awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

merge main

Browse Source
This commit is contained in:
Scott Wilson
2025-06-02 16:24:55 -07:00
parent d924580599 739ef8e05a
commit 8730d14104
722 changed files with 30947 additions and 13097 deletions
Download Patch File Download Diff File Expand all files Collapse all files

123
docs/integrations/app-connections/1password.mdx Normal file
View File

@@ -0,0 +1,123 @@
---
title: "1Password Connection"
description: "Learn how to configure a 1Password Connection for Infisical."
---
Infisical supports the use of [Service Accounts](https://developer.1password.com/docs/service-accounts) to connect with 1Password.
## Setup 1Password Connect Server
<Note>
If you already have a Connect Server for your vault you may skip this step.
</Note>
<Steps>
<Step title="Navigate to 'Developer' and click 'Other'">
![Developer Page](/images/app-connections/1password/developer-page.png)
</Step>
<Step title="Select 'Connect Server'">
![Click Connect Server](/images/app-connections/1password/click-connect-server.png)
</Step>
<Step title="Configure Connect Server">
1. Input a name for your Connect Server
2. Click "Choose Vaults" and select the vaults you want to connect
3. For each selected vault, click **Edit Access** and **Enable All**
4. Click "Add Environment"
![Configure Connect Server](/images/app-connections/1password/configure-connect-server.png)
</Step>
<Step title="Configure Access Token">
1. Input a name and expiration for the token
2. Click "Choose Vaults" and select the vaults you want to connect
3. For each selected vault, click **Edit Access** and **Enable All**
4. Click "Issue Token"
![Set Up Access Token](/images/app-connections/1password/set-up-access-token.png)
</Step>
<Step title="Deploy Connect Server">
Download the Credentials File and set up your Connect Server.
<Note>
Follow [this guide](https://developer.1password.com/docs/connect/get-started#step-2-deploy-1password-connect-server) to deploy a Connect Server.
</Note>
Make sure to save the **Access Token** for later use.
![Deploy Server](/images/app-connections/1password/deploy-server.png)
</Step>
</Steps>
## Create 1Password Connection in Infisical
<Tabs>
<Tab title="Infisical UI">
<Steps>
<Step title="Navigate to App Connections">
In your Infisical dashboard, go to **Organization Settings** and select the [**App Connections**](https://app.infisical.com/organization/app-connections) tab.
![App Connections Tab](/images/app-connections/general/add-connection.png)
</Step>
<Step title="Select 1Password Connection">
Click the **+ Add Connection** button and select the **1Password Connection** option from the available integrations.
![Select 1Password Connection](/images/app-connections/1password/app-connection-option.png)
</Step>
<Step title="Fill out the 1Password Connection Modal">
Complete the 1Password Connection form by entering:
- A descriptive name for the connection
- An optional description for future reference
- The URL at which your 1Password Connect Server instance is hosted
- The Access Token from earlier steps
![1Password Connection Modal](/images/app-connections/1password/app-connection-modal.png)
</Step>
<Step title="Connection Created">
After clicking Create, your **1Password Connection** is established and ready to use with your Infisical projects.
![1Password Connection Created](/images/app-connections/1password/app-connection-created.png)
</Step>
</Steps>
</Tab>
<Tab title="API">
To create an 1Password Connection, make an API request to the [Create 1Password Connection](/api-reference/endpoints/app-connections/1password/create) API endpoint.
