diff --git a/docs/infisical-agent/overview.mdx b/docs/infisical-agent/overview.mdx index db245f605..cd279e005 100644 --- a/docs/infisical-agent/overview.mdx +++ b/docs/infisical-agent/overview.mdx @@ -12,37 +12,51 @@ It eliminates the need to modify application logic by enabling clients to decide - Templating: Renders secrets via user provided templates to desired formats for applications to consume ### Token renewal +The Infisical agent can help manage the life cycle of access tokens. The token renewal process is split into two main components: a Method, which is the authentication process suitable for your current setup, and Sinks, which are the places where the agent deposits the new access token whenever it receives updates. + +When the Infisical Agent is started, it will attempts to obtain a valid access token using the authentication method you have configured. If the agent is unable to fetch a valid token, the agent will keep trying, increasing the time between each attempt. + +Once a access token is successfully fetched, the agent will make sure the access token stays valid, continuing to renew it before it expires. + +Every time the agent successfully retrieves a new access token, it writes the new token to the Sinks you've configured. + + + Access tokens can be utilized with Infisical SDKs or directly in API requests to retrieve secrets from Infisical + ### Templating +The Infisical agent can help deliver formatted secrets to your application in a variety of environments. To achieve this, the agent will retrieve secrets from Infisical, format them using a specified template, and then save these formatted secrets to a designated file path. -### Configuration +Templating process is done through the use of Go language's [text/template feature](https://pkg.go.dev/text/template). Multiple template definitions can be set in the agent configuration file to generate a variety of formatted secret files. + +When the agent is started and templates are defined in the agent configuration file, the agent will attempt to acquire a valid access token using the set authentication method outlined in the agent's configuration. +If this initial attempt is unsuccessful, the agent will momentarily pauses before continuing to make more attempts. + +Once the agent successfully obtains a valid access token, the agent proceeds to fetch the secrets from Infisical using it. +It then formats these secrets using the user provided templates and writes the formatted data to configured file paths. + +## Agent configuration file + +To set up the authentication method for token renewal and to define secret templates, the Infisical agent requires a YAML configuration file containing properties defined below. +While specifying an authentication method is mandatory to start the agent, configuring sinks and secret templates are optional. | Field | Description | | ---------------------------- | ----------- | | `infisical.address` | The URL of the Infisical service. Default: `"https://app.infisical.com"`. | -| `auth.type` | The type of authentication method used. | +| `auth.type` | The type of authentication method used. Only `"token"` type is currently available | | `auth.config.token-path` | The file path where the initial token for authentication is stored. | -| `sinks[].type` | The type of sink in a list of sinks. Each item specifies a sink type, default is `"file"`. | -| `sinks[].config.path` | The file path where the token is stored for each sink in the list. Default: `"/some/path/to/store/token/toke-name"`. | -| `templates[].source-path` | The path to the source template file in a list of templates. Default: `/some/path/template-name`. | -| `templates[].destination-path` | The path where the output file from the template will be saved in a list of templates. Default: `/some/path/output-file-name`. | +| `sinks[].type` | The type of sink in a list of sinks. Each item specifies a sink type. Currently, only `"file"` type is available. | +| `sinks[].config.path` | The file path where the access token should be stored for each sink in the list. | +| `templates[].source-path` | The path to the template file that should be used to render secrets. | +| `templates[].destination-path` | The path where the rendered secrets from the source template will be saved to. | ## Quick start Infisical Agent +To install the Infisical agent, you must first install the [Infisical CLI](../cli/overview) in the desired environment where you'd like the agent to run. This is because the Infisical agent is a sub-command of the Infisical CLI. -```bash -infisical agent --config agent-config-file.yaml -``` +Once you have the CLI installed, you will need to create a agent configuration file in yaml. -```text secret-template-file -{{- with secret "6553ccb2b7da580d7f6e7260" "dev" "/" }} -{{- range . }} -{{ .Key }}={{ .Value }} -{{- end }} -{{- end }} -``` - -```yaml agent-config-file.yaml +```yaml example-agent-config-file.yaml infisical: address: "https://app.infisical.com" auth: @@ -54,6 +68,26 @@ sinks: config: path: "/some/path/to/store/token/toke-name" templates: - - source-path: /some/path/template-name - destination-path: /some/path/output-file-name -``` \ No newline at end of file + - source-path: my-dot-ev-secret-template + destination-path: /some/path/.env +``` + +Above is an example agent configuration file that defines the token authentication method, one sink location (where to deposit access tokens after renewal) and a secret template. + + +```text my-dot-ev-secret-template +{{- with secret "6553ccb2b7da580d7f6e7260" "dev" "/" }} +{{- range . }} +{{ .Key }}={{ .Value }} +{{- end }} +{{- end }} +``` + +The secret template above will be used to render the secrets where the key and the value are separated by `=` sign. You'll notice that a custom function named `secret` is used to fetch the secrets. +This function takes the following arguments: `secret "" "" ""`. + +```bash +infisical agent --config example-agent-config-file.yaml +``` + +After defining the agent configuration file, run the command above pointing to the path where the agent configuration is located. \ No newline at end of file