awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 11:44:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: made review changed

Browse Source
This commit is contained in:
=
2025-08-04 23:35:57 +05:30
parent 35012fde03
commit 6826b1c242
5 changed files with 33 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
docs/integrations/platforms/kubernetes/infisical-dynamic-secret-crd.mdx
View File

@@ -111,7 +111,7 @@ kind: Secret
<Accordion title="hostAPI"> <Accordion title="hostAPI">
If you are fetching secrets from a self-hosted instance of Infisical set the value of `hostAPI` to If you are fetching secrets from a self-hosted instance of Infisical set the value of `hostAPI` to
` https://your-self-hosted-instace.com/api` `https://your-self-hosted-instace.com/api`
When `hostAPI` is not defined the operator fetches secrets from Infisical Cloud. When `hostAPI` is not defined the operator fetches secrets from Infisical Cloud.
@@ -322,11 +322,11 @@ The available authentication methods are `universalAuth`, `kubernetesAuth`, `aws
</Accordion> </Accordion>
<Accordion title="ldapAuth"> <Accordion title="ldapAuth">
The ldap machine identity authentication method is used to authenticate with a configured LDAP directory. [Read more about LDAP Auth](/documentation/platform/identities/ldap-auth). The LDAP machine identity authentication method is used to authenticate with a configured LDAP directory. [Read more about LDAP Auth](/documentation/platform/identities/ldap-auth).
Valid fields: Valid fields:
- `identityId`: The identity ID of the machine identity you created. - `identityId`: The identity ID of the machine identity you created.
- `credentialsRef`: The name and namespace of the Kubernetes secret that stores the ldap credentials. - `credentialsRef`: The name and namespace of the Kubernetes secret that stores the LDAP credentials.
- `credentialsRef.secretName`: The name of the Kubernetes secret. - `credentialsRef.secretName`: The name of the Kubernetes secret.
- `credentialsRef.secretNamespace`: The namespace of the Kubernetes secret. - `credentialsRef.secretNamespace`: The namespace of the Kubernetes secret.

6
docs/integrations/platforms/kubernetes/infisical-push-secret-crd.mdx
View File

@@ -110,7 +110,7 @@ After applying the InfisicalPushSecret CRD, you should notice that the secrets y
<Accordion title="hostAPI"> <Accordion title="hostAPI">
If you are fetching secrets from a self-hosted instance of Infisical set the value of `hostAPI` to If you are fetching secrets from a self-hosted instance of Infisical set the value of `hostAPI` to
` https://your-self-hosted-instace.com/api` `https://your-self-hosted-instace.com/api`
When `hostAPI` is not defined the operator fetches secrets from Infisical Cloud. When `hostAPI` is not defined the operator fetches secrets from Infisical Cloud.
@@ -330,11 +330,11 @@ After applying the InfisicalPushSecret CRD, you should notice that the secrets y
``` ```
</Accordion> </Accordion>
<Accordion title="ldapAuth"> <Accordion title="ldapAuth">
The ldap machine identity authentication method is used to authenticate with a configured LDAP directory. [Read more about LDAP Auth](/documentation/platform/identities/ldap-auth). The LDAP machine identity authentication method is used to authenticate with a configured LDAP directory. [Read more about LDAP Auth](/documentation/platform/identities/ldap-auth).
Valid fields: Valid fields:
- `identityId`: The identity ID of the machine identity you created. - `identityId`: The identity ID of the machine identity you created.
- `credentialsRef`: The name and namespace of the Kubernetes secret that stores the ldap credentials. - `credentialsRef`: The name and namespace of the Kubernetes secret that stores the LDAP credentials.
- `credentialsRef.secretName`: The name of the Kubernetes secret. - `credentialsRef.secretName`: The name of the Kubernetes secret.
- `credentialsRef.secretNamespace`: The namespace of the Kubernetes secret. - `credentialsRef.secretNamespace`: The namespace of the Kubernetes secret.

44
docs/integrations/platforms/kubernetes/infisical-secret-crd.mdx
View File

@@ -44,15 +44,15 @@ spec:
The following properties help define what instance of Infisical the operator will interact with, the interval it will sync secrets and any CA certificates that may be required to connect. The following properties help define what instance of Infisical the operator will interact with, the interval it will sync secrets and any CA certificates that may be required to connect.
