mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-10-05 05:26:25 +00:00
Merge branch 'heads/main' into daniel/redis-secret-rotation-new
This commit is contained in:
Daniel Hougaard
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "List PKI Syncs"
|
||||
openapi: "GET /api/v1/pki/syncs"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Options"
|
||||
openapi: "GET /api/v1/pki/syncs/options"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Create Azure Key Vault PKI Sync"
|
||||
openapi: "POST /api/v1/pki/syncs/azure-key-vault"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Delete Azure Key Vault PKI Sync"
|
||||
openapi: "DELETE /api/v1/pki/syncs/azure-key-vault/{pkiSyncId}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Get Azure Key Vault PKI Sync by ID"
|
||||
openapi: "GET /api/v1/pki/syncs/azure-key-vault/{pkiSyncId}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "List Azure Key Vault PKI Syncs"
|
||||
openapi: "GET /api/v1/pki/syncs/azure-key-vault"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Remove Certificates from Azure Key Vault"
|
||||
openapi: "POST /api/v1/pki/syncs/azure-key-vault/{pkiSyncId}/remove-certificates"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Sync Certificates to Azure Key Vault"
|
||||
openapi: "POST /api/v1/pki/syncs/azure-key-vault/{pkiSyncId}/sync"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Update Azure Key Vault PKI Sync"
|
||||
openapi: "PATCH /api/v1/pki/syncs/azure-key-vault/{pkiSyncId}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Get PKI Sync by ID"
|
||||
openapi: "GET /api/v1/pki/syncs/{pkiSyncId}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "List PKI Syncs"
|
||||
openapi: "GET /api/v1/pki/syncs"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "List PKI Sync Options"
|
||||
openapi: "GET /api/v1/pki/syncs/options"
|
||||
---
|
||||
@@ -714,6 +714,18 @@
|
||||
"documentation/platform/pki/pki-issuer",
|
||||
"documentation/platform/pki/integration-guides/gloo-mesh"
|
||||
]
|
||||
},
|
||||
{
|
||||
"group": "Certificate Syncs",
|
||||
"pages": [
|
||||
"documentation/platform/pki/certificate-syncs/overview",
|
||||
{
|
||||
"group": "Syncs",
|
||||
"pages": [
|
||||
"documentation/platform/pki/certificate-syncs/azure-key-vault"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -2503,6 +2515,26 @@
|
||||
"api-reference/endpoints/pki-alerts/update",
|
||||
"api-reference/endpoints/pki-alerts/delete"
|
||||
]
|
||||
},
|
||||
{
|
||||
"group": "Certificate Syncs",
|
||||
"pages": [
|
||||
"api-reference/endpoints/pki/syncs/list",
|
||||
"api-reference/endpoints/pki/syncs/get-by-id",
|
||||
"api-reference/endpoints/pki/syncs/options",
|
||||
{
|
||||
"group": "Azure Key Vault",
|
||||
"pages": [
|
||||
"api-reference/endpoints/pki/syncs/azure-key-vault/list",
|
||||
"api-reference/endpoints/pki/syncs/azure-key-vault/get-by-id",
|
||||
"api-reference/endpoints/pki/syncs/azure-key-vault/create",
|
||||
"api-reference/endpoints/pki/syncs/azure-key-vault/update",
|
||||
"api-reference/endpoints/pki/syncs/azure-key-vault/delete",
|
||||
"api-reference/endpoints/pki/syncs/azure-key-vault/sync-certificates",
|
||||
"api-reference/endpoints/pki/syncs/azure-key-vault/remove-certificates"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
|
||||
@@ -0,0 +1,150 @@
|
||||
---
|
||||
title: "Azure Key Vault"
|
||||
description: "Learn how to configure an Azure Key Vault Certificate Sync for Infisical PKI."
|
||||
---
|
||||
|
||||
**Prerequisites:**
|
||||
|
||||
- Set up and configure a [Certificate Authority](/documentation/platform/pki/overview)
|
||||
- Create an [Azure Key Vault Connection](/integrations/app-connections/azure-key-vault)
|
||||
- Ensure your network security policies allow incoming requests from Infisical to this certificate sync provider, if network restrictions apply.
