requested changes

.github/workflows/release_docker_gateway.yaml

@@ -6,7 +6,6 @@ on:
 
 permissions:
     contents: write
-    pull-requests: write
 
 jobs:
     release-image:
@@ -18,7 +17,7 @@ jobs:
               run: echo "::set-output name=version::${GITHUB_REF_NAME#infisical-gateway/}"
 
             - name: Checkout code
-              uses: actions/checkout@v2
+              uses: actions/checkout@v4
 
             - name: 🔧 Set up QEMU
               uses: docker/setup-qemu-action@v1

.github/workflows/release_helm_gateway.yaml

@@ -8,7 +8,7 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             - name: Checkout
-              uses: actions/checkout@v2
+              uses: actions/checkout@v4
 
             - name: Install Helm
               uses: azure/setup-helm@v3

Dockerfile.gateway

@@ -7,7 +7,7 @@ COPY ./cli .
 
 RUN go build -o infisical-cli .
 
-FROM alpine:latest
+FROM alpine:3.19
 
 ENV TOKEN=""
 ENV INFISICAL_API_URL="https://app.infisical.com"

helm-charts/infisical-gateway/templates/deployment.yaml

@@ -37,11 +37,9 @@ spec:
           {{- end }}
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
-          env:
+          envFrom:
-          {{- range $key, $value := .Values.env }}
+            - secretRef:
-            - name: {{ $key }}
+                name: {{ .Values.secret.name }}
-              value: {{ $value | quote }}
-          {{- end }}
           ports:
             - name: http
               containerPort: {{ .Values.service.port }}

helm-charts/infisical-gateway/templates/secret.yaml

@@ -0,0 +1,13 @@
+{{- if .Values.secret.create -}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Values.secret.name }}
+  labels:
+    {{- include "infisical-gateway.labels" . | nindent 4 }}
+type: Opaque
+data:
+  {{- range $key, $value := .Values.secret.data }}
+  {{ $key }}: {{ $value | b64enc }}
+  {{- end }}
+{{- end }}

helm-charts/infisical-gateway/values.yaml

@@ -1,16 +1,22 @@
 image:
   repository: infisical/infisical-gateway
   pullPolicy: IfNotPresent
-  tag: "latest"
+  tag: "v0.0.1"
 
-# Environment variables for the gateway
+secret:
-env:
+  # create a new secret (if true) or use existing (if false)
-  TOKEN: ""
+  create: true
-  INFISICAL_API_URL: "https://app.infisical.com/api"
+  # name of the secret to use/create
+  name: "infisical-gateway-secrets"
+
+  # Secret data (only used if create: true)
+  data:
+    TOKEN: ""
+    INFISICAL_API_URL: "https://app.infisical.com"
 
 resources:
   limits:
-    cpu: 100m
+    cpu: 500m
     memory: 128Mi
   requests:
     cpu: 100m
@@ -28,8 +34,12 @@ serviceAccount:
 
 podAnnotations: {}
 podLabels: {}
-podSecurityContext: {}
+podSecurityContext:
-securityContext: {}
+  runAsNonRoot: true
+
+securityContext:
+  runAsNonRoot: true
+
 affinity: {}
 tolerations: {}
 nodeSelector: {}