From 00b2a6bafc8dd8ff8994f031eb5edcb8dc92c316 Mon Sep 17 00:00:00 2001 From: Daniel Hougaard Date: Mon, 20 Oct 2025 15:51:26 +0400 Subject: [PATCH 01/11] docs: better postgres SSL docs --- docs/self-hosting/configuration/envars.mdx | 21 +++++++++++++++++++ .../deployment-options/kubernetes-helm.mdx | 11 ++++++++-- 2 files changed, 30 insertions(+), 2 deletions(-) diff --git a/docs/self-hosting/configuration/envars.mdx b/docs/self-hosting/configuration/envars.mdx index 551c79184..edebf1670 100644 --- a/docs/self-hosting/configuration/envars.mdx +++ b/docs/self-hosting/configuration/envars.mdx @@ -116,6 +116,27 @@ The platform utilizes Postgres to persist all of its data and Redis for caching Configure the SSL certificate for securing a Postgres connection by first encoding it in base64. Use the following command to encode your certificate: `echo "" | base64` + + Many cloud providers provide a CA certificate for their data regions that you can use to secure your connection with SSL. + + + + If you're hosting your database on AWS RDS, you can use their publicly available CA certificate as the database root certificate. + + You can find all the available CA certificates for AWS RDS on the official [AWS RDS documentation](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html). + + As an example, if your RDS cluster is hosted in `us-east-1` _(US East, N. Virginia)_, you can use the following root certificate: https://truststore.pki.rds.amazonaws.com/us-east-1/us-east-1-bundle.pem. + + All the available CA certificates can be found in the AWS RDS documentation linked above. + + Remember to base64 encode the certificate before setting it as the `DB_ROOT_CERT` environment variable. `cat /path/to/certificate.pem | base64`. + + ```bash + DB_ROOT_CERT=LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1 # .... (base64 encoded certificate) + DB_CONNECTION_URI=?sslmode=verify-ca # or verify-full depending on your security policies + ``` + + diff --git a/docs/self-hosting/deployment-options/kubernetes-helm.mdx b/docs/self-hosting/deployment-options/kubernetes-helm.mdx index f8a2a6864..f4ef67e1e 100644 --- a/docs/self-hosting/deployment-options/kubernetes-helm.mdx +++ b/docs/self-hosting/deployment-options/kubernetes-helm.mdx @@ -1,8 +1,10 @@ --- title: "Kubernetes via Helm Chart" description: "Learn how to use Helm chart to install Infisical on your Kubernetes cluster." ---- +--- + **Prerequisites** + - You have extensive understanding of [Kubernetes](https://kubernetes.io/) - Installed [Helm package manager](https://helm.sh/) version v3.11.3 or greater - You have [kubectl](https://kubernetes.io/docs/reference/kubectl/kubectl/) installed and connected to your kubernetes cluster @@ -12,7 +14,7 @@ description: "Learn how to use Helm chart to install Infisical on your Kubernete ```bash helm repo add infisical-helm-charts 'https://dl.cloudsmith.io/public/infisical/helm-charts/helm/charts/' ``` - ``` + ```bash helm repo update ``` @@ -61,6 +63,7 @@ description: "Learn how to use Helm chart to install Infisical on your Kubernete For production environments, we recommend using Cloud-based Platform as a Service (PaaS) solutions for PostgreSQL and Redis to ensure high availability. In on-premise setups, it's recommended to configure Redis and Postgres for high availability, either by using Bitnami charts or a custom configuration. + ```yaml simple-values-example.yaml apiVersion: v1 kind: Secret @@ -74,6 +77,10 @@ description: "Learn how to use Helm chart to install Infisical on your Kubernete DB_CONNECTION_URI: <> SITE_URL: <> ``` + + + If you need to configure the SSL certificate for your production Postgres instance, you can use the `DB_ROOT_CERT` environment variable. [Learn more about configuring the SSL certificate](/self-hosting/configuration/envars#aws-rds). + From bf37ad958a51dd593523c6c811012c665a3f3285 Mon Sep 17 00:00:00 2001 From: Daniel Hougaard Date: Mon, 20 Oct 2025 15:54:51 +0400 Subject: [PATCH 02/11] feat(helm/infisical-core): auto-reload --- helm-charts/infisical-standalone-postgres/CHANGELOG.md | 5 +++++ helm-charts/infisical-standalone-postgres/Chart.lock | 7 +++++-- helm-charts/infisical-standalone-postgres/Chart.yaml | 6 +++++- .../infisical-standalone-postgres/templates/infisical.yaml | 3 +++ .../templates/schema-migration-job.yaml | 4 ++++ helm-charts/infisical-standalone-postgres/values.yaml | 7 +++++-- 6 files changed, 27 insertions(+), 5 deletions(-) diff --git a/helm-charts/infisical-standalone-postgres/CHANGELOG.md b/helm-charts/infisical-standalone-postgres/CHANGELOG.md index f94f80073..ac6906de3 100644 --- a/helm-charts/infisical-standalone-postgres/CHANGELOG.md +++ b/helm-charts/infisical-standalone-postgres/CHANGELOG.md @@ -1,3 +1,8 @@ +## 1.7.2 (October 20, 2025) +Changes: +* Added automatic reloading support for the Infisical deployment when the `infisical.kubeSecretRef` kubernetes secret changes. + * Configurable by `reloader.enabled: true|false`. Defaults to `true`. + ## 1.7.1 (October 10, 2025) Changes: diff --git a/helm-charts/infisical-standalone-postgres/Chart.lock b/helm-charts/infisical-standalone-postgres/Chart.lock index 