<Accordion title="hostAPI"> <Accordion title="hostAPI">
If you are fetching secrets from a self-hosted instance of Infisical set the value of `hostAPI` to If you are fetching secrets from a self-hosted instance of Infisical set the value of `hostAPI` to
` https://your-self-hosted-instace.com/api` ` https://your-self-hosted-instace.com/api`
When `hostAPI` is not defined the operator fetches secrets from Infisical Cloud. When `hostAPI` is not defined the operator fetches secrets from Infisical Cloud.
<Accordion title="Advanced use case"> <Accordion title="Advanced use case">
If you have installed your Infisical instance within the same cluster as the Infisical operator, you can optionally access the Infisical backend's service directly without having to route through the public internet. If you have installed your Infisical instance within the same cluster as the Infisical operator, you can optionally access the Infisical backend's service directly without having to route through the public internet.
To achieve this, use the following address for the hostAPI field: To achieve this, use the following address for the hostAPI field:
``` bash ``` bash
http://<backend-svc-name>.<namespace>.svc.cluster.local:4000/api http://<backend-svc-name>.<namespace>.svc.cluster.local:4000/api
``` ```
@@ -110,7 +110,7 @@ The list of available authentication methods are shown below.
<Step title="Create Kubernetes secret containing machine identity credentials"> <Step title="Create Kubernetes secret containing machine identity credentials">
Once you have created your machine identity and added it to your project(s), you will need to create a Kubernetes secret containing the identity credentials. Once you have created your machine identity and added it to your project(s), you will need to create a Kubernetes secret containing the identity credentials.
To quickly create a Kubernetes secret containing the identity credentials, you can run the command below. To quickly create a Kubernetes secret containing the identity credentials, you can run the command below.
Make sure you replace `<your-identity-client-id>` with the identity client ID and `<your-identity-client-secret>` with the identity client secret. Make sure you replace `<your-identity-client-id>` with the identity client ID and `<your-identity-client-secret>` with the identity client secret.
``` bash ``` bash
@@ -705,7 +705,7 @@ spec:
</Accordion> </Accordion>
<Accordion title="authentication.ldapAuth"> <Accordion title="authentication.ldapAuth">
The ldap machine identity authentication method is used to authenticate with Infisical using the configured LDAP directory. The username and password needs to be stored in a Kubernetes secret. This block defines the reference to the name and namespace of secret that stores these credentials. The LDAP machine identity authentication method is used to authenticate with Infisical using the configured LDAP directory. The username and password needs to be stored in a Kubernetes secret. This block defines the reference to the name and namespace of secret that stores these credentials.
<Steps> <Steps>
<Step title="Create a machine identity"> <Step title="Create a machine identity">
@@ -714,8 +714,8 @@ spec:
<Step title="Create Kubernetes secret containing machine identity credentials"> <Step title="Create Kubernetes secret containing machine identity credentials">
Once you have created your machine identity and added it to your project(s), you will need to create a Kubernetes secret containing the identity credentials. Once you have created your machine identity and added it to your project(s), you will need to create a Kubernetes secret containing the identity credentials.
To quickly create a Kubernetes secret containing the identity credentials, you can run the command below. To quickly create a Kubernetes secret containing the identity credentials, you can run the command below.
Make sure you replace `<your-identity-ldap-username>` with the identity ldap username and `<your-identity-ldap-password>` with the identity ldap password. Make sure you replace `<your-identity-ldap-username>` with the identity LDAP username and `<your-identity-ldap-password>` with the identity LDAP password.
``` bash ``` bash
kubectl create secret generic ldap-auth-credentials --from-literal=username="<your-identity-ldap-username>" --from-literal=password="<your-identity-ldap-password>" kubectl create secret generic ldap-auth-credentials --from-literal=username="<your-identity-ldap-username>" --from-literal=password="<your-identity-ldap-password>"
@@ -836,7 +836,7 @@ managedKubeSecretReferences:
The name of the managed Kubernetes secret to be created The name of the managed Kubernetes secret to be created
</Accordion> </Accordion>
<Accordion title="managedKubeSecretReferences[].secretNamespace"> <Accordion title="managedKubeSecretReferences[].secretNamespace">
The namespace of the managed Kubernetes secret to be created. The namespace of the managed Kubernetes secret to be created.
</Accordion> </Accordion>
<Accordion title="managedKubeSecretReferences[].secretType"> <Accordion title="managedKubeSecretReferences[].secretType">
Override the default Opaque type for managed secrets with this field. Useful for creating kubernetes.io/dockerconfigjson secrets. Override the default Opaque type for managed secrets with this field. Useful for creating kubernetes.io/dockerconfigjson secrets.
