diff --git a/helm-charts/README.md b/helm-charts/README.md index 468275e3f..01675d0b2 100644 --- a/helm-charts/README.md +++ b/helm-charts/README.md @@ -1,17 +1,36 @@ -### helm repository Setup -Assuming you have helm already installed, it is straight-forward to add a Cloudsmith-based chart repository: +# Infisical Helm Charts -``` -helm repo add infisical-helm-charts 'https://dl.cloudsmith.io/public/infisical/helm-charts/helm/charts/' +Welcome to Infisical Helm Charts repository! Find instructions below to setup and install our charts. + +```sh +# Add the Infisical repository +helm repo add infisical 'https://dl.cloudsmith.io/public/infisical/helm-charts/helm/charts/' && helm repo update + +# Install Infisical +helm upgrade --install --atomic \ + -n infisical-dev --create-namespace \ + infisical infisical/infisical -helm repo update +# Install Infisical Secrets Operator +helm upgrade --install --atomic \ + -n infisical-dev --create-namespace \ + infisical-secrets-operator infisical/secrets-operator ``` -### Installing a Helm Chart -``` -helm install infisical-helm-charts/ -``` +## Charts -#### Available chart names -- infisical -- secrets-operator +Here's the link to our charts corresponding documentation : +- **`[infisical](./infisical/README.md)`** +- **`secrets-operator`** + +## Documentation + +We're trying to follow a documentation convention across our charts, allowing us to auto-generate markdown documentation thanks to [this tool](https://github.com/bitnami-labs/readme-generator-for-helm) + +Steps to update the documentation : +1. `cd helm-charts/` +1. `git clone https://github.com/bitnami-labs/readme-generator-for-helm` +2. `npm install ./readme-generator-for-helm` +3. `npm exec readme-generator -- --readme README.md --values values.yaml` + - It'll insert the table below the `## Parameters` title + - It'll output errors if some of the path aren't documented \ No newline at end of file diff --git a/helm-charts/infisical/.gitignore b/helm-charts/infisical/.gitignore new file mode 100644 index 000000000..a2968aad7 --- /dev/null +++ b/helm-charts/infisical/.gitignore @@ -0,0 +1,3 @@ +charts/ +node_modules/ +package*.json \ No newline at end of file diff --git a/helm-charts/infisical/Chart.lock b/helm-charts/infisical/Chart.lock new file mode 100644 index 000000000..3b5f48ca4 --- /dev/null +++ b/helm-charts/infisical/Chart.lock @@ -0,0 +1,9 @@ +dependencies: +- name: mongodb + repository: https://charts.bitnami.com/bitnami + version: 13.6.7 +- name: mailhog + repository: https://codecentric.github.io/helm-charts + version: 5.2.3 +digest: sha256:a54ae9ee60775f6f1aa916b59aee55b3ed5234b6bd88185fcb118b7f69539d70 +generated: "2023-02-13T14:13:27.525541038+01:00" diff --git a/helm-charts/infisical/Chart.yaml b/helm-charts/infisical/Chart.yaml index fe65e3b11..d0d293b71 100644 --- a/helm-charts/infisical/Chart.yaml +++ b/helm-charts/infisical/Chart.yaml @@ -7,10 +7,20 @@ type: application # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. # Versions are expected to follow Semantic Versioning (https://semver.org/) -version: 0.1.13 +version: 0.1.14 # This is the version number of the application being deployed. This version number should be # incremented each time you make changes to the application. Versions are not expected to # follow Semantic Versioning. They should reflect the version the application is using. # It is recommended to use it with quotes. appVersion: "1.17.0" + +dependencies: + - name: mongodb + version: "~13.6.7" + repository: "https://charts.bitnami.com/bitnami" + condition: mongodb.enabled + - name: mailhog + version: "~5.2.3" + repository: "https://codecentric.github.io/helm-charts" + condition: mailhog.enabled \ No newline at end of file diff --git a/helm-charts/infisical/README.md b/helm-charts/infisical/README.md new file mode 100644 index 000000000..6965b818a --- /dev/null +++ b/helm-charts/infisical/README.md @@ -0,0 +1,187 @@ +# Infisical - Helm Chart + +This is the Infisical application Helm chart. + +## Parameters + +### Common parameters + +| Name | Description | Value | +| ------------------ | ------------------------- | ----- | +| `nameOverride` | Override release name | `""` | +| `fullnameOverride` | Override