From 00b2a6bafc8dd8ff8994f031eb5edcb8dc92c316 Mon Sep 17 00:00:00 2001 From: Daniel Hougaard Date: Mon, 20 Oct 2025 15:51:26 +0400 Subject: [PATCH 1/8] docs: better postgres SSL docs --- docs/self-hosting/configuration/envars.mdx | 21 +++++++++++++++++++ .../deployment-options/kubernetes-helm.mdx | 11 ++++++++-- 2 files changed, 30 insertions(+), 2 deletions(-) diff --git a/docs/self-hosting/configuration/envars.mdx b/docs/self-hosting/configuration/envars.mdx index 551c79184..edebf1670 100644 --- a/docs/self-hosting/configuration/envars.mdx +++ b/docs/self-hosting/configuration/envars.mdx @@ -116,6 +116,27 @@ The platform utilizes Postgres to persist all of its data and Redis for caching Configure the SSL certificate for securing a Postgres connection by first encoding it in base64. Use the following command to encode your certificate: `echo "" | base64` + + Many cloud providers provide a CA certificate for their data regions that you can use to secure your connection with SSL. + + + + If you're hosting your database on AWS RDS, you can use their publicly available CA certificate as the database root certificate. + + You can find all the available CA certificates for AWS RDS on the official [AWS RDS documentation](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html). + + As an example, if your RDS cluster is hosted in `us-east-1` _(US East, N. Virginia)_, you can use the following root certificate: https://truststore.pki.rds.amazonaws.com/us-east-1/us-east-1-bundle.pem. + + All the available CA certificates can be found in the AWS RDS documentation linked above. + + Remember to base64 encode the certificate before setting it as the `DB_ROOT_CERT` environment variable. `cat /path/to/certificate.pem | base64`. + + ```bash + DB_ROOT_CERT=LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1 # .... (base64 encoded certificate) + DB_CONNECTION_URI=?sslmode=verify-ca # or verify-full depending on your security policies + ``` + + diff --git a/docs/self-hosting/deployment-options/kubernetes-helm.mdx b/docs/self-hosting/deployment-options/kubernetes-helm.mdx index f8a2a6864..f4ef67e1e 100644 --- a/docs/self-hosting/deployment-options/kubernetes-helm.mdx +++ b/docs/self-hosting/deployment-options/kubernetes-helm.mdx @@ -1,8 +1,10 @@ --- title: "Kubernetes via Helm Chart" description: "Learn how to use Helm chart to install Infisical on your Kubernetes cluster." ---- +--- + **Prerequisites** + - You have extensive understanding of [Kubernetes](https://kubernetes.io/) - Installed [Helm package manager](https://helm.sh/) version v3.11.3 or greater - You have [kubectl](https://kubernetes.io/docs/reference/kubectl/kubectl/) installed and connected to your kubernetes cluster @@ -12,7 +14,7 @@ description: "Learn how to use Helm chart to install Infisical on your Kubernete ```bash helm repo add infisical-helm-charts 'https://dl.cloudsmith.io/public/infisical/helm-charts/helm/charts/' ``` - ``` + ```bash helm repo update ``` @@ -61,6 +63,7 @@ description: "Learn how to use Helm chart to install Infisical on your Kubernete For production environments, we recommend using Cloud-based Platform as a Service (PaaS) solutions for PostgreSQL and Redis to ensure high availability. In on-premise setups, it's recommended to configure Redis and Postgres for high availability, either by using Bitnami charts or a custom configuration. + ```yaml simple-values-example.yaml apiVersion: v1 kind: Secret @@ -74,6 +77,10 @@ description: "Learn how to use Helm chart to install Infisical on your Kubernete DB_CONNECTION_URI: <> SITE_URL: <> ``` + + + If you need to configure the SSL certificate for your production Postgres