### Sample request
```bash Request
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/1password \
--header 'Content-Type: application/json' \
--data '{
"name": "my-1password-connection",
"method": "api-token",
"credentials": {
"instanceUrl": "https://1pass.example.com",
"apiToken": "[PRIVATE TOKEN]"
}
}'
```
### Sample response
```bash Response
{
"appConnection": {
"id": "e5d18aca-86f7-4026-a95e-efb8aeb0d8e6",
"name": "my-1password-connection",
"description": null,
"version": 1,
"orgId": "6f03caa1-a5de-43ce-b127-95a145d3464c",
"createdAt": "2025-04-23T19:46:34.831Z",
"updatedAt": "2025-04-23T19:46:34.831Z",
"isPlatformManagedCredentials": false,
"credentialsHash": "7c2d371dec195f82a6a0d5b41c970a229cfcaf88e894a5b6395e2dbd0280661f",
"app": "1password",
"method": "api-token",
"credentials": {
"instanceUrl": "https://1pass.example.com"
}
}
}
```
</Tab>
</Tabs>

2
docs/integrations/app-connections/ldap.mdx
View File

@@ -10,7 +10,7 @@ Infisical supports the use of [Simple Binding](https://ldap.com/the-ldap-bind-op
You will need the following information to establish an LDAP connection:
- **LDAP URL** - The LDAP/LDAPS URL to connect to (e.g., ldap://domain-or-ip:389 or ldaps://domain-or-ip:636)
- **Binding DN** - The Distinguished Name (DN) of the principal to bind with (e.g., 'CN=John,CN=Users,DC=example,DC=com')
- **Binding DN/UPN** - The Distinguished Name (DN), or User Principal Name (UPN) if supported, of the principal to bind with (e.g., 'CN=John,CN=Users,DC=example,DC=com')
- **Binding Password** - The password to bind with for authentication
- **CA Certificate** - The SSL certificate (PEM format) to use for secure connection when using ldaps:// with a self-signed certificate

129
docs/integrations/app-connections/mysql.mdx Normal file
View File

@@ -0,0 +1,129 @@
---
title: "MySQL Connection"
description: "Learn how to configure a MySQL Connection for Infisical."
---
Infisical supports connecting to MySQL using a database role.
## Configure a MySQL Role for Infisical
<Steps>
<Step title="Create a Role">
Infisical recommends creating a designated role in your MySQL database for your connection.
```SQL
-- create user role
CREATE USER 'infisical_role'@'%' IDENTIFIED BY 'my-password';
```
</Step>
<Step title="Grant Relevant Permissions">
Depending on how you intend to use your MySQL connection, you'll need to grant one or more of the following permissions.
<Tip>
To learn more about MySQL's permission system, please visit their [documentation](https://dev.mysql.com/doc/refman/8.4/en/grant.html).
</Tip>
<Tabs>
<Tab title="Secret Rotation">
For Secret Rotations, your Infisical user will require the ability to alter other users' passwords:
```SQL
-- enable permissions to alter login credentials
GRANT CREATE USER ON *.* TO 'infisical_role'@'%';
-- Apply changes
FLUSH PRIVILEGES;
```
</Tab>
</Tabs>
</Step>
<Step title="Get Connection Details">
You'll need the following information to create your MySQL connection:
- `host` - The hostname or IP address of your MySQL server
- `port` - The port number your MySQL server is listening on (default: 3306)
- `database` - The name of the specific database you want to connect to
- `username` - The role name of the login created in the steps above
- `password` - The role password of the login created in the steps above
- `sslCertificate` (optional) - The SSL certificate required for connection (if configured)
<Note>
If you are self-hosting Infisical and intend to connect to an internal/private IP address, be sure to set the `ALLOW_INTERNAL_IP_CONNECTIONS` environment variable to `true`.
</Note>
</Step>
</Steps>
## Create Connection in Infisical
<Tabs>
<Tab title="Infisical UI">
1. Navigate to the App Connections tab on the Organization Settings page.
![App Connections Tab](/images/app-connections/general/add-connection.png)
2. Select the **MySQL Connection** option.
![Select MySQL Connection](/images/app-connections/mysql/select-mysql-connection.png)
3. Select the **Username & Password** method option and provide the details obtained from the previous section and press **Connect to MySQL**.
<Note>
Optionally, if you'd like Infisical to manage the credentials of this connection, you can enable the Platform Managed Credentials option.
If enabled, Infisical will update the password of the connection on creation to prevent external access to this database role.
</Note>
![Create MySQL Connection](/images/app-connections/mysql/create-username-and-password-method.png)
4. Your **MySQL Connection** is now available for use.
![Assume Role MySQL Connection](/images/app-connections/mysql/username-and-password-connection.png)
</Tab>
<Tab title="API">
To create a MySQL Connection, make an API request to the [Create MySQL Connection](/api-reference/endpoints/app-connections/mysql/create) API endpoint.
<Note>
Optionally, if you'd like Infisical to manage the credentials of this connection, you can set the `isPlatformManagedCredentials` option to `true`.
If enabled, Infisical will update the password of the connection on creation to prevent external access to this database role.
