awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

misc: doc improvements

Browse Source
This commit is contained in:
Sheen
2025-06-08 18:56:40 +00:00
parent 95b843779b
commit 6dfe2851e1
1 changed files with 263 additions and 298 deletions
Download Patch File Download Diff File Expand all files Collapse all files

59
docs/documentation/platform/dynamic-secrets/kubernetes.mdx
View File

@@ -73,7 +73,8 @@ This feature is ideal for scenarios where you need to:
Choose your authentication method:
#### Option 1: Token (API) Authentication
<AccordionGroup>
<Accordion title="Token (API) Authentication">
This method uses a service account token to authenticate with the Kubernetes cluster. It's suitable when:
- You want to use a specific service account token that you've created
- You're working with a public cluster or have network access to the cluster's API server
@@ -147,8 +148,8 @@ This feature is ideal for scenarios where you need to:
kubectl patch serviceaccount infisical-token-requester -p '{"secrets": [{"name": "infisical-token-requester-token"}]}' -n default
kubectl get secret infisical-token-requester-token -n default -o=jsonpath='{.data.token}' | base64 --decode
```
#### Option 2: Gateway Authentication
</Accordion>
<Accordion title="Gateway Authentication">
This method uses an Infisical Gateway deployed in your Kubernetes cluster. It's ideal when:
- You want to avoid storing static service account tokens
- You prefer to use the Gateway's pre-configured service account
@@ -194,6 +195,8 @@ This feature is ideal for scenarios where you need to:
```bash
kubectl apply -f rbac.yaml
```
</Accordion>
</AccordionGroup>
</Tab>
@@ -214,7 +217,8 @@ This feature is ideal for scenarios where you need to:
Choose your authentication method:
#### Option 1: Token (API) Authentication
<AccordionGroup>
<Accordion title="Token (API) Authentication">
This method uses a service account token to authenticate with the Kubernetes cluster. It's suitable when:
- You want to use a specific service account token that you've created
- You're working with a public cluster or have network access to the cluster's API server
@@ -300,8 +304,8 @@ This feature is ideal for scenarios where you need to:
```bash
kubectl apply -f rbac.yaml
```
#### Option 2: Gateway Authentication
</Accordion>
<Accordion title="Gateway Authentication">
This method uses an Infisical Gateway deployed in your Kubernetes cluster. It's ideal when:
- You want to avoid storing static service account tokens
- You prefer to use the Gateway's pre-configured service account
@@ -368,47 +372,8 @@ This feature is ideal for scenarios where you need to:
```bash
kubectl apply -f rbac.yaml
```
### Example Role Configuration
Here's an example of a role that can be assigned to dynamically created service accounts:
```yaml test-role.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: infisical-dynamic-role
rules:
- apiGroups: [""]
resources:
- "pods"
- "configmaps"
- "secrets"
verbs:
- "get"
- "list"
- "watch"
- apiGroups: ["apps"]
resources:
- "deployments"
- "statefulsets"
verbs:
- "get"
- "list"
- "watch"
- apiGroups: ["batch"]
resources:
- "jobs"
- "cronjobs"
verbs:
- "get"
- "list"
- "watch"
```
```bash
kubectl apply -f test-role.yaml
```
</Accordion>
</AccordionGroup>
<Note>
In Kubernetes RBAC, a service account can only create role bindings for resources that it has access to.