mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-10-04 16:26:16 +00:00
remove service accounts from k8 docs
This commit is contained in:
@@ -51,16 +51,10 @@ spec:
|
|||||||
# The host that should be used to pull secrets from. If left empty, the value specified in Global configuration will be used
|
# The host that should be used to pull secrets from. If left empty, the value specified in Global configuration will be used
|
||||||
hostAPI: https://app.infisical.com/api
|
hostAPI: https://app.infisical.com/api
|
||||||
authentication:
|
authentication:
|
||||||
serviceToken: # <-- option 1
|
serviceToken:
|
||||||
serviceTokenSecretReference:
|
serviceTokenSecretReference:
|
||||||
secretName: service-token
|
secretName: service-token
|
||||||
secretNamespace: option
|
secretNamespace: option
|
||||||
serviceAccount: # <-- method 2
|
|
||||||
serviceAccountSecretReference:
|
|
||||||
secretName: service-account
|
|
||||||
secretNamespace: default
|
|
||||||
projectId: "6439ec224cfbf7ea2a95b651"
|
|
||||||
environmentName: "dev"
|
|
||||||
managedSecretReference:
|
managedSecretReference:
|
||||||
secretName: managed-secret # <-- the name of kubernetes secret that will be created
|
secretName: managed-secret # <-- the name of kubernetes secret that will be created
|
||||||
secretNamespace: default # <-- where the kubernetes secret that will be created
|
secretNamespace: default # <-- where the kubernetes secret that will be created
|
||||||
@@ -86,7 +80,7 @@ spec:
|
|||||||
</Accordion>
|
</Accordion>
|
||||||
|
|
||||||
<Accordion title="authentication">
|
<Accordion title="authentication">
|
||||||
The `authentication` property tells the operator where it should look to find credentials needed to fetch secrets from Infisical. You can authenticate via two methods as described below.
|
The `authentication` property tells the operator where it should look to find credentials needed to fetch secrets from Infisical.
|
||||||
|
|
||||||
<Tabs>
|
<Tabs>
|
||||||
<Tab title="Service Token">
|
<Tab title="Service Token">
|
||||||
@@ -94,7 +88,7 @@ spec:
|
|||||||
|
|
||||||
#### 1. Generate service token
|
#### 1. Generate service token
|
||||||
|
|
||||||
You can generate a service token for an Infisical project by heading over to the Infisical dashboard then to Project Settings.
|
You can generate a [service token](../../documentation/platform/token) for an Infisical project by heading over to the Infisical dashboard then to Project Settings.
|
||||||
|
|
||||||
#### 2. Create Kubernetes secret containing service token
|
#### 2. Create Kubernetes secret containing service token
|
||||||
|
|
||||||
@@ -123,52 +117,6 @@ spec:
|
|||||||
secretNamespace: option # <-- namespace of the Kubernetes secret that stores our service token
|
secretNamespace: option # <-- namespace of the Kubernetes secret that stores our service token
|
||||||
...
|
...
|
||||||
```
|
```
|
||||||
|
|
||||||
</Tab>
|
|
||||||
<Tab title="Service Account">
|
|
||||||
We recommend authenticating with service account credentials when you have a large number of services. With this method, instead of creating a service token for each Infisical project you'd like to
|
|
||||||
fetch secrets from, you can fetch secrets from a number of Infisical projects with just one set of credentials.
|
|
||||||
|
|
||||||
#### 1. Generate service account
|
|
||||||
|
|
||||||
You can generate a service account by heading over to the organization settings. Once you create the service account, keep the credentials at hand for the next steps.
|
|
||||||
|
|
||||||
#### 2. Grant service account access to Infisical projects
|
|
||||||
|
|
||||||
Click on the pencil icon on the service account you just created and add the projects you'd like to be accessible via that service account.
|
|
||||||
|
|
||||||
#### 3. Store service account credentials in K8 secret
|
|
||||||
Next, we'll need to store the service account credentials in a kubernetes secret so that we can reference it in our InfisicalSecret CRD.
|
|
||||||
|
|
||||||
We recommend you create this kubernetes secret in a new namespace since you may need to reference it many times for each InfisicalSecret CRD you create.
|
|
||||||
|
|
||||||
To quickly create a Kubernetes secret containing the service account details, you can execute the command below after replacing it with your own service account credentials.
|
|
||||||
|
|
||||||
```
|
|
||||||
kubectl create secret generic service-token --from-literal=serviceAccountAccessKey=[REPLACE] --from-literal=serviceAccountPrivateKey=[REPLACE] --from-literal=serviceAccountPublicKey=[REPLACE]
|
|
||||||
```
|
|
||||||
|
|
||||||
Regardless of how you create the kubernetes secret containing the service account credentials, you will need to define values for the following keys in the secret: `serviceAccountAccessKey`, `serviceAccountPrivateKey`, and `serviceAccountPublicKey`
|
|
||||||
|
|
||||||
Once the secret is created, add the name and namespace of the secret that was just created under `authentication.serviceAccount.serviceAccountSecretReference` field in the InfisicalSecret CRD.
|
|
||||||
|
|
||||||
#### 4. Add projectId and environment from which to fetch secrets from
|
|
||||||
Add the Infisical project id and environment from which to fetch secrets for by providing values under `authentication.serviceAccount.projectId` and `authentication.serviceAccount.environmentName`.
|
|
||||||
|
|
||||||
## Example
|
|
||||||
```yaml
|
|
||||||
apiVersion: secrets.infisical.com/v1alpha1
|
|
||||||
kind: InfisicalSecret
|
|
||||||
metadata:
|
|
||||||
name: infisicalsecret-sample-crd
|
|
||||||
spec:
|
|
||||||
serviceAccount:
|
|
||||||
serviceAccountSecretReference:
|
|
||||||
secretName: service-account
|
|
||||||
secretNamespace: default
|
|
||||||
projectId: "6439ec224cfbf7ea2a95b651"
|
|
||||||
environmentName: "dev"
|
|
||||||
```
|
|
||||||
</Tab>
|
</Tab>
|
||||||
</Tabs>
|
</Tabs>
|
||||||
</Accordion>
|
</Accordion>
|
||||||
|
|||||||
Reference in New Issue
Block a user