From 984552eea9df7a926554234d4a79636fa10945c0 Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Wed, 7 May 2025 19:18:45 -0400 Subject: [PATCH] rephrase generator overview --- .../kubernetes/infisical-push-secret-crd.mdx | 41 ++++++++----------- 1 file changed, 18 insertions(+), 23 deletions(-) diff --git a/docs/integrations/platforms/kubernetes/infisical-push-secret-crd.mdx b/docs/integrations/platforms/kubernetes/infisical-push-secret-crd.mdx index f1912b847..d87648bbf 100644 --- a/docs/integrations/platforms/kubernetes/infisical-push-secret-crd.mdx +++ b/docs/integrations/platforms/kubernetes/infisical-push-secret-crd.mdx @@ -477,17 +477,26 @@ Using Go templates, you can format, combine, and create new key-value pairs of s ## Using generators to push secrets -Generators are a feature of the Infisical secrets operator that allows you to generate secrets on-reconcile and push them to Infisical. This is useful for secret rotation purposes, and fully operator-managed secrets. -A generator is a custom resource that is installed on the cluster that defines the logic for generating a secret. +Generators allow secrets to be dynamically generated during each reconciliation cycle and then pushed to Infisical. They are useful for use cases where a new secret value is needed on every sync, such as ephemeral credentials or one-time-use tokens. -Generators don't keep track of the secrets they generate, which means that on each reconciliation, a new value will be created and pushed. -For this reason you may want to disable automatic reconciliation of the InfisicalPushSecret CRD. You can do this by removing `resyncInterval` from the InfisicalPushSecret CRD. +A generator is defined as a custom resource (`ClusterGenerator`) within the cluster, which specifies the logic for generating secret values. Generators are stateless, each invocation triggers the creation of a new set of values, with no tracking or persistence of previously generated data. -**Supported generators**: -- `Password`: Generates a random password of string format. -- `UUID`: Generates a random v4 UUID. +Because of this behavior, you may want to disable automatic syncing for the `InfisicalPushSecret` resource to avoid continuous regeneration of secrets. This can be done by omitting the `resyncInterval` field from the InfisicalPushSecret CRD. -To use a generator, you must specify at least one generator in the `push.generators[]` field. An example of a generator usage can be seen here: +### Example usage +```yaml + push: + secret: + secretName: push-secret-source-secret + secretNamespace: dev + generators: + - destinationSecretName: password-generator # Name of the secret that will be created in Infisical + generatorRef: + kind: Password # Kind of the resource, must match the generator kind. + name: custom-generator # Name of the generator resource +``` + +To use a generator, you must specify at least one generator in the `push.generators[]` field. @@ -518,22 +527,8 @@ To use a generator, you must specify at least one generator in the `push.generat The name of the generator resource. - -```yaml - push: - secret: - secretName: push-secret-source-secret - secretNamespace: dev - generators: - - destinationSecretName: password-generator # Name of the secret that will be created in Infisical - generatorRef: - kind: Password|UUID # Kind of the resource, must match the generator kind. - name: custom-generator # Name of the generator resource -``` - - ### Supported Generators -Below are the currently supported generators for the InfisicalPushSecret CRD. Each generator has its own spec that can be used to customize the generated secret. +Below are the currently supported generators for the InfisicalPushSecret CRD. Each generator is a `ClusterGenerator` custom resource that can be used to customize the generated secret. ### Password Generator