</Note>
### Sample request
```bash Request
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/mysql \
--header 'Content-Type: application/json' \
--data '{
"name": "my-mysql-connection",
"method": "username-and-password",
"isPlatformManagedCredentials": true,
"credentials": {
"host": "123.4.5.6",
"port": 3306,
"database": "default",
"username": "infisical_role",
"password": "my-password",
"sslEnabled": true,
"sslRejectUnauthorized": true
},
}'
```
### Sample response
```bash Response
{
"appConnection": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"name": "my-mysql-connection",
"version": 1,
"orgId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"createdAt": "2023-11-07T05:31:56Z",
"updatedAt": "2023-11-07T05:31:56Z",
"app": "mysql",
"method": "username-and-password",
"isPlatformManagedCredentials": true,
"credentials": {
"host": "123.4.5.6",
"port": 3306,
"database": "default",
"username": "infisical_role",
"sslEnabled": true,
"sslRejectUnauthorized": true
}
}
}
```
</Tab>
</Tabs>

7
docs/integrations/app-connections/oci.mdx
View File

@@ -3,6 +3,13 @@ title: "OCI Connection"
description: "Learn how to configure an Oracle Cloud Infrastructure Connection for Infisical."
---
<Info>
OCI App Connection is a paid feature.
If you're using Infisical Cloud, then it is available under the **Enterprise Tier**. If you're self-hosting Infisical,
then you should contact team@infisical.com to purchase an enterprise license to use it.
</Info>
Infisical supports the use of [API Signing Key Authentication](https://docs.oracle.com/en-us/iaas/Content/API/Concepts/apisigningkey.htm) to connect with OCI.
## Create OCI User

6
docs/integrations/platforms/kubernetes-csi.mdx
View File

@@ -1,6 +1,6 @@
---
title: "Kubernetes CSI"
description: "How to use Infisical to inject secrets directly into Kubernetes pods."
description: "How to use the Infisical Kubernetes CSI provider to inject secrets directly into Kubernetes pods."
---
## Overview
@@ -15,9 +15,9 @@ flowchart LR
CSP --> CSD(Secrets Store CSI Driver)
end
subgraph Application
subgraph Pod
CSD --> V(Volume)
V <--> P(Pod)
V <--> P(Application)
end
```

317
docs/integrations/platforms/kubernetes-injector.mdx Normal file
View File

@@ -0,0 +1,317 @@
---
title: "Kubernetes Agent Injector"
description: "How to use the Infisical Kubernetes Agent Injector to inject secrets directly into Kubernetes pods."
---
## Overview
The Infisical Kubernetes Agent Injector allows you to inject secrets directly into your Kubernetes pods. The Injector will create a [Infisical Agent](/integrations/platforms/infisical-agent) container within your pod that syncs secrets from Infisical into a shared volume mount within your pod.
The Infisical Agent Injector will patch and modify your pod's deployment to contain an [Infisical Agent](/integrations/platforms/infisical-agent) container which renders your Infisical secrets into a shared volume mount within your pod.
The Infisical Agent Injector is built on [Kubernetes Mutating Admission Webhooks](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers), and will watch for `CREATE` and `UPDATE` events on pods in your cluster.
The injector is namespace-agnostic, and will watch for pods in any namespace, but will only patch pods that have the `org.infisical.com/inject` annotation set to `true`.
```mermaid
flowchart LR
subgraph Secrets Management
SS(Infisical) --> INJ(Infisical Injector)
end
subgraph Pod
INJ --> INIT(Agent Init Container)
INIT --> V(Volume)
V <--> P(Application)
end
```
## Install the Infisical Agent Injector
To install the Infisical Agent Injector, you will need to install our helm charts using [Helm](https://helm.sh/).
```bash
helm repo add infisical-helm-charts 'https://dl.cloudsmith.io/public/infisical/helm-charts/helm/charts/'
helm repo update
helm install --generate-name infisical-helm-charts/infisical-agent-injector
```
After installing the helm chart you can verify that the injector is running and working as intended by checking the logs of the injector pod.
```bash
$ kubectl logs deployment/infisical-agent-injector
2025/05/19 14:20:05 Starting infisical-agent-injector...
2025/05/19 14:20:05 Generating self-signed certificate...
2025/05/19 14:20:06 Creating directory: /tmp/tls
2025/05/19 14:20:06 Writing cert to: /tmp/tls/tls.crt
2025/05/19 14:20:06 Writing key to: /tmp/tls/tls.key
2025/05/19 14:20:06 Starting HTTPS server on port 8585...
