From 8445127fadd102402e006d56f961a162931c6380 Mon Sep 17 00:00:00 2001 From: Daniel Hougaard Date: Sat, 7 Jun 2025 02:58:07 +0400 Subject: [PATCH 1/3] feat(gateway): multiple authentication methods --- cli/packages/cmd/gateway.go | 3 +- cli/packages/cmd/login.go | 1 + cli/packages/util/constants.go | 4 + cli/packages/util/helper.go | 5 + docs/cli/commands/gateway.mdx | 251 +++++++++++++++++- docs/cli/commands/login.mdx | 30 ++- .../platform/gateways/overview.mdx | 217 ++++++++++++++- helm-charts/infisical-gateway/Chart.yaml | 4 +- .../templates/deployment.yaml | 9 - helm-charts/infisical-gateway/values.yaml | 2 +- 10 files changed, 498 insertions(+), 28 deletions(-) diff --git a/cli/packages/cmd/gateway.go b/cli/packages/cmd/gateway.go index 90710154e..abc4d6949 100644 --- a/cli/packages/cmd/gateway.go +++ b/cli/packages/cmd/gateway.go @@ -43,7 +43,8 @@ func getInfisicalSdkInstance(cmd *cobra.Command) (infisicalSdk.InfisicalClientIn } // if the --token param is not set, we use the auth-method flag to determine the authentication method, and perform the appropriate login flow based on that - authMethod, err := cmd.Flags().GetString("auth-method") + authMethod, err := util.GetCmdFlagOrEnv(cmd, "auth-method", []string{util.INFISICAL_AUTH_METHOD_NAME}) + if err != nil { cancel() return nil, nil, err diff --git a/cli/packages/cmd/login.go b/cli/packages/cmd/login.go index ef549aabe..fd3ce1569 100644 --- a/cli/packages/cmd/login.go +++ b/cli/packages/cmd/login.go @@ -243,6 +243,7 @@ var loginCmd = &cobra.Command{ util.AuthStrategy.GCP_IAM_AUTH: sdkAuthenticator.HandleGcpIamAuthLogin, util.AuthStrategy.AWS_IAM_AUTH: sdkAuthenticator.HandleAwsIamAuthLogin, util.AuthStrategy.OIDC_AUTH: sdkAuthenticator.HandleOidcAuthLogin, + util.AuthStrategy.JWT_AUTH: sdkAuthenticator.HandleJwtAuthLogin, } credential, err := authStrategies[strategy]() diff --git a/cli/packages/util/constants.go b/cli/packages/util/constants.go index 68fda6d50..126e5a5d0 100644 --- a/cli/packages/util/constants.go +++ b/cli/packages/util/constants.go @@ -13,6 +13,8 @@ const ( VAULT_BACKEND_AUTO_MODE = "auto" VAULT_BACKEND_FILE_MODE = "file" + INFISICAL_AUTH_METHOD_NAME = "INFISICAL_AUTH_METHOD" + // Universal Auth INFISICAL_UNIVERSAL_AUTH_CLIENT_ID_NAME = "INFISICAL_UNIVERSAL_AUTH_CLIENT_ID" INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET_NAME = "INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET" @@ -29,6 +31,8 @@ const ( // JWT AUTH INFISICAL_JWT_NAME = "INFISICAL_JWT" + INFISICAL_GATEWAY_TOKEN_NAME_LEGACY = "TOKEN" // backwards compatibility with gateway helm chart, where token was the only supported auth method + // Generic env variable used for auth methods that require a machine identity ID INFISICAL_MACHINE_IDENTITY_ID_NAME = "INFISICAL_MACHINE_IDENTITY_ID" diff --git a/cli/packages/util/helper.go b/cli/packages/util/helper.go index fc3f994a7..abd9768aa 100644 --- a/cli/packages/util/helper.go +++ b/cli/packages/util/helper.go @@ -96,6 +96,11 @@ func GetInfisicalToken(cmd *cobra.Command) (token *models.TokenDetails, err erro infisicalToken = os.Getenv(INFISICAL_TOKEN_NAME) source = fmt.Sprintf("%s environment variable", INFISICAL_TOKEN_NAME) } + + if infisicalToken == "" { // if its still empty, check for the `TOKEN` environment variable (for gateway helm) + infisicalToken = os.Getenv(INFISICAL_GATEWAY_TOKEN_NAME_LEGACY) + source = fmt.Sprintf("%s environment variable", INFISICAL_GATEWAY_TOKEN_NAME_LEGACY) + } } if infisicalToken == "" { // If it's empty, we return nothing at all. diff --git a/docs/cli/commands/gateway.mdx b/docs/cli/commands/gateway.mdx index fd035f1fd..bd3ce503a 100644 --- a/docs/cli/commands/gateway.mdx +++ b/docs/cli/commands/gateway.mdx @@ -29,10 +29,252 @@ Run the Infisical gateway in the foreground or manage its systemd service instal infisical gateway --token= --domain= ``` - ### Flags + ### Authentication + + + The Infisical CLI supports multiple authentication methods. Below are the available authentication methods, with their respective flags. + + + + The Universal Auth method is a simple and secure way to authenticate with Infisical. It requires a client ID and a client secret to authenticate with Infisical. + + + + + Your machine identity client ID. + + + Your machine identity client secret. + + + The authentication