configuration/envars
##
frontendEnvironmentVariables:
## @param frontendEnvironmentVariables.SITE_URL Absolute URL including the protocol (e.g. https://app.infisical.com)
##
SITE_URL: infisical.local
## @section Infisical backend parameters
## Documentation : https://infisical.com/docs/self-hosting/deployments/kubernetes
##
backend:
## @param backend.enabled Enable backend
##
enabled: true
## @param backend.name Backend name
##
name: backend
## @param backend.fullnameOverride Backend fullnameOverride
##
fullnameOverride: ""
## @param backend.podAnnotations Backend pod annotations
##
podAnnotations: {}
## @param backend.deploymentAnnotations Backend deployment annotations
##
deploymentAnnotations: {}
## @param backend.replicaCount Backend replica count
##
replicaCount: 2
## Backend image parameters
##
image:
## @param backend.image.repository Backend image repository
##
repository: infisical/backend
pullPolicy: IfNotPresent
## @param backend.image.tag Backend image tag
##
tag: "latest"
# kubeSecretRef: some-kube-secret-name
## @param backend.image.pullPolicy Backend image pullPolicy
##
pullPolicy: IfNotPresent
## @param backend.kubeSecretRef Backend secret resource reference name (containing required [backend configuration variables](https://infisical.com/docs/self-hosting/configuration/envars))
##
kubeSecretRef: ""
service:
## @param backend.service.annotations Backend service annotations
##
annotations: {}
## @param backend.service.type Backend service type
##
type: ClusterIP
## @param backend.service.nodePort Backend service nodePort (used if above type is `NodePort`)
##
nodePort: ""
## Backend variables configuration
## Documentation : https://infisical.com/docs/self-hosting/configuration/envars
##
backendEnvironmentVariables:
## @param backendEnvironmentVariables.ENCRYPTION_KEY **Required** Backend encryption key (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057))
## Command to generate the required value (linux) : 'hexdump -vn16 -e'4/4 "%08X" 1 "\n"' /dev/urandom', 'openssl rand -hex 16'
##
ENCRYPTION_KEY: MUST_REPLACE
## @param backendEnvironmentVariables.JWT_SIGNUP_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057))
## @param backendEnvironmentVariables.JWT_REFRESH_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057))
## @param backendEnvironmentVariables.JWT_AUTH_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057))
## @param backendEnvironmentVariables.JWT_SERVICE_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057))
## Command to generate the required value (linux) : 'hexdump -vn16 -e'4/4 "%08X" 1 "\n"' /dev/urandom', 'openssl rand -hex 16'
##
JWT_SIGNUP_SECRET: MUST_REPLACE
JWT_REFRESH_SECRET: MUST_REPLACE
JWT_AUTH_SECRET: MUST_REPLACE
JWT_SERVICE_SECRET: MUST_REPLACE
## @param backendEnvironmentVariables.SMTP_HOST **Required** Hostname to connect to for establishing SMTP connections
## @param backendEnvironmentVariables.SMTP_PORT Port to connect to for establishing SMTP connections
## @param backendEnvironmentVariables.SMTP_SECURE If true, use TLS when connecting to host. If false, TLS will be used if STARTTLS is supported
## @param backendEnvironmentVariables.SMTP_FROM_NAME Name label to be used in From field (e.g. Infisical)
## @param backendEnvironmentVariables.SMTP_FROM_ADDRESS **Required** Email address to be used for sending emails (e.g. dev@infisical.com)
## @param backendEnvironmentVariables.SMTP_USERNAME **Required** Credential to connect to host (e.g. team@infisical.com)
## @param backendEnvironmentVariables.SMTP_PASSWORD **Required** Credential to connect to host
##
SMTP_HOST: MUST_REPLACE
SMTP_PORT: 587
SMTP_SECURE: false
SMTP_FROM_NAME: Infisical
SMTP_FROM_ADDRESS: MUST_REPLACE
SMTP_USERNAME: MUST_REPLACE
SMTP_PASSWORD: MUST_REPLACE
## @param backendEnvironmentVariables.SITE_URL Absolute URL including the protocol (e.g. https://app.infisical.com)
##
SITE_URL: infisical.local
## @section MongoDB(&reg;) parameters
## Documentation : https://github.com/bitnami/charts/blob/main/bitnami/mongodb/values.yaml
##
mongodb:
name: mongodb
## @param mongodb.enabled Enable MongoDB(&reg;)
##
enabled: true
## @param mongodb.name Name used to build variables (deprecated)
##
name: "mongodb"
## @param mongodb.fullnameOverride Fullname override
##
fullnameOverride: "mongodb"
## @param mongodb.nameOverride Name override
##
nameOverride: "mongodb"
## @param mongodb.podAnnotations Pod annotations
##
podAnnotations: {}
## @param mongodb.useStatefulSet Set to true to use a StatefulSet instead of a Deployment (only when `architecture: standalone`)
##
useStatefulSet: true
## @param mongodb.architecture MongoDB(&reg;) architecture (`standalone` or `replicaset`)
##
architecture: "standalone"
## Bitnami MongoDB(&reg;) image
## ref: https://hub.docker.com/r/bitnami/mongodb/tags/
## @param mongodb.image.repository MongoDB(&reg;) image registry
## @param mongodb.image.tag MongoDB(&reg;) image tag (immutable tags are recommended)
## @param mongodb.image.pullPolicy MongoDB(&reg;) image pull policy
##
image:
repository: mongo
repository: bitnami/mongodb
pullPolicy: IfNotPresent
tag: "latest"
tag: "6.0.4-debian-11-r0"
## @param mongodb.service.annotations Service annotations
##
service:
annotations: {}
## Infisical MongoDB custom authentication
##
auth:
## @param mongodb.auth.enabled Enable custom authentication
##
enabled: true
## @param mongodb.auth.usernames Custom usernames list ([special characters warning](https://www.mongodb.com/docs/manual/reference/connection-string/#standard-connection-string-format))
##
usernames:
- "infisical"
## @param mongodb.auth.passwords Custom passwords list, match the above usernames order ([special characters warning](https://www.mongodb.com/docs/manual/reference/connection-string/#standard-connection-string-format))
##
passwords:
- "infisical"
## @param mongodb.auth.databases Custom databases list ([special characters warning](https://www.mongodb.com/docs/manual/reference/connection-string/#standard-connection-string-format))
##
databases:
- "infisical"
## MongoDB persistence configuration
##
persistence:
## @param mongodb.persistence.enabled Enable database persistence
##
enabled: true
## @param mongodb.persistence.existingClaim Existing persistent volume claim name
##
existingClaim: ""
## @param mongodb.persistence.resourcePolicy Keep the persistent volume even on deletion (`keep` or `""`)
##
resourcePolicy: "keep"
## @param mongodb.persistence.accessModes Persistent volume access modes
##
accessModes: ["ReadWriteOnce"]
