diff --git a/docs/integrations/platforms/kubernetes/infisical-dynamic-secret-crd.mdx b/docs/integrations/platforms/kubernetes/infisical-dynamic-secret-crd.mdx index c4c1c0222..76dd24cf7 100644 --- a/docs/integrations/platforms/kubernetes/infisical-dynamic-secret-crd.mdx +++ b/docs/integrations/platforms/kubernetes/infisical-dynamic-secret-crd.mdx @@ -111,7 +111,7 @@ kind: Secret If you are fetching secrets from a self-hosted instance of Infisical set the value of `hostAPI` to - ` https://your-self-hosted-instace.com/api` + `https://your-self-hosted-instace.com/api` When `hostAPI` is not defined the operator fetches secrets from Infisical Cloud. @@ -322,11 +322,11 @@ The available authentication methods are `universalAuth`, `kubernetesAuth`, `aws - The ldap machine identity authentication method is used to authenticate with a configured LDAP directory. [Read more about LDAP Auth](/documentation/platform/identities/ldap-auth). + The LDAP machine identity authentication method is used to authenticate with a configured LDAP directory. [Read more about LDAP Auth](/documentation/platform/identities/ldap-auth). Valid fields: - `identityId`: The identity ID of the machine identity you created. - - `credentialsRef`: The name and namespace of the Kubernetes secret that stores the ldap credentials. + - `credentialsRef`: The name and namespace of the Kubernetes secret that stores the LDAP credentials. - `credentialsRef.secretName`: The name of the Kubernetes secret. - `credentialsRef.secretNamespace`: The namespace of the Kubernetes secret. diff --git a/docs/integrations/platforms/kubernetes/infisical-push-secret-crd.mdx b/docs/integrations/platforms/kubernetes/infisical-push-secret-crd.mdx index e385b3b87..d5a9c1ef4 100644 --- a/docs/integrations/platforms/kubernetes/infisical-push-secret-crd.mdx +++ b/docs/integrations/platforms/kubernetes/infisical-push-secret-crd.mdx @@ -110,7 +110,7 @@ After applying the InfisicalPushSecret CRD, you should notice that the secrets y If you are fetching secrets from a self-hosted instance of Infisical set the value of `hostAPI` to - ` https://your-self-hosted-instace.com/api` + `https://your-self-hosted-instace.com/api` When `hostAPI` is not defined the operator fetches secrets from Infisical Cloud. @@ -330,11 +330,11 @@ After applying the InfisicalPushSecret CRD, you should notice that the secrets y ``` - The ldap machine identity authentication method is used to authenticate with a configured LDAP directory. [Read more about LDAP Auth](/documentation/platform/identities/ldap-auth). + The LDAP machine identity authentication method is used to authenticate with a configured LDAP directory. [Read more about LDAP Auth](/documentation/platform/identities/ldap-auth). Valid fields: - `identityId`: The identity ID of the machine identity you created. - - `credentialsRef`: The name and namespace of the Kubernetes secret that stores the ldap credentials. + - `credentialsRef`: The name and namespace of the Kubernetes secret that stores the LDAP credentials. - `credentialsRef.secretName`: The name of the Kubernetes secret. - `credentialsRef.secretNamespace`: The namespace of the Kubernetes secret. diff --git a/docs/integrations/platforms/kubernetes/infisical-secret-crd.mdx b/docs/integrations/platforms/kubernetes/infisical-secret-crd.mdx index 36901bcc4..d0e403b79 100644 --- a/docs/integrations/platforms/kubernetes/infisical-secret-crd.mdx +++ b/docs/integrations/platforms/kubernetes/infisical-secret-crd.mdx @@ -44,15 +44,15 @@ spec: The following properties help define what instance of Infisical the operator will interact with, the interval it will sync secrets and any CA certificates that may be required to connect. - If you are fetching secrets from a self-hosted instance of Infisical set the value of `hostAPI` to + If you are fetching secrets from a self-hosted instance of Infisical set the value of `hostAPI` to ` https://your-self-hosted-instace.com/api` When `hostAPI` is not defined the operator fetches secrets from Infisical Cloud. - If you have installed your Infisical instance within the same cluster as the Infisical operator, you can optionally access the Infisical backend's service directly without having to route through the public internet. + If you have installed your Infisical instance within the