method to use. Must be `universal-auth` when using Universal Auth. + + + + + + + To create a universal auth machine identity, follow the step by step guide outlined [here](/documentation/platform/identities/universal-auth). + + + Run the `login` command with the following flags to obtain an access token: + + ```bash + infisical gateway --auth-method=universal-auth --client-id= --client-secret= + ``` + + + + + + The Native Kubernetes method is used to authenticate with Infisical when running in a Kubernetes environment. It requires a service account token to authenticate with Infisical. + + + + + Your machine identity ID. + + + Path to the Kubernetes service account token to use. Default: `/var/run/secrets/kubernetes.io/serviceaccount/token`. + + + The authentication method to use. Must be `kubernetes` when using Native Kubernetes. + + + + + + + + To create a Kubernetes machine identity, follow the step by step guide outlined [here](/documentation/platform/identities/kubernetes-auth). + + + Run the `login` command with the following flags to obtain an access token: + + ```bash + # --service-account-token-path is optional, and will default to '/var/run/secrets/kubernetes.io/serviceaccount/token' if not provided. + infisical gateway --auth-method=kubernetes --machine-identity-id= --service-account-token-path= + ``` + + + + + + + The Native Azure method is used to authenticate with Infisical when running in an Azure environment. + + + + + Your machine identity ID. + + + The authentication method to use. Must be `azure` when using Native Azure. + + + + + + + To create an Azure machine identity, follow the step by step guide outlined [here](/documentation/platform/identities/azure-auth). + + + Run the `login` command with the following flags to obtain an access token: + + ```bash + infisical gateway --auth-method=azure --machine-identity-id= + ``` + + + + + The Native GCP ID Token method is used to authenticate with Infisical when running in a GCP environment. + + + + + Your machine identity ID. + + + The authentication method to use. Must be `gcp-id-token` when using Native GCP ID Token. + + + + + + + To create a GCP machine identity, follow the step by step guide outlined [here](/documentation/platform/identities/gcp-auth). + + + Run the `login` command with the following flags to obtain an access token: + + ```bash + infisical gateway --auth-method=gcp-id-token --machine-identity-id= + ``` + + + + + + The GCP IAM method is used to authenticate with Infisical with a GCP service account key. + + + + + Your machine identity ID. + + + Path to your GCP service account key file _(Must be in JSON format!)_ + + + The authentication method to use. Must be `gcp-iam` when using GCP IAM. + + + + + + + To create a GCP machine identity, follow the step by step guide outlined [here](/documentation/platform/identities/gcp-auth). + + + Run the `login` command with the following flags to obtain an access token: + + ```bash + infisical gateway --auth-method=gcp-iam --machine-identity-id= --service-account-key-file-path= + ``` + + + + + + The AWS IAM method is used to authenticate with Infisical with an AWS IAM role while running in an AWS environment like EC2, Lambda, etc. + + + + + Your machine identity ID. + + + The authentication method to use. Must be `aws-iam` when using Native AWS IAM. + + + + + + + To create an AWS machine identity, follow the step by step guide outlined [here](/documentation/platform/identities/aws-auth). + + + Run the `login` command with the following flags to obtain an access token: + + ```bash + infisical gateway --auth-method=aws-iam --machine-identity-id= + ``` + + + + + + The OIDC Auth method is used to authenticate with Infisical via identity tokens with OIDC. + + + + + Your machine identity ID. + + + The OIDC JWT from the identity provider. + + + The authentication method to use. Must be `oidc-auth` when using OIDC Auth. + + + + + + + To create an OIDC machine identity, follow the step by step guide outlined [here](/documentation/platform/identities/oidc-auth/general). + + + Run the `login` command with the following flags to obtain an access token: + + ```bash + infisical gateway --auth-method=oidc-auth --machine-identity-id= --jwt= + ``` + + + + + + The JWT Auth method is used to authenticate with Infisical via a JWT