From 53176784b3a509a936954aedc1144bcf737724a2 Mon Sep 17 00:00:00 2001 From: Carlos Monastyrski Date: Mon, 22 Sep 2025 14:21:14 -0300 Subject: [PATCH] Docs improvements --- .../app-connection/app-connection-fns.ts | 7 +- .../azure-key-vault-pki-sync-constants.ts | 2 +- .../azure-key-vault-pki-sync-schemas.ts | 2 +- .../pki/syncs/azure-key-vault/create.mdx | 147 ------------------ .../pki/syncs/azure-key-vault/delete.mdx | 109 ------------- .../pki/syncs/azure-key-vault/get-by-id.mdx | 136 ---------------- .../pki/syncs/azure-key-vault/list.mdx | 134 ---------------- .../azure-key-vault/remove-certificates.mdx | 61 -------- .../azure-key-vault/sync-certificates.mdx | 53 ------- .../pki/syncs/azure-key-vault/update.mdx | 146 ----------------- .../endpoints/pki/syncs/get-by-id.mdx | 135 ---------------- .../endpoints/pki/syncs/list.mdx | 140 ----------------- .../endpoints/pki/syncs/options.mdx | 53 ------- docs/docs.json | 2 +- .../platform/pki/certificate-syncs.mdx | 102 ------------ .../pki-syncs/forms/CreatePkiSyncForm.tsx | 6 +- 16 files changed, 12 insertions(+), 1223 deletions(-) delete mode 100644 docs/documentation/platform/pki/certificate-syncs.mdx diff --git a/backend/src/services/app-connection/app-connection-fns.ts b/backend/src/services/app-connection/app-connection-fns.ts index f88b5a357..8c8f01af7 100644 --- a/backend/src/services/app-connection/app-connection-fns.ts +++ b/backend/src/services/app-connection/app-connection-fns.ts @@ -150,7 +150,12 @@ const SECRET_SCANNING_APP_CONNECTION_MAP = Object.fromEntries( ); // scott: ideally this would be derived from a utilized map like the above -const PKI_APP_CONNECTIONS = [AppConnection.AWS, AppConnection.Cloudflare, AppConnection.AzureADCS]; +const PKI_APP_CONNECTIONS = [ + AppConnection.AWS, + AppConnection.Cloudflare, + AppConnection.AzureADCS, + AppConnection.AzureKeyVault +]; export const listAppConnectionOptions = (projectType?: ProjectType) => { return [ diff --git a/backend/src/services/pki-sync/azure-key-vault/azure-key-vault-pki-sync-constants.ts b/backend/src/services/pki-sync/azure-key-vault/azure-key-vault-pki-sync-constants.ts index 3c64bc86d..247d72fa4 100644 --- a/backend/src/services/pki-sync/azure-key-vault/azure-key-vault-pki-sync-constants.ts +++ b/backend/src/services/pki-sync/azure-key-vault/azure-key-vault-pki-sync-constants.ts @@ -43,7 +43,7 @@ export const AZURE_KEY_VAULT_PKI_SYNC_LIST_OPTION = { connection: AppConnection.AzureKeyVault, destination: PkiSync.AzureKeyVault, canImportCertificates: false, - canRemoveCertificates: true, + canRemoveCertificates: false, defaultCertificateNameSchema: "Infisical-PKI-Sync-{{certificateId}}", forbiddenCharacters: AZURE_KEY_VAULT_CERTIFICATE_NAMING.FORBIDDEN_CHARACTERS, allowedCharacterPattern: AZURE_KEY_VAULT_CERTIFICATE_NAMING.ALLOWED_CHARACTER_PATTERN, diff --git a/backend/src/services/pki-sync/azure-key-vault/azure-key-vault-pki-sync-schemas.ts b/backend/src/services/pki-sync/azure-key-vault/azure-key-vault-pki-sync-schemas.ts index b27cc2f42..ef6347e82 100644 --- a/backend/src/services/pki-sync/azure-key-vault/azure-key-vault-pki-sync-schemas.ts +++ b/backend/src/services/pki-sync/azure-key-vault/azure-key-vault-pki-sync-schemas.ts @@ -70,5 +70,5 @@ export const AzureKeyVaultPkiSyncListItemSchema = z.object({ connection: z.literal(AppConnection.AzureKeyVault), destination: z.literal(PkiSync.AzureKeyVault), canImportCertificates: z.literal(false), - canRemoveCertificates: z.literal(true) + canRemoveCertificates: z.literal(false) }); diff --git a/docs/api-reference/endpoints/pki/syncs/azure-key-vault/create.mdx b/docs/api-reference/endpoints/pki/syncs/azure-key-vault/create.mdx index ab64179ce..1a464cd1e 100644 --- a/docs/api-reference/endpoints/pki/syncs/azure-key-vault/create.mdx +++ b/docs/api-reference/endpoints/pki/syncs/azure-key-vault/create.mdx @@ -2,150 +2,3 @@ title: "Create Azure Key Vault PKI Sync" openapi: "POST /api/v1/pki/syncs/azure-key-vault" --- - - -This endpoint creates a new Azure Key Vault PKI sync for a specified project. - - -## Request - - - Name of the PKI sync (1-64 characters) - - - - Description of the PKI sync - - - - Whether automatic synchronization is enabled when certificates are issued - - - - Azure Key Vault specific configuration - - - Base URL of the Azure Key Vault (e.g., "https://my-vault.vault.azure.net/") - - - - - - Sync-specific options and settings - - - - ID of the PKI subscriber to connect this sync to. If provided, certificates issued by this subscriber will be automatically synced to Azure Key Vault. - - - - ID of the Azure Key Vault app connection to use for this sync - - - - ID of the project to create the PKI sync in - - -## Response - -Returns the created Azure Key Vault PKI sync object with the same structure as the list endpoint response. - - - Unique identifier for the created PKI sync - - - - Name of the PKI sync - - - - Description of the PKI sync - - - - Always "azure-key-vault" - - - - Whether automatic synchronization is enabled - - - - Azure Key Vault specific configuration - - - - Sync-specific options and settings - - - - ID of the project this sync belongs to - - - - ID of the PKI subscriber this sync is connected to - - - - ID of the Azure Key Vault app connection used for this sync - - - - Timestamp when the PKI sync was created - - - - Timestamp when the PKI sync was last updated - - - -```bash cURL -curl -X POST "https://app.infisical.com/api/v1/pki/syncs/azure-key-vault" \ - -H "Authorization: Bearer " \ - -H "Content-Type: application/json" \ - -d '{ - "name": "Production Azure Key Vault Sync", - "description": "Sync certificates to production Key Vault", - "isAutoSyncEnabled": true, - "destinationConfig": { - "vaultBaseUrl": "https://my-vault.vault.azure.net/" - }, - "syncOptions": {}, - "subscriberId": "sub_12345", - "connectionId": "conn_12345", - "projectId": "proj_12345" - }' -``` - - - -```json Response -{ - "id": "ps_12345", - "name": "Production Azure Key Vault Sync", - "description": "Sync certificates to production Key Vault", - "destination": "azure-key-vault", - "isAutoSyncEnabled": true, - "destinationConfig": { - "vaultBaseUrl": "https://my-vault.vault.azure.net/" - }, - "syncOptions": {}, - "projectId": "proj_12345", - "subscriberId": "sub_12345", - "connectionId": "conn_12345", - "syncStatus": null, - "lastSyncedAt": null, - "lastSyncMessage": null, - "removeStatus": null, - "lastRemovedAt": null, - "lastRemoveMessage": null, - "connection": { - "id": "conn_12345", - "name": "Azure Production Connection", - "app": "azure-key-vault" - }, - "createdAt": "2023-11-01T10:00:00Z", - "updatedAt": "2023-11-01T10:00:00Z" -} -``` - \ No newline at end of file diff --git a/docs/api-reference/endpoints/pki/syncs/azure-key-vault/delete.mdx b/docs/api-reference/endpoints/pki/syncs/azure-key-vault/delete.mdx index 1e1e6b10d..a08b2664d 100644 --- a/docs/api-reference/endpoints/pki/syncs/azure-key-vault/delete.mdx +++ b/docs/api-reference/endpoints/pki/syncs/azure-key-vault/delete.mdx @@ -2,112 +2,3 @@ title: "Delete Azure Key Vault PKI Sync" openapi: "DELETE /api/v1/pki/syncs/azure-key-vault/{pkiSyncId}" --- - - -This action is irreversible. Deleting a PKI sync will stop all automatic certificate synchronization to the Azure Key Vault, but it will not remove certificates that have already been synced. - - - -This endpoint deletes an existing Azure Key Vault PKI sync. - - -## Request - - - The ID of the Azure Key Vault PKI sync to delete - - - - Project ID for additional authorization (will be inferred if not provided) - - -## Response - -Returns the deleted Azure Key Vault PKI sync object. - - - Unique identifier for the deleted PKI sync - - - - Name of the deleted PKI sync - - - - Description of the deleted PKI sync - - - - Always "azure-key-vault" - - - - Whether automatic synchronization was enabled - - - - Azure Key Vault specific configuration - - - - Sync-specific options and settings - - - - ID of the project this sync belonged to - - - - ID of the PKI subscriber this sync was connected to - - - - ID of the Azure Key Vault app connection that was used for this sync - - - - Timestamp when the PKI sync was created - - - - Timestamp when the PKI sync was last updated - - - -```bash cURL -curl -X DELETE "https://app.infisical.com/api/v1/pki/syncs/azure-key-vault/ps_12345" \ - -H "Authorization: Bearer " -``` - - - -```json Response -{ - "id": "ps_12345", - "name": "Production Azure Key Vault Sync", - "description": "Sync certificates to production Key