awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

misc: url and ssl config not needed when gateway auth

Browse Source
This commit is contained in:
Sheen Capadngan
2025-06-11 02:51:22 +08:00
parent f7fb015bd8
commit 8b443e0957
6 changed files with 263 additions and 172 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
backend/src/ee/services/dynamic-secret/providers/kubernetes.ts
View File

@@ -20,6 +20,9 @@ import {
const EXTERNAL_REQUEST_TIMEOUT = 10 * 1000;
// This value is just a placeholder. When using gateway auth method, the url is irrelevant.
const GATEWAY_AUTH_DEFAULT_URL = "https://kubernetes.default.svc.cluster.local";
type TKubernetesProviderDTO = {
gatewayService: Pick<TGatewayServiceFactory, "fnGetGatewayClientTlsByGatewayId">;
};
@@ -37,7 +40,7 @@ const generateUsername = (usernameTemplate?: string | null) => {
export const KubernetesProvider = ({ gatewayService }: TKubernetesProviderDTO): TDynamicProviderFns => {
const validateProviderInputs = async (inputs: unknown) => {
const providerInputs = await DynamicSecretKubernetesSchema.parseAsync(inputs);
if (!providerInputs.gatewayId) {
if (!providerInputs.gatewayId && providerInputs.url) {
await blockLocalAndPrivateIpAddresses(providerInputs.url);
}
@@ -272,7 +275,9 @@ export const KubernetesProvider = ({ gatewayService }: TKubernetesProviderDTO):
);
};
const url = new URL(providerInputs.url);
const rawUrl =
providerInputs.authMethod === KubernetesAuthMethod.Gateway ? GATEWAY_AUTH_DEFAULT_URL : providerInputs.url || "";
const url = new URL(rawUrl);
const k8sGatewayHost = url.hostname;
const k8sPort = url.port ? Number(url.port) : 443;
const k8sHost = `${url.protocol}//${url.hostname}`;
@@ -488,7 +493,9 @@ export const KubernetesProvider = ({ gatewayService }: TKubernetesProviderDTO):
return { ...res.data, serviceAccountName: providerInputs.serviceAccountName };
};
const url = new URL(providerInputs.url);
const rawUrl =
providerInputs.authMethod === KubernetesAuthMethod.Gateway ? GATEWAY_AUTH_DEFAULT_URL : providerInputs.url || "";
const url = new URL(rawUrl);
const k8sHost = `${url.protocol}//${url.hostname}`;
const k8sGatewayHost = url.hostname;
const k8sPort = url.port ? Number(url.port) : 443;
@@ -611,7 +618,12 @@ export const KubernetesProvider = ({ gatewayService }: TKubernetesProviderDTO):
};
if (providerInputs.credentialType === KubernetesCredentialType.Dynamic) {
const url = new URL(providerInputs.url);
const rawUrl =
providerInputs.authMethod === KubernetesAuthMethod.Gateway
? GATEWAY_AUTH_DEFAULT_URL
: providerInputs.url || "";
const url = new URL(rawUrl);
const k8sGatewayHost = url.hostname;
const k8sPort = url.port ? Number(url.port) : 443;
const k8sHost = `${url.protocol}//${url.hostname}`;

