Merge pull request #4703 from Infisical/daniel/helm-improvements

fix: self-hosting experience improvements

.github/values.yaml

@@ -1,57 +0,0 @@
-## @section Common parameters
-##
-
-## @param nameOverride Override release name
-##
-nameOverride: ""
-## @param fullnameOverride Override release fullname
-##
-fullnameOverride: ""
-
-## @section Infisical backend parameters
-## Documentation : https://infisical.com/docs/self-hosting/deployments/kubernetes
-##
-
-infisical:
-  autoDatabaseSchemaMigration: false
-  
-  enabled: false
-
-  name: infisical
-  replicaCount: 3
-  image:
-    repository: infisical/staging_infisical
-    tag: "latest"
-    pullPolicy: Always
-
-  deploymentAnnotations:
-    secrets.infisical.com/auto-reload: "true"
-
-  kubeSecretRef: "managed-secret"
-
-ingress:
-  ## @param ingress.enabled Enable ingress
-  ##
-  enabled: true
-  ## @param ingress.ingressClassName Ingress class name
-  ##
-  ingressClassName: nginx
-  ## @param ingress.nginx.enabled Ingress controller
-  ##
-  # nginx:
-  #   enabled: true
-  ## @param ingress.annotations Ingress annotations
-  ##
-  annotations:
-    cert-manager.io/cluster-issuer: "letsencrypt-prod"
-  hostName: "gamma.infisical.com"
-  tls:
-    - secretName: letsencrypt-prod
-      hosts:
-        - gamma.infisical.com
-
-postgresql:
-  enabled: false
-
-redis:
-  enabled: false

.github/workflows/helm-release-infisical-core.yml

@@ -56,7 +56,7 @@ jobs:
             --config ct.yaml \
             --charts helm-charts/infisical-standalone-postgres \
             --helm-extra-args="--timeout=300s" \
-            --helm-extra-set-args="--set ingress.nginx.enabled=false --set infisical.autoDatabaseSchemaMigration=false --set infisical.replicaCount=1 --set infisical.image.tag=v0.132.2-postgres" \
+            --helm-extra-set-args="--set ingress.nginx.enabled=false --set infisical.replicaCount=1 --set infisical.image.tag=v0.151.0" \
             --namespace infisical-standalone-postgres
 
   release:

.github/workflows/run-helm-chart-tests-infisical-standalone-postgres.yml

@@ -66,5 +66,5 @@ jobs:
             --config ct.yaml \
             --charts helm-charts/infisical-standalone-postgres \
             --helm-extra-args="--timeout=300s" \
-            --helm-extra-set-args="--set ingress.nginx.enabled=false --set infisical.autoDatabaseSchemaMigration=false --set infisical.replicaCount=1 --set infisical.image.tag=v0.132.2-postgres --set infisical.autoBootstrap.enabled=true" \
+            --helm-extra-set-args="--set ingress.nginx.enabled=false --set infisical.replicaCount=1 --set infisical.image.tag=v0.151.0 --set infisical.autoBootstrap.enabled=true" \
             --namespace infisical-standalone-postgres

docs/documentation/platform/kms/hsm-integration.mdx

@@ -1428,7 +1428,7 @@ Enabling HSM encryption has a set of key benefits:
               infisical:
                 image:
                   repository: infisical/infisical
-                  tag: "v0.151.0-nightly-20251013.1"
+                  tag: "v0.151.0"
                   pullPolicy: IfNotPresent
 
                 extraVolumeMounts:

docs/self-hosting/configuration/envars.mdx

@@ -116,6 +116,27 @@ The platform utilizes Postgres to persist all of its data and Redis for caching
 <ParamField query="DB_ROOT_CERT" type="string" default="" optional>
   Configure the SSL certificate for securing a Postgres connection by first encoding it in base64.
   Use the following command to encode your certificate: `echo "<certificate>" | base64`
+
+  Many cloud providers provide a CA certificate for their data regions that you can use to secure your connection with SSL.
+
+  <AccordionGroup>
+    <Accordion title="AWS RDS">
+      If you're hosting your database on AWS RDS, you can use their publicly available CA certificate as the database root certificate.
+
+      You can find all the available CA certificates for AWS RDS on the official [AWS RDS documentation](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html).
+
+      As an example, if your RDS cluster is hosted in `us-east-1` _(US East, N. Virginia)_, you can use the following root certificate: https://truststore.pki.rds.amazonaws.com/us-east-1/us-east-1-bundle.pem.
+
+      All the available CA certificates can be found in the AWS RDS documentation linked above.
+
+      Remember to base64 encode the certificate before setting it as the `DB_ROOT_CERT` environment variable. `cat /path/to/certificate.pem | base64`.
+
+      ```bash
+      DB_ROOT_CERT=LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1 # .... (base64 encoded certificate)
+      DB_CONNECTION_URI=<rds-endpoint>?sslmode=verify-ca # or verify-full depending on your security policies
+      ```
+    </Accordion>
+  </AccordionGroup>
 </ParamField>
 