token. + + + + + The JWT token to use for authentication. + + + Your machine identity ID. + + + The authentication method to use. Must be `jwt-auth` when using JWT Auth. + + + + + + + Run the `login` command with the following flags to obtain an access token: + + ```bash + infisical gateway --auth-method=jwt-auth --jwt= --machine-identity-id= + ``` + + + - The machine identity access token to authenticate with Infisical. + You can use the `--token` flag to authenticate with Infisical with a raw machine identity access token. If the token is passed, no other flags are needed. ```bash # Example @@ -41,13 +283,16 @@ Run the Infisical gateway in the foreground or manage its systemd service instal You may also expose the token to the CLI by setting the environment variable `INFISICAL_TOKEN` before executing the gateway command. + + + ### Other Flags Domain of your self-hosted Infisical instance. ```bash # Example - sudo infisical gateway install --domain=https://app.your-domain.com + infisical gateway --domain=https://app.your-domain.com ``` diff --git a/docs/cli/commands/login.mdx b/docs/cli/commands/login.mdx index f493ff5d2..f93e3b4b2 100644 --- a/docs/cli/commands/login.mdx +++ b/docs/cli/commands/login.mdx @@ -190,7 +190,7 @@ The Infisical CLI supports multiple authentication methods. Below are the availa - + The OIDC Auth method is used to authenticate with Infisical via identity tokens with OIDC. @@ -198,7 +198,7 @@ The Infisical CLI supports multiple authentication methods. Below are the availa Your machine identity ID. - + The OIDC JWT from the identity provider. @@ -212,11 +212,35 @@ The Infisical CLI supports multiple authentication methods. Below are the availa Run the `login` command with the following flags to obtain an access token: ```bash - infisical login --method=oidc-auth --machine-identity-id= --oidc-jwt= + infisical login --method=oidc-auth --machine-identity-id= --jwt= ``` + + + The JWT Auth method is used to authenticate with Infisical via a JWT token. + + + + + The JWT token to use for authentication. + + + Your machine identity ID. + + + + + + + Run the `login` command with the following flags to obtain an access token: + + ```bash + infisical login --method=jwt-auth --jwt= --machine-identity-id= + ``` + + diff --git a/docs/documentation/platform/gateways/overview.mdx b/docs/documentation/platform/gateways/overview.mdx index e5f9623f5..07d15d607 100644 --- a/docs/documentation/platform/gateways/overview.mdx +++ b/docs/documentation/platform/gateways/overview.mdx @@ -89,18 +89,217 @@ Once authenticated, the Gateway establishes a secure connection with Infisical t helm repo update ``` - ### Create a Kubernetes Secret with the gateway token + ### Create a Kubernetes Secret containing gateway environment variables - Create a new Kubernetes secret containing the gateway token as the `TOKEN` key. You can optionally also set the `INFISICAL_API_URL` key to your Infisical instance URL. By default, `INFISICAL_API_URL` is set to `https://app.infisical.com`. + The gateway supports all identity authentication methods through the use of environment variables. + The environment variables must be set in the `infisical-gateway-environment` Kubernetes secret. - ```bash - kubectl create secret generic infisical-gateway-environment --from-literal=TOKEN= - ``` - - - The secret name is `infisical-gateway-environment` by default. The `TOKEN` key is required, and the `INFISICAL_API_URL` key is optional. - + #### Supported authentication methods + + + + The Universal Auth method is a simple and secure way to authenticate with Infisical. It requires a client ID and a client secret to authenticate with Infisical. + + + + + Your machine identity client ID. + + + Your machine identity client secret. + + + The authentication method to use. Must be `universal-auth` when using Universal Auth. + + + + + ```bash + kubectl create secret generic infisical-gateway-environment --from-literal=INFISICAL_AUTH_METHOD=universal-auth --from-literal=INFISICAL_UNIVERSAL_AUTH_CLIENT_ID= --from-literal=INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET= + ``` + + + + The Native Kubernetes method is used to authenticate with Infisical when running in a Kubernetes environment. It requires a service account token to authenticate with Infisical. + + + + + Your