|
||||
|
||||
<Note>
|
||||
The Azure Key Vault Certificate Sync requires the following certificate permissions to be set on the user / service principal
|
||||
for Infisical to sync certificates to Azure Key Vault: `certificates/list`, `certificates/get`, `certificates/import`, `certificates/delete`.
|
||||
|
||||
Any role with these permissions would work such as the **Key Vault Certificates Officer** role.
|
||||
</Note>
|
||||
|
||||
<Note>
|
||||
Certificates synced to Azure Key Vault will be stored as certificate objects, preserving both the certificate and private key components.
|
||||
</Note>
|
||||
|
||||
<Tabs>
|
||||
<Tab title="Infisical UI">
|
||||
1. Navigate to **Project** > **Integrations** and select the **Certificate Syncs** tab. Click on the **Add Sync** button.
|
||||
|
||||
|
||||
2. Select the **Azure Key Vault** option.
|
||||
|
||||
|
||||
3. Configure the **Source** from where certificates should be retrieved, then click **Next**.
|
||||
|
||||
|
||||
- **PKI Subscriber**: The PKI subscriber to retrieve certificates from.
|
||||
|
||||
4. Configure the **Destination** to where certificates should be deployed, then click **Next**.
|
||||
|
||||
|
||||
- **Azure Connection**: The Azure Connection to authenticate with.
|
||||
- **Vault Base URL**: The URL of your Azure Key Vault.
|
||||
<p class="height:1px" />
|
||||
|
||||
5. Configure the **Sync Options** to specify how certificates should be synced, then click **Next**.
|
||||
|
||||
|
||||
- **Auto-Sync Enabled**: If enabled, certificates will automatically be synced from the source PKI subscriber when changes occur. Disable to enforce manual syncing only.
|
||||
- **Enable Certificate Removal**: If enabled, Infisical will remove expired certificates from the destination during sync operations. Disable this option if you intend to manage certificate cleanup manually.
|
||||
- **Certificate Name Schema** (Optional): Customize how certificate names are generated in Azure Key Vault. Use `{{certificateId}}` as a placeholder for the certificate ID. If not specified, defaults to `Infisical-{{certificateId}}`.
|
||||
|
||||
<Tip>
|
||||
**Azure Key Vault Soft Delete**: When certificates are removed from Azure Key Vault, they are placed in a soft-deleted state rather than being permanently deleted. This means:
|
||||
- Subsequent syncs will not re-add these soft-deleted certificates automatically
|
||||
- To resync removed certificates, you must either manually **purge** them from Azure Key Vault or **recover** them through the Azure portal/CLI
|
||||
</Tip>
|
||||
|
||||
6. Configure the **Details** of your Azure Key Vault Certificate Sync, then click **Next**.
|
||||
|
||||
|
||||
- **Name**: The name of your sync. Must be slug-friendly.
|
||||
- **Description**: An optional description for your sync.
|
||||
|
||||
7. Review your Azure Key Vault Certificate Sync configuration, then click **Create Sync**.
|
||||
|
||||
|
||||
8. If enabled, your Azure Key Vault Certificate Sync will begin syncing your certificates to the destination endpoint.
|
||||
|
||||
|
||||
</Tab>
|
||||
<Tab title="API">
|
||||
To create an **Azure Key Vault Certificate Sync**, make an API request to the [Create Azure Key Vault Certificate Sync](/api-reference/endpoints/pki/syncs/azure-key-vault/create) API endpoint.