Vault", - "destination": "azure-key-vault", - "isAutoSyncEnabled": true, - "destinationConfig": { - "vaultBaseUrl": "https://my-vault.vault.azure.net/" - }, - "syncOptions": {}, - "projectId": "proj_12345", - "subscriberId": "sub_12345", - "connectionId": "conn_12345", - "syncStatus": "succeeded", - "lastSyncedAt": "2023-12-01T10:00:00Z", - "lastSyncMessage": "Successfully synced 3 certificates", - "removeStatus": null, - "lastRemovedAt": null, - "lastRemoveMessage": null, - "connection": { - "id": "conn_12345", - "name": "Azure Production Connection", - "app": "azure-key-vault" - }, - "createdAt": "2023-11-01T10:00:00Z", - "updatedAt": "2023-12-01T10:00:00Z" -} -``` - \ No newline at end of file diff --git a/docs/api-reference/endpoints/pki/syncs/azure-key-vault/get-by-id.mdx b/docs/api-reference/endpoints/pki/syncs/azure-key-vault/get-by-id.mdx index a521a68c6..0976a9dd1 100644 --- a/docs/api-reference/endpoints/pki/syncs/azure-key-vault/get-by-id.mdx +++ b/docs/api-reference/endpoints/pki/syncs/azure-key-vault/get-by-id.mdx @@ -2,139 +2,3 @@ title: "Get Azure Key Vault PKI Sync by ID" openapi: "GET /api/v1/pki/syncs/azure-key-vault/{pkiSyncId}" --- - - -This endpoint retrieves a specific Azure Key Vault PKI sync by its ID. - - -## Request - - - The ID of the Azure Key Vault PKI sync to retrieve - - - - Project ID for additional authorization (will be inferred if not provided) - - -## Response - - - Unique identifier for the PKI sync - - - - Name of the PKI sync - - - - Description of the PKI sync - - - - Always "azure-key-vault" - - - - Whether automatic synchronization is enabled - - - - Azure Key Vault specific configuration - - - Base URL of the Azure Key Vault - - - - - - Sync-specific options and settings - - - - ID of the project this sync belongs to - - - - ID of the PKI subscriber this sync is connected to - - - - ID of the Azure Key Vault app connection used for this sync - - - - Current status of the last sync operation - - - - Timestamp of the last successful sync - - - - Message from the last sync operation - - - - Current status of the last remove operation - - - - Timestamp of the last certificate removal - - - - Message from the last remove operation - - - - Details about the associated Azure Key Vault app connection - - - - Timestamp when the PKI sync was created - - - - Timestamp when the PKI sync was last updated - - - -```bash cURL -curl -X GET "https://app.infisical.com/api/v1/pki/syncs/azure-key-vault/ps_12345" \ - -H "Authorization: Bearer " -``` - - - -```json Response -{ - "id": "ps_12345", - "name": "Production Azure Key Vault Sync", - "description": "Sync certificates to production Key Vault", - "destination": "azure-key-vault", - "isAutoSyncEnabled": true, - "destinationConfig": { - "vaultBaseUrl": "https://my-vault.vault.azure.net/" - }, - "syncOptions": {}, - "projectId": "proj_12345", - "subscriberId": "sub_12345", - "connectionId": "conn_12345", - "syncStatus": "succeeded", - "lastSyncedAt": "2023-12-01T10:00:00Z", - "lastSyncMessage": "Successfully synced 3 certificates", - "removeStatus": null, - "lastRemovedAt": null, - "lastRemoveMessage": null, - "connection": { - "id": "conn_12345", - "name": "Azure Production Connection", - "app": "azure-key-vault" - }, - "createdAt": "2023-11-01T10:00:00Z", - "updatedAt": "2023-12-01T10:00:00Z" -} -``` - \ No newline at end of file diff --git a/docs/api-reference/endpoints/pki/syncs/azure-key-vault/list.mdx b/docs/api-reference/endpoints/pki/syncs/azure-key-vault/list.mdx index a9968de5b..b21f5bc33 100644 --- a/docs/api-reference/endpoints/pki/syncs/azure-key-vault/list.mdx +++ b/docs/api-reference/endpoints/pki/syncs/azure-key-vault/list.mdx @@ -2,137 +2,3 @@ title: "List Azure Key Vault PKI Syncs" openapi: "GET /api/v1/pki/syncs/azure-key-vault" --- - - -This endpoint lists all Azure Key Vault PKI syncs for a specified project. - - -## Request - - - The ID of the project to list Azure Key Vault PKI syncs for - - -## Response - - -Array of Azure Key Vault PKI syncs for the project - - - Unique identifier for the PKI sync - - - - Name of the PKI sync - - - - Description of the PKI sync - - - - Always "azure-key-vault" for this endpoint - - - - Whether automatic synchronization is enabled - - - - Azure Key Vault specific configuration - - - Base URL of the Azure Key Vault (e.g., "https://my-vault.vault.azure.net/") - - - - - - Sync-specific options and settings - - - - ID of the project this sync belongs to - - - - ID of