instance, you can use the `DB_ROOT_CERT` environment variable. [Learn more about configuring the SSL certificate](/self-hosting/configuration/envars#aws-rds). + From bf37ad958a51dd593523c6c811012c665a3f3285 Mon Sep 17 00:00:00 2001 From: Daniel Hougaard Date: Mon, 20 Oct 2025 15:54:51 +0400 Subject: [PATCH 2/8] feat(helm/infisical-core): auto-reload --- helm-charts/infisical-standalone-postgres/CHANGELOG.md | 5 +++++ helm-charts/infisical-standalone-postgres/Chart.lock | 7 +++++-- helm-charts/infisical-standalone-postgres/Chart.yaml | 6 +++++- .../infisical-standalone-postgres/templates/infisical.yaml | 3 +++ .../templates/schema-migration-job.yaml | 4 ++++ helm-charts/infisical-standalone-postgres/values.yaml | 7 +++++-- 6 files changed, 27 insertions(+), 5 deletions(-) diff --git a/helm-charts/infisical-standalone-postgres/CHANGELOG.md b/helm-charts/infisical-standalone-postgres/CHANGELOG.md index f94f80073..ac6906de3 100644 --- a/helm-charts/infisical-standalone-postgres/CHANGELOG.md +++ b/helm-charts/infisical-standalone-postgres/CHANGELOG.md @@ -1,3 +1,8 @@ +## 1.7.2 (October 20, 2025) +Changes: +* Added automatic reloading support for the Infisical deployment when the `infisical.kubeSecretRef` kubernetes secret changes. + * Configurable by `reloader.enabled: true|false`. Defaults to `true`. + ## 1.7.1 (October 10, 2025) Changes: diff --git a/helm-charts/infisical-standalone-postgres/Chart.lock b/helm-charts/infisical-standalone-postgres/Chart.lock index 993acf0a9..ef1f9371b 100644 --- a/helm-charts/infisical-standalone-postgres/Chart.lock +++ b/helm-charts/infisical-standalone-postgres/Chart.lock @@ -8,5 +8,8 @@ dependencies: - name: redis repository: oci://registry-1.docker.io/bitnamicharts version: 18.14.1 -digest: sha256:57a18fb5258fc153d27b633f6570104c7628af651f08f3ae7e1cf8920c2c31fa -generated: "2025-09-30T18:44:50.303037+04:00" +- name: reloader + repository: https://stakater.github.io/stakater-charts + version: 2.2.3 +digest: sha256:cdaf2a4056a24633b7bbcafb72c8c6fd1c0e8d75a9ceb016917906f83db1e6b0 +generated: "2025-10-20T13:56:11.25867+04:00" diff --git a/helm-charts/infisical-standalone-postgres/Chart.yaml b/helm-charts/infisical-standalone-postgres/Chart.yaml index e7069532f..543043843 100644 --- a/helm-charts/infisical-standalone-postgres/Chart.yaml +++ b/helm-charts/infisical-standalone-postgres/Chart.yaml @@ -7,7 +7,7 @@ type: application # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. # Versions are expected to follow Semantic Versioning (https://semver.org/) -version: 1.7.1 +version: 1.7.2 # This is the version number of the application being deployed. This version number should be # incremented each time you make changes to the application. Versions are not expected to @@ -28,3 +28,7 @@ dependencies: version: 18.14.1 repository: oci://registry-1.docker.io/bitnamicharts condition: redis.enabled + - name: reloader + version: 2.2.3 + repository: https://stakater.github.io/stakater-charts + condition: reloader.enabled diff --git a/helm-charts/infisical-standalone-postgres/templates/infisical.yaml b/helm-charts/infisical-standalone-postgres/templates/infisical.yaml index 11ebb8f3d..49e7626dd 100644 --- a/helm-charts/infisical-standalone-postgres/templates/infisical.yaml +++ b/helm-charts/infisical-standalone-postgres/templates/infisical.yaml @@ -4,6 +4,9 @@ kind: Deployment metadata: name: {{ include "infisical.fullname" . }} annotations: + {{- if .Values.reloader.enabled }} + secret.reloader.stakater.com/reload: {{ $infisicalValues.kubeSecretRef }} + {{- end }} updatedAt: {{ now | date "2006-01-01 MST 15:04:05" | quote }} {{- with $infisicalValues.deploymentAnnotations }} {{- toYaml . | nindent 4 }} diff --git a/helm-charts/infisical-standalone-postgres/templates/schema-migration-job.yaml b/helm-charts/infisical-standalone-postgres/templates/schema-migration-job.yaml index 8280b98a3..a887ae37b 100644 --- a/helm-charts/infisical-standalone-postgres/templates/schema-migration-job.yaml +++ b/helm-charts/infisical-standalone-postgres/templates/schema-migration-job.yaml @@ -15,6 +15,10 @@ spec: app.kubernetes.io/managed-by: {{ .Release.Service | quote }} app.kubernetes.io/instance: {{ .Release.Name | quote }} helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + {{- if .Values.reloader.enabled }} + annotations: + secret.reloader.stakater.com/reload: {{ $infisicalValues.kubeSecretRef }} + {{- end }} spec: serviceAccountName: {{ include "infisical.serviceAccountName" . }} {{- if $infisicalValues.image.imagePullSecrets }} diff --git a/helm-charts/infisical-standalone-postgres/values.yaml b/helm-charts/infisical-standalone-postgres/values.yaml index 078c84e78..770b4f5b8 100644 --- a/helm-charts/infisical-standalone-postgres/values.yaml +++ b/helm-charts/infisical-standalone-postgres/values.yaml @@ -118,8 +118,7 @@ ingress: # -- Custom annotations for ingress resource annotations: {} # -- TLS settings for HTTPS access - tls: - [] + tls: [] # -- TLS secret name for HTTPS # - secretName: letsencrypt-prod # -- Domain name to associate with the TLS certificate @@ -184,3 +183,7 @@ redis: # -- Redis deployment type (e.g., standalone or cluster) architecture: standalone + +# -- Reloader is used to reload the Infisical instance when the Kubernetes secret referenced by `infisical.kubeSecretRef` is updated +reloader: + enabled: true From ccaf4d78d1a22d06da3a05614aee39d0fd7b19b7 Mon Sep 17 00:00:00 2001 From: Daniel Hougaard Date: Mon, 20 Oct 2025 16:00:01 +0400 Subject: [PATCH 3/8] fix(doc): hsm versioning mismatch --- docs/documentation/platform/kms/hsm-integration.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/documentation/platform/kms/hsm-integration.mdx b/docs/documentation/platform/kms/hsm-integration.mdx index 45d883977..7a8d15fe5 100644 --- a/docs/documentation/platform/kms/hsm-integration.mdx +++ b/docs/documentation/platform/kms/hsm-integration.mdx @@ -1428,7 +1428,7 @@ Enabling HSM encryption has a set of key benefits: infisical: image: repository: infisical/infisical - tag: "v0.151.0-nightly-20251013.1" + tag: "v0.151.0" pullPolicy: IfNotPresent extraVolumeMounts: From 2b8e2d67ee897181694f926ef221276c553b1892 Mon Sep 17 00:00:00 2001 From: Daniel Hougaard Date: Mon, 20 Oct 2025 17:45:27 +0400 Subject: [PATCH 4/8] requested changes --- helm-charts/infisical-standalone-postgres/CHANGELOG.md | 2 +- helm-charts/infisical-standalone-postgres/Chart.yaml | 2 +- .../infisical-standalone-postgres/templates/infisical.yaml | 2 +- .../templates/schema-migration-job.yaml | 2 +- helm-charts/infisical-standalone-postgres/values.yaml | 7 +++---- 5 files changed, 7 insertions(+), 8 deletions(-) diff --git a/helm-charts/infisical-standalone-postgres/CHANGELOG.md b/helm-charts/infisical-standalone-postgres/CHANGELOG.md index ac6906de3..a0e7216e0 100644 --- a/helm-charts/infisical-standalone-postgres/CHANGELOG.md +++ b/helm-charts/infisical-standalone-postgres/CHANGELOG.md @@ -1,7 +1,7 @@ ## 1.7.2 (October 20, 2025) Changes: * Added automatic reloading support for the Infisical deployment when the `infisical.kubeSecretRef` kubernetes secret changes. - * Configurable by `reloader.enabled: true|false`. Defaults to `true`. + * Configurable by `infisical.redeployOnSecretChange: true|false`. Defaults to `true`. ## 1.7.1 (October 10, 2025) diff --git a/helm-charts/infisical-standalone-postgres/Chart.yaml