993acf0a9..ef1f9371b 100644 --- a/helm-charts/infisical-standalone-postgres/Chart.lock +++ b/helm-charts/infisical-standalone-postgres/Chart.lock @@ -8,5 +8,8 @@ dependencies: - name: redis repository: oci://registry-1.docker.io/bitnamicharts version: 18.14.1 -digest: sha256:57a18fb5258fc153d27b633f6570104c7628af651f08f3ae7e1cf8920c2c31fa -generated: "2025-09-30T18:44:50.303037+04:00" +- name: reloader + repository: https://stakater.github.io/stakater-charts + version: 2.2.3 +digest: sha256:cdaf2a4056a24633b7bbcafb72c8c6fd1c0e8d75a9ceb016917906f83db1e6b0 +generated: "2025-10-20T13:56:11.25867+04:00" diff --git a/helm-charts/infisical-standalone-postgres/Chart.yaml b/helm-charts/infisical-standalone-postgres/Chart.yaml index e7069532f..543043843 100644 --- a/helm-charts/infisical-standalone-postgres/Chart.yaml +++ b/helm-charts/infisical-standalone-postgres/Chart.yaml @@ -7,7 +7,7 @@ type: application # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. # Versions are expected to follow Semantic Versioning (https://semver.org/) -version: 1.7.1 +version: 1.7.2 # This is the version number of the application being deployed. This version number should be # incremented each time you make changes to the application. Versions are not expected to @@ -28,3 +28,7 @@ dependencies: version: 18.14.1 repository: oci://registry-1.docker.io/bitnamicharts condition: redis.enabled + - name: reloader + version: 2.2.3 + repository: https://stakater.github.io/stakater-charts + condition: reloader.enabled diff --git a/helm-charts/infisical-standalone-postgres/templates/infisical.yaml b/helm-charts/infisical-standalone-postgres/templates/infisical.yaml index 11ebb8f3d..49e7626dd 100644 --- a/helm-charts/infisical-standalone-postgres/templates/infisical.yaml +++ b/helm-charts/infisical-standalone-postgres/templates/infisical.yaml @@ -4,6 +4,9 @@ kind: Deployment metadata: name: {{ include "infisical.fullname" . }} annotations: + {{- if .Values.reloader.enabled }} + secret.reloader.stakater.com/reload: {{ $infisicalValues.kubeSecretRef }} + {{- end }} updatedAt: {{ now | date "2006-01-01 MST 15:04:05" | quote }} {{- with $infisicalValues.deploymentAnnotations }} {{- toYaml . | nindent 4 }} diff --git a/helm-charts/infisical-standalone-postgres/templates/schema-migration-job.yaml b/helm-charts/infisical-standalone-postgres/templates/schema-migration-job.yaml index 8280b98a3..a887ae37b 100644 --- a/helm-charts/infisical-standalone-postgres/templates/schema-migration-job.yaml +++ b/helm-charts/infisical-standalone-postgres/templates/schema-migration-job.yaml @@ -15,6 +15,10 @@ spec: app.kubernetes.io/managed-by: {{ .Release.Service | quote }} app.kubernetes.io/instance: {{ .Release.Name | quote }} helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + {{- if .Values.reloader.enabled }} + annotations: + secret.reloader.stakater.com/reload: {{ $infisicalValues.kubeSecretRef }} + {{- end }} spec: serviceAccountName: {{ include "infisical.serviceAccountName" . }} {{- if $infisicalValues.image.imagePullSecrets }} diff --git a/helm-charts/infisical-standalone-postgres/values.yaml b/helm-charts/infisical-standalone-postgres/values.yaml index 078c84e78..770b4f5b8 100644 --- a/helm-charts/infisical-standalone-postgres/values.yaml +++ b/helm-charts/infisical-standalone-postgres/values.yaml @@ -118,8 +118,7 @@ ingress: # -- Custom annotations for ingress resource annotations: {} # -- TLS settings for HTTPS access - tls: - [] + tls: [] # -- TLS secret name for HTTPS # - secretName: letsencrypt-prod # -- Domain name to associate with the TLS certificate @@ -184,3 +183,7 @@ redis: # -- Redis deployment type (e.g., standalone or cluster) architecture: standalone + +# -- Reloader is used to reload the Infisical instance when the Kubernetes secret referenced by `infisical.kubeSecretRef` is updated +reloader: + enabled: true From ccaf4d78d1a22d06da3a05614aee39d0fd7b19b7 Mon Sep 17 00:00:00 2001 From: Daniel Hougaard Date: Mon, 20 Oct 2025 16:00:01 +0400 Subject: [PATCH 03/11] fix(doc): hsm versioning mismatch --- docs/documentation/platform/kms/hsm-integration.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/documentation/platform/kms/hsm-integration.mdx b/docs/documentation/platform/kms/hsm-integration.mdx index 45d883977..7a8d15fe5 100644 --- a/docs/documentation/platform/kms/hsm-integration.mdx +++ b/docs/documentation/platform/kms/hsm-integration.mdx @@ -1428,7 +1428,7 @@ Enabling HSM encryption has a set of key benefits: infisical: image: repository: infisical/infisical - tag: "v0.151.0-nightly-20251013.1" + tag: "v0.151.0" pullPolicy: IfNotPresent extraVolumeMounts: From 2b8e2d67ee897181694f926ef221276c553b1892 Mon Sep 17 00:00:00 2001 From: Daniel Hougaard Date: Mon, 20 Oct 2025 17:45:27 +0400 Subject: [PATCH 04/11] requested changes --- helm-charts/infisical-standalone-postgres/CHANGELOG.md | 2 +- helm-charts/infisical-standalone-postgres/Chart.yaml | 2 +- .../infisical-standalone-postgres/templates/infisical.yaml | 2 +- .../templates/schema-migration-job.yaml | 2 +- helm-charts/infisical-standalone-postgres/values.yaml | 7 +++---- 5 files changed, 7 insertions(+), 8 