awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-07 12:27:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

rephrase generator overview

Browse Source
This commit is contained in:
Maidul Islam
2025-05-07 19:18:45 -04:00
parent 2f4efad8ae
commit 984552eea9
1 changed files with 18 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/integrations/platforms/kubernetes/infisical-push-secret-crd.mdx
+18 -23
View File
@@ -477,17 +477,26 @@ Using Go templates, you can format, combine, and create new key-value pairs of s
## Using generators to push secrets ## Using generators to push secrets
Generators are a feature of the Infisical secrets operator that allows you to generate secrets on-reconcile and push them to Infisical. This is useful for secret rotation purposes, and fully operator-managed secrets. Generators allow secrets to be dynamically generated during each reconciliation cycle and then pushed to Infisical. They are useful for use cases where a new secret value is needed on every sync, such as ephemeral credentials or one-time-use tokens.
A generator is a custom resource that is installed on the cluster that defines the logic for generating a secret.
Generators don't keep track of the secrets they generate, which means that on each reconciliation, a new value will be created and pushed. A generator is defined as a custom resource (`ClusterGenerator`) within the cluster, which specifies the logic for generating secret values. Generators are stateless, each invocation triggers the creation of a new set of values, with no tracking or persistence of previously generated data.
For this reason you may want to disable automatic reconciliation of the InfisicalPushSecret CRD. You can do this by removing `resyncInterval` from the InfisicalPushSecret CRD.
**Supported generators**: Because of this behavior, you may want to disable automatic syncing for the `InfisicalPushSecret` resource to avoid continuous regeneration of secrets. This can be done by omitting the `resyncInterval` field from the InfisicalPushSecret CRD.
- `Password`: Generates a random password of string format.
- `UUID`: Generates a random v4 UUID.
To use a generator, you must specify at least one generator in the `push.generators[]` field. An example of a generator usage can be seen here: ### Example usage
```yaml
push:
secret:
secretName: push-secret-source-secret
secretNamespace: dev
generators:
- destinationSecretName: password-generator # Name of the secret that will be created in Infisical
generatorRef:
kind: Password # Kind of the resource, must match the generator kind.
name: custom-generator # Name of the generator resource
```
To use a generator, you must specify at least one generator in the `push.generators[]` field.
<Accordion title="push.generators[]"> <Accordion title="push.generators[]">
@@ -518,22 +527,8 @@ To use a generator, you must specify at least one generator in the `push.generat
The name of the generator resource. The name of the generator resource.
</Accordion> </Accordion>
```yaml
push:
secret:
secretName: push-secret-source-secret
secretNamespace: dev
generators:
- destinationSecretName: password-generator # Name of the secret that will be created in Infisical
generatorRef:
kind: Password|UUID # Kind of the resource, must match the generator kind.
name: custom-generator # Name of the generator resource
```
### Supported Generators ### Supported Generators
Below are the currently supported generators for the InfisicalPushSecret CRD. Each generator has its own spec that can be used to customize the generated secret. Below are the currently supported generators for the InfisicalPushSecret CRD. Each generator is a `ClusterGenerator` custom resource that can be used to customize the generated secret.
<Accordion title="Password Generator"> <Accordion title="Password Generator">
### Password Generator ### Password Generator