2025/05/19 14:20:06 Attempting to update webhook config (attempt 1)...
2025/05/19 14:20:06 Successfully updated webhook configuration with CA bundle
```
## Supported annotations
The Infisical Agent Injector supports the following annotations:
<Accordion title="org.infisical.com/inject">
The inject annotation is used to enable the injector on a pod. Set the value to `true` and the pod will be patched with an Infisical Agent container on update or create.
</Accordion>
<Accordion title="org.infisical.com/inject-mode">
The inject mode annotation is used to specify the mode to use to inject the secrets into the pod. Currently only `init` mode is supported.
- `init`: The init method will create an init container for the pod that will render the secrets into a shared volume mount within the pod. The agent init container will run before any other containers in the pod runs, including other init containers.
</Accordion>
<Accordion title="org.infisical.com/agent-config-map">
The agent config map annotation is used to specify the name of the config map that contains the configuration for the injector. The config map must be in the same namespace as the pod.
</Accordion>
## ConfigMap Configuration
### Supported Fields
When you are configuring a pod to use the injector, you must create a config map in the same namespace as the pod you want to inject secrets into.
The entire config needs to be of string format and needs to be assigned to the `config.yaml` key in the config map. You can find a full example of the config at the end of this section.
<Accordion title="infisical.address">
The address of your Infisical instance. This field is optional and will default to `https://app.infisical.com` if not provided.
</Accordion>
<Accordion title="infisical.auth.type">
The authentication type to use to connect to Infisical. Currently only the `kubernetes` authentication type is supported.
You can refer to our [Kubernetes Auth](/documentation/platform/identities/kubernetes-auth) documentation for more information on how to create a machine identity for Kubernetes Auth.
Please note that the pod's default service account will be used to authenticate with Infisical.
</Accordion>
<Accordion title="infisical.auth.config.identity-id">
The ID of the machine identity to use to connect to Infisical. This field is required if the `infisical.auth.type` is set to `kubernetes`.
</Accordion>
<Accordion title="templates[]">
The templates hold an array of templates that will be rendered and injected into the pod.
</Accordion>
<Accordion title="templates[].destination-path">
The path to inject the secrets into within the pod.
If not specified, this will default to `/shared/infisical-secrets`. If you have multiple templates and don't provide a destination path, the destination paths will default to `/shared/infisical-secrets-1`, `/shared/infisical-secrets-2`, etc.
</Accordion>
<Accordion title="templates[].template-content">
The content of the template to render.
This will be rendered as a [Go Template](https://pkg.go.dev/text/template) and will have access to the following variables.
It follows the templating format and supports the same functions as the [Infisical Agent](/integrations/platforms/infisical-agent#quick-start-infisical-agent)
</Accordion>
### Authentication
The Infisical Agent Injector only supports Machine Identity [Kubernetes Auth](/documentation/platform/identities/kubernetes-auth) authentication at the moment.
To configure Kubernetes Auth, you need to set the `auth.type` field to `kubernetes` and set the `auth.config.identity-id` to the ID of the machine identity you wish to use for authentication.
```yaml
auth:
type: "kubernetes"
config:
identity-id: "<your-infisical-machine-identity-id>"
```
### Example ConfigMap
```yaml config-map.yaml
apiVersion: v1
kind: ConfigMap
metadata:
name: demo-config-map
data:
config.yaml: |
infisical:
address: "https://app.infisical.com"
auth:
type: "kubernetes"
config:
identity-id: "<your-infisical-machine-identity-id>"
templates:
- destination-path: "/path/to/save/secrets/file.txt"
template-content: |
{{- with secret "<your-project-id>" "dev" "/" }}
{{- range . }}
{{ .Key }}={{ .Value }}
{{- end }}
{{- end }}
```
```bash
kubectl apply -f config-map.yaml
```
To use the config map in your pod, you will need to add the `org.infisical.com/agent-config-map` annotation to your pod's deployment. The value of the annotation is the name of the config map you created above.
```yaml
apiVersion: v1
kind: Pod
metadata:
name: demo
labels:
app: demo
annotations:
org.infisical.com/inject: "true" # Set to true for the injector to patch the pod on create/update events
org.infisical.com/inject-mode: "init" # The mode to use to inject the secrets into the pod. Currently only `init` mode is supported.
org.infisical.com/agent-config-map: "name-of-config-map" # The name of the config map that you created above, which contains all the settings for injecting the secrets into the pod
spec:
# ...
```
## Quick Start
In this section we'll walk through a full example of how to inject secrets into a pod using the Infisical Agent Injector.