|
||||
|
||||
### Sample request
|
||||
|
||||
```bash Request
|
||||
curl --request POST \
|
||||
--url https://app.infisical.com/api/v1/pki/syncs/azure-key-vault \
|
||||
--header 'Content-Type: application/json' \
|
||||
--data '{
|
||||
"name": "my-key-vault-cert-sync",
|
||||
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"description": "an example certificate sync",
|
||||
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"subscriberId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"destination": "azure-key-vault",
|
||||
"isAutoSyncEnabled": true,
|
||||
"syncOptions": {
|
||||
"canRemoveCertificates": true,
|
||||
"certificateNameSchema": "myapp-{{certificateId}}"
|
||||
},
|
||||
"destinationConfig": {
|
||||
"vaultBaseUrl": "https://my-key-vault.vault.azure.net"
|
||||
}
|
||||
}'
|
||||
```
|
||||
|
||||
### Sample response
|
||||
|
||||
```json Response
|
||||
{
|
||||
"pkiSync": {
|
||||
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"name": "my-key-vault-cert-sync",
|
||||
"description": "an example certificate sync",
|
||||
"destination": "azure-key-vault",
|
||||
"isAutoSyncEnabled": true,
|
||||
"destinationConfig": {
|
||||
"vaultBaseUrl": "https://my-key-vault.vault.azure.net"
|
||||
},
|
||||
"syncOptions": {
|
||||
"canRemoveCertificates": true,
|
||||
"certificateNameSchema": "myapp-{{certificateId}}"
|
||||
},
|
||||
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"subscriberId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"createdAt": "2023-01-01T00:00:00.000Z",
|
||||
"updatedAt": "2023-01-01T00:00:00.000Z"
|
||||
}
|
||||
}
|
||||
```
|
||||
</Tab>
|
||||
</Tabs>
|
||||
|
||||
## Certificate Management
|
||||
|
||||
Your Azure Key Vault Certificate Sync will:
|
||||
|
||||
- **Automatic Deployment**: Deploy new certificates issued by your PKI subscriber to Azure Key Vault
|
||||
- **Certificate Updates**: Update certificates in Azure Key Vault when renewals occur
|
||||
- **Expiration Handling**: Optionally remove expired certificates from Azure Key Vault (if enabled)
|
||||
- **Format Preservation**: Maintain certificate format and metadata during sync operations
|
||||
|
||||
<Note>
|
||||
Azure Key Vault Certificate Syncs support both automatic and manual synchronization modes. When auto-sync is enabled, certificates are automatically deployed as they are issued or renewed.
|
||||
</Note>
|
||||
|
||||
## Manual Certificate Sync
|
||||
|
||||
You can manually trigger certificate synchronization from your PKI subscriber to Azure Key Vault using the sync certificates functionality. This is useful for:
|
||||
|
||||
- Initial setup when you have existing certificates to deploy
|
||||
- One-time sync of specific certificates
|
||||
- Testing certificate sync configurations
|
||||
- Force sync after making changes
|
||||
|
||||
To manually sync certificates, use the [Sync Certificates](/api-reference/endpoints/pki/syncs/azure-key-vault/sync-certificates) API endpoint or the manual sync option in the Infisical UI.
|
||||
|
||||
<Note>
|
||||
Azure Key Vault does not support importing certificates back into Infisical due to security limitations where private keys cannot be extracted from Azure Key Vault.
|
||||
</Note>
|
||||
@@ -0,0 +1,142 @@
|
||||
---
|
||||
sidebarTitle: "Overview"
|
||||
description: "Learn how to sync certificates from Infisical PKI to third-party services."
|
||||
---
|
||||
|
||||
Certificate Syncs enable you to sync certificates from Infisical PKI to third-party services using [App Connections](/integrations/app-connections/overview).
|
||||
|
||||
<Note>
|
||||
Certificate Syncs are designed to automatically deploy certificates issued by your Certificate Authority to external services, ensuring your certificates are always up-to-date across your infrastructure.
|
||||
</Note>
|
||||
|
||||
## Concept
|
||||
|
||||
Certificate Syncs are a project-level resource used to sync certificates, via an [App Connection](/integrations/app-connections/overview), from a particular PKI subscriber (source)
|
||||
to a third-party service (destination). When new certificates are issued or existing certificates are renewed, changes will automatically be propagated to the destination, ensuring
|
||||
your certificates are always current.