the PKI subscriber this sync is connected to - - - - ID of the Azure Key Vault app connection used for this sync - - - - Current status of the last sync operation ("pending", "running", "succeeded", "failed") - - - - Timestamp of the last successful sync - - - - Message from the last sync operation - - - - Current status of the last remove operation - - - - Timestamp of the last certificate removal - - - - Message from the last remove operation - - - - Details about the associated Azure Key Vault app connection - - - - Timestamp when the PKI sync was created - - - - Timestamp when the PKI sync was last updated - - - - - -```json Response -{ - "pkiSyncs": [ - { - "id": "ps_12345", - "name": "Production Azure Key Vault Sync", - "description": "Sync certificates to production Key Vault", - "destination": "azure-key-vault", - "isAutoSyncEnabled": true, - "destinationConfig": { - "vaultBaseUrl": "https://my-vault.vault.azure.net/" - }, - "syncOptions": {}, - "projectId": "proj_12345", - "subscriberId": "sub_12345", - "connectionId": "conn_12345", - "syncStatus": "succeeded", - "lastSyncedAt": "2023-12-01T10:00:00Z", - "lastSyncMessage": "Successfully synced 3 certificates", - "removeStatus": null, - "lastRemovedAt": null, - "lastRemoveMessage": null, - "connection": { - "id": "conn_12345", - "name": "Azure Production Connection", - "app": "azure-key-vault" - }, - "createdAt": "2023-11-01T10:00:00Z", - "updatedAt": "2023-12-01T10:00:00Z" - } - ] -} -``` - \ No newline at end of file diff --git a/docs/api-reference/endpoints/pki/syncs/azure-key-vault/remove-certificates.mdx b/docs/api-reference/endpoints/pki/syncs/azure-key-vault/remove-certificates.mdx index ebd9bff6b..817f545c0 100644 --- a/docs/api-reference/endpoints/pki/syncs/azure-key-vault/remove-certificates.mdx +++ b/docs/api-reference/endpoints/pki/syncs/azure-key-vault/remove-certificates.mdx @@ -2,64 +2,3 @@ title: "Remove Certificates from Azure Key Vault" openapi: "POST /api/v1/pki/syncs/azure-key-vault/{pkiSyncId}/remove-certificates" --- - - -This endpoint permanently removes certificates from Azure Key Vault. Only certificates managed by Infisical (prefixed with "Infisical-") will be removed. This action cannot be undone. - - - -This endpoint removes certificates from the specified Azure Key Vault that are no longer active in Infisical or are expired. It helps clean up outdated certificates and maintain security hygiene. - - -## Request - - - The ID of the Azure Key Vault PKI sync to remove certificates from - - - - Project ID for additional authorization (will be inferred if not provided) - - -## Response - - - Success message confirming the remove operation has been triggered - - - -```bash cURL -curl -X POST "https://app.infisical.com/api/v1/pki/syncs/azure-key-vault/ps_12345/remove-certificates" \ - -H "Authorization: Bearer " -``` - - - -```json Response -{ - "message": "Remove operation has been triggered successfully" -} -``` - - -## Behavior - -When this endpoint is called: - -1. **Certificate Identification**: Identifies certificates in Azure Key Vault that are managed by Infisical (prefixed with "Infisical-") -2. **Status Check**: Compares against active certificates in the connected PKI subscriber -3. **Selective Removal**: Removes only certificates that are: - - Expired or revoked in Infisical - - No longer present in the PKI subscriber - - Managed by Infisical (prefixed with "Infisical-") -4. **Status Tracking**: The remove status is updated and can be monitored through the PKI sync object - - -- Only certificates with the "Infisical-" prefix are considered for removal -- Certificates not managed by Infisical remain untouched -- Disabled certificates in Azure Key Vault are skipped during the removal process - - - -This operation requires appropriate permissions in the Azure Key Vault. Ensure your Azure Key Vault app connection has sufficient permissions to delete certificates. - \ No newline at end of file diff --git a/docs/api-reference/endpoints/pki/syncs/azure-key-vault/sync-certificates.mdx b/docs/api-reference/endpoints/pki/syncs/azure-key-vault/sync-certificates.mdx index fbb89d088..ca8faced5 100644 --- a/docs/api-reference/endpoints/pki/syncs/azure-key-vault/sync-certificates.mdx +++ b/docs/api-reference/endpoints/pki/syncs/azure-key-vault/sync-certificates.mdx @@ -2,56 +2,3 @@ title: "Sync Certificates to Azure Key Vault" openapi: "POST /api/v1/pki/syncs/azure-key-vault/{pkiSyncId}/sync" --- - - -This endpoint triggers a manual synchronization of certificates from Infisical to the specified Azure Key Vault. It will upload all active certificates from the connected PKI subscriber to the Azure Key Vault, creating or updating certificates as needed. - - - -Certificates are uploaded to Azure Key Vault with their certificate and private key combined in PEM format. The certificate key properties (RSA/ECDSA type and key size) are automatically detected and configured appropriately. - - -## Request - - - The ID of the Azure Key Vault PKI sync to trigger synchronization for - - - - Project ID for additional authorization (will be inferred if not provided) - - -## Response - - - Success message confirming the sync operation has been triggered - - - -```bash cURL -curl -X POST "https://app.infisical.com/api/v1/pki/syncs/azure-key-vault/ps_12345/sync" \ - -H "Authorization: Bearer " -``` - - - -```json Response -{ - "message": "Sync operation has been triggered successfully" -} -``` - - -## Behavior - -When this endpoint is called: - -1. **Certificate Collection**: All active (non-expired) certificates from the connected PKI subscriber are collected -2. **Key Property Detection**: Each certificate's key properties (RSA/ECDSA type, key size, curve) are automatically detected -3. **Azure Key Vault Upload**: Certificates are uploaded to Azure Key Vault with the correct key properties -4. **Certificate Naming**: Certificates are prefixed with "Infisical-" in Azure Key Vault for identification -5. **Status Tracking**: The sync status is updated and can be monitored through the PKI sync object - - -This operation requires appropriate permissions in the Azure Key Vault. Ensure your Azure Key Vault app connection has sufficient permissions to create and update certificates. - \ No newline at end of file diff --git a/docs/api-reference/endpoints/pki/syncs/azure-key-vault/update.mdx b/docs/api-reference/endpoints/pki/syncs/azure-key-vault/update.mdx index 23563179d..bc0e903cf 100644 --- a/docs/api-reference/endpoints/pki/syncs/azure-key-vault/update.mdx +++ b/docs/api-reference/endpoints/pki/syncs/azure-key-vault/update.mdx @@ -2,149 +2,3 @@ title: "Update Azure Key Vault PKI Sync" openapi: "PATCH /api/v1/pki/syncs/azure-key-vault/{pkiSyncId}" --- - - -This endpoint updates an existing Azure Key Vault PKI sync. - - -## Request - - - The ID of the Azure Key Vault PKI sync to update - - - - Project ID for additional authorization (will be inferred if not provided) - - - - Name of the PKI sync (1-64 characters) - - - - Description of the PKI sync - - - - Whether automatic synchronization is enabled when certificates are issued - - - - Azure Key Vault specific configuration - - - Base URL of the Azure Key Vault (e.g., "https://my-vault.vault.azure.net/") - - - - - - Sync-specific options and settings - - - - ID of the PKI subscriber to connect this sync to. If provided, certificates issued by this subscriber will be automatically synced to Azure Key Vault. - - - - ID of the Azure Key Vault app connection to use for this sync - - -## Response - -Returns the updated Azure Key Vault PKI sync object. - - - Unique identifier for the PKI sync - - - - Updated name of the PKI sync - - - - Updated description of the PKI sync - - - - Always "azure-key-vault" - - - - Updated automatic synchronization setting - - - - Updated Azure Key Vault specific configuration - - - - Updated sync-specific options and settings - - - - ID of the project this sync belongs to - - - - Updated PKI subscriber ID this sync is connected to - - - - Updated Azure Key Vault app connection ID - - - - Timestamp when the PKI sync was created - - - - Timestamp when the PKI sync was last updated - - - -```bash cURL -curl -X PATCH "https://app.infisical.com/api/v1/pki/syncs/azure-key-vault/ps_12345" \ - -H "Authorization: Bearer " \ - -H "Content-Type: application/json" \ - -d '{ - "name": "Updated Production Azure Key Vault Sync", - "isAutoSyncEnabled": false, - "destinationConfig": { - "vaultBaseUrl": "https://my-new-vault.vault.azure.net/" - } - }' -``` - - - -```json Response -{ - "id": "ps_12345", - "name": "Updated Production Azure Key Vault Sync", - "description": "Sync