release fullname | `""` | + + +### Infisical frontend parameters + +| Name | Description | Value | +| --------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------- | +| `frontend.enabled` | Enable frontend | `true` | +| `frontend.name` | Backend name | `frontend` | +| `frontend.fullnameOverride` | Backend fullnameOverride | `""` | +| `frontend.podAnnotations` | Backend pod annotations | `{}` | +| `frontend.deploymentAnnotations` | Backend deployment annotations | `{}` | +| `frontend.replicaCount` | Backend replica count | `2` | +| `frontend.image.repository` | Backend image repository | `infisical/frontend` | +| `frontend.image.tag` | Backend image tag | `latest` | +| `frontend.image.pullPolicy` | Backend image pullPolicy | `IfNotPresent` | +| `frontend.kubeSecretRef` | Backend secret resource reference name (containing required [frontend configuration variables](https://infisical.com/docs/self-hosting/configuration/envars)) | `""` | +| `frontend.service.annotations` | Backend service annotations | `{}` | +| `frontend.service.type` | Backend service type | `ClusterIP` | +| `frontend.service.nodePort` | Backend service nodePort (used if above type is `NodePort`) | `""` | +| `frontendEnvironmentVariables.SITE_URL` | Absolute URL including the protocol (e.g. https://app.infisical.com) | `infisical.local` | + + +### Infisical backend parameters + +| Name | Description | Value | +| ------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------- | +| `backend.enabled` | Enable backend | `true` | +| `backend.name` | Backend name | `backend` | +| `backend.fullnameOverride` | Backend fullnameOverride | `""` | +| `backend.podAnnotations` | Backend pod annotations | `{}` | +| `backend.deploymentAnnotations` | Backend deployment annotations | `{}` | +| `backend.replicaCount` | Backend replica count | `2` | +| `backend.image.repository` | Backend image repository | `infisical/backend` | +| `backend.image.tag` | Backend image tag | `latest` | +| `backend.image.pullPolicy` | Backend image pullPolicy | `IfNotPresent` | +| `backend.kubeSecretRef` | Backend secret resource reference name (containing required [backend configuration variables](https://infisical.com/docs/self-hosting/configuration/envars)) | `""` | +| `backend.service.annotations` | Backend service annotations | `{}` | +| `backend.service.type` | Backend service type | `ClusterIP` | +| `backend.service.nodePort` | Backend service nodePort (used if above type is `NodePort`) | `""` | +| `backendEnvironmentVariables.ENCRYPTION_KEY` | **Required** Backend encryption key (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)) | `MUST_REPLACE` | +| `backendEnvironmentVariables.JWT_SIGNUP_SECRET` | **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)) | `MUST_REPLACE` | +| `backendEnvironmentVariables.JWT_REFRESH_SECRET` | **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)) | `MUST_REPLACE` | +| `backendEnvironmentVariables.JWT_AUTH_SECRET` | **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)) | `MUST_REPLACE` | +| `backendEnvironmentVariables.JWT_SERVICE_SECRET` | **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)) | `MUST_REPLACE` | +| `backendEnvironmentVariables.SMTP_HOST` | **Required** Hostname to connect to for establishing SMTP connections | `MUST_REPLACE` | +| `backendEnvironmentVariables.SMTP_PORT` | Port to connect to for establishing SMTP connections | `587` | +| `backendEnvironmentVariables.SMTP_SECURE` | If true, use TLS when connecting to host. If false, TLS will be used if STARTTLS is supported | `false` | +| `backendEnvironmentVariables.SMTP_FROM_NAME` | Name label to be used in From field (e.g. Infisical) | `Infisical` | +| `backendEnvironmentVariables.SMTP_FROM_ADDRESS` | **Required** Email address to be used for sending emails (e.g. dev@infisical.com) | `MUST_REPLACE` | +| `backendEnvironmentVariables.SMTP_USERNAME` | **Required** Credential to connect to host (e.g. team@infisical.com) | `MUST_REPLACE` | +| `backendEnvironmentVariables.SMTP_PASSWORD` | **Required** Credential to connect to host | `MUST_REPLACE` | +| `backendEnvironmentVariables.SITE_URL` | Absolute URL including the protocol (e.g. https://app.infisical.com) | `infisical.local` | + + +### MongoDB(®) parameters + +| Name | Description | Value | +| --------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------- | +| `mongodb.enabled` | Enable MongoDB(®) | `true` | +| `mongodb.name` | Name used to build variables (deprecated) | `mongodb` | +| `mongodb.fullnameOverride` | Fullname override | `mongodb` | +| `mongodb.nameOverride` | Name override | `mongodb` | +| `mongodb.podAnnotations` | Pod annotations | `{}` | +| `mongodb.useStatefulSet` | Set to true to use a StatefulSet instead of a Deployment (only when `architecture: standalone`) | `true` | +| `mongodb.architecture` | MongoDB(®) architecture (`standalone` or `replicaset`) | `standalone` | +| `mongodb.image.repository` | MongoDB(®) image registry | `bitnami/mongodb` | +| `mongodb.image.tag` | MongoDB(®) image tag (immutable tags are recommended) | `6.0.4-debian-11-r0` | +| `mongodb.image.pullPolicy` | MongoDB(®) image pull policy | `IfNotPresent` | +| `mongodb.service.annotations` | Service annotations | `{}` | +| `mongodb.auth.enabled` | Enable custom authentication | `true` | +| `mongodb.auth.usernames` | Custom usernames list ([special characters warning](https://www.mongodb.com/docs/manual/reference/connection-string/#standard-connection-string-format)) | `["infisical"]` | +| `mongodb.auth.passwords` | Custom passwords list, match the above usernames order ([special characters warning](https://www.mongodb.com/docs/manual/reference/connection-string/#standard-connection-string-format)) | `["infisical"]` | +| `mongodb.auth.databases` | Custom databases list ([special characters warning](https://www.mongodb.com/docs/manual/reference/connection-string/#standard-connection-string-format)) | `["infisical"]` | +| `mongodb.persistence.enabled` | Enable database persistence | `true` | +| `mongodb.persistence.existingClaim` | Existing persistent volume claim name | `""` | +| `mongodb.persistence.resourcePolicy` | Keep the persistent volume even on deletion (`keep` or `""`) | `keep` | +| `mongodb.persistence.accessModes` | Persistent volume access modes | `["ReadWriteOnce"]` | +| `mongodb.persistence.size` | Persistent storage request size | `8Gi` | +| `mongodbConnection.externalMongoDBConnectionString` | External MongoDB connection string | `""` | + + +### Ingress parameters + +| Name | Description | Value | +| ------------------ | ------------------------------------------- | ----------------- | +| `ingress.enabled` | Enable ingress | `true` | +| `ingress.hostName` | Ingress hostname (your custom domain name) | `infisical.local` | +| `ingress.tls` | Ingress TLS hosts (matching above hostName) | `[]` | + + +### Mailhog parameters + +| Name | Description | Value | +| ---------------------------------- | -------------------------- | ------------------------- | +| `mailhog.enabled` | Enable Mailhog | `false` | +| `mailhog.fullnameOverride` | Fullname override | `mailhog` | +| `mailhog.nameOverride` | Name override | `""` | +| `mailhog.image.repository` | Image repository | `lytrax/mailhog` | +| `mailhog.image.tag` | Image tag | `latest` | +| `mailhog.image.pullPolicy` | Image pull policy | `IfNotPresent` | +| `mailhog.containerPort.http.port` | Mailhog HTTP port (Web UI) | `8025` | +| `mailhog.containerPort.smtp.port` | Mailhog SMTP port (Mail) | `1025` | +| `mailhog.ingress.enabled` | Enable ingress | `true` | +| `mailhog.ingress.ingressClassName` | Ingress class name | `nginx` | +| `mailhog.ingress.annotations` | Ingress annotations | `{}` | +| `mailhog.ingress.labels` | Ingress labels | `{}` | +| `mailhog.ingress.hosts[0].host` | Mailhog host | `mailhog.infisical.local` | + + +## Persistence + +The database persistence is enabled by default, your volumes will remain on your cluster even after uninstalling the chart. To disable persistence, set this value `mongodb.persistence.enabled: false` + +## Local development + +Use below values if you want to setup a local development environment, and adapt those variables as you need. Below example will deploy the following : +- https://infisical.local + - Your local Infisical instance + - You may have to add `infisical.local` to your `/etc/hosts` or similar depending your OS +- https://mailhog.infisical.local + - Local SMTP server used to receive the signup verification code + - You may have to add `mailhog.infisical.local` to your `/etc/hosts` or similar depending your OS + +```yaml +# values.dev.yaml + +# Enable all services for local development +frontend: + enabled: true +backend: + enabled: true +mongodb: + enabled: true +mailhog: + enabled: true + +# Configure backend development variables +backendEnvironmentVariables: + ENCRYPTION_KEY: 6c1fe4e407b8911c104518103505b218 + JWT_AUTH_SECRET: 4be6ba5602e0fa0ac6ac05c3cd4d247f + JWT_REFRESH_SECRET: 5f2f3c8f0159068dc2bbb3a652a716ff + JWT_SERVICE_SECRET: f32f716d70a42c5703f4656015e76200 + JWT_SIGNUP_SECRET: 3679e04ca949f914c03332aaaeba805a + SITE_URL: https://infisical.local + SMTP_FROM_ADDRESS: dev@infisical.local + SMTP_FROM_NAME: Local Infisical + SMTP_HOST: mailhog + SMTP_PASSWORD: "" + SMTP_PORT: 1025 + SMTP_SECURE: false + SMTP_USERNAME: dev@infisical.local + +# Configure frontend development variables +frontendEnvironmentVariables: + SITE_URL: https://infisical.local +``` + +After creating the above file, run : + +```sh +# Fetch the required charts +helm dep update + +# Install/upgrade Infisical +helm upgrade --install --atomic \ + -n infisical-dev --create-namespace \ + -f ./values.dev.yaml \ + infisical-dev . +``` + +## Upgrading + +### 1.15.0 + +Refactoring in progress, instructions are coming soon \ No newline at end of file diff --git a/helm-charts/infisical/templates/NOTES.txt b/helm-charts/infisical/templates/NOTES.txt index e69de29bb..027ecde67 100644 --- a/helm-charts/infisical/templates/NOTES.txt +++ b/helm-charts/infisical/templates/NOTES.txt @@ -0,0 +1,80 @@ +## + +-- Infisical Helm Chart -- + + __ __ + ( _) ( _) + / / \\ / /\_\_ + / / \\ / / | \ \ + / / \\ / / |\ \ \ + / / , \ , / / /| \ \ + / / |\_ /| / / / \ \_\ + / / |\/ _ '_|\ / / / \ \\ + | / |/ 0 \0\\ / | | \ \\ + | |\| \_\_ / / | \ \\ + | | |/ \.\ o\o) / \ | \\ + \ | /\\`v-v / | | \\ + | \/ /_| \\_| / | | \ \\ + | | /__/_ / _____ | | \ \\ + \| [__] \_/ |_________ \ | \ () + / [___] ( \ \ |\ | | // + | [___] |\| \| / |/ + /| [____] \ |/\ / / || + ( \ [____ / ) _\ \ \ \| | || + \ \ [_____| / / __/ \ / / // + | \ [_____/ / / \ | \/ // + | / '----| /=\____ _/ | / // + __ / / | / ___/ _/\ \ | || + (/-(/-\) / \ (/\/\)/ | / | / + (/\/\) / / // + _________/ / / + \____________/ ( + +██╗███╗ ██╗███████╗██╗███████╗██╗ ██████╗ █████╗ ██╗ +██║████╗ ██║██╔════╝██║██╔════╝██║██╔════╝██╔══██╗██║ +██║██╔██╗ ██║█████╗ ██║███████╗██║██║ ███████║██║ +██║██║╚██╗██║██╔══╝ ██║╚════██║██║██║ ██╔══██║██║ +██║██║ ╚████║██║ ██║███████║██║╚██████╗██║ ██║███████╗ +╚═╝╚═╝ ╚═══╝╚═╝ ╚═╝╚══════╝╚═╝ ╚═════╝╚═╝ ╚═╝╚══════╝ +{{ .Chart.Name }} ({{ .Chart.Version }}) + + +╭―― Thank you for installing Infisical! 👋 ―――――――――――――――――――――――――――――――――――――――――――――――――――――――――――┤ +│ +│ Infisical / All-in-one open-source SecretOps solution to manage your secrets across your infra! 🔒🔑 +│ +│ Visit < https://infisical.com/docs/self-hosting/overview > for further documentation about self-hosting! +│ +│ Current installation (infisical) : +│ • infisical-frontend : {{ .Values.frontend.enabled }} +│ • infisical-backend : {{ .Values.backend.enabled }} +│ • mongodb : {{ .Values.mongodb.enabled }} +│ • mailhog : {{ .Values.mailhog.enabled }} +│ +╰―――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――┤ + +╭―― Here's a list of helpfull commands to get you started 📝 ―――――――――――――――――――――――――――――――――――――――――┤ +│ +│ → Get all the Infisical resources (excluding secrets/pvcs) +│ $ kubectl get all -n {{ .Release.Namespace }} +│ +│ → Get your release status +│ $ helm status {{ .Release.Namespace }} {{ .Release.Name }} +│ +│ → Get your release resources +│ $ helm get all {{ .Release.Namespace }} {{ .Release.Name }} +│ +│ → Uninstall your release +│ $ helm uninstall {{ .Release.Namespace }} {{ .Release.Name }} +│ +│ → Get MongoDB root password +│ $ kubectl get secret {{ .Release.Namespace }} mongodb +│ -o jsonpath="{.data['mongodb-root-password']}" | base64 -d +│ +│ → Get MongoDB users passwords +│ $ kubectl get secret {{ .Release.Namespace }} mongodb +│ -o jsonpath="{.data['mongodb-passwords']}" | base64 -d +│ +╰―――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――┤ + +## \ No newline at end of file diff --git a/helm-charts/infisical/templates/_helpers.tpl b/helm-charts/infisical/templates/_helpers.tpl index d0ceb0641..bf3f8e301 100644 --- a/helm-charts/infisical/templates/_helpers.tpl +++ b/helm-charts/infisical/templates/_helpers.tpl @@ -118,9 +118,10 @@ Create the mongodb connection string. {{- define "infisical.mongodb.connectionString" -}} {{- $host := include "infisical.mongodb.fullname" . -}} {{- $port := 27017 -}} -{{- $user := "root" -}} -{{- $pass := "root" -}} -{{- $connectionString := printf "mongodb://%s:%s@%s:%d/" $user $pass $host $port -}} +{{- $user := first .Values.mongodb.auth.usernames | default "root" -}} +{{- $pass := first .Values.mongodb.auth.passwords | default "root" -}} +{{- $database := first .Values.mongodb.auth.databases | default "test" -}} +{{- $connectionString := printf "mongodb://%s:%s@%s:%d/%s" $user $pass $host $port $database -}} {{- if .Values.mongodbConnection.externalMongoDBConnectionString -}} {{- $connectionString = .Values.mongodbConnection.externalMongoDBConnectionString -}} {{- end -}} diff --git a/helm-charts/infisical/templates/backend-deployment.yaml b/helm-charts/infisical/templates/backend-deployment.yaml index 7a366d390..f93f3c87e 100644 --- a/helm-charts/infisical/templates/backend-deployment.yaml +++ b/helm-charts/infisical/templates/backend-deployment.yaml @@ -64,9 +64,13 @@ metadata: {{- toYaml . | nindent 4 }} {{- end }} spec: + type: {{ .Values.backend.service.type }} selector: {{- include "infisical.backend.matchLabels" . | nindent 8 }} ports: - protocol: TCP port: 4000 targetPort: 4000 # container port + {{- if eq .Values.backend.service.type "NodePort" }} + nodePort: {{ .Values.backend.service.nodePort }} + {{- end }} diff --git a/helm-charts/infisical/templates/mongodb-deployment.yaml b/helm-charts/infisical/templates/mongodb-deployment.yaml deleted file mode 100644 index c9a4b13a8..000000000 --- a/helm-charts/infisical/templates/mongodb-deployment.yaml +++ /dev/null @@ -1,49 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: {{ include "infisical.mongodb.fullname" . }} - labels: - {{- include "infisical.mongodb.labels" . | nindent 4 }} -spec: - replicas: 1 # Cannot be scaled. To scale, you must set up Stateful Set - selector: - matchLabels: - {{- include "infisical.mongodb.matchLabels" . | nindent 6 }} - template: - metadata: - labels: - {{- include "infisical.mongodb.matchLabels" . | nindent 8 }} - {{- with .Values.mongodb.podAnnotations }} - annotations: - {{- toYaml . | nindent 8 }} - {{- end }} - spec: - containers: - - name: {{ template "infisical.name" . }}-{{ .Values.mongodb.name }} - image: "{{ .Values.mongodb.image.repository }}:{{ .Values.mongodb.image.tag | default .Chart.AppVersion }}" - imagePullPolicy: {{ .Values.mongodb.image.pullPolicy }} - ports: - - containerPort: 27017 - env: - - name: MONGO_INITDB_ROOT_USERNAME - value: root - - name: MONGO_INITDB_ROOT_PASSWORD - value: root ---- -apiVersion: v1 -kind: Service -metadata: - name: {{ include "infisical.mongodb.fullname" . }} - labels: - {{- include "infisical.mongodb.labels" . | nindent 4 }} - {{- with .Values.mongodb.service.annotations }} - annotations: - {{- toYaml . | nindent 4 }} - {{- end }} -spec: - selector: - {{- include "infisical.mongodb.matchLabels" . | nindent 8 }} - ports: - - protocol: TCP - port: 27017 - targetPort: 27017 # container port diff --git a/helm-charts/infisical/values.yaml b/helm-charts/infisical/values.yaml index 9ed7ef9dc..f670028b3 100644 --- a/helm-charts/infisical/values.yaml +++ b/helm-charts/infisical/values.yaml @@ -1,88 +1,355 @@ -##### -# INFISICAL K8 DEFAULT VALUES FILE -# PLEASE REPLACE VALUES/EDIT AS REQUIRED -##### +## @section Common parameters +## +## @param nameOverride Override release name +## nameOverride: "" +## @param fullnameOverride Override release fullname +## +fullnameOverride: "" + +## @section Infisical frontend parameters +## Documentation : https://infisical.com/docs/self-hosting/deployments/kubernetes +## frontend: + ## @param frontend.enabled Enable frontend + ## + enabled: true + ## @param frontend.name Backend name + ## name: frontend + ## @param frontend.fullnameOverride