|
||||
|
||||
<br />
|
||||
|
||||
<div align="center">
|
||||
|
||||
```mermaid
|
||||
%%{init: {'flowchart': {'curve': 'linear'} } }%%
|
||||
graph LR
|
||||
A[App Connection]
|
||||
B[Certificate Sync]
|
||||
C[Certificate 1]
|
||||
D[Certificate 2]
|
||||
E[Certificate 3]
|
||||
F[Third-Party Service]
|
||||
G[Certificate 1]
|
||||
H[Certificate 2]
|
||||
I[Certificate 3]
|
||||
J[PKI Subscriber]
|
||||
|
||||
B --> A
|
||||
C --> J
|
||||
D --> J
|
||||
E --> J
|
||||
A --> F
|
||||
F --> G
|
||||
F --> H
|
||||
F --> I
|
||||
J --> B
|
||||
|
||||
classDef default fill:#ffffff,stroke:#666,stroke-width:2px,rx:10px,color:black
|
||||
classDef connection fill:#FFF2B2,stroke:#E6C34A,stroke-width:2px,color:black,rx:15px
|
||||
classDef certificate fill:#E6F4FF,stroke:#0096D6,stroke-width:2px,color:black,rx:15px
|
||||
classDef sync fill:#F4FFE6,stroke:#96D600,stroke-width:2px,color:black,rx:15px
|
||||
classDef service fill:#E6E6FF,stroke:#6B4E96,stroke-width:2px,color:black,rx:15px
|
||||
classDef subscriber fill:#FFE6E6,stroke:#D63F3F,stroke-width:2px,color:black,rx:15px
|
||||
|
||||
class A connection
|
||||
class B sync
|
||||
class C,D,E,G,H,I certificate
|
||||
class F service
|
||||
class J subscriber
|
||||
```
|
||||
|
||||
</div>
|
||||
|
||||
## Workflow
|
||||
|
||||
Configuring a Certificate Sync requires three components: a <strong>source</strong> PKI subscriber to retrieve certificates from,
|
||||
a <strong>destination</strong> endpoint to deploy certificates to, and <strong>configuration options</strong> to determine how your certificates
|
||||
should be synced. Follow these steps to start syncing:
|
||||
|
||||
<Note>
|
||||
For step-by-step guides on syncing to a particular third-party service, refer to the Certificate Syncs section in the Navigation Bar.
|
||||
</Note>
|
||||
|
||||
1. <strong>Create App Connection:</strong> If you have not already done so, create an [App Connection](/integrations/app-connections/overview)
|
||||
via the UI or API for the third-party service you intend to sync certificates to.
|
||||
|
||||
2. <strong>Create Certificate Sync:</strong> Configure a Certificate Sync in the desired project by specifying the following parameters via the UI or API:
|
||||
- <strong>Source:</strong> The PKI subscriber you wish to retrieve certificates from.
|
||||
- <strong>Destination:</strong> The App Connection to utilize and the destination endpoint to deploy certificates to. These can vary between services.
|
||||
- <strong>Options:</strong> Customize how certificates should be synced, including:
|
||||
- Whether certificates should be removed from the destination when they expire
|
||||
- Certificate naming schema to control how certificate names are generated in the destination
|
||||
|
||||
<Note>
|
||||
Only certificates managed by Infisical will be affected during sync operations. Certificates not created or
|
||||
managed by Infisical will remain untouched, and changes made to Infisical-managed certificates directly
|
||||
in the destination service may be overwritten by future syncs.
|
||||
</Note>
|
||||
|
||||
<Info>
|
||||
Some third-party services do not support removing expired certificates automatically.
|
||||
</Info>
|
||||
|
||||
3. <strong>Utilize Sync:</strong> Any new certificates issued or renewals from the source PKI subscriber will now automatically be propagated to the destination endpoint.
|
||||
|
||||
<Note>
|
||||
Infisical is continuously expanding its Certificate Sync third-party service support. If the service you need isn't available,
|
||||
contact us at [email protected] to make a request.
