mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-10-04 10:26:16 +00:00
Merge pull request #3564 from Infisical/daniel/generator-doc-imp
docs(k8s/generators): improve documentation
This commit is contained in:
Daniel Hougaard
@@ -241,7 +241,21 @@ After applying the InfisicalPushSecret CRD, you should notice that the secrets y
|
|||||||
DATABASE_URL: postgres://127.0.0.1:5432
|
DATABASE_URL: postgres://127.0.0.1:5432
|
||||||
ENCRYPTION_KEY: fabcc12-a22-facbaa4-11aa568aab
|
ENCRYPTION_KEY: fabcc12-a22-facbaa4-11aa568aab
|
||||||
```
|
```
|
||||||
|
</Accordion>
|
||||||
|
<Accordion title="generators[]">
|
||||||
|
The `generators[]` field is used to define the generators you want to use for your InfisicalPushSecret CRD.
|
||||||
|
You can follow the guide for [using generators to push secrets](#using-generators-to-push-secrets) for more information.
|
||||||
|
|
||||||
|
Example:
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
push:
|
||||||
|
generators:
|
||||||
|
- destinationSecretName: password-generator-test
|
||||||
|
generatorRef:
|
||||||
|
kind: Password
|
||||||
|
name: password-generator
|
||||||
|
```
|
||||||
</Accordion>
|
</Accordion>
|
||||||
</Accordion>
|
</Accordion>
|
||||||
|
|
||||||
@@ -463,34 +477,13 @@ Using Go templates, you can format, combine, and create new key-value pairs of s
|
|||||||
|
|
||||||
## Using generators to push secrets
|
## Using generators to push secrets
|
||||||
|
|
||||||
Generators are a feature of the Infisical secrets operator that allows you to generate secrets on-reconcile and push them to Infisical. This is useful for secret rotation purposes, and fully operator-managed secrets.
|
Generators allow secrets to be dynamically generated during each reconciliation cycle and then pushed to Infisical. They are useful for use cases where a new secret value is needed on every sync, such as ephemeral credentials or one-time-use tokens.
|
||||||
A generator is a custom resource that is installed on the cluster that defines the logic for generating a secret.
|
|
||||||
|
|
||||||
Generators don't keep track of the secrets they generate, which means that on each reconciliation, a new value will be created and pushed.
|
A generator is defined as a custom resource (`ClusterGenerator`) within the cluster, which specifies the logic for generating secret values. Generators are stateless, each invocation triggers the creation of a new set of values, with no tracking or persistence of previously generated data.
|
||||||
For this reason you may want to disable automatic reconciliation of the InfisicalPushSecret CRD. You can do this by removing `resyncInterval` from the InfisicalPushSecret CRD.
|
|
||||||
|
|
||||||
**Supported generators**:
|
Because of this behavior, you may want to disable automatic syncing for the `InfisicalPushSecret` resource to avoid continuous regeneration of secrets. This can be done by omitting the `resyncInterval` field from the InfisicalPushSecret CRD.
|
||||||
- `Password`: Generates a random password of string format.
|
|
||||||
- `UUID`: Generates a random v4 UUID.
|
|
||||||
|
|
||||||
To use a generator, you must specify at least one generator in the `push.generators[]` field. An example of a generator usage can be seen here:
|
|
||||||
|
|
||||||
<Accordion title="push.generators[]">
|
|
||||||
Define a generator in the `push.generators[]` field.
|
|
||||||
|
|
||||||
<Accordion title="push.generators[].destinationSecretName">
|
|
||||||
The name of the secret that will be created in Infisical.
|
|
||||||
</Accordion>
|
|
||||||
|
|
||||||
<Accordion title="push.generators[].generatorRef">
|
|
||||||
The reference to the generator resource.
|
|
||||||
|
|
||||||
Valid fields:
|
|
||||||
- `kind`: The kind of the generator resource, must match the generator kind.
|
|
||||||
- `name`: The name of the generator resource.
|
|
||||||
</Accordion>
|
|
||||||
</Accordion>
|
|
||||||
|
|
||||||
|
### Example usage
|
||||||
```yaml
|
```yaml
|
||||||
push:
|
push:
|
||||||
secret:
|
secret:
|
||||||
@@ -499,85 +492,128 @@ To use a generator, you must specify at least one generator in the `push.generat
|
|||||||
generators:
|
generators:
|
||||||
- destinationSecretName: password-generator # Name of the secret that will be created in Infisical
|
- destinationSecretName: password-generator # Name of the secret that will be created in Infisical
|
||||||
generatorRef:
|
generatorRef:
|
||||||
kind: Password|UUID # Kind of the resource, must match the generator kind.