machine identity ID. + + + Path to the Kubernetes service account token to use. Default: `/var/run/secrets/kubernetes.io/serviceaccount/token`. + + + The authentication method to use. Must be `kubernetes` when using Native Kubernetes. + + + + + + ```bash + kubectl create secret generic infisical-gateway-environment --from-literal=INFISICAL_AUTH_METHOD=kubernetes --from-literal=INFISICAL_MACHINE_IDENTITY_ID= + ``` + + + + The Native Azure method is used to authenticate with Infisical when running in an Azure environment. + + + + + Your machine identity ID. + + + The authentication method to use. Must be `azure` when using Native Azure. + + + + + ```bash + kubectl create secret generic infisical-gateway-environment --from-literal=INFISICAL_AUTH_METHOD=azure --from-literal=INFISICAL_MACHINE_IDENTITY_ID= + ``` + + + The Native GCP ID Token method is used to authenticate with Infisical when running in a GCP environment. + + + + + Your machine identity ID. + + + The authentication method to use. Must be `gcp-id-token` when using Native GCP ID Token. + + + + + ```bash + kubectl create secret generic infisical-gateway-environment --from-literal=INFISICAL_AUTH_METHOD=gcp-id-token --from-literal=INFISICAL_MACHINE_IDENTITY_ID= + ``` + + + + The GCP IAM method is used to authenticate with Infisical with a GCP service account key. + + + + + Your machine identity ID. + + + Path to your GCP service account key file _(Must be in JSON format!)_ + + + The authentication method to use. Must be `gcp-iam` when using GCP IAM. + + + + + ```bash + kubectl create secret generic infisical-gateway-environment --from-literal=INFISICAL_AUTH_METHOD=gcp-iam --from-literal=INFISICAL_MACHINE_IDENTITY_ID= --from-literal=INFISICAL_GCP_SERVICE_ACCOUNT_KEY_FILE_PATH= + ``` + + + + + The AWS IAM method is used to authenticate with Infisical with an AWS IAM role while running in an AWS environment like EC2, Lambda, etc. + + + + + Your machine identity ID. + + + The authentication method to use. Must be `aws-iam` when using Native AWS IAM. + + + + + ```bash + kubectl create secret generic infisical-gateway-environment --from-literal=INFISICAL_AUTH_METHOD=aws-iam --from-literal=INFISICAL_MACHINE_IDENTITY_ID= + ``` + + + + The OIDC Auth method is used to authenticate with Infisical via identity tokens with OIDC. + + + + + Your machine identity ID. + + + The OIDC JWT from the identity provider. + + + The authentication method to use. Must be `oidc-auth` when using OIDC Auth. + + + + + + + To create an OIDC machine identity, follow the step by step guide outlined [here](/documentation/platform/identities/oidc-auth/general). + + + Run the `login` command with the following flags to obtain an access token: + + ```bash + infisical gateway --auth-method=oidc-auth --machine-identity-id= --jwt= + ``` + + + + + + The JWT Auth method is used to authenticate with Infisical via a JWT token. + + + + + The JWT token to use for authentication. + + + Your machine identity ID. + + + The authentication method to use. Must be `jwt-auth` when using JWT Auth. + + + + + ```bash + kubectl create secret generic infisical-gateway-environment --from-literal=INFISICAL_AUTH_METHOD=jwt-auth --from-literal=INFISICAL_JWT= --from-literal=INFISICAL_MACHINE_IDENTITY_ID= + ``` + + + You can use the `INFISICAL_TOKEN` environment variable to authenticate with Infisical with a raw machine identity access token. + + + + + The machine identity access token to use for authentication. + + + + + ```bash + kubectl create secret generic infisical-gateway-environment --from-literal=INFISICAL_TOKEN= + ``` + + + + + #### Other environment variables + + + + The API URL to use for the gateway. By default, `INFISICAL_API_URL` is set to `https://app.infisical.com`. + + + ### Install the Infisical Gateway Helm Chart ```bash diff --git a/helm-charts/infisical-gateway/Chart.yaml b/helm-charts/infisical-gateway/Chart.yaml index 8d9d4dac3..5bb18e702 100644 --- a/helm-charts/infisical-gateway/Chart.yaml +++ b/helm-charts/infisical-gateway/Chart.yaml @@ -15,10 +15,10 @@ type: application # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. # Versions are expected to follow Semantic Versioning (https://semver.org/) -version: 0.0.3 +version: 0.0.4 # This is the version number of the application being deployed. This