|
||||
</Note>
|
||||
|
||||
## Certificate Naming
|
||||
|
||||
Certificate Syncs support flexible certificate naming through configurable naming schemas. This allows you to customize how certificate names appear in your destination services.
|
||||
|
||||
### Default Naming
|
||||
|
||||
By default, certificates are named using the pattern `Infisical-{certificateId}` where `{certificateId}` is the unique identifier of the certificate with hyphens removed for compatibility with services like Azure Key Vault.
|
||||
|
||||
### Custom Naming Schema
|
||||
|
||||
You can customize certificate naming by providing a **Certificate Name Schema** when creating or updating a Certificate Sync. The schema supports the following placeholders:
|
||||
|
||||
- `{{certificateId}}` - The unique certificate identifier (required)
|
||||
|
||||
**Examples:**
|
||||
- `myapp-{{certificateId}}` → `myapp-abc123def456`
|
||||
- `ssl/{{certificateId}}` → `ssl/abc123def456`
|
||||
|
||||
**Rules:**
|
||||
- Must include exactly one `{{certificateId}}` placeholder
|
||||
- Only alphanumeric characters, dashes (-), underscores (_), and slashes (/) are allowed
|
||||
- Certificate names matching your schema will be managed by Infisical during sync operations
|
||||
|
||||
## Certificate Management
|
||||
|
||||
Certificate Syncs handle the full lifecycle of certificate management:
|
||||
|
||||
- **Automatic Deployment**: New certificates are automatically deployed to configured destinations
|
||||
- **Renewal Propagation**: Certificate renewals are seamlessly pushed to all connected services
|
||||
- **Expiration Handling**: Expired certificates can be automatically removed from destinations (service-dependent)
|
||||
- **Certificate Validation**: Certificates are validated before deployment to ensure integrity
|
||||
|
||||
<div align="center">
|
||||
```mermaid
|
||||
graph LR
|
||||
A[Certificate Issued] -->|Deploy| B[Destination Service]
|
||||
C[Certificate Renewed] -->|Update| B
|
||||
D[Certificate Expired] -->|Remove| B
|
||||
style B fill:#F4FFE6,stroke:#96D600,stroke-width:2px,color:black,rx:15px
|
||||
style A fill:#E6F4FF,stroke:#0096D6,stroke-width:2px,color:black,rx:15px
|
||||
style C fill:#E6F4FF,stroke:#0096D6,stroke-width:2px,color:black,rx:15px
|
||||
style D fill:#FFE6E6,stroke:#D63F3F,stroke-width:2px,color:black,rx:15px
|
||||
```
|
||||
</div>
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 470 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 525 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 522 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 520 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 544 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 498 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 807 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 782 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 1.2 MiB After Width: | Height: | Size: 459 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 1.0 MiB After Width: | Height: | Size: 425 KiB |
@@ -24,7 +24,7 @@ Infisical supports two methods for connecting to Heroku: **OAuth** and **Auth To
|
||||
|
||||
|
||||
|
||||
Create the API client. As part of the form, set the **OAuth callback URL** to `https://your-domain.com/integrations/heroku/oauth2/callback`.
|
||||
Create the API client. As part of the form, set the **OAuth callback URL** to `https://your-domain.com/organization/app-connections/heroku/oauth/callback`.
|
||||
|
||||
<Tip>
|
||||
The domain you defined in the OAuth callback URL should be equivalent to the `SITE_URL` configured in your Infisical instance.
|
||||
@@ -39,8 +39,8 @@ Infisical supports two methods for connecting to Heroku: **OAuth** and **Auth To
|
||||
|
||||
Back in your Infisical instance, add two new environment variables for the credentials of your Heroku API client:
|
||||
|
||||
- `CLIENT_ID_HEROKU`: The **Client ID** of your Heroku API client.
|
||||
- `CLIENT_SECRET_HEROKU`: The **Client Secret** of your Heroku API client.
|
||||
- `INF_APP_CONNECTION_HEROKU_OAUTH_CLIENT_ID`: The **Client ID** of your Heroku API client.