|
kind: Password # Kind of the resource, must match the generator kind.
|
||||||
name: custom-generator # Name of the generator resource
|
name: custom-generator # Name of the generator resource
|
||||||
```
|
```
|
||||||
|
|
||||||
<Tabs>
|
To use a generator, you must specify at least one generator in the `push.generators[]` field.
|
||||||
<Tab title="Password Generator">
|
|
||||||
|
|
||||||
The Password generator is a custom resource that is installed on the cluster that defines the logic for generating a password.
|
|
||||||
<Accordion title="Spec definition">
|
|
||||||
|
|
||||||
- `kind`: The kind of the generator resource, must match the generator kind. For the Password generator, the kind is `Password`.
|
<Accordion title="push.generators[]">
|
||||||
- `generator.passwordSpec`: The spec of the password generator.
|
This field holds an array of the generators you want to use for your InfisicalPushSecret CRD.
|
||||||
|
</Accordion>
|
||||||
|
|
||||||
<Accordion title="generator.passwordSpec">
|
<Accordion title="push.generators[].destinationSecretName">
|
||||||
- `length`: The length of the password.
|
The name of the secret that will be created in Infisical.
|
||||||
- `digits`: The number of digits in the password.
|
</Accordion>
|
||||||
- `symbols`: The number of symbols in the password.
|
|
||||||
- `symbolCharacters`: The characters to use for the symbols in the password.
|
<Accordion title="push.generators[].generatorRef">
|
||||||
- `noUpper`: Whether to include uppercase letters in the password.
|
The reference to the generator resource.
|
||||||
- `allowRepeat`: Whether to allow repeating characters in the password.
|
|
||||||
</Accordion>
|
Valid fields:
|
||||||
|
- `kind`: The kind of the generator resource, must match the generator kind.
|
||||||
|
- `name`: The name of the generator resource.
|
||||||
|
</Accordion>
|
||||||
|
|
||||||
|
<Accordion title="push.generators[].generatorRef.kind">
|
||||||
|
The kind of the generator resource, must match the generator kind.
|
||||||
|
|
||||||
|
Valid values:
|
||||||
|
- `Password`
|
||||||
|
- `UUID`
|
||||||
|
</Accordion>
|
||||||
|
|
||||||
|
<Accordion title="push.generators[].generatorRef.name">
|
||||||
|
The name of the generator resource.
|
||||||
|
</Accordion>
|
||||||
|
|
||||||
|
### Supported Generators
|
||||||
|
Below are the currently supported generators for the InfisicalPushSecret CRD. Each generator is a `ClusterGenerator` custom resource that can be used to customize the generated secret.
|
||||||
|
|
||||||
|
<Accordion title="Password Generator">
|
||||||
|
### Password Generator
|
||||||
|
|
||||||
|
The Password generator is a custom resource that is installed on the cluster that defines the logic for generating a password.
|
||||||
|
- `kind`: The kind of the generator resource, must match the generator kind. For the Password generator, the kind is `Password`.
|
||||||
|
- `generator.passwordSpec`: The spec of the password generator.
|
||||||
|
|
||||||
|
<Accordion title="generator.kind">
|
||||||
|
The `generator.kind` field must match the kind of the generator resource. For the Password generator, the kind should always be set to `Password`.
|
||||||
|
</Accordion>
|
||||||
|
<Accordion title="generator.passwordSpec">
|
||||||
|
- `length`: The length of the password.
|
||||||
|
- `digits`: The number of digits in the password.
|
||||||
|
- `symbols`: The number of symbols in the password.
|
||||||
|
- `symbolCharacters`: The characters to use for the symbols in the password.
|
||||||
|
- `noUpper`: Whether to include uppercase letters in the password.
|
||||||
|
- `allowRepeat`: Whether to allow repeating characters in the password.