same cluster as the Infisical operator, you can optionally access the Infisical backend's service directly without having to route through the public internet. To achieve this, use the following address for the hostAPI field: - + ``` bash http://..svc.cluster.local:4000/api ``` @@ -110,7 +110,7 @@ The list of available authentication methods are shown below. Once you have created your machine identity and added it to your project(s), you will need to create a Kubernetes secret containing the identity credentials. To quickly create a Kubernetes secret containing the identity credentials, you can run the command below. - + Make sure you replace `` with the identity client ID and `` with the identity client secret. ``` bash @@ -705,7 +705,7 @@ spec: - The ldap machine identity authentication method is used to authenticate with Infisical using the configured LDAP directory. The username and password needs to be stored in a Kubernetes secret. This block defines the reference to the name and namespace of secret that stores these credentials. + The LDAP machine identity authentication method is used to authenticate with Infisical using the configured LDAP directory. The username and password needs to be stored in a Kubernetes secret. This block defines the reference to the name and namespace of secret that stores these credentials. @@ -714,8 +714,8 @@ spec: Once you have created your machine identity and added it to your project(s), you will need to create a Kubernetes secret containing the identity credentials. To quickly create a Kubernetes secret containing the identity credentials, you can run the command below. - - Make sure you replace `` with the identity ldap username and `` with the identity ldap password. + + Make sure you replace `` with the identity LDAP username and `` with the identity LDAP password. ``` bash kubectl create secret generic ldap-auth-credentials --from-literal=username="" --from-literal=password="" @@ -836,7 +836,7 @@ managedKubeSecretReferences: The name of the managed Kubernetes secret to be created -The namespace of the managed Kubernetes secret to be created. +The namespace of the managed Kubernetes secret to be created. Override the default Opaque type for managed secrets with this field. Useful for creating kubernetes.io/dockerconfigjson secrets. @@ -865,8 +865,8 @@ Using Go templates, you can format, combine, and create new key-value pairs from - This property controls what secrets are included in your managed secret when using templates. - When set to `true`, all secrets fetched from your Infisical project will be added into your managed Kubernetes secret resource. + This property controls what secrets are included in your managed secret when using templates. + When set to `true`, all secrets fetched from your Infisical project will be added into your managed Kubernetes secret resource. **Use this option when you would like to sync all secrets from Infisical to Kubernetes but want to template a subset of them.** When set to `false`, only secrets defined in the `managedKubeSecretReferences[].template.data` field of the template will be included in the managed secret. @@ -874,7 +874,7 @@ Use this option when you would like to sync **only** a subset of secrets from In -Define secret keys and their corresponding templates. +Define secret keys and their corresponding templates. Each data value uses a Golang template with access to all secrets retrieved from the specified scope. Secrets are structured as follows: @@ -949,7 +949,7 @@ The Infisical operator will automatically create the Kubernetes config map in th The name of the managed Kubernetes config map that your Infisical data will be stored in. - The namespace of the managed Kubernetes config map that your Infisical data will be stored in. + The namespace of the managed Kubernetes config map that your Infisical data will be stored in. Creation policies allow you to control whether or not owner references should be added to the managed Kubernetes config map that is generated by the Infisical operator. @@ -975,8 +975,8 @@ Using Go templates, you can format, combine, and create new key-value pairs from - This property controls what secrets are included in your managed config map when using templates. - When set to `true`, all secrets fetched from your Infisical project will be added into your managed Kubernetes config map resource. + This property controls what secrets are included in your managed config map when using templates. + When set to `true`, all secrets fetched from your Infisical project will be added into your managed Kubernetes config map resource. **Use this option when you would like to sync all secrets from Infisical to Kubernetes but want to template a subset of them.