Backend fullnameOverride + ## + fullnameOverride: "" + ## @param frontend.podAnnotations Backend pod annotations + ## podAnnotations: {} + ## @param frontend.deploymentAnnotations Backend deployment annotations + ## deploymentAnnotations: {} + ## @param frontend.replicaCount Backend replica count + ## replicaCount: 2 + ## Backend image parameters + ## image: + ## @param frontend.image.repository Backend image repository + ## repository: infisical/frontend - pullPolicy: IfNotPresent + ## @param frontend.image.tag Backend image tag + ## tag: "latest" - # kubeSecretRef: some-kube-secret-name + ## @param frontend.image.pullPolicy Backend image pullPolicy + ## + pullPolicy: IfNotPresent + ## @param frontend.kubeSecretRef Backend secret resource reference name (containing required [frontend configuration variables](https://infisical.com/docs/self-hosting/configuration/envars)) + ## + kubeSecretRef: "" service: - # type of the frontend service - type: ClusterIP - # define the nodePort if service type is NodePort - # nodePort: + ## @param frontend.service.annotations Backend service annotations + ## annotations: {} + ## @param frontend.service.type Backend service type + ## + type: ClusterIP + ## @param frontend.service.nodePort Backend service nodePort (used if above type is `NodePort`) + ## + nodePort: "" + +## Frontend variables configuration +## Documentation : https://infisical.com/docs/self-hosting/configuration/envars +## +frontendEnvironmentVariables: + ## @param frontendEnvironmentVariables.SITE_URL Absolute URL including the protocol (e.g. https://app.infisical.com) + ## + SITE_URL: infisical.local + +## @section Infisical backend parameters +## Documentation : https://infisical.com/docs/self-hosting/deployments/kubernetes +## backend: + ## @param backend.enabled Enable backend + ## + enabled: true + ## @param backend.name Backend name + ## name: backend + ## @param backend.fullnameOverride Backend fullnameOverride + ## + fullnameOverride: "" + ## @param backend.podAnnotations Backend pod annotations + ## podAnnotations: {} + ## @param backend.deploymentAnnotations Backend deployment annotations + ## deploymentAnnotations: {} + ## @param backend.replicaCount Backend replica count + ## replicaCount: 2 + ## Backend image parameters + ## image: + ## @param backend.image.repository Backend image repository + ## repository: infisical/backend - pullPolicy: IfNotPresent + ## @param backend.image.tag Backend image tag + ## tag: "latest" - # kubeSecretRef: some-kube-secret-name + ## @param backend.image.pullPolicy Backend image pullPolicy + ## + pullPolicy: IfNotPresent + ## @param backend.kubeSecretRef Backend secret resource reference name (containing required [backend configuration variables](https://infisical.com/docs/self-hosting/configuration/envars)) + ## + kubeSecretRef: "" service: + ## @param backend.service.annotations Backend service annotations + ## annotations: {} + ## @param backend.service.type Backend service type + ## + type: ClusterIP + ## @param backend.service.nodePort Backend service nodePort (used if above type is `NodePort`) + ## + nodePort: "" + +## Backend variables configuration +## Documentation : https://infisical.com/docs/self-hosting/configuration/envars +## +backendEnvironmentVariables: + ## @param backendEnvironmentVariables.ENCRYPTION_KEY **Required** Backend encryption key (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)) + ## Command to generate the required value (linux) : 'hexdump -vn16 -e'4/4 "%08X" 1 "\n"' /dev/urandom', 'openssl rand -hex 16' + ## + ENCRYPTION_KEY: MUST_REPLACE + ## @param backendEnvironmentVariables.JWT_SIGNUP_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)) + ## @param backendEnvironmentVariables.JWT_REFRESH_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)) + ## @param backendEnvironmentVariables.JWT_AUTH_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)) + ## @param backendEnvironmentVariables.JWT_SERVICE_SECRET **Required** Secrets to sign JWT tokens (128-bit hex value, 32-characters hex, [example](https://stackoverflow.com/a/34329057)) + ## Command to generate the required value (linux) : 'hexdump -vn16 -e'4/4 "%08X" 1 "\n"' /dev/urandom', 