In this example we'll create a basic nginx deployment and print a Infisical secret called `API_KEY` to the container logs.
### Create secrets in Infisical
First you'll need to create the secret in Infisical.
- `API_KEY`: The API key to use for the nginx deployment.
Once you've created the secret, save your project ID, environment slug, and secret path, as these will be used in the next step.
### Configuration
To use the injector you must create a config map in the same namespace as the pod you want to inject secrets into. In this example we'll create a config map in the `test-namespace` namespace.
The agent injector will authenticate with Infisical using a [Kubernetes Auth](/documentation/platform/identities/kubernetes-auth) machine identity. Please follow the [instructions](/documentation/platform/identities/kubernetes-auth) to create a machine identity configured for Kubernetes Auth.
The agent injector will use the service account token of the pod to authenticate with Infisical.
The `template-content` will be rendered as a [Go Template](https://pkg.go.dev/text/template) and will have access to the following variables. It follows the templating format and supports the same functions as the [Infisical Agent](/integrations/platforms/infisical-agent#quick-start-infisical-agent)
The `destination-path` refers to the path within the pod that the secrets will be injected into. In this case we're injecting the secrets into a file called `/infisical/secrets`.
Replace the `<your-project-id>`, `<your-environment-slug>`, with your project ID and the environment slug of where you created your secrets in Infisical. Replace `<your-infisical-machine-identity-id>` with the ID of your machine identity configured for Kubernetes Auth.
```yaml config-map.yaml
apiVersion: v1
kind: ConfigMap
metadata:
name: nginx-infisical-config-map
namespace: test-namespace
data:
config.yaml: |
infisical:
address: "https://app.infisical.com"
auth:
type: "kubernetes"
config:
identity-id: "<your-infisical-machine-identity-id>"
templates:
- destination-path: "/infisical/secrets"
template-content: |
{{- with secret "<your-project-id>" "<your-environment-slug>" "/" }}
{{- range . }}
{{ .Key }}={{ .Value }}
{{- end }}
{{- end }}
```
Now apply the config map:
```bash
kubectl apply -f config-map.yaml
```
### Injecting secrets into your pod
To inject secrets into your pod, you will need to add the `org.infisical.com/inject: "true"` annotation to your pod's deployment.
The `org.infisical.com/agent-config-map` annotation will point to the config map we created in the previous step. It's important that the config map is in the same namespace as the pod.
We are creating a nginx deployment with a PVC to store the database data.
```yaml nginx.yaml
---
apiVersion: v1
kind: Pod
metadata:
name: nginx-pod
namespace: test-namespace
labels:
app: nginx
annotations:
org.infisical.com/inject: "true"
org.infisical.com/inject-mode: "init"
org.infisical.com/agent-config-map: "nginx-infisical-config-map"
spec:
containers:
- name: simple-app-demo
image: nginx:alpine
command: ["/bin/sh", "-c"]
args:
- |
export $(cat /infisical/secrets | xargs)
echo "API_KEY is set to: $API_KEY"
nginx -g "daemon off;"
```
### Applying the deployment
To apply the deployment, you can use the following command:
```bash
kubectl apply -f nginx.yaml
```
It may take a few minutes for the pod to be ready and for the Infisical secrets to be injected. You can check the status of the pod by running:
```bash
kubectl get pods -n test-namespace
```
### Verifying the secrets are injected
To verify the secrets are injected, you can check the pod's logs:
```bash
$ kubectl exec -it pod/nginx-pod -n test-namespace -- cat /infisical/secrets
Defaulted container "simple-app-demo" out of: simple-app-demo, infisical-agent-init (init)
API_KEY=sk_api_... # The secret you created in Infisical
```
Additionally you can now check that the `API_KEY` secret is being logged to the nginx container logs:
```bash
$ kubectl logs pod/nginx-pod -n test-namespace
Defaulted container "simple-app-demo" out of: simple-app-demo, infisical-agent-init (init)
API_KEY is set to: sk_api_... # The secret you created in Infisical
```
## Troubleshooting
<Accordion title="The pod is stuck in `Init` state">
If the pod is stuck in `Init` state, it means the Agent init container is failing to start or is stuck in a restart loop.