|
||||||
</Accordion>
|
</Accordion>
|
||||||
|
|
||||||
```yaml password-cluster-generator.yaml
|
```yaml password-cluster-generator.yaml
|
||||||
|
apiVersion: secrets.infisical.com/v1alpha1
|
||||||
|
kind: ClusterGenerator
|
||||||
|
metadata:
|
||||||
|
name: password-generator
|
||||||
|
spec:
|
||||||
|
kind: Password
|
||||||
|
generator:
|
||||||
|
passwordSpec:
|
||||||
|
length: 10
|
||||||
|
digits: 5
|
||||||
|
symbols: 5
|
||||||
|
symbolCharacters: "-_$@"
|
||||||
|
noUpper: false
|
||||||
|
allowRepeat: true
|
||||||
|
```
|
||||||
|
|
||||||
|
Example InfisicalPushSecret CRD using the Password generator:
|
||||||
|
```yaml infisical-push-secret-crd.yaml
|
||||||
|
push:
|
||||||
|
generators:
|
||||||
|
- destinationSecretName: password-generator-test
|
||||||
|
generatorRef:
|
||||||
|
kind: Password
|
||||||
|
name: password-generator
|
||||||
|
```
|
||||||
|
</Accordion>
|
||||||
|
<Accordion title="UUID Generator">
|
||||||
|
### UUID Generator
|
||||||
|
|
||||||
|
The UUID generator is a custom resource that is installed on the cluster that defines the logic for generating a UUID.
|
||||||
|
- `kind`: The kind of the generator resource, must match the generator kind. For the UUID generator, the kind is `UUID`.
|
||||||
|
- `generator.uuidSpec`: The spec of the UUID generator. For UUID's, this can be left empty.
|
||||||
|
|
||||||
|
<Accordion title="generator.kind">
|
||||||
|
The `generator.kind` field must match the kind of the generator resource. For the UUID generator, the kind should always be set to `UUID`.
|
||||||
|
</Accordion>
|
||||||
|
|
||||||
|
<Accordion title="generator.uuidSpec">
|
||||||
|
The spec of the UUID generator. For UUID's, this can be left empty.
|
||||||
|
</Accordion>
|
||||||
|
|
||||||
|
```yaml uuid-cluster-generator.yaml
|
||||||
apiVersion: secrets.infisical.com/v1alpha1
|
apiVersion: secrets.infisical.com/v1alpha1
|
||||||
kind: ClusterGenerator
|
kind: ClusterGenerator
|
||||||
metadata:
|
metadata:
|
||||||
name: password-generator
|
name: uuid-generator
|
||||||
spec:
|
spec:
|
||||||
kind: Password
|
kind: UUID
|
||||||
generator:
|
generator:
|
||||||
passwordSpec:
|
uuidSpec:
|
||||||
length: 10
|
```
|
||||||
digits: 5
|
|
||||||
symbols: 5
|
|
||||||
symbolCharacters: "-_$@"
|
|
||||||
noUpper: false
|
|
||||||
allowRepeat: true
|
|
||||||
```
|
|
||||||
|
|
||||||
Example InfisicalPushSecret CRD using the Password generator:
|
Example InfisicalPushSecret CRD using the UUID generator:
|
||||||
```yaml infisical-push-secret-crd.yaml
|
|
||||||
push:
|
|
||||||
generators:
|
|
||||||
- destinationSecretName: password-generator-test
|
|
||||||
generatorRef:
|
|
||||||
kind: Password
|
|
||||||
name: password-generator
|
|
||||||
```
|
|
||||||
</Tab>
|
|
||||||
<Tab title="UUID Generator">
|
|
||||||
The UUID generator is a custom resource that is installed on the cluster that defines the logic for generating a UUID.
|
|
||||||
<Accordion title="Spec definition">
|
|
||||||
- `kind`: The kind of the generator resource, must match the generator kind. For the UUID generator, the kind is `UUID`.
|
|
||||||
- `generator.uuidSpec`: The spec of the UUID generator. For UUID's, this can be left empty.
|
|
||||||
</Accordion>
|
|
||||||
|
|
||||||
```yaml uuid-cluster-generator.yaml
|
```yaml infisical-push-secret-crd.yaml
|
||||||
apiVersion: secrets.infisical.com/v1alpha1
|
push:
|
||||||
kind: ClusterGenerator
|
generators:
|
||||||
metadata:
|
- destinationSecretName: uuid-generator-test
|
||||||
name: uuid-generator
|
generatorRef:
|
||||||
spec:
|
kind: UUID
|
||||||
kind: UUID
|
name: uuid-generator
|
||||||
generator:
|
```
|
||||||
uuidSpec:
|
</Accordion>
|
||||||
```
|
|
||||||
|
|
||||||
Example InfisicalPushSecret CRD using the UUID generator:
|
|
||||||
```yaml infisical-push-secret-crd.yaml
|
|
||||||
push:
|
|
||||||
generators:
|
|
||||||
- destinationSecretName: uuid-generator-test
|
|
||||||
generatorRef:
|
|
||||||
kind: UUID
|
|
||||||
name: uuid-generator
|
|
||||||
```
|
|
||||||
</Tab>
|
|
||||||
</Tabs>
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|||||||
Reference in New Issue
Block a user