'openssl rand -hex 16' + ## + JWT_SIGNUP_SECRET: MUST_REPLACE + JWT_REFRESH_SECRET: MUST_REPLACE + JWT_AUTH_SECRET: MUST_REPLACE + JWT_SERVICE_SECRET: MUST_REPLACE + ## @param backendEnvironmentVariables.SMTP_HOST **Required** Hostname to connect to for establishing SMTP connections + ## @param backendEnvironmentVariables.SMTP_PORT Port to connect to for establishing SMTP connections + ## @param backendEnvironmentVariables.SMTP_SECURE If true, use TLS when connecting to host. If false, TLS will be used if STARTTLS is supported + ## @param backendEnvironmentVariables.SMTP_FROM_NAME Name label to be used in From field (e.g. Infisical) + ## @param backendEnvironmentVariables.SMTP_FROM_ADDRESS **Required** Email address to be used for sending emails (e.g. dev@infisical.com) + ## @param backendEnvironmentVariables.SMTP_USERNAME **Required** Credential to connect to host (e.g. team@infisical.com) + ## @param backendEnvironmentVariables.SMTP_PASSWORD **Required** Credential to connect to host + ## + SMTP_HOST: MUST_REPLACE + SMTP_PORT: 587 + SMTP_SECURE: false + SMTP_FROM_NAME: Infisical + SMTP_FROM_ADDRESS: MUST_REPLACE + SMTP_USERNAME: MUST_REPLACE + SMTP_PASSWORD: MUST_REPLACE + ## @param backendEnvironmentVariables.SITE_URL Absolute URL including the protocol (e.g. https://app.infisical.com) + ## + SITE_URL: infisical.local + +## @section MongoDB(®) parameters +## Documentation : https://github.com/bitnami/charts/blob/main/bitnami/mongodb/values.yaml +## mongodb: - name: mongodb + ## @param mongodb.enabled Enable MongoDB(®) + ## + enabled: true + ## @param mongodb.name Name used to build variables (deprecated) + ## + name: "mongodb" + ## @param mongodb.fullnameOverride Fullname override + ## + fullnameOverride: "mongodb" + ## @param mongodb.nameOverride Name override + ## + nameOverride: "mongodb" + ## @param mongodb.podAnnotations Pod annotations + ## podAnnotations: {} + ## @param mongodb.useStatefulSet Set to true to use a StatefulSet instead of a Deployment (only when `architecture: standalone`) + ## + useStatefulSet: true + ## @param mongodb.architecture MongoDB(®) architecture (`standalone` or `replicaset`) + ## + architecture: "standalone" + ## Bitnami MongoDB(®) image + ## ref: https://hub.docker.com/r/bitnami/mongodb/tags/ + ## @param mongodb.image.repository MongoDB(®) image registry + ## @param mongodb.image.tag MongoDB(®) image tag (immutable tags are recommended) + ## @param mongodb.image.pullPolicy MongoDB(®) image pull policy + ## image: - repository: mongo + repository: bitnami/mongodb pullPolicy: IfNotPresent - tag: "latest" + tag: "6.0.4-debian-11-r0" + ## @param mongodb.service.annotations Service annotations + ## service: annotations: {} + ## Infisical MongoDB custom authentication + ## + auth: + ## @param mongodb.auth.enabled Enable custom authentication + ## + enabled: true + ## @param mongodb.auth.usernames Custom usernames list ([special characters warning](https://www.mongodb.com/docs/manual/reference/connection-string/#standard-connection-string-format)) + ## + usernames: + - "infisical" + ## @param mongodb.auth.passwords Custom passwords list, match the above usernames order ([special characters warning](https://www.mongodb.com/docs/manual/reference/connection-string/#standard-connection-string-format)) + ## + passwords: + - "infisical" + ## @param mongodb.auth.databases Custom databases list ([special characters warning](https://www.mongodb.com/docs/manual/reference/connection-string/#standard-connection-string-format)) + ## + databases: + - "infisical" + ## MongoDB persistence configuration + ## + persistence: + ## @param mongodb.persistence.enabled Enable database persistence + ## + enabled: true + ## @param mongodb.persistence.existingClaim Existing persistent volume claim name + ## + existingClaim: "" + ## @param mongodb.persistence.resourcePolicy Keep the persistent volume even on deletion (`keep` or `""`) + ## + resourcePolicy: "keep" + ## @param mongodb.persistence.accessModes Persistent volume access modes + ## + accessModes: ["ReadWriteOnce"] + ## @param mongodb.persistence.size Persistent storage request size + ## + size: 8Gi -# By default the backend will be connected to a Mongo instance in the