37
backend/src/ee/services/dynamic-secret/providers/models.ts
View File

@@ -1,3 +1,4 @@
import RE2 from "re2";
import { z } from "zod";
import { TDynamicSecretLeaseConfig } from "../../dynamic-secret-lease/dynamic-secret-lease-types";
@@ -325,7 +326,12 @@ export const LdapSchema = z.union([
export const DynamicSecretKubernetesSchema = z
.discriminatedUnion("credentialType", [
z.object({
url: z.string().url().trim().min(1),
url: z
.string()
.optional()
.refine((val: string | undefined) => !val || new RE2(/^https?:\/\/.+/).test(val), {
message: "Invalid URL. Must start with http:// or https:// (e.g. https://example.com)"
}),
clusterToken: z.string().trim().optional(),
ca: z.string().optional(),
sslEnabled: z.boolean().default(false),
@@ -341,7 +347,13 @@ export const DynamicSecretKubernetesSchema = z
authMethod: z.nativeEnum(KubernetesAuthMethod).default(KubernetesAuthMethod.Api)
}),
z.object({
url: z.string().url().trim().min(1),
url: z
.string()
.url()
.optional()
.refine((val: string | undefined) => !val || new RE2(/^https?:\/\/.+/).test(val), {
message: "Invalid URL. Must start with http:// or https:// (e.g. https://example.com)"
}),
clusterToken: z.string().trim().optional(),
ca: z.string().optional(),
sslEnabled: z.boolean().default(false),
@@ -369,12 +381,21 @@ export const DynamicSecretKubernetesSchema = z
message: "When auth method is set to Gateway, a gateway must be selected"
});
}
if ((data.authMethod === KubernetesAuthMethod.Api || !data.authMethod) && !data.clusterToken) {
ctx.addIssue({
path: ["clusterToken"],
code: z.ZodIssueCode.custom,
message: "When auth method is set to Manual Token, a cluster token must be provided"
});
if (data.authMethod === KubernetesAuthMethod.Api || !data.authMethod) {
if (!data.clusterToken) {
ctx.addIssue({
path: ["clusterToken"],
code: z.ZodIssueCode.custom,
message: "When auth method is set to Token, a cluster token must be provided"
});
}
if (!data.url) {
ctx.addIssue({
path: ["url"],
code: z.ZodIssueCode.custom,
message: "When auth method is set to Token, a cluster URL must be provided"
});
}
}
});

65
docs/documentation/platform/dynamic-secrets/kubernetes.mdx
View File

@@ -162,6 +162,12 @@ This feature is ideal for scenarios where you need to:
tokens for the target service account.
</Note>
<Note>
When using Gateway authentication, the Gateway will access the Kubernetes API server
using its internal cluster URL (typically https://kubernetes.default.svc) and TLS configuration.
You don't need to specify these values separately in the dynamic secret configuration.
</Note>
1. Deploy the Infisical Gateway in your cluster
2. Set up RBAC permissions for the Gateway's service account:
```yaml rbac.yaml
@@ -206,6 +212,7 @@ This feature is ideal for scenarios where you need to:
- Automatically clean up service accounts after token expiration
- Assign different roles to different users or applications
- Maintain strict control over service account permissions
- Support multiple namespaces with a single dynamic secret configuration
### Prerequisites
@@ -213,6 +220,16 @@ This feature is ideal for scenarios where you need to:
- Cluster access token with permissions to create service accounts and manage RBAC
- (Optional) [Gateway](/documentation/platform/gateways/overview) for private cluster access
### Namespace Support
When configuring a dynamic secret, you can specify multiple allowed namespaces as a comma-separated list. During lease creation, you can then specify which namespace to use from this allowed list. This provides flexibility while maintaining security by:
- Allowing a single dynamic secret configuration to support multiple namespaces
- Restricting service account creation to only the specified allowed namespaces
- Enabling fine-grained control over which namespaces can be used for each lease
For example, if you configure a dynamic secret with allowed namespaces "default,kube-system,monitoring", you can create leases that use any of these namespaces while preventing access to other namespaces in your cluster.
