mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-09-22 13:39:35 +00:00
Merge pull request #4703 from Infisical/daniel/helm-improvements
fix: self-hosting experience improvements
This commit is contained in:
Daniel Hougaard
57
.github/values.yaml
vendored
57
.github/values.yaml
vendored
@@ -1,57 +0,0 @@
|
||||
## @section Common parameters
|
||||
##
|
||||
|
||||
## @param nameOverride Override release name
|
||||
##
|
||||
nameOverride: ""
|
||||
## @param fullnameOverride Override release fullname
|
||||
##
|
||||
fullnameOverride: ""
|
||||
|
||||
## @section Infisical backend parameters
|
||||
## Documentation : https://infisical.com/docs/self-hosting/deployments/kubernetes
|
||||
##
|
||||
|
||||
infisical:
|
||||
autoDatabaseSchemaMigration: false
|
||||
|
||||
enabled: false
|
||||
|
||||
name: infisical
|
||||
replicaCount: 3
|
||||
image:
|
||||
repository: infisical/staging_infisical
|
||||
tag: "latest"
|
||||
pullPolicy: Always
|
||||
|
||||
deploymentAnnotations:
|
||||
secrets.infisical.com/auto-reload: "true"
|
||||
|
||||
kubeSecretRef: "managed-secret"
|
||||
|
||||
ingress:
|
||||
## @param ingress.enabled Enable ingress
|
||||
##
|
||||
enabled: true
|
||||
## @param ingress.ingressClassName Ingress class name
|
||||
##
|
||||
ingressClassName: nginx
|
||||
## @param ingress.nginx.enabled Ingress controller
|
||||
##
|
||||
# nginx:
|
||||
# enabled: true
|
||||
## @param ingress.annotations Ingress annotations
|
||||
##
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: "letsencrypt-prod"
|
||||
hostName: "gamma.infisical.com"
|
||||
tls:
|
||||
- secretName: letsencrypt-prod
|
||||
hosts:
|
||||
- gamma.infisical.com
|
||||
|
||||
postgresql:
|
||||
enabled: false
|
||||
|
||||
redis:
|
||||
enabled: false
|
||||
@@ -56,7 +56,7 @@ jobs:
|
||||
--config ct.yaml \
|
||||
--charts helm-charts/infisical-standalone-postgres \
|
||||
--helm-extra-args="--timeout=300s" \
|
||||
--helm-extra-set-args="--set ingress.nginx.enabled=false --set infisical.autoDatabaseSchemaMigration=false --set infisical.replicaCount=1 --set infisical.image.tag=v0.132.2-postgres" \
|
||||
--helm-extra-set-args="--set ingress.nginx.enabled=false --set infisical.replicaCount=1 --set infisical.image.tag=v0.151.0" \
|
||||
--namespace infisical-standalone-postgres
|
||||
|
||||
release:
|
||||
|
||||
@@ -66,5 +66,5 @@ jobs:
|
||||
--config ct.yaml \
|
||||
--charts helm-charts/infisical-standalone-postgres \
|
||||
--helm-extra-args="--timeout=300s" \
|
||||
--helm-extra-set-args="--set ingress.nginx.enabled=false --set infisical.autoDatabaseSchemaMigration=false --set infisical.replicaCount=1 --set infisical.image.tag=v0.132.2-postgres --set infisical.autoBootstrap.enabled=true" \
|
||||
--helm-extra-set-args="--set ingress.nginx.enabled=false --set infisical.replicaCount=1 --set infisical.image.tag=v0.151.0 --set infisical.autoBootstrap.enabled=true" \
|
||||
--namespace infisical-standalone-postgres
|
||||
|
||||
@@ -1428,7 +1428,7 @@ Enabling HSM encryption has a set of key benefits:
|
||||
infisical:
|
||||
image:
|
||||
repository: infisical/infisical
|
||||
tag: "v0.151.0-nightly-20251013.1"
|
||||
tag: "v0.151.0"
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
extraVolumeMounts:
|
||||
|
||||
@@ -116,6 +116,27 @@ The platform utilizes Postgres to persist all of its data and Redis for caching
|
||||
<ParamField query="DB_ROOT_CERT" type="string" default="" optional>
|
||||
Configure the SSL certificate for securing a Postgres connection by first encoding it in base64.
|
||||
Use the following command to encode your certificate: `echo "<certificate>" | base64`
|
||||
|
||||
Many cloud providers provide a CA certificate for their data regions that you can use to secure your connection with SSL.
|
||||
|
||||
<AccordionGroup>
|
||||
<Accordion title="AWS RDS">
|
||||
If you're hosting your database on AWS RDS, you can use their publicly available CA certificate as the database root certificate.
|
||||
|
||||
You can find all the available CA certificates for AWS RDS on the official [AWS RDS documentation](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html).
