mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-09-22 13:39:35 +00:00
misc: add helm chart auto bootstrap to methods
This commit is contained in:
Sheen Capadngan
@@ -29,7 +29,7 @@ The Automated Bootstrapping workflow automates the following processes:
|
||||
|
||||
## Bootstrap Methods
|
||||
|
||||
You can bootstrap an Infisical instance using either the API or the CLI.
|
||||
You can bootstrap an Infisical instance using the API, CLI, or Helm chart.
|
||||
|
||||
<Tabs>
|
||||
<Tab title="Using the API">
|
||||
@@ -64,95 +64,95 @@ You can bootstrap an Infisical instance using either the API or the CLI.
|
||||
This example command pipes the output through `jq` to extract only the machine identity token, making it easy to capture and use directly in automation scripts or export as an environment variable for tools like Terraform.
|
||||
|
||||
</Tab>
|
||||
<Tab title="Helm Chart Auto Bootstrap">
|
||||
When deploying Infisical using the official Helm chart, you can enable automatic bootstrapping that runs as part of the deployment process. This eliminates the need to manually bootstrap the instance after deployment.
|
||||
|
||||
The bootstrapping process automatically generates a Kubernetes secret containing the instance admin token, which can then be referenced by Crossplane providers, Terraform operators, or other automation systems for further infrastructure provisioning and configuration.
|
||||
|
||||
### Configuration
|
||||
|
||||
Enable auto bootstrapping in your Helm values by setting `autoBootstrap.enabled: true` and providing the necessary configuration:
|
||||
|
||||
```yaml
|
||||
autoBootstrap:
|
||||
enabled: true
|
||||
organization: "My Organization"
|
||||
secretTemplate: '{"data":{"token":"{{.Identity.Credentials.Token}}"}}'
|
||||
|
||||
secretDestination:
|
||||
name: "infisical-bootstrap-secret"
|
||||
namespace: "default" # defaults to release namespace if not specified
|
||||
|
||||
credentialSecret:
|
||||
name: "infisical-bootstrap-credentials"
|
||||
```
|
||||
|
||||
You'll also need to create a secret containing the bootstrap credentials before deployment. The secret must contain `INFISICAL_ADMIN_EMAIL` and `INFISICAL_ADMIN_PASSWORD` keys:
|
||||
|
||||
```bash
|
||||
kubectl create secret generic infisical-bootstrap-credentials \
|
||||
--from-literal=INFISICAL_ADMIN_EMAIL="admin@example.com" \
|
||||
--from-literal=INFISICAL_ADMIN_PASSWORD="your-secure-password" \
|
||||
--namespace=release-namespace
|
||||
```
|
||||
|
||||
### How It Works
|
||||
|
||||
The Helm chart auto bootstrap feature:
|
||||
|
||||
1. **Post-Install Hook**: Runs automatically after the main Infisical deployment is complete
|
||||
2. **Readiness Check**: Uses an init container with curl to wait for Infisical to be ready by polling the `/api/status` endpoint
|
||||
3. **Bootstrap Execution**: Uses the Infisical CLI to bootstrap the instance
|
||||
4. **Kubernetes Secret Creation**: Creates a Kubernetes secret directly via the Kubernetes API using the rendered template
|
||||
5. **RBAC**: Automatically configures the necessary permissions (`get`, `create`, `update` on secrets) for the bootstrap job
|
||||
|
||||
### Template System
|
||||
|
||||
The `secretTemplate` field allows you to customize the data section of the created Kubernetes secret. The template has access to the full bootstrap response with the following available data fields:
|
||||
|
||||
- `{{ .Identity.Credentials.Token }}`: The admin machine identity token
|
||||
- `{{ .Identity.ID }}`: The identity ID
|
||||
- `{{ .Identity.Name }}`: The identity name
|
||||
- `{{ .Organization.ID }}`: The organization ID
|
||||
- `{{ .Organization.Name }}`: The organization name
|
||||
- `{{ .Organization.Slug }}`: The organization slug
|
||||
- `{{ .User.Email }}`: The admin user email
|
||||
- `{{ .User.ID }}`: The admin user ID
|
||||
- `{{ .User.FirstName }}`: The admin user first name
|
||||
- `{{ .User.LastName }}`: The admin user last name
|
||||
|
||||
The template also supports the `encodeBase64` function for base64 encoding values.