### Authentication Setup
Choose your authentication method:
@@ -318,6 +335,12 @@ This feature is ideal for scenarios where you need to:
manage service accounts, their tokens, and RBAC resources.
</Note>
<Note>
When using Gateway authentication, the Gateway will access the Kubernetes API server
using its internal cluster URL (typically https://kubernetes.default.svc) and TLS configuration.
You don't need to specify these values separately in the dynamic secret configuration.
</Note>
1. Deploy the Infisical Gateway in your cluster
2. Set up RBAC permissions for the Gateway's service account:
```yaml rbac.yaml
@@ -401,13 +424,13 @@ This feature is ideal for scenarios where you need to:
Select a gateway for private cluster access. If not specified, the Internet Gateway will be used.
</ParamField>
<ParamField path="Cluster URL" type="string" required>
Kubernetes API server URL (e.g., https://kubernetes.default.svc)
Kubernetes API server URL (e.g., https://kubernetes.default.svc). Not required when using Gateway authentication as the Gateway will use its internal cluster URL.
</ParamField>
<ParamField path="Enable SSL" type="boolean">
Whether to enable SSL verification for the Kubernetes API server connection.
Whether to enable SSL verification for the Kubernetes API server connection. Not required when using Gateway authentication as the Gateway will use its internal TLS configuration.
</ParamField>
<ParamField path="CA" type="string">
Custom CA certificate for the Kubernetes API server. Leave blank to use the system/public CA.
Custom CA certificate for the Kubernetes API server. Leave blank to use the system/public CA. Not required when using Gateway authentication as the Gateway will use its internal TLS configuration.
</ParamField>
<ParamField path="Auth Method" type="string" required>
Choose between Token (API) or Gateway authentication. If using Gateway, the Gateway must be deployed in your Kubernetes cluster.
@@ -418,18 +441,30 @@ This feature is ideal for scenarios where you need to:
<ParamField path="Credential Type" type="string" required>
Choose between Static (predefined service account) or Dynamic (temporary service accounts with role assignments)
</ParamField>
<ParamField path="Service Account Name" type="string" required>
Name of the service account to generate tokens for (required for Static credentials)
</ParamField>
<ParamField path="Namespace" type="string" required>
Kubernetes namespace where the service account exists or will be created
</ParamField>
<ParamField path="Role Type" type="string" required>
Type of role to assign (ClusterRole or Role) (required for Dynamic credentials)
</ParamField>
<ParamField path="Role" type="string" required>
Name of the role to assign to the temporary service account (required for Dynamic credentials)
</ParamField>
<Tabs>
<Tab title="Static Credentials Parameters">
<ParamField path="Service Account Name" type="string" required>
Name of the service account to generate tokens for
</ParamField>
<ParamField path="Namespace" type="string" required>
Kubernetes namespace where the service account exists
</ParamField>
</Tab>
<Tab title="Dynamic Credentials Parameters">
<ParamField path="Allowed Namespaces" type="string" required>
Kubernetes namespace(s) where the service accounts will be created. You can specify multiple namespaces as a comma-separated list (e.g., "default,kube-system"). During lease creation, you can specify which namespace to use from this allowed list.
</ParamField>
<ParamField path="Role Type" type="string" required>
Type of role to assign (ClusterRole or Role)
</ParamField>
<ParamField path="Role" type="string" required>
Name of the role to assign to the temporary service account
</ParamField>
</Tab>
</Tabs>
<ParamField path="Audiences" type="array">
Optional list of audiences to include in the generated token
</ParamField>