 <ParamField query="DB_READ_REPLICAS" type="string" default="" optional>

docs/self-hosting/deployment-options/kubernetes-helm.mdx

@@ -1,8 +1,10 @@
 ---
 title: "Kubernetes via Helm Chart"
 description: "Learn how to use Helm chart to install Infisical on your Kubernetes cluster."
---- 
+---
+
 **Prerequisites**
+
 - You have extensive understanding of [Kubernetes](https://kubernetes.io/)
 - Installed [Helm package manager](https://helm.sh/) version v3.11.3 or greater
 - You have [kubectl](https://kubernetes.io/docs/reference/kubectl/kubectl/) installed and connected to your kubernetes cluster
@@ -12,7 +14,7 @@ description: "Learn how to use Helm chart to install Infisical on your Kubernete
     ```bash
     helm repo add infisical-helm-charts 'https://dl.cloudsmith.io/public/infisical/helm-charts/helm/charts/' 
     ```
-    ```
+    ```bash
     helm repo update
     ```
   </Step>
@@ -61,6 +63,7 @@ description: "Learn how to use Helm chart to install Infisical on your Kubernete
       </Tab>
       <Tab title="Production deployment">
         For production environments, we recommend using Cloud-based Platform as a Service (PaaS) solutions for PostgreSQL and Redis to ensure high availability. In on-premise setups, it's recommended to configure Redis and Postgres for high availability, either by using Bitnami charts or a custom configuration.
+
         ```yaml simple-values-example.yaml 
         apiVersion: v1
         kind: Secret
@@ -74,6 +77,10 @@ description: "Learn how to use Helm chart to install Infisical on your Kubernete
           DB_CONNECTION_URI: <>
           SITE_URL: <>
         ```
+
+        <Tip>
+          If you need to configure the SSL certificate for your production Postgres instance, you can use the `DB_ROOT_CERT` environment variable. [Learn more about configuring the SSL certificate](/self-hosting/configuration/envars#aws-rds).
+        </Tip>
       </Tab>
     </Tabs>
   </Step>

helm-charts/infisical-standalone-postgres/CHANGELOG.md

@@ -1,3 +1,8 @@
+## 1.7.2 (October 20, 2025)
+Changes:
+* Updated the default `infisical.image.tag` value to `v0.151.0`.
+* `autoDatabaseSchemaMigration` has been fully removed as all newer versions of Infisical automatically run migrations as apart of the startup process.
+
 ## 1.7.1 (October 10, 2025)
 
 Changes:

helm-charts/infisical-standalone-postgres/Chart.lock

@@ -9,4 +9,4 @@ dependencies:
   repository: oci://registry-1.docker.io/bitnamicharts
   version: 18.14.1
 digest: sha256:57a18fb5258fc153d27b633f6570104c7628af651f08f3ae7e1cf8920c2c31fa
-generated: "2025-09-30T18:44:50.303037+04:00"
+generated: "2025-10-21T22:30:21.313884+04:00"

helm-charts/infisical-standalone-postgres/Chart.yaml

@@ -7,7 +7,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 1.7.1
+version: 1.7.2
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

helm-charts/infisical-standalone-postgres/README.md

@@ -18,7 +18,6 @@ A helm chart to deploy Infisical
 |-----|------|---------|-------------|
 | fullnameOverride | string | `""` | Overrides the full name of the release, affecting resource names |
 | infisical.affinity | object | `{}` | Node affinity settings for pod placement |
-| infisical.autoDatabaseSchemaMigration | bool | `true` | Automatically migrates new database schema when deploying |
 | infisical.databaseSchemaMigrationJob.image.pullPolicy | string | `"IfNotPresent"` | Pulls image only if not present on the node |
 | infisical.databaseSchemaMigrationJob.image.repository | string | `"ghcr.io/groundnuty/k8s-wait-for"` | Image repository for migration wait job |
 | infisical.databaseSchemaMigrationJob.image.tag | string | `"no-root-v2.0"` | Image tag version |

helm-charts/infisical-standalone-postgres/templates/infisical.yaml

@@ -44,16 +44,6 @@ spec:
     {{- if $infisicalValues.image.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml $infisicalValues.image.imagePullSecrets | nindent 6 }}
-    {{- end }}