version number should be # incremented each time you make changes to the application. Versions are not expected to # follow Semantic Versioning. They should reflect the version the application is using. # It is recommended to use it with quotes. -appVersion: "0.0.3" +appVersion: "0.0.4" diff --git a/helm-charts/infisical-gateway/templates/deployment.yaml b/helm-charts/infisical-gateway/templates/deployment.yaml index 223bdabd8..a6fac0e7c 100644 --- a/helm-charts/infisical-gateway/templates/deployment.yaml +++ b/helm-charts/infisical-gateway/templates/deployment.yaml @@ -39,18 +39,9 @@ spec: imagePullPolicy: {{ .Values.image.pullPolicy }} args: - gateway - - --token - - $(TOKEN) envFrom: - secretRef: name: {{ .Values.secret.name }} - env: - - name: TOKEN_VALIDATION - valueFrom: - secretKeyRef: - name: {{ .Values.secret.name }} - key: TOKEN - optional: false ports: - name: http containerPort: {{ .Values.service.port }} diff --git a/helm-charts/infisical-gateway/values.yaml b/helm-charts/infisical-gateway/values.yaml index 9e897f461..bf1a81767 100644 --- a/helm-charts/infisical-gateway/values.yaml +++ b/helm-charts/infisical-gateway/values.yaml @@ -1,6 +1,6 @@ image: pullPolicy: IfNotPresent - tag: "0.41.81" + tag: "0.41.83" secret: # The secret that contains the environment variables to be used by the gateway, such as INFISICAL_API_URL and TOKEN From 2ca476f21e35923229181568c9ebdc1f96daa86d Mon Sep 17 00:00:00 2001 From: Daniel Hougaard Date: Sat, 7 Jun 2025 03:04:45 +0400 Subject: [PATCH 2/3] Update gateway.mdx --- docs/cli/commands/gateway.mdx | 138 ++++++++++------------------------ 1 file changed, 40 insertions(+), 98 deletions(-) diff --git a/docs/cli/commands/gateway.mdx b/docs/cli/commands/gateway.mdx index bd3ce503a..a12493c58 100644 --- a/docs/cli/commands/gateway.mdx +++ b/docs/cli/commands/gateway.mdx @@ -26,13 +26,11 @@ Run the Infisical gateway in the foreground or manage its systemd service instal Run the Infisical gateway in the foreground. The gateway will connect to the relay service and maintain a persistent connection. ```bash - infisical gateway --token= --domain= + infisical gateway --domain= --auth-method= ``` ### Authentication - - The Infisical CLI supports multiple authentication methods. Below are the available authentication methods, with their respective flags. @@ -53,19 +51,10 @@ Run the Infisical gateway in the foreground or manage its systemd service instal - - - To create a universal auth machine identity, follow the step by step guide outlined [here](/documentation/platform/identities/universal-auth). - - - Run the `login` command with the following flags to obtain an access token: + ```bash + infisical gateway --auth-method=universal-auth --client-id= --client-secret= + ``` - ```bash - infisical gateway --auth-method=universal-auth --client-id= --client-secret= - ``` - - - The Native Kubernetes method is used to authenticate with Infisical when running in a Kubernetes environment. It requires a service account token to authenticate with Infisical. @@ -85,20 +74,10 @@ Run the Infisical gateway in the foreground or manage its systemd service instal - - - To create a Kubernetes machine identity, follow the step by step guide outlined [here](/documentation/platform/identities/kubernetes-auth). - - - Run the `login` command with the following flags to obtain an access token: - ```bash - # --service-account-token-path is optional, and will default to '/var/run/secrets/kubernetes.io/serviceaccount/token' if not provided. - infisical gateway --auth-method=kubernetes --machine-identity-id= --service-account-token-path= - ``` - - - + ```bash + infisical gateway --auth-method=kubernetes --machine-identity-id= + ``` @@ -115,18 +94,12 @@ Run the Infisical gateway in the foreground or manage its systemd service instal - - - To create an Azure machine identity, follow the step by step guide outlined [here](/documentation/platform/identities/azure-auth). - - - Run the `login` command with the following flags to obtain an access token: - ```bash - infisical gateway --auth-method=azure --machine-identity-id= - ``` - - + + ```bash + infisical gateway --auth-method=azure --machine-identity-id= + ``` + The Native GCP ID Token method is used to authenticate with Infisical when running in a GCP environment. @@ -142,18 +115,12 @@ Run the Infisical gateway in the foreground or manage its systemd service instal - - - To create a GCP machine identity, follow the step by step guide outlined [here](/documentation/platform/identities/gcp-auth). - - - Run the `login` command with the following flags to obtain an access token: - ```bash - infisical gateway --auth-method=gcp-id-token --machine-identity-id= - ``` - - + + ```bash + infisical gateway --auth-method=gcp-id-token --machine-identity-id= + ``` + @@ -173,18 +140,9 @@ Run the Infisical gateway in the foreground or manage its systemd service instal - - - To create a GCP machine identity, follow the step by step guide outlined [here](/documentation/platform/identities/gcp-auth). - - - Run the `login` command with the following flags to obtain an access token: - - ```bash - infisical gateway --auth-method=gcp-iam --machine-identity-id= --service-account-key-file-path= - ``` - - + ```bash + infisical gateway --auth-method=gcp-iam --machine-identity-id= --service-account-key-file-path= + ``` @@ -201,18 +159,10 @@ Run the Infisical gateway in the foreground or manage its systemd service instal - - - To create an AWS machine identity, follow the step by step guide outlined [here](/documentation/platform/identities/aws-auth). - - - Run the `login` command with the following flags to obtain an access token: - ```bash infisical gateway --auth-method=aws-iam --machine-identity-id= ``` - - + @@ -232,18 +182,9 @@ Run the Infisical gateway in the foreground or manage its systemd service instal - - - To create an OIDC machine identity, follow the step by step guide outlined [here](/documentation/platform/identities/oidc-auth/general). - - - Run the `login` command with the following flags to obtain an access token: - - ```bash - infisical gateway --auth-method=oidc-auth --machine-identity-id= --jwt= - ``` - - + ```bash + infisical gateway --auth-method=oidc-auth --machine-identity-id= --jwt= + ``` @@ -263,25 +204,26 @@ Run the Infisical gateway in the foreground or manage its systemd service instal - - - Run the `login` command with the following flags to obtain an access token: - - ```bash - infisical gateway --auth-method=jwt-auth --jwt= --machine-identity-id= - ``` - - - - - You can use the `--token` flag to authenticate with Infisical with a raw machine identity access token. If the token is passed, no other flags are needed. ```bash - # Example - infisical gateway --token= + infisical gateway --auth-method=jwt-auth --jwt= --machine-identity-id= + ``` + + + You can use the `INFISICAL_TOKEN` environment variable to authenticate with Infisical with a raw machine identity access token. + + + + + The machine identity access token to use for authentication. + + + + + ```bash + infisical gateway --token= ``` - You may also expose the token to the CLI by setting the environment variable `INFISICAL_TOKEN` before executing the gateway command. From cf5391d6d4a8f9927dc907568caff55f2b8500f4 Mon Sep 17 00:00:00 2001 From: Daniel Hougaard Date: Sat, 7 Jun 2025 03:06:01 +0400 Subject: [PATCH 3/3] Update overview.mdx --- .../platform/gateways/overview.mdx | 17 ++++------------- 1 file changed, 4 insertions(+), 13 deletions(-) diff --git a/docs/documentation/platform/gateways/overview.mdx b/docs/documentation/platform/gateways/overview.mdx index 07d15d607..127e544b7 100644 --- a/docs/documentation/platform/gateways/overview.mdx +++ b/docs/documentation/platform/gateways/overview.mdx @@ -164,7 +164,7 @@ Once authenticated, the Gateway establishes a secure connection with Infisical t The Native GCP ID Token method is used to authenticate with Infisical when running in a GCP environment. - + Your machine identity ID. @@ -239,18 +239,9 @@ Once authenticated, the Gateway establishes a secure connection with Infisical t - - - To create an OIDC machine identity, follow the step by step guide outlined [here](/documentation/platform/identities/oidc-auth/general). - - - Run the `login` command with the following flags to obtain an access token: - - ```bash - infisical gateway --auth-method=oidc-auth --machine-identity-id= --jwt= - ``` - - + ```bash + kubectl create secret generic infisical-gateway-environment --from-literal=INFISICAL_AUTH_METHOD=oidc-auth --from-literal=INFISICAL_MACHINE_IDENTITY_ID= --from-literal=INFISICAL_JWT= + ```