This could be due to a number of reasons, such as the machine identity not having the correct permissions, or trying to fetch secrets from a non-existent project/environment.
You can check the logs of the infisical init container by running:
```bash
# For deployments
kubectl logs deployment/your-deployment-name -c infisical-agent-init -n "<namespace>"
# For pods
kubectl logs pod/your-pod-name -c infisical-agent-init -n "<namespace>"
```
You can also check the logs of the pod by running:
```bash
kubectl logs deployment/postgres-deployment -n test-namespace
```
When checking the logs of the agent init container, you may see something like the following:
```bash
Starting infisical agent...
11:10AM INF starting Infisical agent...
11:10AM INF Infisical instance address set to https://daniel1.tunn.dev
11:10AM INF template engine started for template 1...
11:10AM INF attempting to authenticate...
11:10AM INF new access token saved to file at path '/home/infisical/config/identity-access-token'
11:10AM ERR unable to process template because template: literalTemplate:1:9: executing "literalTemplate" at <secret "3c0d3ff6-165c-4dc9-b52c-ff3ffaedfce311111" "dev" "/">: error calling secret: CallGetRawSecretsV3: Unsuccessful response [GET https://daniel1.tunn.dev/api/v3/secrets/raw?environment=dev&expandSecretReferences=true&include_imports=true&secretPath=%2F&workspaceId=3c0d3ff6-165c-4dc9-b52c-ff3ffaedfce311111] [status-code=404] [response={"reqId":"req-ljqNq567jchFrK","statusCode":404,"message":"Project with ID '3c0d3ff6-165c-4dc9-b52c-ff3ffaedfce311111' not found during bot lookup. Are you sure you are using the correct project ID?","error":"NotFound"}]
+ echo 'Agent failed with exit code 1'
+ exit 1
Agent failed with exit code 1
```
In the above error, the project ID was invalid in the config map.
</Accordion>

163
docs/integrations/secret-syncs/1password.mdx Normal file
View File

@@ -0,0 +1,163 @@
---
title: "1Password Sync"
description: "Learn how to configure a 1Password Sync for Infisical."
---
**Prerequisites:**
- Create an [1Password Connection](/integrations/app-connections/1password)
<Tabs>
<Tab title="Infisical UI">
<Steps>
<Step title="Add Sync">
Navigate to **Project** > **Integrations** and select the **Secret Syncs** tab. Click on the **Add Sync** button.
![Secret Syncs Tab](/images/secret-syncs/general/secret-sync-tab.png)
</Step>
<Step title="Select '1Password'">
![Select 1Password](/images/secret-syncs/1password/select-option.png)
</Step>
<Step title="Configure source">
Configure the **Source** from where secrets should be retrieved, then click **Next**.
![Configure Source](/images/secret-syncs/1password/configure-source.png)
- **Environment**: The project environment to retrieve secrets from.
- **Secret Path**: The folder path to retrieve secrets from.
<Tip>
If you need to sync secrets from multiple folder locations, check out [secret imports](/documentation/platform/secret-reference#secret-imports).
</Tip>
</Step>
<Step title="Configure destination">
Configure the **Destination** to where secrets should be deployed, then click **Next**.
![Configure Destination](/images/secret-syncs/1password/configure-destination.png)
- **1Password Connection**: The 1Password Connection to authenticate with.
- **Vault**: The 1Password vault to sync secrets to.
</Step>
<Step title="Configure sync options">
Configure the **Sync Options** to specify how secrets should be synced, then click **Next**.
![Configure Sync Options](/images/secret-syncs/1password/configure-sync-options.png)
- **Initial Sync Behavior**: Determines how Infisical should resolve the initial sync.
- **Overwrite Destination Secrets**: Removes any secrets at the destination endpoint not present in Infisical.
- **Import Secrets (Prioritize Infisical)**: Imports secrets from the destination endpoint before syncing, prioritizing values from Infisical over 1Password when keys conflict.
- **Import Secrets (Prioritize 1Password)**: Imports secrets from the destination endpoint before syncing, prioritizing values from 1Password over Infisical when keys conflict.
- **Key Schema**: Template that determines how secret names are transformed when syncing, using `{{secretKey}}` as a placeholder for the original secret name.
<Note>
We highly recommend using a Key Schema to ensure that Infisical only manages the specific keys you intend, keeping everything else untouched.