|
||||
|
||||
As an example, if your RDS cluster is hosted in `us-east-1` _(US East, N. Virginia)_, you can use the following root certificate: https://truststore.pki.rds.amazonaws.com/us-east-1/us-east-1-bundle.pem.
|
||||
|
||||
All the available CA certificates can be found in the AWS RDS documentation linked above.
|
||||
|
||||
Remember to base64 encode the certificate before setting it as the `DB_ROOT_CERT` environment variable. `cat /path/to/certificate.pem | base64`.
|
||||
|
||||
```bash
|
||||
DB_ROOT_CERT=LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1 # .... (base64 encoded certificate)
|
||||
DB_CONNECTION_URI=<rds-endpoint>?sslmode=verify-ca # or verify-full depending on your security policies
|
||||
```
|
||||
</Accordion>
|
||||
</AccordionGroup>
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="DB_READ_REPLICAS" type="string" default="" optional>
|
||||
|
||||
@@ -1,8 +1,10 @@
|
||||
---
|
||||
title: "Kubernetes via Helm Chart"
|
||||
description: "Learn how to use Helm chart to install Infisical on your Kubernetes cluster."
|
||||
---
|
||||
---
|
||||
|
||||
**Prerequisites**
|
||||
|
||||
- You have extensive understanding of [Kubernetes](https://kubernetes.io/)
|
||||
- Installed [Helm package manager](https://helm.sh/) version v3.11.3 or greater
|
||||
- You have [kubectl](https://kubernetes.io/docs/reference/kubectl/kubectl/) installed and connected to your kubernetes cluster
|
||||
@@ -12,7 +14,7 @@ description: "Learn how to use Helm chart to install Infisical on your Kubernete
|
||||
```bash
|
||||
helm repo add infisical-helm-charts 'https://dl.cloudsmith.io/public/infisical/helm-charts/helm/charts/'
|
||||
```
|
||||
```
|
||||
```bash
|
||||
helm repo update
|
||||
```
|
||||
</Step>
|
||||
@@ -61,6 +63,7 @@ description: "Learn how to use Helm chart to install Infisical on your Kubernete
|
||||
</Tab>
|
||||
<Tab title="Production deployment">
|
||||
For production environments, we recommend using Cloud-based Platform as a Service (PaaS) solutions for PostgreSQL and Redis to ensure high availability. In on-premise setups, it's recommended to configure Redis and Postgres for high availability, either by using Bitnami charts or a custom configuration.
|
||||
|
||||
```yaml simple-values-example.yaml
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
@@ -74,6 +77,10 @@ description: "Learn how to use Helm chart to install Infisical on your Kubernete
|
||||
DB_CONNECTION_URI: <>
|
||||
SITE_URL: <>
|
||||
```
|
||||
|
||||
<Tip>
|
||||
If you need to configure the SSL certificate for your production Postgres instance, you can use the `DB_ROOT_CERT` environment variable. [Learn more about configuring the SSL certificate](/self-hosting/configuration/envars#aws-rds).
|
||||
</Tip>
|
||||
</Tab>
|
||||
</Tabs>
|
||||
</Step>
|
||||
|
||||
@@ -1,3 +1,8 @@
|
||||
## 1.7.2 (October 20, 2025)
|
||||
Changes:
|
||||
* Updated the default `infisical.image.tag` value to `v0.151.0`.
|
||||
* `autoDatabaseSchemaMigration` has been fully removed as all newer versions of Infisical automatically run migrations as apart of the startup process.
|
||||
|
||||
## 1.7.1 (October 10, 2025)
|
||||
|
||||
Changes:
|
||||
|
||||
@@ -9,4 +9,4 @@ dependencies:
|
||||
repository: oci://registry-1.docker.io/bitnamicharts
|
||||
version: 18.14.1
|
||||
digest: sha256:57a18fb5258fc153d27b633f6570104c7628af651f08f3ae7e1cf8920c2c31fa
|
||||
generated: "2025-09-30T18:44:50.303037+04:00"
|
||||
generated: "2025-10-21T22:30:21.313884+04:00"