4
frontend/src/hooks/api/dynamicSecret/types.ts
View File

@@ -290,7 +290,7 @@ export type TDynamicSecretProvider =
type: DynamicSecretProviders.Kubernetes;
inputs:
| {
url: string;
url?: string;
clusterToken?: string;
ca?: string;
serviceAccountName: string;
@@ -302,7 +302,7 @@ export type TDynamicSecretProvider =
authMethod: string;
}
| {
url: string;
url?: string;
clusterToken?: string;
ca?: string;
credentialType: KubernetesDynamicSecretCredentialType.Dynamic;

153
frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/KubernetesInputForm.tsx
View File

@@ -61,7 +61,7 @@ const formSchema = z
.object({
provider: z.discriminatedUnion("credentialType", [
z.object({
url: z.string().url().trim().min(1),
url: z.string().trim().optional(),
clusterToken: z.string().trim().optional(),
ca: z.string().optional(),
sslEnabled: z.boolean().default(false),
@@ -80,7 +80,7 @@ const formSchema = z
authMethod: z.nativeEnum(AuthMethod).default(AuthMethod.Api)
}),
z.object({
url: z.string().url().trim().min(1),
url: z.string().trim().optional(),
clusterToken: z.string().trim().optional(),
ca: z.string().optional(),
sslEnabled: z.boolean().default(false),
@@ -130,12 +130,21 @@ const formSchema = z
message: "When auth method is set to Gateway, a gateway must be selected"
});
}
if (data.provider.authMethod === AuthMethod.Api && !data.provider.clusterToken) {
ctx.addIssue({
path: ["provider.clusterToken"],
code: z.ZodIssueCode.custom,
message: "When auth method is set to Token, a cluster token must be provided"
});
if (data.provider.authMethod === AuthMethod.Api) {
if (!data.provider.clusterToken) {
ctx.addIssue({
path: ["provider.clusterToken"],
code: z.ZodIssueCode.custom,
message: "When auth method is set to Token, a cluster token must be provided"
});
}
if (!data.provider.url) {
ctx.addIssue({
path: ["provider.url"],
code: z.ZodIssueCode.custom,
message: "When auth method is set to Token, a cluster URL must be provided"
});
}
}
});
@@ -347,69 +356,6 @@ export const KubernetesInputForm = ({
)}
</OrgPermissionCan>
</div>
<Controller
control={control}
name="provider.url"
render={({ field, fieldState: { error } }) => (
<FormControl
label="Cluster URL"
isError={Boolean(error?.message)}
errorText={error?.message}
>
<Input {...field} />
</FormControl>
)}
/>
<div className="mb-2 flex items-center">
<span className="mr-3 flex items-center text-sm text-mineshaft-400">
Enable SSL
<Tooltip
className="ml-1 max-w-md"
content={
<span>
If enabled, you can optionally provide a custom CA certificate. Leave
blank to use the system/public CA.
</span>
}
>
<FontAwesomeIcon icon={faQuestionCircle} size="sm" className="ml-1" />
</Tooltip>
</span>
<Controller
name="provider.sslEnabled"
control={control}
render={({ field: { value, onChange } }) => (
<Switch
className="bg-mineshaft-400/50 shadow-inner data-[state=checked]:bg-green/80"
id="ssl-enabled"
thumbClassName="bg-mineshaft-800"
isChecked={value}
onCheckedChange={onChange}
aria-label="Enable SSL"
/>
)}
/>
</div>
<Controller
control={control}
name="provider.ca"
render={({ field, fieldState: { error } }) => (
<FormControl
label="CA"
isError={Boolean(error?.message)}
errorText={error?.message}
className={sslEnabled ? "" : "opacity-50"}
>
<TextArea
{...field}
placeholder="-----BEGIN CERTIFICATE----- ..."
isDisabled={!sslEnabled}
/>
</FormControl>
)}
/>
<Controller
control={control}
name="provider.authMethod"
@@ -434,6 +380,71 @@ export const KubernetesInputForm = ({
</FormControl>
)}
/>
{authMethod === AuthMethod.Api && (
<>
<Controller
control={control}
name="provider.url"
render={({ field, fieldState: { error } }) => (
<FormControl
label="Cluster URL"
isError={Boolean(error?.message)}
errorText={error?.message}
>
<Input {...field} />
</FormControl>
)}
/>
<div className="mb-2 flex items-center">
<span className="mr-3 flex items-center text-sm text-mineshaft-400">
Enable SSL
<Tooltip
className="ml-1 max-w-md"
content={
<span>
If enabled, you can optionally provide a custom CA certificate. Leave
blank to use the system/public CA.
</span>
}
>
<FontAwesomeIcon icon={faQuestionCircle} size="sm" className="ml-1" />
</Tooltip>
</span>
<Controller
name="provider.sslEnabled"
control={control}
render={({ field: { value, onChange } }) => (
<Switch
className="bg-mineshaft-400/50 shadow-inner data-[state=checked]:bg-green/80"
id="ssl-enabled"
thumbClassName="bg-mineshaft-800"
isChecked={value}
onCheckedChange={onChange}
aria-label="Enable SSL"
/>
)}
/>
</div>
<Controller
control={control}
name="provider.ca"
render={({ field, fieldState: { error } }) => (
<FormControl
label="CA"
isError={Boolean(error?.message)}
errorText={error?.message}
className={sslEnabled ? "" : "opacity-50"}
>
<TextArea
{...field}
placeholder="-----BEGIN CERTIFICATE----- ..."
isDisabled={!sslEnabled}
/>
</FormControl>
)}
/>
</>
)}
{authMethod === AuthMethod.Api && (
<Controller
control={control}

156
frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/EditDynamicSecretForm/EditDynamicSecretKubernetesForm.tsx
View File