-    {{- if $infisicalValues.autoDatabaseSchemaMigration }}
-      serviceAccountName: {{ include "infisical.serviceAccountName" . }}
-      initContainers:
-      - name: "migration-init"
-        image: "{{ $infisicalValues.databaseSchemaMigrationJob.image.repository }}:{{ $infisicalValues.databaseSchemaMigrationJob.image.tag }}"
-        imagePullPolicy: {{ $infisicalValues.databaseSchemaMigrationJob.image.pullPolicy }}
-        args: 
-        - "job"
-        - "{{ .Release.Name }}-schema-migration-{{ .Release.Revision }}"
     {{- end }}
       containers:
       - name: {{ template "infisical.name" . }}-{{ $infisicalValues.name }}

helm-charts/infisical-standalone-postgres/templates/schema-migration-job.yaml

@@ -1,52 +0,0 @@
-{{- $infisicalValues := .Values.infisical }}
-{{- if $infisicalValues.autoDatabaseSchemaMigration }}
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: "{{ .Release.Name }}-schema-migration-{{ .Release.Revision }}"
-  labels:
-    helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-spec:
-  backoffLimit: 10
-  template:
-    metadata:
-      name: "{{ .Release.Name }}-create-tables"
-      labels:
-        app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-        app.kubernetes.io/instance: {{ .Release.Name | quote }}
-        helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-    spec:
-      serviceAccountName: {{ include "infisical.serviceAccountName" . }}
-    {{- if $infisicalValues.image.imagePullSecrets }}
-      imagePullSecrets:
-        {{- toYaml $infisicalValues.image.imagePullSecrets | nindent 6 }}
-    {{- end }}
-      restartPolicy: OnFailure
-      containers:
-        - name: infisical-schema-migration
-          image: "{{ $infisicalValues.image.repository }}:{{ $infisicalValues.image.tag }}"
-          command: ["npm", "run", "migration:latest"]
-          env:
-          {{- if .Values.postgresql.useExistingPostgresSecret.enabled }}
-          - name: DB_CONNECTION_URI
-            valueFrom:
-              secretKeyRef:
-                name: {{ .Values.postgresql.useExistingPostgresSecret.existingConnectionStringSecret.name }}
-                key: {{ .Values.postgresql.useExistingPostgresSecret.existingConnectionStringSecret.key }}
-          {{- end }}
-          {{- if .Values.postgresql.enabled }}
-          - name: DB_CONNECTION_URI
-            value: {{ include "infisical.postgresDBConnectionString" . }}
-          {{- end }}
-          envFrom:
-          - secretRef:
-              name: {{ $infisicalValues.kubeSecretRef }}
-          {{- with $infisicalValues.extraVolumeMounts }}
-          volumeMounts:
-            {{- toYaml . | nindent 10 }}
-          {{- end }}
-      {{- with $infisicalValues.extraVolumes }}
-      volumes:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-{{- end }}

helm-charts/infisical-standalone-postgres/values.yaml

@@ -10,9 +10,6 @@ infisical:
   # -- Sets the name of the deployment within this chart
   name: infisical
 
-  # -- Automatically migrates new database schema when deploying
-  autoDatabaseSchemaMigration: true
-
   autoBootstrap:
     # -- Enable auto-bootstrap of the Infisical instance
     enabled: false
@@ -68,7 +65,7 @@ infisical:
     # -- Image repository for the Infisical service
     repository: infisical/infisical
     # -- Specific version tag of the Infisical image. View the latest version here https://hub.docker.com/r/infisical/infisical
-    tag: "v0.93.1-postgres"
+    tag: "v0.151.0"
     # -- Pulls image only if not already present on the node
     pullPolicy: IfNotPresent
     # -- Secret references for pulling the image, if needed
@@ -118,8 +115,7 @@ ingress:
   # -- Custom annotations for ingress resource
   annotations: {}
   # -- TLS settings for HTTPS access
-  tls:
+  tls: []
-    []
     # -- TLS secret name for HTTPS
     # - secretName: letsencrypt-prod
     # -- Domain name to associate with the TLS certificate