deletions(-) diff --git a/helm-charts/infisical-standalone-postgres/CHANGELOG.md b/helm-charts/infisical-standalone-postgres/CHANGELOG.md index ac6906de3..a0e7216e0 100644 --- a/helm-charts/infisical-standalone-postgres/CHANGELOG.md +++ b/helm-charts/infisical-standalone-postgres/CHANGELOG.md @@ -1,7 +1,7 @@ ## 1.7.2 (October 20, 2025) Changes: * Added automatic reloading support for the Infisical deployment when the `infisical.kubeSecretRef` kubernetes secret changes. - * Configurable by `reloader.enabled: true|false`. Defaults to `true`. + * Configurable by `infisical.redeployOnSecretChange: true|false`. Defaults to `true`. ## 1.7.1 (October 10, 2025) diff --git a/helm-charts/infisical-standalone-postgres/Chart.yaml b/helm-charts/infisical-standalone-postgres/Chart.yaml index 543043843..0d4381e72 100644 --- a/helm-charts/infisical-standalone-postgres/Chart.yaml +++ b/helm-charts/infisical-standalone-postgres/Chart.yaml @@ -31,4 +31,4 @@ dependencies: - name: reloader version: 2.2.3 repository: https://stakater.github.io/stakater-charts - condition: reloader.enabled + condition: infisical.redeployOnSecretChange diff --git a/helm-charts/infisical-standalone-postgres/templates/infisical.yaml b/helm-charts/infisical-standalone-postgres/templates/infisical.yaml index 49e7626dd..d4637866b 100644 --- a/helm-charts/infisical-standalone-postgres/templates/infisical.yaml +++ b/helm-charts/infisical-standalone-postgres/templates/infisical.yaml @@ -4,7 +4,7 @@ kind: Deployment metadata: name: {{ include "infisical.fullname" . }} annotations: - {{- if .Values.reloader.enabled }} + {{- if $infisicalValues.redeployOnSecretChange }} secret.reloader.stakater.com/reload: {{ $infisicalValues.kubeSecretRef }} {{- end }} updatedAt: {{ now | date "2006-01-01 MST 15:04:05" | quote }} diff --git a/helm-charts/infisical-standalone-postgres/templates/schema-migration-job.yaml b/helm-charts/infisical-standalone-postgres/templates/schema-migration-job.yaml index a887ae37b..c53c6e3d1 100644 --- a/helm-charts/infisical-standalone-postgres/templates/schema-migration-job.yaml +++ b/helm-charts/infisical-standalone-postgres/templates/schema-migration-job.yaml @@ -15,7 +15,7 @@ spec: app.kubernetes.io/managed-by: {{ .Release.Service | quote }} app.kubernetes.io/instance: {{ .Release.Name | quote }} helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" - {{- if .Values.reloader.enabled }} + {{- if $infisicalValues.redeployOnSecretChange }} annotations: secret.reloader.stakater.com/reload: {{ $infisicalValues.kubeSecretRef }} {{- end }} diff --git a/helm-charts/infisical-standalone-postgres/values.yaml b/helm-charts/infisical-standalone-postgres/values.yaml index 770b4f5b8..202a9008a 100644 --- a/helm-charts/infisical-standalone-postgres/values.yaml +++ b/helm-charts/infisical-standalone-postgres/values.yaml @@ -13,6 +13,9 @@ infisical: # -- Automatically migrates new database schema when deploying autoDatabaseSchemaMigration: true + # -- redeployOnSecretChange is used to reload the Infisical instance when the Kubernetes secret referenced by `infisical.kubeSecretRef` is updated + redeployOnSecretChange: true + autoBootstrap: # -- Enable auto-bootstrap of the Infisical instance enabled: false @@ -183,7 +186,3 @@ redis: # -- Redis deployment type (e.g., standalone or cluster) architecture: standalone - -# -- Reloader is used to reload the Infisical instance when the Kubernetes secret referenced by `infisical.kubeSecretRef` is updated -reloader: - enabled: true From 64df9872b301ae324abfff4b74ac8db46a7e79f1 Mon Sep 17 00:00:00 2001 From: Daniel Hougaard Date: Mon, 20 Oct 2025 21:04:49 +0400 Subject: [PATCH 05/11] Update run-helm-chart-tests-infisical-standalone-postgres.yml --- .../run-helm-chart-tests-infisical-standalone-postgres.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/run-helm-chart-tests-infisical-standalone-postgres.yml b/.github/workflows/run-helm-chart-tests-infisical-standalone-postgres.yml index d48562fc6..a7bb2c619 100644 --- a/.github/workflows/run-helm-chart-tests-infisical-standalone-postgres.yml +++ b/.github/workflows/run-helm-chart-tests-infisical-standalone-postgres.yml @@ -29,6 +29,7 @@ jobs: run: | helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx helm repo add bitnami https://charts.bitnami.com/bitnami + helm repo add stakater https://stakater.github.io/stakater-charts helm repo update - name: Set up chart-testing From 53563a5c3a836fa280073a21f3fded5e99b1b8e1 Mon Sep 17 00:00:00 2001 From: Daniel Hougaard Date: Mon, 20 Oct 2025 21:07:32 +0400 Subject: [PATCH 06/11] Update Chart.lock --- helm-charts/infisical-standalone-postgres/Chart.lock | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/helm-charts/infisical-standalone-postgres/Chart.lock b/helm-charts/infisical-standalone-postgres/Chart.lock index ef1f9371b..8e7a3004e 100644 --- a/helm-charts/infisical-standalone-postgres/Chart.lock +++ b/helm-charts/infisical-standalone-postgres/Chart.lock @@ -11,5 +11,5 @@ dependencies: - name: reloader repository: https://stakater.github.io/stakater-charts version: 2.2.3 -digest: sha256:cdaf2a4056a24633b7bbcafb72c8c6fd1c0e8d75a9ceb016917906f83db1e6b0 -generated: "2025-10-20T13:56:11.25867+04:00" +digest: sha256:ae7d9ff526de87e972fed0f9c8f32ca40af8cf8b24b59d814cf72beb66ee4198 +generated: "2025-10-20T21:07:19.162271+04:00" From 4dd343af11206c9b32ad2b9da84704072fa559cf Mon Sep 17 00:00:00 2001 From: Daniel Hougaard Date: Tue, 21 Oct 2025 22:27:20 +0400 Subject: [PATCH 07/11] removed reloader requested changes --- .github/values.yaml | 57 ------------------- .../workflows/helm-release-infisical-core.yml | 2 +- ...rt-tests-infisical-standalone-postgres.yml | 2 +- .../CHANGELOG.md | 4 +- .../infisical-standalone-postgres/Chart.lock | 7 +-- .../infisical-standalone-postgres/Chart.yaml | 4 -- .../infisical-standalone-postgres/README.md | 1 - .../templates/infisical.yaml | 13 ----- .../templates/schema-migration-job.yaml | 56 ------------------ .../infisical-standalone-postgres/values.yaml | 8 +-- 10 files changed, 8 insertions(+), 146 deletions(-) delete mode 100644 .github/values.yaml delete mode 100644 helm-charts/infisical-standalone-postgres/templates/schema-migration-job.yaml diff --git a/.github/values.yaml b/.github/values.yaml deleted file mode 100644 index 1b3ffd87a..000000000 --- a/.github/values.yaml +++ /dev/null @@ -1,57 +0,0 @@ -## @section Common parameters -## - -## @param nameOverride Override release name -## -nameOverride: "" -## @param fullnameOverride Override release fullname -## -fullnameOverride: "" - -## @section Infisical backend parameters -## Documentation : https://infisical.com/docs/self-hosting/deployments/kubernetes -## - -infisical: - autoDatabaseSchemaMigration: false - - enabled: false - - name: infisical - replicaCount: 3 - image: - repository: infisical/staging_infisical - tag: "latest" - pullPolicy: Always - - deploymentAnnotations: - secrets.infisical.com/auto-reload: "true" - - kubeSecretRef: "managed-secret" - -ingress: - ## @param ingress.enabled Enable ingress - ## - enabled: true - ## @param ingress.ingressClassName Ingress class name - ## - ingressClassName: nginx - ## @param ingress.nginx.enabled Ingress controller - ## - # nginx: - # enabled: true - ## @param ingress.annotations Ingress annotations - ## - annotations: - cert-manager.io/cluster-issuer: "letsencrypt-prod" - hostName: "gamma.infisical.com" - tls: - - secretName: letsencrypt-prod - hosts: - - gamma.infisical.com - -postgresql: - enabled: false - -redis: - enabled: false diff --git a/.github/workflows/helm-release-infisical-core.yml b/.github/workflows/helm-release-infisical-core.yml index 6c317cc27..49118a5ae 100644 --- a/.github/workflows/helm-release-infisical-core.yml +++ b/.github/workflows/helm-release-infisical-core.yml @@ -56,7 +56,7 @@ jobs: --config ct.yaml \ --charts helm-charts/infisical-standalone-postgres \ --helm-extra-args="--timeout=300s" \ - --helm-extra-set-args="--set ingress.nginx.enabled=false --set infisical.autoDatabaseSchemaMigration=false --set infisical.replicaCount=1 --set infisical.image.tag=v0.132.2-postgres" \ + --helm-extra-set-args="--set ingress.nginx.enabled=false --set infisical.replicaCount=1 --set infisical.image.tag=v0.151.0" \ --namespace infisical-standalone-postgres release: diff --git a/.github/workflows/run-helm-chart-tests-infisical-standalone-postgres.yml b/.github/workflows/run-helm-chart-tests-infisical-standalone-postgres.yml index a7bb2c619..2023de187 100644 --- a/.github/workflows/run-helm-chart-tests-infisical-standalone-postgres.yml +++ b/.github/workflows/run-helm-chart-tests-infisical-standalone-postgres.yml @@ -67,5 +67,5 @@ jobs: --config ct.yaml \ --charts helm-charts/infisical-standalone-postgres \ --helm-extra-args="--timeout=300s" \ - --helm-extra-set-args="--set ingress.nginx.enabled=false --set infisical.autoDatabaseSchemaMigration=false --set infisical.replicaCount=1 --set infisical.image.tag=v0.132.2-postgres --set infisical.autoBootstrap.enabled=true" \ + --helm-extra-set-args="--set ingress.nginx.enabled=false --set infisical.replicaCount=1 --set infisical.image.tag=v0.151.0 --set infisical.autoBootstrap.enabled=true" \ --namespace infisical-standalone-postgres diff --git a/helm-charts/infisical-standalone-postgres/CHANGELOG.md b/helm-charts/infisical-standalone-postgres/CHANGELOG.md index a0e7216e0..5298432d7 100644 --- a/helm-charts/infisical-standalone-postgres/CHANGELOG.md +++ b/helm-charts/infisical-standalone-postgres/CHANGELOG.md @@ -1,7 +1,9 @@ ## 1.7.2 (October 20, 2025) Changes: +* Updated the default `infisical.image.tag` value to `v0.151.0`. +* `autoDatabaseSchemaMigration` has been fully removed as all newer versions of Infisical automatically run migrations as apart of the startup process. * Added automatic reloading support for the Infisical deployment when the `infisical.kubeSecretRef` kubernetes secret changes. - * Configurable by `infisical.redeployOnSecretChange: true|false`. Defaults to `true`. + * Configurable by `infisical.redeployOnSecretChange: true|false`. Defaults to `false`. ## 1.7.1 (October 10, 2025) diff --git a/helm-charts/infisical-standalone-postgres/Chart.lock b/helm-charts/infisical-standalone-postgres/Chart.lock index 8e7a3004e..b8ae1fd3f 100644 --- a/helm-charts/infisical-standalone-postgres/Chart.lock +++ b/helm-charts/infisical-standalone-postgres/Chart.lock @@ -8,8 +8,5 @@ dependencies: - name: redis repository: oci://registry-1.docker.io/bitnamicharts version: 18.14.1 -- name: reloader - repository: https://stakater.github.io/stakater-charts - version: 2.2.3 -digest: sha256:ae7d9ff526de87e972fed0f9c8f32ca40af8cf8b24b59d814cf72beb66ee4198 -generated: "2025-10-20T21:07:19.162271+04:00" +digest: sha256:57a18fb5258fc153d27b633f6570104c7628af651f08f3ae7e1cf8920c2c31fa +generated: "2025-10-21T22:30:21.313884+04:00" diff --git a/helm-charts/infisical-standalone-postgres/Chart.yaml b/helm-charts/infisical-standalone-postgres/Chart.yaml index 0d4381e72..21f358626 100644 --- a/helm-charts/infisical-standalone-postgres/Chart.yaml +++ b/helm-charts/infisical-standalone-postgres/Chart.yaml @@ -28,7 +28,3 @@ dependencies: version: 18.14.1 repository: oci://registry-1.docker.io/bitnamicharts condition: redis.enabled - - name: reloader - version: 2.2.3 - repository: https://stakater.github.io/stakater-charts - condition: infisical.redeployOnSecretChange diff --git a/helm-charts/infisical-standalone-postgres/README.md b/helm-charts/infisical-standalone-postgres/README.md index cd0e18848..b266563e8 100644 --- a/helm-charts/infisical-standalone-postgres/README.md +++ b/helm-charts/infisical-standalone-postgres/README.md @@ -18,7 +18,6 @@ A helm chart to deploy Infisical |-----|------|---------|-------------| | fullnameOverride | string | `""` | Overrides the full name of the release, affecting resource names | | infisical.affinity | object | `{}` | Node affinity settings for pod placement | -| infisical.autoDatabaseSchemaMigration | bool | `true` | Automatically migrates new database schema when deploying | | infisical.databaseSchemaMigrationJob.image.pullPolicy | string | `"IfNotPresent"` | Pulls image only if not present on the node | | infisical.databaseSchemaMigrationJob.image.repository | string | `"ghcr.io/groundnuty/k8s-wait-for"` | Image repository for migration wait job | | infisical.databaseSchemaMigrationJob.image.tag | string | `"no-root-v2.0"` | Image tag version | diff --git a/helm-charts/infisical-standalone-postgres/templates/infisical.yaml b/helm-charts/infisical-standalone-postgres/templates/infisical.yaml index d4637866b..d13c51295 100644 --- a/helm-charts/infisical-standalone-postgres/templates/infisical.yaml +++ b/helm-charts/infisical-standalone-postgres/templates/infisical.yaml @@ -4,9 +4,6 @@ kind: Deployment metadata: name: {{ include "infisical.fullname" . }} annotations: - {{- if $infisicalValues.redeployOnSecretChange }} - secret.reloader.stakater.com/reload: {{ $infisicalValues.kubeSecretRef }} - {{- end }} updatedAt: {{ now | date "2006-01-01 MST 15:04:05" | quote }} {{- with $infisicalValues.deploymentAnnotations }} {{- toYaml . | nindent 4 }} @@ -47,16 +44,6 @@ spec: {{- if $infisicalValues.image.imagePullSecrets }} imagePullSecrets: {{- toYaml $infisicalValues.image.imagePullSecrets | nindent 6 }} - {{- end }} - {{- if $infisicalValues.autoDatabaseSchemaMigration }} - serviceAccountName: {{ include "infisical.serviceAccountName" . }} - initContainers: - - name: "migration-init" - image: "{{ $infisicalValues.databaseSchemaMigrationJob.image.repository }}:{{ $infisicalValues.databaseSchemaMigrationJob.image.tag }}" - imagePullPolicy: {{ $infisicalValues.databaseSchemaMigrationJob.image.pullPolicy }} - args: - - "job" - - "{{ .Release.Name }}-schema-migration-{{ .Release.Revision }}" {{- end }} containers: - name: {{ template "infisical.name" . }}-{{ $infisicalValues.name }} diff --git a/helm-charts/infisical-standalone-postgres/templates/schema-migration-job.yaml b/helm-charts/infisical-standalone-postgres/templates/schema-migration-job.yaml deleted file mode 100644 index c53c6e3d1..000000000 --- a/helm-charts/infisical-standalone-postgres/templates/schema-migration-job.yaml +++ /dev/null @@ -1,56 +0,0 @@ -{{- $infisicalValues := .Values.infisical }} -{{- if $infisicalValues.autoDatabaseSchemaMigration }} -apiVersion: batch/v1 -kind: Job -metadata: - name: "{{ .Release.Name }}-schema-migration-{{ .Release.Revision }}" - labels: - helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" -spec: - backoffLimit: 10 - template: - metadata: - name: "{{ .Release.Name }}-create-tables" - labels: - app.kubernetes.io/managed-by: {{ .Release.Service | quote }} - app.kubernetes.io/instance: {{ .Release.Name | quote }} - helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" - {{- if $infisicalValues.redeployOnSecretChange }} - annotations: - secret.reloader.stakater.com/reload: {{ $infisicalValues.kubeSecretRef }} - {{- end }} - spec: - serviceAccountName: {{ include "infisical.serviceAccountName" . }} - {{- if $infisicalValues.image.imagePullSecrets }} - imagePullSecrets: - {{- toYaml $infisicalValues.image.imagePullSecrets | nindent 6 }} - {{- end }} - restartPolicy: OnFailure - containers: - - name: infisical-schema-migration - image: "{{ $infisicalValues.image.repository }}:{{ $infisicalValues.image.tag }}" - command: ["npm", "run", "migration:latest"] - env: - {{- if .Values.postgresql.useExistingPostgresSecret.enabled }} - - name: DB_CONNECTION_URI - valueFrom: - secretKeyRef: - name: {{ .Values.postgresql.useExistingPostgresSecret.existingConnectionStringSecret.name }} - key: {{ .Values.postgresql.useExistingPostgresSecret.existingConnectionStringSecret.key }} - {{- end }} - {{- if .Values.postgresql.enabled }} - - name: DB_CONNECTION_URI - value: {{ include "infisical.postgresDBConnectionString" . }} - {{- end }} - envFrom: - - secretRef: - name: {{ $infisicalValues.kubeSecretRef }} - {{- with $infisicalValues.extraVolumeMounts }} - volumeMounts: - {{- toYaml . | nindent 10 }} - {{- end }} - {{- with $infisicalValues.extraVolumes }} - volumes: - {{- toYaml . | nindent 8 }} - {{- end }} -{{- end }} \ No newline at end of file diff --git a/helm-charts/infisical-standalone-postgres/values.yaml b/helm-charts/infisical-standalone-postgres/values.yaml index 202a9008a..e0a81d9e3 100644 --- a/helm-charts/infisical-standalone-postgres/values.yaml +++ b/helm-charts/infisical-standalone-postgres/values.yaml @@ -10,12 +10,6 @@ infisical: # -- Sets the name of the deployment within this chart name: infisical - # -- Automatically migrates new database schema when deploying - autoDatabaseSchemaMigration: true - - # -- redeployOnSecretChange is used to reload the Infisical instance when the Kubernetes secret referenced by `infisical.kubeSecretRef` is updated - redeployOnSecretChange: true - autoBootstrap: # -- Enable auto-bootstrap of the Infisical instance enabled: false @@ -71,7 +65,7 @@ infisical: # -- Image repository for the Infisical service repository: infisical/infisical # -- Specific version tag of the Infisical image. View the latest version here https://hub.docker.com/r/infisical/infisical - tag: "v0.93.1-postgres" + tag: "v0.151.0" # -- Pulls image only if not already present on the node pullPolicy: IfNotPresent # -- Secret references for pulling the image, if needed From db3a667d1f968ab3016d7f899973c7f38c6366e8 Mon Sep 17 00:00:00 2001 From: Daniel Hougaard Date: Wed, 22 Oct 2025 14:25:02 +0400 Subject: [PATCH 08/11] requested changes --- .../run-helm-chart-tests-infisical-standalone-postgres.yml | 1 - helm-charts/infisical-standalone-postgres/CHANGELOG.md | 2 -- 2 files changed, 3 deletions(-) diff --git a/.github/workflows/run-helm-chart-tests-infisical-standalone-postgres.yml b/.github/workflows/run-helm-chart-tests-infisical-standalone-postgres.yml index 2023de187..f960aa6ff 100644 --- a/.github/workflows/run-helm-chart-tests-infisical-standalone-postgres.yml +++ b/.github/workflows/run-helm-chart-tests-infisical-standalone-postgres.yml @@ -29,7 +29,6 @@ jobs: run: | helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx helm repo add bitnami https://charts.bitnami.com/bitnami - helm repo add stakater https://stakater.github.io/stakater-charts helm repo update - name: Set up chart-testing diff --git a/helm-charts/infisical-standalone-postgres/CHANGELOG.md b/helm-charts/infisical-standalone-postgres/CHANGELOG.md index 5298432d7..7ff0069d3 100644 --- a/helm-charts/infisical-standalone-postgres/CHANGELOG.md +++ b/helm-charts/infisical-standalone-postgres/CHANGELOG.md @@ -2,8 +2,6 @@ Changes: * Updated the default `infisical.image.tag` value to `v0.151.0`. * `autoDatabaseSchemaMigration` has been fully removed as all newer versions of Infisical automatically run migrations as apart of the startup process. -* Added automatic reloading support for the Infisical deployment when the `infisical.kubeSecretRef` kubernetes secret changes. - * Configurable by `infisical.redeployOnSecretChange: true|false`. Defaults to `false`. ## 1.7.1 (October 10, 2025) From eb1bf7906699892b623f898bbe7146eff947ce46 Mon Sep 17 00:00:00 2001 From: Piyush Gupta Date: Wed, 22 Oct 2025 20:59:25 +0530 Subject: [PATCH 09/11] fix: pricing calculation on billing page --- .../ee/services/license/license-service.ts | 45 +++++++++++-------- .../src/ee/services/license/license-types.ts | 9 ++++ frontend/src/hooks/api/organization/types.ts | 2 + .../BillingCloudTab/PreviewSection.tsx | 37 ++++++++++----- 4 files changed, 65 insertions(+), 28 deletions(-) diff --git a/backend/src/ee/services/license/license-service.ts b/backend/src/ee/services/license/license-service.ts index 45f74fd8c..9b6df4eaf 100644 --- a/backend/src/ee/services/license/license-service.ts +++ b/backend/src/ee/services/license/license-service.ts @@ -40,6 +40,7 @@ import { TOrgPlanDTO, TOrgPlansTableDTO, TOrgPmtMethodsDTO, + TPlanBillingInfo, TStartOrgTrialDTO, TUpdateOrgBillingDetailsDTO } from "./license-types"; @@ -465,6 +466,21 @@ export const licenseServiceFactory = ({ return { url }; }; + const getUsageMetrics = async (orgId: string) => { + const [orgMembersUsed, identityUsed, projectCount] = await Promise.all([ + orgDAL.countAllOrgMembers(orgId), + licenseDAL.countOfOrgIdentities(orgId), + projectDAL.countOfOrgProjects(orgId) + ]); + + return { + orgMembersUsed, + identityUsed, + projectCount, + totalIdentities: identityUsed + orgMembersUsed + }; + }; + const getOrgBillingInfo = async ({ orgId, actor, actorId, actorAuthMethod, actorOrgId }: TGetOrgBillInfoDTO) => { const { permission } = await permissionService.getOrgPermission({ actorId, @@ -483,10 +499,16 @@ export const licenseServiceFactory = ({ }); } if (instanceType === InstanceType.Cloud) { - const { data } = await licenseServerCloudApi.request.get( + const { data } = await licenseServerCloudApi.request.get( `/api/license-server/v1/customers/${organization.customerId}/cloud-plan/billing` ); - return data; + const { identityUsed, orgMembersUsed } = await getUsageMetrics(orgId); + + return { + ...data, + users: orgMembersUsed, + identities: identityUsed + }; } return { @@ -495,7 +517,9 @@ export const licenseServiceFactory = ({ interval: "month", intervalCount: 1, amount: 0, - quantity: 1 + quantity: 1, + users: 0, + identities: 0 }; }; @@ -539,21 +563,6 @@ export const licenseServiceFactory = ({ throw new Error(`Unsupported instance type for server-based plan table: ${instanceType}`); }; - const getUsageMetrics = async (orgId: string) => { - const [orgMembersUsed, identityUsed, projectCount] = await Promise.all([ - orgDAL.countAllOrgMembers(orgId), - licenseDAL.countOfOrgIdentities(orgId), - projectDAL.countOfOrgProjects(orgId) - ]); - - return { - orgMembersUsed, - identityUsed, - projectCount, - totalIdentities: identityUsed + orgMembersUsed - }; - }; - // returns org current plan feature table const getOrgPlanTable = async ({ orgId, actor, actorId, actorAuthMethod, actorOrgId }: TGetOrgBillInfoDTO) => { const { permission } = await permissionService.getOrgPermission({ diff --git a/backend/src/ee/services/license/license-types.ts b/backend/src/ee/services/license/license-types.ts index 93f40ae6e..c4ff6a8fa 100644 --- a/backend/src/ee/services/license/license-types.ts +++ b/backend/src/ee/services/license/license-types.ts @@ -22,6 +22,15 @@ export type TOfflineLicense = { features: TFeatureSet; }; +export type TPlanBillingInfo = { + currentPeriodStart: number; + currentPeriodEnd: number; + interval: "month" | "year"; + intervalCount: number; + amount: number; + quantity: number; +}; + export type TFeatureSet = { _id: null; slug: string | null; diff --git a/frontend/src/hooks/api/organization/types.ts b/frontend/src/hooks/api/organization/types.ts index e9c36fada..867450830 100644 --- a/frontend/src/hooks/api/organization/types.ts +++ b/frontend/src/hooks/api/organization/types.ts @@ -66,6 +66,8 @@ export type PlanBillingInfo = { interval: "month" | "year"; intervalCount: number; quantity: number; + users: number; + identities: number; }; export type Invoice = { diff --git a/frontend/src/pages/organization/BillingPage/components/BillingCloudTab/PreviewSection.tsx b/frontend/src/pages/organization/BillingPage/components/BillingCloudTab/PreviewSection.tsx index d22eab08b..7edc8b0db 100644 --- a/frontend/src/pages/organization/BillingPage/components/BillingCloudTab/PreviewSection.tsx +++ b/frontend/src/pages/organization/BillingPage/components/BillingCloudTab/PreviewSection.tsx @@ -1,10 +1,10 @@ import { useEffect } from "react"; -import { faArrowUpRightFromSquare } from "@fortawesome/free-solid-svg-icons"; +import { faArrowUpRightFromSquare, faInfoCircle } from "@fortawesome/free-solid-svg-icons"; import { FontAwesomeIcon } from "@fortawesome/react-fontawesome"; import { useQueryClient } from "@tanstack/react-query"; import { OrgPermissionCan } from "@app/components/permissions"; -import { Button } from "@app/components/v2"; +import { Button, Tooltip } from "@app/components/v2"; import { OrgPermissionBillingActions, OrgPermissionSubjects, @@ -27,6 +27,9 @@ export const PreviewSection = () => { const { subscription } = useSubscription(true); const queryClient = useQueryClient(); const { data, isPending } = useGetOrgPlanBillingInfo(currentOrg?.id ?? ""); + + const totalAmount = data?.amount ? data.amount * (data.users + data.identities) : 0; + const getOrgTrialUrl = useGetOrgTrialUrl(); const createCustomerPortalSession = useCreateCustomerPortalSession(); @@ -190,14 +193,28 @@ export const PreviewSection = () => { )} -
-

Price

-

- {subscription.status === "trialing" - ? "$0.00 / month" - : `${formatAmount(data.amount)} / ${data.interval}`} -

-
+ {subscription.slug !== "enterprise" ? ( +
+

Price

+

+ {subscription.status === "trialing" ? ( + "$0.00 / month" + ) : ( + <> + {formatAmount(totalAmount)} / {data.interval} + {(subscription.slug === "pro" || subscription.slug === "pro-annual") && ( + 1 ? "users" : "user"} and ${data.identities} ${data.identities > 1 ? "machine identities" : "machine identity"}.`} + className="max-w-lg" + > + + + )} + + )} +

+
+ ) : null}

Subscription renews on