certificates to production Key Vault", - "destination": "azure-key-vault", - "isAutoSyncEnabled": false, - "destinationConfig": { - "vaultBaseUrl": "https://my-new-vault.vault.azure.net/" - }, - "syncOptions": {}, - "projectId": "proj_12345", - "subscriberId": "sub_12345", - "connectionId": "conn_12345", - "syncStatus": "succeeded", - "lastSyncedAt": "2023-12-01T10:00:00Z", - "lastSyncMessage": "Successfully synced 3 certificates", - "removeStatus": null, - "lastRemovedAt": null, - "lastRemoveMessage": null, - "connection": { - "id": "conn_12345", - "name": "Azure Production Connection", - "app": "azure-key-vault" - }, - "createdAt": "2023-11-01T10:00:00Z", - "updatedAt": "2023-12-01T11:30:00Z" -} -``` - \ No newline at end of file diff --git a/docs/api-reference/endpoints/pki/syncs/get-by-id.mdx b/docs/api-reference/endpoints/pki/syncs/get-by-id.mdx index 853cc26ea..6ec710ec8 100644 --- a/docs/api-reference/endpoints/pki/syncs/get-by-id.mdx +++ b/docs/api-reference/endpoints/pki/syncs/get-by-id.mdx @@ -2,138 +2,3 @@ title: "Get PKI Sync by ID" openapi: "GET /api/v1/pki/syncs/{pkiSyncId}" --- - - -This endpoint retrieves a specific PKI sync by its ID. - - -## Request - - - The ID of the PKI sync to retrieve - - - - Project ID for additional authorization (will be inferred if not provided) - - -## Response - - - Unique identifier for the PKI sync - - - - Name of the PKI sync - - - - Description of the PKI sync - - - - PKI sync destination type (e.g., "azure-key-vault") - - - - Whether automatic synchronization is enabled - - - - Configuration specific to the destination - - - - Sync-specific options and settings - - - - ID of the project this sync belongs to - - - - ID of the PKI subscriber this sync is connected to - - - - ID of the app connection used for this sync - - - - Current status of the last sync operation - - - - Timestamp of the last successful sync - - - - Message from the last sync operation - - - - Current status of the last remove operation - - - - Timestamp of the last certificate removal - - - - Message from the last remove operation - - - - Details about the associated app connection - - - Connection ID - - - Connection name - - - App type - - - - - - Timestamp when the PKI sync was created - - - - Timestamp when the PKI sync was last updated - - - -```json Response -{ - "id": "ps_12345", - "name": "Production Azure Key Vault Sync", - "description": "Sync certificates to production Key Vault", - "destination": "azure-key-vault", - "isAutoSyncEnabled": true, - "destinationConfig": { - "vaultUrl": "https://my-vault.vault.azure.net/" - }, - "syncOptions": {}, - "projectId": "proj_12345", - "subscriberId": "sub_12345", - "connectionId": "conn_12345", - "syncStatus": "succeeded", - "lastSyncedAt": "2023-12-01T10:00:00Z", - "lastSyncMessage": "Successfully synced 3 certificates", - "removeStatus": null, - "lastRemovedAt": null, - "lastRemoveMessage": null, - "connection": { - "id": "conn_12345", - "name": "Azure Production Connection", - "app": "azure-key-vault" - }, - "createdAt": "2023-11-01T10:00:00Z", - "updatedAt": "2023-12-01T10:00:00Z" -} -``` - \ No newline at end of file diff --git a/docs/api-reference/endpoints/pki/syncs/list.mdx b/docs/api-reference/endpoints/pki/syncs/list.mdx index 463b5bd06..4b1f1972a 100644 --- a/docs/api-reference/endpoints/pki/syncs/list.mdx +++ b/docs/api-reference/endpoints/pki/syncs/list.mdx @@ -2,143 +2,3 @@ title: "List PKI Syncs" openapi: "GET /api/v1/pki/syncs" --- - - -This endpoint lists all PKI syncs across all destinations for a specified project. - - -## Request - - - The ID of the project to list PKI syncs for - - -## Response - - -Array of PKI syncs for the project - - - Unique identifier for the PKI sync - - - - Name of the PKI sync - - - - Description of the PKI sync - - - - PKI sync destination type (e.g., "azure-key-vault") - - - - Whether automatic synchronization is enabled - - - - Configuration specific to the destination - - - - Sync-specific options and settings - - - - ID of the project this sync belongs to - - - - ID of the PKI subscriber this sync is connected to - - - - ID of the app connection used for this sync - - - - Current status of the last sync operation - - - - Timestamp of the last successful sync - - - - Message from the last sync operation - - - - Current status of the last