|
||||
|
||||
@@ -7,7 +7,7 @@ type: application
|
||||
# This is the chart version. This version number should be incremented each time you make changes
|
||||
# to the chart and its templates, including the app version.
|
||||
# Versions are expected to follow Semantic Versioning (https://semver.org/)
|
||||
version: 1.7.1
|
||||
version: 1.7.2
|
||||
|
||||
# This is the version number of the application being deployed. This version number should be
|
||||
# incremented each time you make changes to the application. Versions are not expected to
|
||||
|
||||
@@ -18,7 +18,6 @@ A helm chart to deploy Infisical
|
||||
|-----|------|---------|-------------|
|
||||
| fullnameOverride | string | `""` | Overrides the full name of the release, affecting resource names |
|
||||
| infisical.affinity | object | `{}` | Node affinity settings for pod placement |
|
||||
| infisical.autoDatabaseSchemaMigration | bool | `true` | Automatically migrates new database schema when deploying |
|
||||
| infisical.databaseSchemaMigrationJob.image.pullPolicy | string | `"IfNotPresent"` | Pulls image only if not present on the node |
|
||||
| infisical.databaseSchemaMigrationJob.image.repository | string | `"ghcr.io/groundnuty/k8s-wait-for"` | Image repository for migration wait job |
|
||||
| infisical.databaseSchemaMigrationJob.image.tag | string | `"no-root-v2.0"` | Image tag version |
|
||||
|
||||
@@ -44,16 +44,6 @@ spec:
|
||||
{{- if $infisicalValues.image.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml $infisicalValues.image.imagePullSecrets | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if $infisicalValues.autoDatabaseSchemaMigration }}
|
||||
serviceAccountName: {{ include "infisical.serviceAccountName" . }}
|
||||
initContainers:
|
||||
- name: "migration-init"
|
||||
image: "{{ $infisicalValues.databaseSchemaMigrationJob.image.repository }}:{{ $infisicalValues.databaseSchemaMigrationJob.image.tag }}"
|
||||
imagePullPolicy: {{ $infisicalValues.databaseSchemaMigrationJob.image.pullPolicy }}
|
||||
args:
|
||||
- "job"
|
||||
- "{{ .Release.Name }}-schema-migration-{{ .Release.Revision }}"
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: {{ template "infisical.name" . }}-{{ $infisicalValues.name }}
|
||||
|
||||
@@ -1,52 +0,0 @@
|
||||
{{- $infisicalValues := .Values.infisical }}
|
||||
{{- if $infisicalValues.autoDatabaseSchemaMigration }}
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: "{{ .Release.Name }}-schema-migration-{{ .Release.Revision }}"
|
||||
labels:
|
||||
helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
|
||||
spec:
|
||||
backoffLimit: 10
|
||||
template:
|
||||
metadata:
|
||||
name: "{{ .Release.Name }}-create-tables"
|
||||
labels:
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name | quote }}
|
||||
helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
|
||||
spec:
|
||||
serviceAccountName: {{ include "infisical.serviceAccountName" . }}
|
||||
{{- if $infisicalValues.image.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml $infisicalValues.image.imagePullSecrets | nindent 6 }}
|
||||
{{- end }}
|
||||
restartPolicy: OnFailure
|
||||
containers:
|
||||
- name: infisical-schema-migration
|
||||
image: "{{ $infisicalValues.image.repository }}:{{ $infisicalValues.image.tag }}"
|
||||
command: ["npm", "run", "migration:latest"]
|
||||
env:
|
||||
{{- if .Values.postgresql.useExistingPostgresSecret.enabled }}
|
||||
- name: DB_CONNECTION_URI
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Values.postgresql.useExistingPostgresSecret.existingConnectionStringSecret.name }}
|
||||
key: {{ .Values.postgresql.useExistingPostgresSecret.existingConnectionStringSecret.key }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.enabled }}
|
||||
- name: DB_CONNECTION_URI
|
||||
value: {{ include "infisical.postgresDBConnectionString" . }}
|
||||
{{- end }}
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: {{ $infisicalValues.kubeSecretRef }}
|
||||
{{- with $infisicalValues.extraVolumeMounts }}
|
||||
volumeMounts:
|
||||
{{- toYaml . | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- with $infisicalValues.extraVolumes }}
|
||||
volumes:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -10,9 +10,6 @@ infisical:
|
||||
# -- Sets the name of the deployment within this chart
|
||||
name: infisical
|
||||
|
||||
# -- Automatically migrates new database schema when deploying
|
||||
autoDatabaseSchemaMigration: true
|
||||
|
||||
autoBootstrap:
|
||||
# -- Enable auto-bootstrap of the Infisical instance
|
||||
enabled: false
|
||||
@@ -68,7 +65,7 @@ infisical:
|
||||
# -- Image repository for the Infisical service
|
||||
repository: infisical/infisical
|
||||
# -- Specific version tag of the Infisical image. View the latest version here https://hub.docker.com/r/infisical/infisical
|
||||
tag: "v0.93.1-postgres"
|
||||
tag: "v0.151.0"
|
||||
# -- Pulls image only if not already present on the node
|
||||
pullPolicy: IfNotPresent
|
||||
# -- Secret references for pulling the image, if needed
|
||||
@@ -118,8 +115,7 @@ ingress:
|
||||
# -- Custom annotations for ingress resource
|
||||
annotations: {}
|
||||
# -- TLS settings for HTTPS access
|
||||
tls:
|
||||
[]
|
||||
tls: []
|
||||
# -- TLS secret name for HTTPS
|
||||
# - secretName: letsencrypt-prod
|
||||
# -- Domain name to associate with the TLS certificate
|
||||
|
||||
Reference in New Issue
Block a user