## @param mongodb.persistence.size Persistent storage request size
##
size: 8Gi
# By default the backend will be connected to a Mongo instance in the cluster.
# However, it is recommended to add a managed document DB connection string because the DB instance in the cluster does not have persistence yet ( data will be deleted on next deploy).
# Learn about connection string type here https://www.mongodb.com/docs/manual/reference/connection-string/
mongodbConnection: {}
# externalMongoDBConnectionString: <>
## @param mongodbConnection.externalMongoDBConnectionString External MongoDB connection string
## By default the backend will be connected to a Mongo instance within the cluster
## However, it is recommended to add a managed document DB connection string for production-use (DBaaS)
## Learn about connection string type here https://www.mongodb.com/docs/manual/reference/connection-string/
## e.g. "mongodb://<user>:<pass>@<host>:<port>/<database-name>"
##
mongodbConnection:
externalMongoDBConnectionString: ""
## @section Ingress parameters
##
ingress:
## @param ingress.enabled Enable ingress
##
enabled: true
annotations:
## @skip ingress.annotations.kubernetes.io/ingress.class
##
kubernetes.io/ingress.class: "nginx"
hostName: example.com # replace with your domain
frontend:
# cert-manager.io/issuer: letsencrypt-nginx
## @param ingress.hostName Ingress hostname (your custom domain name)
## Replace with your own domain
##
hostName: infisical.local
## @skip ingress.frontend
##
frontend:
path: /
pathType: Prefix
## @skip ingress.backend
##
backend:
path: /api
pathType: Prefix
## @param ingress.tls Ingress TLS hosts (matching above hostName)
## Replace with your own domain
##
tls: []
# - secretName: letsencrypt-nginx
# hosts:
# - infisical.local
## @section Mailhog parameters
## Documentation : https://github.com/codecentric/helm-charts/blob/master/charts/mailhog/values.yaml
##
## Complete Ingress example
# ingress:
# enabled: true
# annotations:
# kubernetes.io/ingress.class: "nginx"
# cert-manager.io/issuer: letsencrypt-nginx
# hostName: k8.infisical.com
# frontend:
# path: /
# pathType: Prefix
# backend:
# path: /api
# pathType: Prefix
# tls:
# - secretName: letsencrypt-nginx
# hosts:
# - k8.infisical.com
mailhog:
## @param mailhog.enabled Enable Mailhog
##
enabled: false
## @param mailhog.fullnameOverride Fullname override
##
fullnameOverride: "mailhog"
## @param mailhog.nameOverride Name override
##
nameOverride: ""
## @param mailhog.image.repository Image repository
## Why we use this version : https://github.com/mailhog/MailHog/issues/353#issuecomment-821137362
## @param mailhog.image.tag Image tag
## @param mailhog.image.pullPolicy Image pull policy
##
image:
repository: lytrax/mailhog
tag: "latest"
pullPolicy: IfNotPresent
frontendEnvironmentVariables: {}
backendEnvironmentVariables: {}
containerPort:
## @param mailhog.containerPort.http.port Mailhog HTTP port (Web UI)
## @skip mailhog.containerPort.http.name
##
http:
name: http
port: 8025
## @param mailhog.containerPort.smtp.port Mailhog SMTP port (Mail)
## @skip mailhog.containerPort.smtp.name
##
smtp:
name: tcp-smtp
port: 1025
## @skip mailhog.service
##
service:
annotations: {}
extraPorts: []
clusterIP: ""
externalIPs: []
loadBalancerIP: ""
loadBalancerSourceRanges: []
type: ClusterIP
# Named target ports are not supported by GCE health checks, so when deploying on GKE
# and exposing it via GCE ingress, the health checks fail and the load balancer returns a 502.
namedTargetPort: true
port:
http: 8025
smtp: 1025
nodePort:
http: ""
smtp: ""
## Mailhog ingress
##
ingress:
## @param mailhog.ingress.enabled Enable ingress
##
enabled: true
## @param mailhog.ingress.ingressClassName Ingress class name
##
ingressClassName: nginx
## @param mailhog.ingress.annotations Ingress annotations
##
annotations: {}
# kubernetes.io/ingress.class: nginx
# kubernetes.io/tls-acme: "true"
## @param mailhog.ingress.labels Ingress labels
##
labels: {}
hosts:
## @param mailhog.ingress.hosts[0].host Mailhog host
##
- host: mailhog.infisical.local
## @skip mailhog.ingress.hosts[0].paths
##
paths:
- path: "/"
pathType: Prefix