** When set to `false`, only secrets defined in the `managedKubeConfigMapReferences[].template.data` field of the template will be included in the managed config map. @@ -984,7 +984,7 @@ Use this option when you would like to sync **only** a subset of secrets from In - Define secret keys and their corresponding templates. + Define secret keys and their corresponding templates. Each data value uses a Golang template with access to all secrets retrieved from the specified scope. Secrets are structured as follows: @@ -1117,9 +1117,9 @@ spec: - - This will allow you to select individual secrets by key name from your managed secret and expose them to your container - + + This will allow you to select individual secrets by key name from your managed secret and expose them to your container + ```yaml env: - name: SECRET_NAME # The environment variable's name which is made available in the container @@ -1255,7 +1255,7 @@ secrets.infisical.com/auto-reload: "true" name: nginx-deployment labels: app: nginx - annotations: + annotations: secrets.infisical.com/auto-reload: "true" # <- redeployment annotation spec: replicas: 1 @@ -1406,9 +1406,9 @@ spec: - - This will allow you to select individual secrets by key name from your managed ConfigMap and expose them to your container - + + This will allow you to select individual secrets by key name from your managed ConfigMap and expose them to your container + ```yaml env: - name: CONFIG_NAME # The environment variable's name which is made available in the container diff --git a/k8-operator/packages/model/model.go b/k8-operator/packages/model/model.go index 3e8577be4..69b987ba7 100644 --- a/k8-operator/packages/model/model.go +++ b/k8-operator/packages/model/model.go @@ -6,7 +6,7 @@ type ServiceAccountDetails struct { PrivateKey string } -type MachineIdentityDetails struct { +type UniversalAuthIdentityDetails struct { ClientId string ClientSecret string } diff --git a/k8-operator/packages/util/kubernetes.go b/k8-operator/packages/util/kubernetes.go index 67d049e29..c4a76fa44 100644 --- a/k8-operator/packages/util/kubernetes.go +++ b/k8-operator/packages/util/kubernetes.go @@ -41,7 +41,7 @@ func GetKubeConfigMapByNamespacedName(ctx context.Context, reconcilerClient clie return kubeConfigMap, err } -func GetInfisicalUniversalAuthFromKubeSecret(ctx context.Context, reconcilerClient client.Client, universalAuthRef v1alpha1.KubeSecretReference) (machineIdentityDetails model.MachineIdentityDetails, err error) { +func GetInfisicalUniversalAuthFromKubeSecret(ctx context.Context, reconcilerClient client.Client, universalAuthRef v1alpha1.KubeSecretReference) (machineIdentityDetails model.UniversalAuthIdentityDetails, err error) { universalAuthCredsFromKubeSecret, err := GetKubeSecretByNamespacedName(ctx, reconcilerClient, types.NamespacedName{ Namespace: universalAuthRef.SecretNamespace, @@ -51,17 +51,17 @@ func GetInfisicalUniversalAuthFromKubeSecret(ctx context.Context, reconcilerClie }) if k8Errors.IsNotFound(err) { - return model.MachineIdentityDetails{}, nil + return model.UniversalAuthIdentityDetails{}, nil } if err != nil { - return model.MachineIdentityDetails{}, fmt.Errorf("something went wrong when fetching your machine identity credentials [err=%s]", err) + return model.UniversalAuthIdentityDetails{}, fmt.Errorf("something went wrong when fetching your machine identity credentials [err=%s]", err) } clientIdFromSecret := universalAuthCredsFromKubeSecret.Data[INFISICAL_MACHINE_IDENTITY_CLIENT_ID] clientSecretFromSecret := universalAuthCredsFromKubeSecret.Data[INFISICAL_MACHINE_IDENTITY_CLIENT_SECRET] - return model.MachineIdentityDetails{ClientId: string(clientIdFromSecret), ClientSecret: string(clientSecretFromSecret)}, nil + return model.UniversalAuthIdentityDetails{ClientId: string(clientIdFromSecret), ClientSecret: string(clientSecretFromSecret)}, nil }