diff --git a/docs/integrations/platforms/kubernetes/infisical-push-secret-crd.mdx b/docs/integrations/platforms/kubernetes/infisical-push-secret-crd.mdx
index 936a37303..d87648bbf 100644
--- a/docs/integrations/platforms/kubernetes/infisical-push-secret-crd.mdx
+++ b/docs/integrations/platforms/kubernetes/infisical-push-secret-crd.mdx
@@ -241,7 +241,21 @@ After applying the InfisicalPushSecret CRD, you should notice that the secrets y
DATABASE_URL: postgres://127.0.0.1:5432
ENCRYPTION_KEY: fabcc12-a22-facbaa4-11aa568aab
```
+
+
+ The `generators[]` field is used to define the generators you want to use for your InfisicalPushSecret CRD.
+ You can follow the guide for [using generators to push secrets](#using-generators-to-push-secrets) for more information.
+ Example:
+
+ ```yaml
+ push:
+ generators:
+ - destinationSecretName: password-generator-test
+ generatorRef:
+ kind: Password
+ name: password-generator
+ ```
@@ -463,34 +477,13 @@ Using Go templates, you can format, combine, and create new key-value pairs of s
## Using generators to push secrets
-Generators are a feature of the Infisical secrets operator that allows you to generate secrets on-reconcile and push them to Infisical. This is useful for secret rotation purposes, and fully operator-managed secrets.
-A generator is a custom resource that is installed on the cluster that defines the logic for generating a secret.
+Generators allow secrets to be dynamically generated during each reconciliation cycle and then pushed to Infisical. They are useful for use cases where a new secret value is needed on every sync, such as ephemeral credentials or one-time-use tokens.
-Generators don't keep track of the secrets they generate, which means that on each reconciliation, a new value will be created and pushed.
-For this reason you may want to disable automatic reconciliation of the InfisicalPushSecret CRD. You can do this by removing `resyncInterval` from the InfisicalPushSecret CRD.
+A generator is defined as a custom resource (`ClusterGenerator`) within the cluster, which specifies the logic for generating secret values. Generators are stateless, each invocation triggers the creation of a new set of values, with no tracking or persistence of previously generated data.
-**Supported generators**:
-- `Password`: Generates a random password of string format.
-- `UUID`: Generates a random v4 UUID.
-
-To use a generator, you must specify at least one generator in the `push.generators[]` field. An example of a generator usage can be seen here:
-
-
- Define a generator in the `push.generators[]` field.
-
-
- The name of the secret that will be created in Infisical.
-
-
-
- The reference to the generator resource.
-
- Valid fields:
- - `kind`: The kind of the generator resource, must match the generator kind.
- - `name`: The name of the generator resource.
-
-
+Because of this behavior, you may want to disable automatic syncing for the `InfisicalPushSecret` resource to avoid continuous regeneration of secrets. This can be done by omitting the `resyncInterval` field from the InfisicalPushSecret CRD.
+### Example usage
```yaml
push:
secret:
@@ -499,85 +492,128 @@ To use a generator, you must specify at least one generator in the `push.generat
generators:
- destinationSecretName: password-generator # Name of the secret that will be created in Infisical
generatorRef:
- kind: Password|UUID # Kind of the resource, must match the generator kind.
+ kind: Password # Kind of the resource, must match the generator kind.
name: custom-generator # Name of the generator resource
```
-
-
+To use a generator, you must specify at least one generator in the `push.generators[]` field.
- The Password generator is a custom resource that is installed on the cluster that defines the logic for generating a password.
-
-
- - `kind`: The kind of the generator resource, must match the generator kind. For the Password generator, the kind is `Password`.
- - `generator.passwordSpec`: The spec of the password generator.
-
- - `length`: The length of the password.
- - `digits`: The number of digits in the password.
- - `symbols`: The number of symbols in the password.
- - `symbolCharacters`: The characters to use for the symbols in the password.
- - `noUpper`: Whether to include uppercase letters in the password.
- - `allowRepeat`: Whether to allow repeating characters in the password.
-
+
+ This field holds an array of the generators you want to use for your InfisicalPushSecret CRD.
+
+
+
+ The name of the secret that will be created in Infisical.
+
+
+
+ The reference to the generator resource.
+
+ Valid fields:
+ - `kind`: The kind of the generator resource, must match the generator kind.
+ - `name`: The name of the generator resource.