|
||||
- `INF_APP_CONNECTION_HEROKU_OAUTH_CLIENT_SECRET`: The **Client Secret** of your Heroku API client.
|
||||
|
||||
Once added, restart your Infisical instance and use the Heroku Connection.
|
||||
</Step>
|
||||
|
||||
@@ -366,3 +366,21 @@ password = "{{ .Value }}"
|
||||
**Returns**: A list of secret objects with the following keys `Key, WorkspaceId, Value, Type, ID, and Comment`
|
||||
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="dynamic_secret">
|
||||
```bash
|
||||
dynamic_secret "<project-slug>" "<environment-slug>" "<secret-path>" "<dynamic-secret-name>" "<lease-ttl>"
|
||||
```
|
||||
|
||||
```bash example-redis-dynamic-secret
|
||||
{{ with dynamic_secret "aaa-o7en-s5qm" "dev" "/" "redis" "1m" }}
|
||||
{{ .DB_USERNAME }}={{ .DB_PASSWORD }}
|
||||
{{- end }}
|
||||
|
||||
**Function Name**: dynamic_secret
|
||||
|
||||
**Description**: This function can be used to render a dynamic secret lease credentials. The credentials are automatically renewed before they expire, ensuring that the rendered credentials are always up-to-date.
|
||||
|
||||
**Returns**: An object with keys corresponding to the dynamic secret lease credentials.
|
||||
```
|
||||
</Accordion>
|
||||
@@ -59,9 +59,10 @@ The Infisical Agent Injector supports the following annotations:
|
||||
The inject annotation is used to enable the injector on a pod. Set the value to `true` and the pod will be patched with an Infisical Agent container on update or create.
|
||||
</Accordion>
|
||||
<Accordion title="org.infisical.com/inject-mode">
|
||||
The inject mode annotation is used to specify the mode to use to inject the secrets into the pod. Currently only `init` mode is supported.
|
||||
The inject mode annotation is used to specify the mode to use to inject the secrets into the pod.
|
||||
|
||||
- `init`: The init method will create an init container for the pod that will render the secrets into a shared volume mount within the pod. The agent init container will run before any other containers in the pod runs, including other init containers.
|
||||
- `sidecar`: The sidecar method will create a sidecar container for the pod that will render the secrets into a shared volume mount within the pod. The agent sidecar container will run alongside the main container in the pod. This means that the secrets rendered will always be in sync with your Infisical secrets.
|
||||
</Accordion>
|
||||
<Accordion title="org.infisical.com/agent-config-map">
|
||||
The agent config map annotation is used to specify the name of the config map that contains the configuration for the injector. The config map must be in the same namespace as the pod.
|
||||
@@ -203,7 +204,7 @@ metadata:
|
||||
app: demo
|
||||
annotations:
|
||||
org.infisical.com/inject: "true" # Set to true for the injector to patch the pod on create/update events
|
||||
org.infisical.com/inject-mode: "init" # The mode to use to inject the secrets into the pod. Currently only `init` mode is supported.
|
||||
org.infisical.com/inject-mode: "init" # The mode to use to inject the secrets into the pod. init|sidecar
|
||||
org.infisical.com/agent-config-map: "name-of-config-map" # The name of the config map that you created above, which contains all the settings for injecting the secrets into the pod
|
||||
spec:
|
||||
# ...
|
||||
|
||||
@@ -146,6 +146,7 @@ spec:
|
||||
projectSlug: <project-slug> # <-- project slug
|
||||
projectId: <project-id> # <-- project id
|
||||
|
||||
secretName: <secret-name> # OPTIONAL: If you want to fetch a single Infisical secret, you can specify the secret name here. If not specified, all secrets in the specified scope will be fetched.
|
||||
envSlug: <env-slug> # "dev", "staging", "prod", etc..