</Note>
- **Auto-Sync Enabled**: If enabled, secrets will automatically be synced from the source location when changes occur. Disable to enforce manual syncing only.
- **Disable Secret Deletion**: If enabled, Infisical will not remove secrets from the sync destination. Enable this option if you intend to manage some secrets manually outside of Infisical.
</Step>
<Step title="Configure details">
Configure the **Details** of your 1Password Sync, then click **Next**.
![Configure Details](/images/secret-syncs/1password/configure-details.png)
- **Name**: The name of your sync. Must be slug-friendly.
- **Description**: An optional description for your sync.
</Step>
<Step title="Review configuration">
Review your 1Password Sync configuration, then click **Create Sync**.
![Review Configuration](/images/secret-syncs/1password/review-configuration.png)
</Step>
<Step title="Sync created">
If enabled, your 1Password Sync will begin syncing your secrets to the destination endpoint.
![Sync Created](/images/secret-syncs/1password/sync-created.png)
</Step>
</Steps>
</Tab>
<Tab title="API">
To create an **1Password Sync**, make an API request to the [Create 1Password Sync](/api-reference/endpoints/secret-syncs/1password/create) API endpoint.
### Sample request
```bash Request
curl --request POST \
--url https://app.infisical.com/api/v1/secret-syncs/1password \
--header 'Content-Type: application/json' \
--data '{
"name": "my-1password-sync",
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"description": "an example sync",
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"environment": "dev",
"secretPath": "/my-secrets",
"isEnabled": true,
"syncOptions": {
"initialSyncBehavior": "overwrite-destination"
},
"destinationConfig": {
"vaultId": "..."
}
}'
```
### Sample response
```bash Response
{
"secretSync": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"name": "my-1password-sync",
"description": "an example sync",
"isEnabled": true,
"version": 1,
"folderId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"createdAt": "2023-11-07T05:31:56Z",
"updatedAt": "2023-11-07T05:31:56Z",
"syncStatus": "succeeded",
"lastSyncJobId": "123",
"lastSyncMessage": null,
"lastSyncedAt": "2023-11-07T05:31:56Z",
"importStatus": null,
"lastImportJobId": null,
"lastImportMessage": null,
"lastImportedAt": null,
"removeStatus": null,
"lastRemoveJobId": null,
"lastRemoveMessage": null,
"lastRemovedAt": null,
"syncOptions": {
"initialSyncBehavior": "overwrite-destination"
},
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"connection": {
"app": "1password",
"name": "my-1password-connection",
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
},
"environment": {
"slug": "dev",
"name": "Development",
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
},
"folder": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"path": "/my-secrets"
},
"destination": "1password",
"destinationConfig": {
"vaultId": "..."
}
}
}
```
</Tab>
</Tabs>
## FAQ
<AccordionGroup>
<Accordion title="How are different 1Password item types treated?">
Infisical can only perform CRUD operations on the following item types:
- API Credentials
</Accordion>
</AccordionGroup>

7
docs/integrations/secret-syncs/oci-vault.mdx
View File

@@ -3,6 +3,13 @@ title: "OCI Vault Sync"
description: "Learn how to configure an Oracle Cloud Infrastructure Vault Sync for Infisical."
---
<Info>
OCI Vault Sync is a paid feature.
If you're using Infisical Cloud, then it is available under the **Enterprise Tier**. If you're self-hosting Infisical,
then you should contact team@infisical.com to purchase an enterprise license to use it.
</Info>
**Prerequisites:**
- Create an [OCI Connection](/integrations/app-connections/oci) with the required **Secret Sync** permissions
- [Create](https://docs.oracle.com/en-us/iaas/Content/Identity/compartments/To_create_a_compartment.htm) or use an existing OCI Compartment (which the OCI Connection is authorized to access)

2
docs/integrations/secret-syncs/overview.mdx
View File

@@ -99,6 +99,8 @@ via the UI or API for the third-party service you intend to sync secrets to.
Key Schemas transform your secret keys by applying a prefix, suffix, or format pattern during sync to external destinations. This makes it clear which secrets are managed by Infisical and prevents accidental changes to unrelated secrets.
Any destination secrets which do not match the schema will not get deleted or updated by Infisical.
**Example:**
- Infisical key: `SECRET_1`
- Schema: `INFISICAL_{{secretKey}}`