mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-10-04 00:26:05 +00:00
Merge branch 'heads/main' into daniel/redis-secret-rotation-new
This commit is contained in:
Daniel Hougaard
@@ -24,7 +24,7 @@ Infisical supports two methods for connecting to Heroku: **OAuth** and **Auth To
|
||||
|
||||
|
||||
|
||||
Create the API client. As part of the form, set the **OAuth callback URL** to `https://your-domain.com/integrations/heroku/oauth2/callback`.
|
||||
Create the API client. As part of the form, set the **OAuth callback URL** to `https://your-domain.com/organization/app-connections/heroku/oauth/callback`.
|
||||
|
||||
<Tip>
|
||||
The domain you defined in the OAuth callback URL should be equivalent to the `SITE_URL` configured in your Infisical instance.
|
||||
@@ -39,8 +39,8 @@ Infisical supports two methods for connecting to Heroku: **OAuth** and **Auth To
|
||||
|
||||
Back in your Infisical instance, add two new environment variables for the credentials of your Heroku API client:
|
||||
|
||||
- `CLIENT_ID_HEROKU`: The **Client ID** of your Heroku API client.
|
||||
- `CLIENT_SECRET_HEROKU`: The **Client Secret** of your Heroku API client.
|
||||
- `INF_APP_CONNECTION_HEROKU_OAUTH_CLIENT_ID`: The **Client ID** of your Heroku API client.
|
||||
- `INF_APP_CONNECTION_HEROKU_OAUTH_CLIENT_SECRET`: The **Client Secret** of your Heroku API client.
|
||||
|
||||
Once added, restart your Infisical instance and use the Heroku Connection.
|
||||
</Step>
|
||||
|
||||
@@ -366,3 +366,21 @@ password = "{{ .Value }}"
|
||||
**Returns**: A list of secret objects with the following keys `Key, WorkspaceId, Value, Type, ID, and Comment`
|
||||
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="dynamic_secret">
|
||||
```bash
|
||||
dynamic_secret "<project-slug>" "<environment-slug>" "<secret-path>" "<dynamic-secret-name>" "<lease-ttl>"
|
||||
```
|
||||
|
||||
```bash example-redis-dynamic-secret
|
||||
{{ with dynamic_secret "aaa-o7en-s5qm" "dev" "/" "redis" "1m" }}
|
||||
{{ .DB_USERNAME }}={{ .DB_PASSWORD }}
|
||||
{{- end }}
|
||||
|
||||
**Function Name**: dynamic_secret
|
||||
|
||||
**Description**: This function can be used to render a dynamic secret lease credentials. The credentials are automatically renewed before they expire, ensuring that the rendered credentials are always up-to-date.
|
||||
|
||||
**Returns**: An object with keys corresponding to the dynamic secret lease credentials.
|
||||
```
|
||||
</Accordion>
|
||||
@@ -59,9 +59,10 @@ The Infisical Agent Injector supports the following annotations:
|
||||
The inject annotation is used to enable the injector on a pod. Set the value to `true` and the pod will be patched with an Infisical Agent container on update or create.
|
||||
</Accordion>
|
||||
<Accordion title="org.infisical.com/inject-mode">
|
||||
The inject mode annotation is used to specify the mode to use to inject the secrets into the pod. Currently only `init` mode is supported.
|
||||
The inject mode annotation is used to specify the mode to use to inject the secrets into the pod.
|
||||
|
||||
- `init`: The init method will create an init container for the pod that will render the secrets into a shared volume mount within the pod. The agent init container will run before any other containers in the pod runs, including other init containers.
|
||||
- `sidecar`: The sidecar method will create a sidecar container for the pod that will render the secrets into a shared volume mount within the pod. The agent sidecar container will run alongside the main container in the pod. This means that the secrets rendered will always be in sync with your Infisical secrets.
|
||||
</Accordion>
|
||||
<Accordion title="org.infisical.com/agent-config-map">
|
||||
The agent config map annotation is used to specify the name of the config map that contains the configuration for the injector. The config map must be in the same namespace as the pod.
|
||||
@@ -203,7 +204,7 @@ metadata:
|
||||
app: demo
|
||||
annotations:
|
||||
org.infisical.com/inject: "true" # Set to true for the injector to patch the pod on create/update events
|
||||
org.infisical.com/inject-mode: "init" # The mode to use to inject the secrets into the pod. Currently only `init` mode is supported.
