mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-10-06 15:27:27 +00:00
Merge remote-tracking branch 'origin/main' into feat/azurePkiConnector
This commit is contained in:
Carlos Monastyrski
@@ -25,6 +25,11 @@ This functionality works in the following way:
|
||||
{/*  */}
|
||||
|
||||
|
||||
<Note>
|
||||
Optionally, approvers can edit the duration of an access request to reduce how long access will be granted by clicking the **Edit** icon next to the duration.
|
||||
|
||||
</Note>
|
||||
|
||||
<Info>
|
||||
If the access request matches with a policy that allows break-glass approval
|
||||
bypasses, the requester may bypass the policy and get access to the resource
|
||||
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 638 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 618 KiB After Width: | Height: | Size: 592 KiB |
@@ -27,22 +27,73 @@ $ ansible-galaxy collection install infisical.vault
|
||||
The python module dependencies are not installed by ansible-galaxy. They can be manually installed using pip:
|
||||
|
||||
```bash
|
||||
$ pip install infisical-python
|
||||
$ pip install infisicalsdk
|
||||
```
|
||||
|
||||
## Using this collection
|
||||
|
||||
You can either call modules by their Fully Qualified Collection Name (FQCN), such as `infisical.vault.read_secrets`, or you can call modules by their short name if you list the `infisical.vault` collection in the playbook's collections keyword:
|
||||
|
||||
### Authentication
|
||||
|
||||
```bash
|
||||
The Infisical Ansible Collection supports [Universal Auth](/documentation/platform/identities/universal-auth) and [OIDC](/documentation/platform/identities/oidc-auth/general) for authenticating against Infisical.
|
||||
|
||||
|
||||
<AccordionGroup>
|
||||
<Accordion title="Universal Auth">
|
||||
Using Universal Auth for authentication is the most straight-forward way to get started with using the Ansible collection.
|
||||
|
||||
To use Universal Auth, you need to provide the Client ID and Client Secret of your Infisical Machine Identity.
|
||||
|
||||
```yaml
|
||||
lookup('infisical.vault.read_secrets', auth_method="universal-auth", universal_auth_client_id='<client-id>', universal_auth_client_secret='<client-secret>' ...rest)
|
||||
```
|
||||
|
||||
You can also provide the `auth_method`, `universal_auth_client_id`, and `universal_auth_client_secret` parameters through environment variables:
|
||||
|
||||
| Parameter Name | Environment Variable Name |
|
||||
| ------------------------------ | ---------------------------------------- |
|
||||
| `auth_method` | `INFISICAL_AUTH_METHOD` |
|
||||
| `universal_auth_client_id` | `INFISICAL_UNIVERSAL_AUTH_CLIENT_ID` |
|
||||
| `universal_auth_client_secret` | `INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET` |
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="OIDC Auth">
|
||||
To use OIDC Auth, you'll need to provide the ID of your machine identity, and the OIDC JWT to be used for authentication.
|
||||
|
||||
<Note>
|
||||
Please note that in order to use OIDC Auth, you must have `1.0.10` or newer of the `infisicalsdk` package installed.