@@ -865,8 +865,8 @@ Using Go templates, you can format, combine, and create new key-value pairs from
<Accordion title="managedKubeSecretReferences[].template"> <Accordion title="managedKubeSecretReferences[].template">
</Accordion> </Accordion>
<Accordion title="managedKubeSecretReferences[].template.includeAllSecrets"> <Accordion title="managedKubeSecretReferences[].template.includeAllSecrets">
This property controls what secrets are included in your managed secret when using templates. This property controls what secrets are included in your managed secret when using templates.
When set to `true`, all secrets fetched from your Infisical project will be added into your managed Kubernetes secret resource. When set to `true`, all secrets fetched from your Infisical project will be added into your managed Kubernetes secret resource.
**Use this option when you would like to sync all secrets from Infisical to Kubernetes but want to template a subset of them.** **Use this option when you would like to sync all secrets from Infisical to Kubernetes but want to template a subset of them.**
When set to `false`, only secrets defined in the `managedKubeSecretReferences[].template.data` field of the template will be included in the managed secret. When set to `false`, only secrets defined in the `managedKubeSecretReferences[].template.data` field of the template will be included in the managed secret.
@@ -874,7 +874,7 @@ Use this option when you would like to sync **only** a subset of secrets from In
</Accordion> </Accordion>
<Accordion title="managedKubeSecretReferences[].template.data"> <Accordion title="managedKubeSecretReferences[].template.data">
Define secret keys and their corresponding templates. Define secret keys and their corresponding templates.
Each data value uses a Golang template with access to all secrets retrieved from the specified scope. Each data value uses a Golang template with access to all secrets retrieved from the specified scope.
Secrets are structured as follows: Secrets are structured as follows:
@@ -949,7 +949,7 @@ The Infisical operator will automatically create the Kubernetes config map in th
The name of the managed Kubernetes config map that your Infisical data will be stored in. The name of the managed Kubernetes config map that your Infisical data will be stored in.
</Accordion> </Accordion>
<Accordion title="managedKubeConfigMapReferences[].configMapNamespace"> <Accordion title="managedKubeConfigMapReferences[].configMapNamespace">
The namespace of the managed Kubernetes config map that your Infisical data will be stored in. The namespace of the managed Kubernetes config map that your Infisical data will be stored in.
</Accordion> </Accordion>
<Accordion title="managedKubeConfigMapReferences[].creationPolicy"> <Accordion title="managedKubeConfigMapReferences[].creationPolicy">
Creation policies allow you to control whether or not owner references should be added to the managed Kubernetes config map that is generated by the Infisical operator. Creation policies allow you to control whether or not owner references should be added to the managed Kubernetes config map that is generated by the Infisical operator.
@@ -975,8 +975,8 @@ Using Go templates, you can format, combine, and create new key-value pairs from
<Accordion title="managedKubeConfigMapReferences[].template"> <Accordion title="managedKubeConfigMapReferences[].template">
</Accordion> </Accordion>
<Accordion title="managedKubeConfigMapReferences[].template.includeAllSecrets"> <Accordion title="managedKubeConfigMapReferences[].template.includeAllSecrets">
This property controls what secrets are included in your managed config map when using templates. This property controls what secrets are included in your managed config map when using templates.
When set to `true`, all secrets fetched from your Infisical project will be added into your managed Kubernetes config map resource. When set to `true`, all secrets fetched from your Infisical project will be added into your managed Kubernetes config map resource.
**Use this option when you would like to sync all secrets from Infisical to Kubernetes but want to template a subset of them.** **Use this option when you would like to sync all secrets from Infisical to Kubernetes but want to template a subset of them.**
When set to `false`, only secrets defined in the `managedKubeConfigMapReferences[].template.data` field of the template will be included in the managed config map. When set to `false`, only secrets defined in the `managedKubeConfigMapReferences[].template.data` field of the template will be included in the managed config map.
@@ -984,7 +984,7 @@ Use this option when you would like to sync **only** a subset of secrets from In
</Accordion> </Accordion>
<Accordion title="managedKubeConfigMapReferences[].template.data"> <Accordion title="managedKubeConfigMapReferences[].template.data">
Define secret keys and their corresponding templates. Define secret keys and their corresponding templates.
Each data value uses a Golang template with access to all secrets retrieved from the specified scope. Each data value uses a Golang template with access to all secrets retrieved from the specified scope.