b/helm-charts/infisical-standalone-postgres/Chart.yaml index 543043843..0d4381e72 100644 --- a/helm-charts/infisical-standalone-postgres/Chart.yaml +++ b/helm-charts/infisical-standalone-postgres/Chart.yaml @@ -31,4 +31,4 @@ dependencies: - name: reloader version: 2.2.3 repository: https://stakater.github.io/stakater-charts - condition: reloader.enabled + condition: infisical.redeployOnSecretChange diff --git a/helm-charts/infisical-standalone-postgres/templates/infisical.yaml b/helm-charts/infisical-standalone-postgres/templates/infisical.yaml index 49e7626dd..d4637866b 100644 --- a/helm-charts/infisical-standalone-postgres/templates/infisical.yaml +++ b/helm-charts/infisical-standalone-postgres/templates/infisical.yaml @@ -4,7 +4,7 @@ kind: Deployment metadata: name: {{ include "infisical.fullname" . }} annotations: - {{- if .Values.reloader.enabled }} + {{- if $infisicalValues.redeployOnSecretChange }} secret.reloader.stakater.com/reload: {{ $infisicalValues.kubeSecretRef }} {{- end }} updatedAt: {{ now | date "2006-01-01 MST 15:04:05" | quote }} diff --git a/helm-charts/infisical-standalone-postgres/templates/schema-migration-job.yaml b/helm-charts/infisical-standalone-postgres/templates/schema-migration-job.yaml index a887ae37b..c53c6e3d1 100644 --- a/helm-charts/infisical-standalone-postgres/templates/schema-migration-job.yaml +++ b/helm-charts/infisical-standalone-postgres/templates/schema-migration-job.yaml @@ -15,7 +15,7 @@ spec: app.kubernetes.io/managed-by: {{ .Release.Service | quote }} app.kubernetes.io/instance: {{ .Release.Name | quote }} helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" - {{- if .Values.reloader.enabled }} + {{- if $infisicalValues.redeployOnSecretChange }} annotations: secret.reloader.stakater.com/reload: {{ $infisicalValues.kubeSecretRef }} {{- end }} diff --git a/helm-charts/infisical-standalone-postgres/values.yaml b/helm-charts/infisical-standalone-postgres/values.yaml index 770b4f5b8..202a9008a 100644 --- a/helm-charts/infisical-standalone-postgres/values.yaml +++ b/helm-charts/infisical-standalone-postgres/values.yaml @@ -13,6 +13,9 @@ infisical: # -- Automatically migrates new database schema when deploying autoDatabaseSchemaMigration: true + # -- redeployOnSecretChange is used to reload the Infisical instance when the Kubernetes secret referenced by `infisical.kubeSecretRef` is updated + redeployOnSecretChange: true + autoBootstrap: # -- Enable auto-bootstrap of the Infisical instance enabled: false @@ -183,7 +186,3 @@ redis: # -- Redis deployment type (e.g., standalone or cluster) architecture: standalone - -# -- Reloader is used to reload the Infisical instance when the Kubernetes secret referenced by `infisical.kubeSecretRef` is updated -reloader: - enabled: true From 64df9872b301ae324abfff4b74ac8db46a7e79f1 Mon Sep 17 00:00:00 2001 From: Daniel Hougaard Date: Mon, 20 Oct 2025 21:04:49 +0400 Subject: [PATCH 5/8] Update run-helm-chart-tests-infisical-standalone-postgres.yml --- .../run-helm-chart-tests-infisical-standalone-postgres.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/run-helm-chart-tests-infisical-standalone-postgres.yml b/.github/workflows/run-helm-chart-tests-infisical-standalone-postgres.yml index d48562fc6..a7bb2c619 100644 --- a/.github/workflows/run-helm-chart-tests-infisical-standalone-postgres.yml +++ b/.github/workflows/run-helm-chart-tests-infisical-standalone-postgres.yml @@ -29,6 +29,7 @@ jobs: run: | helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx helm repo add bitnami https://charts.bitnami.com/bitnami + helm repo add stakater https://stakater.github.io/stakater-charts helm repo update - name: Set up chart-testing From 53563a5c3a836fa280073a21f3fded5e99b1b8e1 Mon Sep 17 00:00:00 2001 From: Daniel Hougaard Date: Mon, 20 Oct 2025 21:07:32 +0400 Subject: [PATCH 6/8] Update Chart.lock --- helm-charts/infisical-standalone-postgres/Chart.lock | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/helm-charts/infisical-standalone-postgres/Chart.lock b/helm-charts/infisical-standalone-postgres/Chart.lock index ef1f9371b..8e7a3004e 100644 --- a/helm-charts/infisical-standalone-postgres/Chart.lock +++ b/helm-charts/infisical-standalone-postgres/Chart.lock @@ -11,5 +11,5 @@ dependencies: - name: reloader repository: https://stakater.github.io/stakater-charts version: 2.2.3 -digest: sha256:cdaf2a4056a24633b7bbcafb72c8c6fd1c0e8d75a9ceb016917906f83db1e6b0 -generated: "2025-10-20T13:56:11.25867+04:00" +digest: sha256:ae7d9ff526de87e972fed0f9c8f32ca40af8cf8b24b59d814cf72beb66ee4198 +generated: "2025-10-20T21:07:19.162271+04:00" From 4dd343af11206c9b32ad2b9da84704072fa559cf Mon Sep 17 00:00:00 2001 From: Daniel Hougaard Date: Tue, 21 Oct 2025 22:27:20 +0400 Subject: [PATCH 7/8] removed reloader requested changes --- .github/values.yaml | 57 ------------------- .../workflows/helm-release-infisical-core.yml | 2 +- ...rt-tests-infisical-standalone-postgres.yml | 2 +- .../CHANGELOG.md | 4 +- .../infisical-standalone-postgres/Chart.lock | 7 +-- .../infisical-standalone-postgres/Chart.yaml | 4 -- .../infisical-standalone-postgres/README.md | 1 - .../templates/infisical.yaml | 13 ----- .../templates/schema-migration-job.yaml | 56 ------------------ .../infisical-standalone-postgres/values.yaml | 8 +-- 10 files changed, 8 insertions(+), 146 deletions(-) delete mode 100644 .github/values.yaml delete mode 100644 helm-charts/infisical-standalone-postgres/templates/schema-migration-job.yaml diff --git a/.github/values.yaml b/.github/values.yaml deleted file mode 100644 index 1b3ffd87a..000000000 --- a/.github/values.yaml +++ /dev/null @@ -1,57 +0,0 @@ -## @section Common parameters -## - -## @param nameOverride Override release name -## -nameOverride: "" -## @param fullnameOverride Override release fullname -## -fullnameOverride: "" - -## @section Infisical backend parameters -## Documentation : https://infisical.com/docs/self-hosting/deployments/kubernetes -## - -infisical: - autoDatabaseSchemaMigration: false - - enabled: false - - name: infisical - replicaCount: 3 - image: - repository: infisical/staging_infisical - tag: "latest" - pullPolicy: Always - - deploymentAnnotations: - secrets.infisical.com/auto-reload: "true" - - kubeSecretRef: "managed-secret" - -ingress: - ## @param ingress.enabled Enable ingress - ## - enabled: true - ## @param ingress.ingressClassName Ingress class name - ## - ingressClassName: nginx - ## @param ingress.nginx.enabled Ingress controller - ## - # nginx: - # enabled: true - ## @param ingress.annotations Ingress annotations - ## - annotations: - cert-manager.io/cluster-issuer: "letsencrypt-prod" - hostName: "gamma.infisical.com" - tls: - - secretName: letsencrypt-prod - hosts: - - gamma.infisical.com - -postgresql: - enabled: false - -redis: - enabled: false diff --git a/.github/workflows/helm-release-infisical-core.yml b/.github/workflows/helm-release-infisical-core.yml index 6c317cc27..49118a5ae 100644 --- a/.github/workflows/helm-release-infisical-core.yml +++ b/.github/workflows/helm-release-infisical-core.yml @@ -56,7 +56,7 @@ jobs: --config ct.yaml \ --charts helm-charts/infisical-standalone-postgres \ --helm-extra-args="--timeout=300s" \ - --helm-extra-set-args="--set ingress.nginx.enabled=false --set infisical.autoDatabaseSchemaMigration=false --set infisical.replicaCount=1 --set infisical.image.tag=v0.132.2-postgres" \ + --helm-extra-set-args="--set ingress.nginx.enabled=false --set infisical.replicaCount=1 --set infisical.image.tag=v0.151.0" \ --namespace infisical-standalone-postgres release: diff --git a/.github/workflows/run-helm-chart-tests-infisical-standalone-postgres.yml b/.github/workflows/run-helm-chart-tests-infisical-standalone-postgres.yml index a7bb2c619..2023de187 100644 --- a/.github/workflows/run-helm-chart-tests-infisical-standalone-postgres.yml +++ b/.github/workflows/run-helm-chart-tests-infisical-standalone-postgres.yml @@ -67,5 +67,5 @@ jobs: --config ct.yaml \ --charts helm-charts/infisical-standalone-postgres \ --helm-extra-args="--timeout=300s" \ - --helm-extra-set-args="--set ingress.nginx.enabled=false --set infisical.autoDatabaseSchemaMigration=false --set infisical.replicaCount=1 --set infisical.image.tag=v0.132.2-postgres --set infisical.autoBootstrap.enabled=true" \ + --helm-extra-set-args="--set ingress.nginx.enabled=false --set infisical.replicaCount=1 --set infisical.image.tag=v0.151.0 --set infisical.autoBootstrap.enabled=true" \ --namespace infisical-standalone-postgres diff --git a/helm-charts/infisical-standalone-postgres/CHANGELOG.md b/helm-charts/infisical-standalone-postgres/CHANGELOG.md index a0e7216e0..5298432d7 100644 --- a/helm-charts/infisical-standalone-postgres/CHANGELOG.md +++ b/helm-charts/infisical-standalone-postgres/CHANGELOG.md @@ -1,7 +1,9 @@ ## 1.7.2 (October 20, 2025) Changes: +* Updated the default `infisical.image.tag` value to `v0.151.0`. +* `autoDatabaseSchemaMigration` has been fully removed as all newer versions of Infisical automatically run migrations as apart of the startup process. * Added automatic reloading support for the Infisical deployment when the `infisical.kubeSecretRef` kubernetes secret changes. - * Configurable by `infisical.redeployOnSecretChange: true|false`. Defaults to `true`. + * Configurable by `infisical.redeployOnSecretChange: true|false`. Defaults to `false`. ## 1.7.1 (October 10, 2025) diff --git a/helm-charts/infisical-standalone-postgres/Chart.lock b/helm-charts/infisical-standalone-postgres/Chart.lock index 8e7a3004e..b8ae1fd3f 100644 --- a/helm-charts/infisical-standalone-postgres/Chart.lock +++ b/helm-charts/infisical-standalone-postgres/Chart.lock @@ -8,8 +8,5 @@ dependencies: - name: redis repository: oci://registry-1.docker.io/bitnamicharts version: 18.14.1 -- name: reloader - repository: https://stakater.github.io/stakater-charts - version: 2.2.3 -digest: sha256:ae7d9ff526de87e972fed0f9c8f32ca40af8cf8b24b59d814cf72beb66ee4198 -generated: "2025-10-20T21:07:19.162271+04:00" +digest: sha256:57a18fb5258fc153d27b633f6570104c7628af651f08f3ae7e1cf8920c2c31fa +generated: "2025-10-21T22:30:21.313884+04:00" diff --git a/helm-charts/infisical-standalone-postgres/Chart.yaml b/helm-charts/infisical-standalone-postgres/Chart.yaml index 0d4381e72..21f358626 100644 --- a/helm-charts/infisical-standalone-postgres/Chart.yaml +++ b/helm-charts/infisical-standalone-postgres/Chart.yaml @@ -28,7 +28,3 @@ dependencies: version: 18.14.1 repository: oci://registry-1.docker.io/bitnamicharts condition: redis.enabled - - name: reloader - version: 2.2.3 - repository: https://stakater.github.io/stakater-charts - condition: infisical.redeployOnSecretChange diff --git a/helm-charts/infisical-standalone-postgres/README.md b/helm-charts/infisical-standalone-postgres/README.md index cd0e18848..b266563e8 100644 --- a/helm-charts/infisical-standalone-postgres/README.md +++ b/helm-charts/infisical-standalone-postgres/README.md @@ -18,7 +18,6 @@ A helm chart to deploy Infisical |-----|------|---------|-------------| | fullnameOverride | string | `""` | Overrides the full name of the release, affecting resource names | | infisical.affinity | object | `{}` | Node affinity settings for pod placement | -| infisical.autoDatabaseSchemaMigration | bool | `true` | Automatically migrates new database schema when deploying | | infisical.databaseSchemaMigrationJob.image.pullPolicy | string | `"IfNotPresent"` | Pulls image only if not present on the node | | infisical.databaseSchemaMigrationJob.image.repository | string | `"ghcr.io/groundnuty/k8s-wait-for"` | Image repository for migration wait job | | infisical.databaseSchemaMigrationJob.image.tag | string | `"no-root-v2.0"` | Image tag version | diff --git a/helm-charts/infisical-standalone-postgres/templates/infisical.yaml b/helm-charts/infisical-standalone-postgres/templates/infisical.yaml index d4637866b..d13c51295 100644 --- a/helm-charts/infisical-standalone-postgres/templates/infisical.yaml +++ b/helm-charts/infisical-standalone-postgres/templates/infisical.yaml @@ -4,9 +4,6 @@ kind: Deployment metadata: name: {{ include "infisical.fullname" . }} annotations: - {{- if $infisicalValues.redeployOnSecretChange }} - secret.reloader.stakater.com/reload: {{ $infisicalValues.kubeSecretRef }} - {{- end }} updatedAt: {{ now | date "2006-01-01 MST 15:04:05" | quote }} {{- with $infisicalValues.deploymentAnnotations }} {{- toYaml . | nindent 4 }} @@ -47,16 +44,6 @@ spec: {{- if $infisicalValues.image.imagePullSecrets }} imagePullSecrets: {{- toYaml $infisicalValues.image.imagePullSecrets | nindent 6 }} - {{- end }} - {{- if $infisicalValues.autoDatabaseSchemaMigration }} - serviceAccountName: {{ include "infisical.serviceAccountName" . }} - initContainers: - - name: "migration-init" - image: "{{ $infisicalValues.databaseSchemaMigrationJob.image.repository }}:{{ $infisicalValues.databaseSchemaMigrationJob.image.tag }}" - imagePullPolicy: {{ $infisicalValues.databaseSchemaMigrationJob.image.pullPolicy }} - args: - - "job" - - "{{ .Release.Name }}-schema-migration-{{ .Release.Revision }}" {{- end }} containers: - name: {{ template "infisical.name" . }}-{{ $infisicalValues.name }} diff --git a/helm-charts/infisical-standalone-postgres/templates/schema-migration-job.yaml b/helm-charts/infisical-standalone-postgres/templates/schema-migration-job.yaml deleted file mode 100644 index c53c6e3d1..000000000 --- a/helm-charts/infisical-standalone-postgres/templates/schema-migration-job.yaml +++ /dev/null @@ -1,56 +0,0 @@ -{{- $infisicalValues := .Values.infisical }} -{{- if $infisicalValues.autoDatabaseSchemaMigration }} -apiVersion: batch/v1 -kind: Job -metadata: - name: "{{ .Release.Name }}-schema-migration-{{ .Release.Revision }}" - labels: - helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" -spec: - backoffLimit: 10 - template: - metadata: - name: "{{ .Release.Name }}-create-tables" - labels: - app.kubernetes.io/managed-by: {{ .Release.Service | quote }} - app.kubernetes.io/instance: {{ .Release.Name | quote }} - helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" - {{- if $infisicalValues.redeployOnSecretChange }} - annotations: - secret.reloader.stakater.com/reload: {{ $infisicalValues.kubeSecretRef }} - {{- end }} - spec: - serviceAccountName: {{ include "infisical.serviceAccountName" . }} - {{- if $infisicalValues.image.imagePullSecrets }} - imagePullSecrets: - {{- toYaml $infisicalValues.image.imagePullSecrets | nindent 6 }} - {{- end }} - restartPolicy: OnFailure - containers: - - name: infisical-schema-migration - image: "{{ $infisicalValues.image.repository }}:{{ $infisicalValues.image.tag }}" - command: ["npm", "run", "migration:latest"] - env: - {{- if .Values.postgresql.useExistingPostgresSecret.enabled }} - - name: DB_CONNECTION_URI - valueFrom: - secretKeyRef: - name: {{ .Values.postgresql.useExistingPostgresSecret.existingConnectionStringSecret.name }} - key: {{ .Values.postgresql.useExistingPostgresSecret.existingConnectionStringSecret.key }} - {{- end }} - {{- if .Values.postgresql.enabled }} - - name: DB_CONNECTION_URI - value: {{ include "infisical.postgresDBConnectionString" . }} - {{- end }} - envFrom: - - secretRef: - name: {{ $infisicalValues.kubeSecretRef }} - {{- with $infisicalValues.extraVolumeMounts }} - volumeMounts: - {{- toYaml . | nindent 10 }} - {{- end }} - {{- with $infisicalValues.extraVolumes }} - volumes: - {{- toYaml . | nindent 8 }} - {{- end }} -{{- end }} \ No newline at end of file diff --git a/helm-charts/infisical-standalone-postgres/values.yaml b/helm-charts/infisical-standalone-postgres/values.yaml index 202a9008a..e0a81d9e3 100644 --- a/helm-charts/infisical-standalone-postgres/values.yaml +++ b/helm-charts/infisical-standalone-postgres/values.yaml @@ -10,12 +10,6 @@ infisical: # -- Sets the name of the deployment within this chart name: infisical - # -- Automatically migrates new database schema when deploying - autoDatabaseSchemaMigration: true - - # -- redeployOnSecretChange is used to reload the Infisical instance when the Kubernetes secret referenced by `infisical.kubeSecretRef` is updated - redeployOnSecretChange: true - autoBootstrap: # -- Enable auto-bootstrap of the Infisical instance enabled: false @@ -71,7 +65,7 @@ infisical: # -- Image repository for the Infisical service repository: infisical/infisical # -- Specific version tag of the Infisical image. View the latest version here https://hub.docker.com/r/infisical/infisical - tag: "v0.93.1-postgres" + tag: "v0.151.0" # -- Pulls image only if not already present on the node pullPolicy: IfNotPresent # -- Secret references for pulling the image, if needed From db3a667d1f968ab3016d7f899973c7f38c6366e8 Mon Sep 17 00:00:00 2001 From: Daniel Hougaard Date: Wed, 22 Oct 2025 14:25:02 +0400 Subject: [PATCH 8/8] requested changes --- .../run-helm-chart-tests-infisical-standalone-postgres.yml | 1 - helm-charts/infisical-standalone-postgres/CHANGELOG.md | 2 -- 2 files changed, 3 deletions(-) diff --git a/.github/workflows/run-helm-chart-tests-infisical-standalone-postgres.yml b/.github/workflows/run-helm-chart-tests-infisical-standalone-postgres.yml index 2023de187..f960aa6ff 100644 --- a/.github/workflows/run-helm-chart-tests-infisical-standalone-postgres.yml +++ b/.github/workflows/run-helm-chart-tests-infisical-standalone-postgres.yml @@ -29,7 +29,6 @@ jobs: run: | helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx helm repo add bitnami https://charts.bitnami.com/bitnami - helm repo add stakater https://stakater.github.io/stakater-charts helm repo update - name: Set up chart-testing diff --git a/helm-charts/infisical-standalone-postgres/CHANGELOG.md b/helm-charts/infisical-standalone-postgres/CHANGELOG.md index 5298432d7..7ff0069d3 100644 --- a/helm-charts/infisical-standalone-postgres/CHANGELOG.md +++ b/helm-charts/infisical-standalone-postgres/CHANGELOG.md @@ -2,8 +2,6 @@ Changes: * Updated the default `infisical.image.tag` value to `v0.151.0`. * `autoDatabaseSchemaMigration` has been fully removed as all newer versions of Infisical automatically run migrations as apart of the startup process. -* Added automatic reloading support for the Infisical deployment when the `infisical.kubeSecretRef` kubernetes secret changes. - * Configurable by `infisical.redeployOnSecretChange: true|false`. Defaults to `false`. ## 1.7.1 (October 10, 2025)