|
||||
</Note>
|
||||
|
||||
```yaml
|
||||
lookup('infisical.vault.read_secrets', auth_method="oidc-auth", identity_id='<identity-id>', jwt='<oidc-jwt>' ...rest)
|
||||
```
|
||||
You can also provide the `auth_method`, `identity_id`, and `jwt` parameters through environment variables:
|
||||
|
||||
| Parameter Name | Environment Variable Name |
|
||||
| --------------- | ------------------------- |
|
||||
| auth_method | `INFISICAL_AUTH_METHOD` |
|
||||
| identity_id | `INFISICAL_IDENTITY_ID` |
|
||||
| jwt | `INFISICAL_JWT` |
|
||||
|
||||
</Accordion>
|
||||
</AccordionGroup>
|
||||
|
||||
### Examples
|
||||
|
||||
```yaml
|
||||
---
|
||||
vars:
|
||||
read_all_secrets_within_scope: "{{ lookup('infisical.vault.read_secrets', universal_auth_client_id='<>', universal_auth_client_secret='<>', project_id='<>', path='/', env_slug='dev', url='https://spotify.infisical.com') }}"
|
||||
# [{ "key": "HOST", "value": "google.com" }, { "key": "SMTP", "value": "gmail.smtp.edu" }]
|
||||
|
||||
|
||||
read_all_secrets_as_dict: "{{ lookup('infisical.vault.read_secrets', as_dict=True, universal_auth_client_id='<>', universal_auth_client_secret='<>', project_id='<>', path='/', env_slug='dev', url='https://spotify.infisical.com') }}"
|
||||
# { "SECRET_KEY_1": "secret-value-1", "SECRET_KEY_2": "secret-value-2" } -> Can be accessed as secrets.SECRET_KEY_1
|
||||
|
||||
|
||||
read_secret_by_name_within_scope: "{{ lookup('infisical.vault.read_secrets', universal_auth_client_id='<>', universal_auth_client_secret='<>', project_id='<>', path='/', env_slug='dev', secret_name='HOST', url='https://spotify.infisical.com') }}"
|
||||
# [{ "key": "HOST", "value": "google.com" }]
|
||||
# { "key": "HOST", "value": "google.com" }
|
||||
```
|
||||
|
||||
|
||||
|
||||
@@ -6,32 +6,10 @@ description: "Learn how to use Infisical to inject environment variables into a
|
||||
This approach allows you to inject secrets from Infisical directly into your application.
|
||||
This is achieved by installing the Infisical CLI into your docker image and modifying your start command to execute with Infisical.
|
||||
|
||||
## Add the Infisical CLI to your Dockerfile
|
||||
## Install the Infisical CLI to your Dockerfile
|
||||
|
||||
<Tabs>
|
||||
<Tab title="Alpine">
|
||||
```dockerfile
|
||||
RUN apk add --no-cache bash curl && curl -1sLf \
|
||||
'https://dl.cloudsmith.io/public/infisical/infisical-cli/setup.alpine.sh' | bash \
|
||||
&& apk add infisical
|
||||
```
|
||||
To install the CLI, follow the instructions for your chosen distribution [here](/cli/overview).
|
||||
|
||||
</Tab>
|
||||
<Tab title="RedHat/CentOs/Amazon-linux">
|
||||
```dockerfile
|
||||
RUN curl -1sLf \
|
||||
'https://dl.cloudsmith.io/public/infisical/infisical-cli/setup.rpm.sh' | sh \
|
||||
&& yum install -y infisical
|
||||
```
|
||||
</Tab>
|
||||
<Tab title="Debian/Ubuntu">
|
||||
```dockerfile
|
||||
RUN apt-get update && apt-get install -y bash curl && curl -1sLf \
|
||||
'https://dl.cloudsmith.io/public/infisical/infisical-cli/setup.deb.sh' | bash \
|
||||
&& apt-get update && apt-get install -y infisical
|
||||
```
|
||||
</Tab>
|
||||
</Tabs>
|
||||
####
|
||||
<Tip>
|
||||
We recommend you to set the version of the CLI to a specific version. This will help keep your CLI version consistent across reinstalls. [View versions](https://cloudsmith.io/~infisical/repos/infisical-cli/packages/)
|
||||
|
||||
@@ -37,6 +37,7 @@ description: "Learn how to configure a Checkly Sync for Infisical."
|
||||
|
||||
- **Checkly Connection**: The Checkly Connection to authenticate with.
|
||||
- **Account**: The Checkly account to sync secrets to.
|
||||
- **Group**: The Checkly check group to sync secrets to (Optional).
|
||||
</Step>
|
||||
<Step title="Configure Sync Options">
|
||||
Configure the **Sync Options** to specify how secrets should be synced, then click **Next**.
|
||||
|
||||
@@ -30,8 +30,9 @@ description: "Learn how to configure a Render Sync for Infisical."
|
||||
|
||||
|
||||
- **Render Connection**: The Render Connection to authenticate with.
|
||||
- **Scope**: Select **Service**.
|
||||
- **Service**: Choose the Render service you want to sync secrets to.
|
||||
- **Scope**: Select **Service** or **Environment Group**.
|
||||
- **Service**: Choose the Render service you want to sync secrets to.
|
||||
- **Environment Group**: Choose the Render environment group you want to sync secrets to.
|
||||
|
||||
5. Configure the **Sync Options** to specify how secrets should be synced, then click **Next**.
|
||||
|
||||
|
||||
Reference in New Issue
Block a user