|
||||
secretsPath: "<secrets-path>" # Root is "/"
|
||||
credentialsRef:
|
||||
@@ -331,6 +332,7 @@ spec:
|
||||
projectSlug: your-project-slug
|
||||
envSlug: prod
|
||||
secretsPath: "/path"
|
||||
secretName: <secret-name> # OPTIONAL: If you want to fetch a single Infisical secret, you can specify the secret name here. If not specified, all secrets in the specified scope will be fetched.
|
||||
recursive: true
|
||||
...
|
||||
```
|
||||
@@ -526,6 +528,7 @@ spec:
|
||||
projectSlug: your-project-slug
|
||||
envSlug: prod
|
||||
secretsPath: "/path"
|
||||
secretName: <secret-name> # OPTIONAL: If you want to fetch a single Infisical secret, you can specify the secret name here. If not specified, all secrets in the specified scope will be fetched.
|
||||
recursive: true
|
||||
...
|
||||
```
|
||||
@@ -574,6 +577,7 @@ spec:
|
||||
projectSlug: your-project-slug
|
||||
envSlug: prod
|
||||
secretsPath: "/path"
|
||||
secretName: <secret-name> # OPTIONAL: If you want to fetch a single Infisical secret, you can specify the secret name here. If not specified, all secrets in the specified scope will be fetched.
|
||||
recursive: true
|
||||
...
|
||||
```
|
||||
@@ -619,6 +623,7 @@ spec:
|
||||
projectSlug: your-project-slug
|
||||
envSlug: prod
|
||||
secretsPath: "/path"
|
||||
secretName: <secret-name> # OPTIONAL: If you want to fetch a single Infisical secret, you can specify the secret name here. If not specified, all secrets in the specified scope will be fetched.
|
||||
recursive: true
|
||||
...
|
||||
```
|
||||
@@ -664,6 +669,7 @@ spec:
|
||||
projectSlug: your-project-slug
|
||||
envSlug: prod
|
||||
secretsPath: "/path"
|
||||
secretName: <secret-name> # OPTIONAL: If you want to fetch a single Infisical secret, you can specify the secret name here. If not specified, all secrets in the specified scope will be fetched.
|
||||
recursive: true
|
||||
...
|
||||
```
|
||||
@@ -711,6 +717,7 @@ spec:
|
||||
projectSlug: your-project-slug
|
||||
envSlug: prod
|
||||
secretsPath: "/path"
|
||||
secretName: <secret-name> # OPTIONAL: If you want to fetch a single Infisical secret, you can specify the secret name here. If not specified, all secrets in the specified scope will be fetched.
|
||||
recursive: true
|
||||
...
|
||||
```
|
||||
@@ -764,6 +771,7 @@ spec:
|
||||
projectSlug: <project-slug> # <-- project slug
|
||||
envSlug: <env-slug> # "dev", "staging", "prod", etc..
|
||||
secretsPath: "<secrets-path>" # Root is "/"
|
||||
secretName: <secret-name> # OPTIONAL: If you want to fetch a single Infisical secret, you can specify the secret name here. If not specified, all secrets in the specified scope will be fetched.
|
||||
identityId: <machine-identity-id>
|
||||
credentialsRef:
|
||||
secretName: ldap-auth-credentials # <-- name of the Kubernetes secret that stores our machine identity credentials
|
||||
|
||||
@@ -672,6 +672,16 @@ You can configure third-party app connections for re-use across Infisical Projec
|
||||
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="Heroku OAuth Connection">
|
||||
<ParamField query="INF_APP_CONNECTION_HEROKU_OAUTH_CLIENT_ID" type="string" default="none" optional>
|
||||
The Application ID of your Heroku OAuth application.
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="INF_APP_CONNECTION_HEROKU_OAUTH_CLIENT_SECRET" type="string" default="none" optional>
|
||||
The Secret of your Heroku OAuth application.
|
||||
</ParamField>
|
||||
</Accordion>
|
||||
|
||||
## Native Secret Integrations
|
||||
|
||||
To help you sync secrets from Infisical to services such as Github and Gitlab, Infisical provides native integrations out of the box.
|
||||
|
||||
Reference in New Issue
Block a user