remove operation - - - - Timestamp of the last certificate removal - - - - Message from the last remove operation - - - - Details about the associated app connection - - - Connection ID - - - Connection name - - - App type - - - - - - Timestamp when the PKI sync was created - - - - Timestamp when the PKI sync was last updated - - - - - -```json Response -{ - "pkiSyncs": [ - { - "id": "ps_12345", - "name": "Production Azure Key Vault Sync", - "description": "Sync certificates to production Key Vault", - "destination": "azure-key-vault", - "isAutoSyncEnabled": true, - "destinationConfig": { - "vaultUrl": "https://my-vault.vault.azure.net/" - }, - "syncOptions": {}, - "projectId": "proj_12345", - "subscriberId": "sub_12345", - "connectionId": "conn_12345", - "syncStatus": "succeeded", - "lastSyncedAt": "2023-12-01T10:00:00Z", - "lastSyncMessage": "Successfully synced 3 certificates", - "removeStatus": null, - "lastRemovedAt": null, - "lastRemoveMessage": null, - "connection": { - "id": "conn_12345", - "name": "Azure Production Connection", - "app": "azure-key-vault" - }, - "createdAt": "2023-11-01T10:00:00Z", - "updatedAt": "2023-12-01T10:00:00Z" - } - ] -} -``` - \ No newline at end of file diff --git a/docs/api-reference/endpoints/pki/syncs/options.mdx b/docs/api-reference/endpoints/pki/syncs/options.mdx index 6b7d3e2dd..a328b0832 100644 --- a/docs/api-reference/endpoints/pki/syncs/options.mdx +++ b/docs/api-reference/endpoints/pki/syncs/options.mdx @@ -2,56 +2,3 @@ title: "List PKI Sync Options" openapi: "GET /api/v1/pki/syncs/options" --- - - -This endpoint lists all available PKI sync destination options and their capabilities. - - -## Request - - - Project ID - - -## Response - - -Array of available PKI sync options - - - Display name of the PKI sync destination - - - - App connection type required for this destination - - - - PKI sync destination identifier - - - - Whether this destination supports importing certificates from the destination to Infisical - - - - Whether this destination supports removing certificates from the destination - - - - - -```json Response -{ - "pkiSyncOptions": [ - { - "name": "Azure Key Vault", - "connection": "azure-key-vault", - "destination": "azure-key-vault", - "canImportCertificates": false, - "canRemoveCertificates": true - } - ] -} -``` - \ No newline at end of file diff --git a/docs/docs.json b/docs/docs.json index b61099f9f..f46c4b365 100644 --- a/docs/docs.json +++ b/docs/docs.json @@ -715,7 +715,6 @@ { "group": "Certificate Syncs", "pages": [ - "documentation/platform/pki/certificate-syncs", "documentation/platform/pki/certificate-syncs/overview", { "group": "Syncs", @@ -2494,6 +2493,7 @@ "pages": [ "api-reference/endpoints/pki/syncs/list", "api-reference/endpoints/pki/syncs/get-by-id", + "api-reference/endpoints/pki/syncs/options", { "group": "Azure Key Vault", "pages": [ diff --git a/docs/documentation/platform/pki/certificate-syncs.mdx b/docs/documentation/platform/pki/certificate-syncs.mdx deleted file mode 100644 index 77bcfb9f8..000000000 --- a/docs/documentation/platform/pki/certificate-syncs.mdx +++ /dev/null @@ -1,102 +0,0 @@ ---- -sidebarTitle: "Certificate Syncs" -title: "PKI Certificate Syncs" -description: "Automatically synchronize your PKI certificates to external destinations and maintain certificate lifecycle management." ---- - -# PKI Certificate Syncs - -PKI Certificate Syncs enable automatic synchronization of certificates from Infisical to external destinations like cloud key management services. This ensures your certificates are consistently deployed and managed across your infrastructure. - -## Overview - -Certificate syncs work by: - -1. **Connecting to PKI Subscribers**: Link syncs to PKI subscribers to automatically sync certificates when they're issued -2. **Destination Integration**: Configure destinations like Azure Key Vault through app connections -3. **Automatic Synchronization**: Certificates are automatically pushed to destinations when issued or when manually triggered -4. **Lifecycle Management**: Remove expired or revoked certificates from destinations to maintain security hygiene - -## Supported Destinations - -### Azure Key Vault - -Azure Key Vault integration supports: - -- ✅ **Certificate Upload**: Sync certificates with their private keys to Azure Key Vault -- ✅ **Certificate Removal**: Clean up expired or revoked certificates -- ✅ **Auto Key Detection**: Automatically detect and configure RSA/ECDSA key properties -- ❌ **Certificate Import**: Cannot import certificates from Azure Key Vault to Infisical (Azure security limitation) - -**Key Features:** -- Certificates are uploaded with both certificate and private key in PEM format -- Key properties (RSA/ECDSA type, key size, curve) are automatically detected from certificates -- Certificates are prefixed with "Infisical-" for identification and management -- Respects Azure Key Vault rate limits with automatic retry logic - -## Configuration - -### Prerequisites - -1. **App Connection**: Create an Azure Key Vault app connection with appropriate permissions -2. **PKI Subscriber**: Set up a PKI subscriber to issue certificates -3. **Azure Permissions**: Ensure the connection has certificate create/update/delete permissions in the target Key Vault - -### Setting Up a Sync - -1. Navigate to your project's PKI section -2. Go to the Certificate Syncs tab -3. Create a new sync: - - **Name**: Descriptive name for the sync - - **Connection**: Select your Azure Key Vault app connection - - **Destination Config**: Specify the Azure Key Vault URL - - **PKI Subscriber**: Link to a specific subscriber (optional) - - **Auto Sync**: Enable automatic synchronization on certificate issuance - - **Certificate Name Schema**: Customize how certificate names are generated (optional) - -### Sync Options - -- **Auto Sync Enabled**: Automatically sync certificates when they're issued -- **Manual Sync**: Trigger synchronization on-demand via API or UI -- **Selective Removal**: Only remove certificates managed by Infisical - -## API Reference - -All PKI sync operations are available via REST API: - -- **[List PKI Sync Options](/api-reference/endpoints/pki/syncs/options)**: Get available sync destinations -- **[List PKI Syncs](/api-reference/endpoints/pki/syncs/list)**: List all syncs for a project -- **[Get PKI Sync](/api-reference/endpoints/pki/syncs/get-by-id)**: Get sync details by ID - -### Azure Key Vault Specific - -- **[Create Azure Key Vault Sync](/api-reference/endpoints/pki/syncs/azure-key-vault/create)** -- **[Update Azure Key Vault Sync](/api-reference/endpoints/pki/syncs/azure-key-vault/update)** -- **[Delete Azure Key Vault Sync](/api-reference/endpoints/pki/syncs/azure-key-vault/delete)** -- **[Sync Certificates](/api-reference/endpoints/pki/syncs/azure-key-vault/sync-certificates)** -- **[Remove Certificates](/api-reference/endpoints/pki/syncs/azure-key-vault/remove-certificates)** - -## Security Considerations - -- **Least Privilege**: Grant minimal required permissions to app connections -- **Certificate Prefixing**: Only certificates with "Infisical-" prefix are managed by syncs -- **Audit Logs**: All sync operations are logged and auditable -- **Rate Limiting**: Built-in rate limiting prevents overwhelming destination services - -## Monitoring and Troubleshooting - -Each PKI sync tracks: -- **Sync Status**: Last sync operation status and message -- **Remove Status**: Last certificate removal status and message -- **Timestamps**: When operations were last performed -- **Error Messages**: Detailed error information for failed operations - -Use these fields to monitor sync health and troubleshoot issues. - ---- - -import { CertificateSyncsBrowser } from "/snippets/CertificateSyncsBrowser.jsx"; - -## Browse Available Syncs - - \ No newline at end of file diff --git a/frontend/src/components/pki-syncs/forms/CreatePkiSyncForm.tsx b/frontend/src/components/pki-syncs/forms/CreatePkiSyncForm.tsx index 1688bf3a7..02066c1cc 100644 --- a/frontend/src/components/pki-syncs/forms/CreatePkiSyncForm.tsx +++ b/frontend/src/components/pki-syncs/forms/CreatePkiSyncForm.tsx @@ -48,10 +48,10 @@ export const CreatePkiSyncForm = ({ destination, onComplete, onCancel }: Props) resolver: zodResolver(PkiSyncFormSchema), defaultValues: { destination, - isAutoSyncEnabled: true, + isAutoSyncEnabled: false, syncOptions: { - canImportCertificates: syncOption?.canImportCertificates ?? false, - canRemoveCertificates: syncOption?.canRemoveCertificates ?? false, + canImportCertificates: false, + canRemoveCertificates: false, certificateNameSchema: syncOption?.defaultCertificateNameSchema } } as Partial,