From cee47af0f8ded48f0b1688457e93c1e8127f64ae Mon Sep 17 00:00:00 2001 From: Piyush Gupta Date: Thu, 23 Oct 2025 22:11:55 +0530 Subject: [PATCH 10/11] fix: update paywall to show correct plan: team -> pro/enterprise --- .../UpgradePlanModal/UpgradePlanModal.tsx | 43 ++++++++++++++++--- .../OverviewPage/OverviewPage.tsx | 7 ++- .../components/ActionBar/ActionBar.tsx | 9 +++- .../EnvironmentTabs/EnvironmentTabs.tsx | 2 +- .../SecretRotationPage/SecretRotationPage.tsx | 2 +- .../EnvironmentSection/EnvironmentSection.tsx | 2 +- 6 files changed, 51 insertions(+), 14 deletions(-) diff --git a/frontend/src/components/license/UpgradePlanModal/UpgradePlanModal.tsx b/frontend/src/components/license/UpgradePlanModal/UpgradePlanModal.tsx index 17c0777f1..2279d6f8d 100644 --- a/frontend/src/components/license/UpgradePlanModal/UpgradePlanModal.tsx +++ b/frontend/src/components/license/UpgradePlanModal/UpgradePlanModal.tsx @@ -8,22 +8,40 @@ type Props = { isOpen?: boolean; onOpenChange?: (isOpen: boolean) => void; text: string; + isEnterpriseFeature?: boolean; }; -export const UpgradePlanModal = ({ text, isOpen, onOpenChange }: Props): JSX.Element => { +export const UpgradePlanModal = ({ + text, + isOpen, + onOpenChange, + isEnterpriseFeature = false +}: Props): JSX.Element => { const { subscription } = useSubscription(); const { currentOrg } = useOrganization(); const { mutateAsync, isPending } = useGetOrgTrialUrl(); - const link = - subscription && subscription.slug !== null - ? ("/organization/billing" as const) - : "https://infisical.com/scheduledemo"; + + const getLink = () => { + // self-hosting + if (!subscription || subscription.slug === null) { + return "https://infisical.com/scheduledemo"; + } + + // Infisical cloud + if (isEnterpriseFeature) { + return "https://infisical.com/talk-to-us"; + } + + return "/organization/billing" as const; + }; + + const link = getLink(); const handleUpgradeBtnClick = async () => { try { if (!subscription || !currentOrg) return; - if (!subscription.has_used_trial) { + if (!subscription.has_used_trial && !isEnterpriseFeature) { // direct user to start pro trial const url = await mutateAsync({ @@ -40,6 +58,17 @@ export const UpgradePlanModal = ({ text, isOpen, onOpenChange }: Props): JSX.Ele console.error(err); } }; + const getUpgradePlanLabel = () => { + if (subscription) { + if (isEnterpriseFeature) { + return "Talk to Us"; + } + if (!subscription.has_used_trial) { + return "Start Pro Free Trial"; + } + } + return "Upgrade Plan"; + }; return ( @@ -55,7 +84,7 @@ export const UpgradePlanModal = ({ text, isOpen, onOpenChange }: Props): JSX.Ele onClick={handleUpgradeBtnClick} className="mr-4" > - {subscription && !subscription.has_used_trial ? "Start Pro Free Trial" : "Upgrade Plan"} + {getUpgradePlanLabel()}

); From 579e2cae14f232c961db7da6540c540d2e060bf0 Mon Sep 17 00:00:00 2001 From: Victor Santos Date: Fri, 24 Oct 2025 09:52:29 -0300 Subject: [PATCH 11/11] feat(identity-aws-auth): support GovCloud ARNs in ARN extraction and validation --- .../src/services/identity-aws-auth/identity-aws-auth-fns.ts | 4 +++- .../identity-aws-auth/identity-aws-auth-validators.ts | 4 ++-- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/backend/src/services/identity-aws-auth/identity-aws-auth-fns.ts b/backend/src/services/identity-aws-auth/identity-aws-auth-fns.ts index 38944917e..a028bc25f 100644 --- a/backend/src/services/identity-aws-auth/identity-aws-auth-fns.ts +++ b/backend/src/services/identity-aws-auth/identity-aws-auth-fns.ts @@ -83,9 +83,11 @@ export const extractPrincipalArnEntity = (arn: string, formatAsIamRole: boolean * Extracts the identity ARN from the GetCallerIdentity response to one of the following formats: * - arn:aws:iam::123456789012:user/MyUserName * - arn:aws:iam::123456789012:role/MyRoleName + * - arn:aws-us-gov:iam::123456789012:user/MyUserName (GovCloud) + * - arn:aws-us-gov:iam::123456789012:role/MyRoleName (GovCloud) */ export const extractPrincipalArn = (arn: string, formatAsIamRole: boolean = false) => { const entity = extractPrincipalArnEntity(arn, formatAsIamRole); - return `arn:aws:${formatAsIamRole ? "iam" : entity.Service}::${entity.AccountNumber}:${entity.Type}/${entity.FriendlyName}`; + return `arn:${entity.Partition}:${formatAsIamRole ? "iam" : entity.Service}::${entity.AccountNumber}:${entity.Type}/${entity.FriendlyName}`; }; diff --git a/backend/src/services/identity-aws-auth/identity-aws-auth-validators.ts b/backend/src/services/identity-aws-auth/identity-aws-auth-validators.ts index 4e3884e15..ed7f6696a 100644 --- a/backend/src/services/identity-aws-auth/identity-aws-auth-validators.ts +++ b/backend/src/services/identity-aws-auth/identity-aws-auth-validators.ts @@ -6,7 +6,7 @@ const twelveDigitRegex = new RE2(/^\d{12}$/); // akhilmhdh: change this to a normal function later. Checked no redosable at the moment const arnRegex = new RE2( - /^arn:aws:(iam|sts)::\d{12}:(user\/[a-zA-Z0-9_.@+*/-]+|role\/[a-zA-Z0-9_.@+*/-]+|assumed-role\/[a-zA-Z0-9_.@+*/-]+|\*)$/ + /^arn:aws(?:-us-gov)?:(iam|sts)::\d{12}:(user\/[a-zA-Z0-9_.@+*/-]+|role\/[a-zA-Z0-9_.@+*/-]+|assumed-role\/[a-zA-Z0-9_.@+*/-]+|\*)$/ ); export const validateAccountIds = z @@ -55,7 +55,7 @@ export const validatePrincipalArns = z }, { message: - "Each ARN must be in the format of 'arn:aws:iam::123456789012:user/UserName', 'arn:aws:iam::123456789012:role/RoleName', or 'arn:aws:iam::123456789012:*', 'arn:aws:sts::123456789012:assumed-role/RoleName'." + "Each ARN must be in the format of 'arn:aws:iam::123456789012:user/UserName', 'arn:aws:iam::123456789012:role/RoleName', or 'arn:aws:iam::123456789012:*', 'arn:aws:sts::123456789012:assumed-role/RoleName'. GovCloud ARNs (arn:aws-us-gov:...) are also supported." } ) // Transform to normalize the spaces around commas