Secrets are structured as follows: Secrets are structured as follows:
@@ -1117,9 +1117,9 @@ spec:
</Accordion> </Accordion>
<Accordion title="env"> <Accordion title="env">
This will allow you to select individual secrets by key name from your managed secret and expose them to your container This will allow you to select individual secrets by key name from your managed secret and expose them to your container
```yaml ```yaml
env: env:
- name: SECRET_NAME # The environment variable's name which is made available in the container - name: SECRET_NAME # The environment variable's name which is made available in the container
@@ -1255,7 +1255,7 @@ secrets.infisical.com/auto-reload: "true"
name: nginx-deployment name: nginx-deployment
labels: labels:
app: nginx app: nginx
annotations: annotations:
secrets.infisical.com/auto-reload: "true" # <- redeployment annotation secrets.infisical.com/auto-reload: "true" # <- redeployment annotation
spec: spec:
replicas: 1 replicas: 1
@@ -1406,9 +1406,9 @@ spec:
</Accordion> </Accordion>
<Accordion title="env"> <Accordion title="env">
This will allow you to select individual secrets by key name from your managed ConfigMap and expose them to your container This will allow you to select individual secrets by key name from your managed ConfigMap and expose them to your container
```yaml ```yaml
env: env:
- name: CONFIG_NAME # The environment variable's name which is made available in the container - name: CONFIG_NAME # The environment variable's name which is made available in the container

2
k8-operator/packages/model/model.go
View File

@@ -6,7 +6,7 @@ type ServiceAccountDetails struct {
PrivateKey string PrivateKey string
} }
type MachineIdentityDetails struct { type UniversalAuthIdentityDetails struct {
ClientId string ClientId string
ClientSecret string ClientSecret string
} }

8
k8-operator/packages/util/kubernetes.go
View File

@@ -41,7 +41,7 @@ func GetKubeConfigMapByNamespacedName(ctx context.Context, reconcilerClient clie
return kubeConfigMap, err return kubeConfigMap, err
} }
func GetInfisicalUniversalAuthFromKubeSecret(ctx context.Context, reconcilerClient client.Client, universalAuthRef v1alpha1.KubeSecretReference) (machineIdentityDetails model.MachineIdentityDetails, err error) { func GetInfisicalUniversalAuthFromKubeSecret(ctx context.Context, reconcilerClient client.Client, universalAuthRef v1alpha1.KubeSecretReference) (machineIdentityDetails model.UniversalAuthIdentityDetails, err error) {
universalAuthCredsFromKubeSecret, err := GetKubeSecretByNamespacedName(ctx, reconcilerClient, types.NamespacedName{ universalAuthCredsFromKubeSecret, err := GetKubeSecretByNamespacedName(ctx, reconcilerClient, types.NamespacedName{
Namespace: universalAuthRef.SecretNamespace, Namespace: universalAuthRef.SecretNamespace,
@@ -51,17 +51,17 @@ func GetInfisicalUniversalAuthFromKubeSecret(ctx context.Context, reconcilerClie
}) })
if k8Errors.IsNotFound(err) { if k8Errors.IsNotFound(err) {
return model.MachineIdentityDetails{}, nil return model.UniversalAuthIdentityDetails{}, nil
} }
if err != nil { if err != nil {
return model.MachineIdentityDetails{}, fmt.Errorf("something went wrong when fetching your machine identity credentials [err=%s]", err) return model.UniversalAuthIdentityDetails{}, fmt.Errorf("something went wrong when fetching your machine identity credentials [err=%s]", err)
} }
clientIdFromSecret := universalAuthCredsFromKubeSecret.Data[INFISICAL_MACHINE_IDENTITY_CLIENT_ID] clientIdFromSecret := universalAuthCredsFromKubeSecret.Data[INFISICAL_MACHINE_IDENTITY_CLIENT_ID]
clientSecretFromSecret := universalAuthCredsFromKubeSecret.Data[INFISICAL_MACHINE_IDENTITY_CLIENT_SECRET] clientSecretFromSecret := universalAuthCredsFromKubeSecret.Data[INFISICAL_MACHINE_IDENTITY_CLIENT_SECRET]
return model.MachineIdentityDetails{ClientId: string(clientIdFromSecret), ClientSecret: string(clientSecretFromSecret)}, nil return model.UniversalAuthIdentityDetails{ClientId: string(clientIdFromSecret), ClientSecret: string(clientSecretFromSecret)}, nil
} }