cluster. -# However, it is recommended to add a managed document DB connection string because the DB instance in the cluster does not have persistence yet ( data will be deleted on next deploy). -# Learn about connection string type here https://www.mongodb.com/docs/manual/reference/connection-string/ -mongodbConnection: {} - # externalMongoDBConnectionString: <> +## @param mongodbConnection.externalMongoDBConnectionString External MongoDB connection string +## By default the backend will be connected to a Mongo instance within the cluster +## However, it is recommended to add a managed document DB connection string for production-use (DBaaS) +## Learn about connection string type here https://www.mongodb.com/docs/manual/reference/connection-string/ +## e.g. "mongodb://:@:/" +## +mongodbConnection: + externalMongoDBConnectionString: "" + +## @section Ingress parameters +## ingress: + ## @param ingress.enabled Enable ingress + ## enabled: true annotations: + ## @skip ingress.annotations.kubernetes.io/ingress.class + ## kubernetes.io/ingress.class: "nginx" - hostName: example.com # replace with your domain - frontend: + # cert-manager.io/issuer: letsencrypt-nginx + ## @param ingress.hostName Ingress hostname (your custom domain name) + ## Replace with your own domain + ## + hostName: infisical.local + ## @skip ingress.frontend + ## + frontend: path: / pathType: Prefix + ## @skip ingress.backend + ## backend: path: /api pathType: Prefix + ## @param ingress.tls Ingress TLS hosts (matching above hostName) + ## Replace with your own domain + ## tls: [] + # - secretName: letsencrypt-nginx + # hosts: + # - infisical.local +## @section Mailhog parameters +## Documentation : https://github.com/codecentric/helm-charts/blob/master/charts/mailhog/values.yaml +## -## Complete Ingress example -# ingress: -# enabled: true -# annotations: -# kubernetes.io/ingress.class: "nginx" -# cert-manager.io/issuer: letsencrypt-nginx -# hostName: k8.infisical.com -# frontend: -# path: / -# pathType: Prefix -# backend: -# path: /api -# pathType: Prefix -# tls: -# - secretName: letsencrypt-nginx -# hosts: -# - k8.infisical.com +mailhog: + ## @param mailhog.enabled Enable Mailhog + ## + enabled: false + ## @param mailhog.fullnameOverride Fullname override + ## + fullnameOverride: "mailhog" + ## @param mailhog.nameOverride Name override + ## + nameOverride: "" + ## @param mailhog.image.repository Image repository + ## Why we use this version : https://github.com/mailhog/MailHog/issues/353#issuecomment-821137362 + ## @param mailhog.image.tag Image tag + ## @param mailhog.image.pullPolicy Image pull policy + ## + image: + repository: lytrax/mailhog + tag: "latest" + pullPolicy: IfNotPresent -frontendEnvironmentVariables: {} - -backendEnvironmentVariables: {} + containerPort: + ## @param mailhog.containerPort.http.port Mailhog HTTP port (Web UI) + ## @skip mailhog.containerPort.http.name + ## + http: + name: http + port: 8025 + ## @param mailhog.containerPort.smtp.port Mailhog SMTP port (Mail) + ## @skip mailhog.containerPort.smtp.name + ## + smtp: + name: tcp-smtp + port: 1025 + ## @skip mailhog.service + ## + service: + annotations: {} + extraPorts: [] + clusterIP: "" + externalIPs: [] + loadBalancerIP: "" + loadBalancerSourceRanges: [] + type: ClusterIP + # Named target ports are not supported by GCE health checks, so when deploying on GKE + # and exposing it via GCE ingress, the health checks fail and the load balancer returns a 502. + namedTargetPort: true + port: + http: 8025 + smtp: 1025 + nodePort: + http: "" + smtp: "" + ## Mailhog ingress + ## + ingress: + ## @param mailhog.ingress.enabled Enable ingress + ## + enabled: true + ## @param mailhog.ingress.ingressClassName Ingress class name + ## + ingressClassName: nginx + ## @param mailhog.ingress.annotations Ingress annotations + ## + annotations: {} + # kubernetes.io/ingress.class: nginx + # kubernetes.io/tls-acme: "true" + ## @param mailhog.ingress.labels Ingress labels + ## + labels: {} + hosts: + ## @param mailhog.ingress.hosts[0].host Mailhog host + ## + - host: mailhog.infisical.local + ## @skip mailhog.ingress.hosts[0].paths + ## + paths: + - path: "/" + pathType: Prefix \ No newline at end of file