|
||||
org.infisical.com/inject-mode: "init" # The mode to use to inject the secrets into the pod. init|sidecar
|
||||
org.infisical.com/agent-config-map: "name-of-config-map" # The name of the config map that you created above, which contains all the settings for injecting the secrets into the pod
|
||||
spec:
|
||||
# ...
|
||||
|
||||
@@ -146,6 +146,7 @@ spec:
|
||||
projectSlug: <project-slug> # <-- project slug
|
||||
projectId: <project-id> # <-- project id
|
||||
|
||||
secretName: <secret-name> # OPTIONAL: If you want to fetch a single Infisical secret, you can specify the secret name here. If not specified, all secrets in the specified scope will be fetched.
|
||||
envSlug: <env-slug> # "dev", "staging", "prod", etc..
|
||||
secretsPath: "<secrets-path>" # Root is "/"
|
||||
credentialsRef:
|
||||
@@ -331,6 +332,7 @@ spec:
|
||||
projectSlug: your-project-slug
|
||||
envSlug: prod
|
||||
secretsPath: "/path"
|
||||
secretName: <secret-name> # OPTIONAL: If you want to fetch a single Infisical secret, you can specify the secret name here. If not specified, all secrets in the specified scope will be fetched.
|
||||
recursive: true
|
||||
...
|
||||
```
|
||||
@@ -526,6 +528,7 @@ spec:
|
||||
projectSlug: your-project-slug
|
||||
envSlug: prod
|
||||
secretsPath: "/path"
|
||||
secretName: <secret-name> # OPTIONAL: If you want to fetch a single Infisical secret, you can specify the secret name here. If not specified, all secrets in the specified scope will be fetched.
|
||||
recursive: true
|
||||
...
|
||||
```
|
||||
@@ -574,6 +577,7 @@ spec:
|
||||
projectSlug: your-project-slug
|
||||
envSlug: prod
|
||||
secretsPath: "/path"
|
||||
secretName: <secret-name> # OPTIONAL: If you want to fetch a single Infisical secret, you can specify the secret name here. If not specified, all secrets in the specified scope will be fetched.
|
||||
recursive: true
|
||||
...
|
||||
```
|
||||
@@ -619,6 +623,7 @@ spec:
|
||||
projectSlug: your-project-slug
|
||||
envSlug: prod
|
||||
secretsPath: "/path"
|
||||
secretName: <secret-name> # OPTIONAL: If you want to fetch a single Infisical secret, you can specify the secret name here. If not specified, all secrets in the specified scope will be fetched.
|
||||
recursive: true
|
||||
...
|
||||
```
|
||||
@@ -664,6 +669,7 @@ spec:
|
||||
projectSlug: your-project-slug
|
||||
envSlug: prod
|
||||
secretsPath: "/path"
|
||||
secretName: <secret-name> # OPTIONAL: If you want to fetch a single Infisical secret, you can specify the secret name here. If not specified, all secrets in the specified scope will be fetched.
|
||||
recursive: true
|
||||
...
|
||||
```
|
||||
@@ -711,6 +717,7 @@ spec:
|
||||
projectSlug: your-project-slug
|
||||
envSlug: prod
|
||||
secretsPath: "/path"
|
||||
secretName: <secret-name> # OPTIONAL: If you want to fetch a single Infisical secret, you can specify the secret name here. If not specified, all secrets in the specified scope will be fetched.
|
||||
recursive: true
|
||||
...
|
||||
```
|
||||
@@ -764,6 +771,7 @@ spec:
|
||||
projectSlug: <project-slug> # <-- project slug
|
||||
envSlug: <env-slug> # "dev", "staging", "prod", etc..
|
||||
secretsPath: "<secrets-path>" # Root is "/"
|
||||
secretName: <secret-name> # OPTIONAL: If you want to fetch a single Infisical secret, you can specify the secret name here. If not specified, all secrets in the specified scope will be fetched.
|
||||
identityId: <machine-identity-id>
|
||||
credentialsRef:
|
||||
secretName: ldap-auth-credentials # <-- name of the Kubernetes secret that stores our machine identity credentials
|
||||
|
||||
Reference in New Issue
Block a user