@@ -59,7 +59,7 @@ const formSchema = z
.object({
inputs: z.discriminatedUnion("credentialType", [
z.object({
url: z.string().url().trim().min(1),
url: z.string().trim().optional(),
clusterToken: z.string().trim().optional(),
ca: z.string().optional(),
sslEnabled: z.boolean().default(false),
@@ -78,7 +78,7 @@ const formSchema = z
authMethod: z.nativeEnum(AuthMethod).default(AuthMethod.Api)
}),
z.object({
url: z.string().url().trim().min(1),
url: z.string().trim().optional(),
clusterToken: z.string().trim().optional(),
ca: z.string().optional(),
sslEnabled: z.boolean().default(false),
@@ -127,12 +127,21 @@ const formSchema = z
message: "When auth method is set to Gateway, a gateway must be selected"
});
}
if (data.inputs.authMethod === AuthMethod.Api && !data.inputs.clusterToken) {
ctx.addIssue({
path: ["inputs.clusterToken"],
code: z.ZodIssueCode.custom,
message: "When auth method is set to Token, a cluster token must be provided"
});
if (data.inputs.authMethod === AuthMethod.Api) {
if (!data.inputs.clusterToken) {
ctx.addIssue({
path: ["inputs.clusterToken"],
code: z.ZodIssueCode.custom,
message: "When auth method is set to Token, a cluster token must be provided"
});
}
if (!data.inputs.url) {
ctx.addIssue({
path: ["inputs.url"],
code: z.ZodIssueCode.custom,
message: "When auth method is set to Token, a cluster URL must be provided"
});
}
}
});
@@ -342,70 +351,6 @@ export const EditDynamicSecretKubernetesForm = ({
)}
</OrgPermissionCan>
</div>
<Controller
control={control}
name="inputs.url"
render={({ field, fieldState: { error } }) => (
<FormControl
label="Cluster URL"
isError={Boolean(error?.message)}
errorText={error?.message}
>
<Input {...field} />
</FormControl>
)}
/>
<div className="mb-2 flex items-center">
<span className="mr-3 flex items-center text-sm text-mineshaft-400">
Enable SSL
<Tooltip
className="ml-1 max-w-md"
content={
<span>
If enabled, you can optionally provide a custom CA certificate. Leave
blank to use the system/public CA.
</span>
}
>
<FontAwesomeIcon icon={faQuestionCircle} size="sm" className="ml-1" />
</Tooltip>
</span>
<Controller
name="inputs.sslEnabled"
control={control}
render={({ field: { value, onChange } }) => (
<Switch
className="bg-mineshaft-400/50 shadow-inner data-[state=checked]:bg-green/80"
id="ssl-enabled"
thumbClassName="bg-mineshaft-800"
isChecked={value}
onCheckedChange={onChange}
aria-label="Enable SSL"
/>
)}
/>
</div>
<Controller
control={control}
name="inputs.ca"
render={({ field, fieldState: { error } }) => (
<FormControl
label="CA"
isError={Boolean(error?.message)}
errorText={error?.message}
className={sslEnabled ? "" : "opacity-50"}
>
<TextArea
{...field}
placeholder="-----BEGIN CERTIFICATE----- ..."
isDisabled={!sslEnabled}
/>
</FormControl>
)}
/>
<Controller
control={control}
name="inputs.authMethod"
@@ -430,6 +375,73 @@ export const EditDynamicSecretKubernetesForm = ({
</FormControl>
)}
/>
{authMethod === AuthMethod.Api && (
<>
<Controller
control={control}
name="inputs.url"
render={({ field, fieldState: { error } }) => (
<FormControl
label="Cluster URL"
isError={Boolean(error?.message)}
errorText={error?.message}
>
<Input {...field} />
</FormControl>
)}
/>
<div className="mb-2 flex items-center">
<span className="mr-3 flex items-center text-sm text-mineshaft-400">
Enable SSL
<Tooltip
className="ml-1 max-w-md"
content={
<span>
If enabled, you can optionally provide a custom CA certificate.
Leave blank to use the system/public CA.
</span>
}
>
<FontAwesomeIcon icon={faQuestionCircle} size="sm" className="ml-1" />
</Tooltip>
</span>
<Controller
name="inputs.sslEnabled"
control={control}
render={({ field: { value, onChange } }) => (
<Switch
className="bg-mineshaft-400/50 shadow-inner data-[state=checked]:bg-green/80"
id="ssl-enabled"
thumbClassName="bg-mineshaft-800"
isChecked={value}
onCheckedChange={onChange}
aria-label="Enable SSL"
/>
)}
/>
</div>
<Controller
control={control}
name="inputs.ca"
render={({ field, fieldState: { error } }) => (
<FormControl
label="CA"
isError={Boolean(error?.message)}
errorText={error?.message}
className={sslEnabled ? "" : "opacity-50"}
>
<TextArea
{...field}
placeholder="-----BEGIN CERTIFICATE----- ..."
isDisabled={!sslEnabled}
/>
</FormControl>
)}
/>
</>
)}
{authMethod === AuthMethod.Api && (
<Controller
control={control}