+
+
+
+ The kind of the generator resource, must match the generator kind.
+
+ Valid values:
+ - `Password`
+ - `UUID`
+
+
+
+ The name of the generator resource.
+
+
+### Supported Generators
+Below are the currently supported generators for the InfisicalPushSecret CRD. Each generator is a `ClusterGenerator` custom resource that can be used to customize the generated secret.
+
+
+ ### Password Generator
+
+ The Password generator is a custom resource that is installed on the cluster that defines the logic for generating a password.
+ - `kind`: The kind of the generator resource, must match the generator kind. For the Password generator, the kind is `Password`.
+ - `generator.passwordSpec`: The spec of the password generator.
+
+
+ The `generator.kind` field must match the kind of the generator resource. For the Password generator, the kind should always be set to `Password`.
+
+
+ - `length`: The length of the password.
+ - `digits`: The number of digits in the password.
+ - `symbols`: The number of symbols in the password.
+ - `symbolCharacters`: The characters to use for the symbols in the password.
+ - `noUpper`: Whether to include uppercase letters in the password.
+ - `allowRepeat`: Whether to allow repeating characters in the password.
- ```yaml password-cluster-generator.yaml
+ ```yaml password-cluster-generator.yaml
+ apiVersion: secrets.infisical.com/v1alpha1
+ kind: ClusterGenerator
+ metadata:
+ name: password-generator
+ spec:
+ kind: Password
+ generator:
+ passwordSpec:
+ length: 10
+ digits: 5
+ symbols: 5
+ symbolCharacters: "-_$@"
+ noUpper: false
+ allowRepeat: true
+ ```
+
+ Example InfisicalPushSecret CRD using the Password generator:
+ ```yaml infisical-push-secret-crd.yaml
+ push:
+ generators:
+ - destinationSecretName: password-generator-test
+ generatorRef:
+ kind: Password
+ name: password-generator
+ ```
+
+
+ ### UUID Generator
+
+ The UUID generator is a custom resource that is installed on the cluster that defines the logic for generating a UUID.
+ - `kind`: The kind of the generator resource, must match the generator kind. For the UUID generator, the kind is `UUID`.
+ - `generator.uuidSpec`: The spec of the UUID generator. For UUID's, this can be left empty.
+
+
+ The `generator.kind` field must match the kind of the generator resource. For the UUID generator, the kind should always be set to `UUID`.
+
+
+
+ The spec of the UUID generator. For UUID's, this can be left empty.
+
+
+ ```yaml uuid-cluster-generator.yaml
apiVersion: secrets.infisical.com/v1alpha1
kind: ClusterGenerator
metadata:
- name: password-generator
+ name: uuid-generator
spec:
- kind: Password
+ kind: UUID
generator:
- passwordSpec:
- length: 10
- digits: 5
- symbols: 5
- symbolCharacters: "-_$@"
- noUpper: false
- allowRepeat: true
- ```
+ uuidSpec:
+ ```
- Example InfisicalPushSecret CRD using the Password generator:
- ```yaml infisical-push-secret-crd.yaml
- push:
- generators:
- - destinationSecretName: password-generator-test
- generatorRef:
- kind: Password
- name: password-generator
- ```
-
-
- The UUID generator is a custom resource that is installed on the cluster that defines the logic for generating a UUID.
-
- - `kind`: The kind of the generator resource, must match the generator kind. For the UUID generator, the kind is `UUID`.
- - `generator.uuidSpec`: The spec of the UUID generator. For UUID's, this can be left empty.
-
+ Example InfisicalPushSecret CRD using the UUID generator:
- ```yaml uuid-cluster-generator.yaml
- apiVersion: secrets.infisical.com/v1alpha1
- kind: ClusterGenerator
- metadata:
- name: uuid-generator
- spec:
- kind: UUID
- generator:
- uuidSpec:
- ```
+ ```yaml infisical-push-secret-crd.yaml
+ push:
+ generators:
+ - destinationSecretName: uuid-generator-test
+ generatorRef:
+ kind: UUID
+ name: uuid-generator
+ ```
+
- Example InfisicalPushSecret CRD using the UUID generator:
- ```yaml infisical-push-secret-crd.yaml
- push:
- generators:
- - destinationSecretName: uuid-generator-test
- generatorRef:
- kind: UUID
- name: uuid-generator
- ```
-
-