|
||||
|
||||
Example template for storing multiple values:
|
||||
|
||||
```yaml
|
||||
secretTemplate: |
|
||||
{
|
||||
"data": {
|
||||
"infisical_token": "{{ .Identity.Credentials.Token }}",
|
||||
"admin_email": "{{ .User.Email }}",
|
||||
"organization": "{{ .Organization.Name }}"
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### Benefits
|
||||
|
||||
- **Zero-Touch Deployment**: Complete Infisical setup without manual intervention
|
||||
- **Infrastructure as Code**: Bootstrap configuration is versioned with your Helm values
|
||||
- **Secure Token Storage**: Admin identity credentials are immediately stored in Kubernetes secrets
|
||||
- **Integration Ready**: The created secret can be referenced by other applications or automation tools
|
||||
|
||||
### Security Considerations
|
||||
|
||||
- The bootstrap job requires permissions to create secrets in the specified namespace
|
||||
- Bootstrap credentials should be stored securely and rotated regularly
|
||||
- The generated admin token has full instance privileges and should be protected accordingly
|
||||
- Consider using Kubernetes RBAC to restrict access to the generated secret
|
||||
|
||||
</Tab>
|
||||
</Tabs>
|
||||
|
||||
## Helm Chart Auto Bootstrap
|
||||
|
||||
When deploying Infisical using the official Helm chart, you can enable automatic bootstrapping that runs as part of the deployment process. This eliminates the need to manually bootstrap the instance after deployment.
|
||||
|
||||
The bootstrapping process automatically generates a Kubernetes secret containing the instance admin token, which can then be referenced by Crossplane providers, Terraform operators, or other automation systems for further infrastructure provisioning and configuration.
|
||||
|
||||
### Configuration
|
||||
|
||||
Enable auto bootstrapping in your Helm values by setting `autoBootstrap.enabled: true` and providing the necessary configuration:
|
||||
|
||||
```yaml
|
||||
autoBootstrap:
|
||||
enabled: true
|
||||
organization: "My Organization"
|
||||
secretTemplate: '{"data":{"token":"{{.Identity.Credentials.Token}}"}}'
|
||||
|
||||
secretDestination:
|
||||
name: "infisical-bootstrap-secret"
|
||||
namespace: "default" # defaults to release namespace if not specified
|
||||
|
||||
credentialSecret:
|
||||
name: "infisical-bootstrap-credentials"
|
||||
```
|
||||
|
||||
You'll also need to create a secret containing the bootstrap credentials before deployment. The secret must contain `INFISICAL_ADMIN_EMAIL` and `INFISICAL_ADMIN_PASSWORD` keys:
|
||||
|
||||
```bash
|
||||
kubectl create secret generic infisical-bootstrap-credentials \
|
||||
--from-literal=INFISICAL_ADMIN_EMAIL="admin@example.com" \
|
||||
--from-literal=INFISICAL_ADMIN_PASSWORD="your-secure-password" \
|
||||
--namespace=release-namespace
|
||||
```
|
||||
|
||||
### How It Works
|
||||
|
||||
The Helm chart auto bootstrap feature:
|
||||
|
||||
1. **Post-Install Hook**: Runs automatically after the main Infisical deployment is complete
|
||||
2. **Readiness Check**: Uses an init container with curl to wait for Infisical to be ready by polling the `/api/status` endpoint
|
||||
3. **Bootstrap Execution**: Uses the Infisical CLI to bootstrap the instance
|
||||
4. **Kubernetes Secret Creation**: Creates a Kubernetes secret directly via the Kubernetes API using the rendered template
|
||||
5. **RBAC**: Automatically configures the necessary permissions (`get`, `create`, `update` on secrets) for the bootstrap job
|
||||
|
||||
### Template System
|
||||
|
||||
The `secretTemplate` field allows you to customize the data section of the created Kubernetes secret. The template has access to the full bootstrap response with the following available data fields:
|
||||
|
||||
- `{{ .Identity.Credentials.Token }}`: The admin machine identity token
|
||||
- `{{ .Identity.ID }}`: The identity ID
|
||||
- `{{ .Identity.Name }}`: The identity name
|
||||
- `{{ .Organization.ID }}`: The organization ID
|
||||
- `{{ .Organization.Name }}`: The organization name
|
||||
- `{{ .Organization.Slug }}`: The organization slug
|
||||
- `{{ .User.Email }}`: The admin user email
|
||||
- `{{ .User.ID }}`: The admin user ID
|
||||
- `{{ .User.FirstName }}`: The admin user first name
|
||||
- `{{ .User.LastName }}`: The admin user last name
|
||||
|
||||
The template also supports the `encodeBase64` function for base64 encoding values.
|
||||
|
||||
Example template for storing multiple values:
|
||||
|
||||
```yaml
|
||||
secretTemplate: |
|
||||
{
|
||||
"data": {
|
||||
"infisical_token": "{{ .Identity.Credentials.Token }}",
|
||||
"admin_email": "{{ .User.Email }}",
|
||||
"organization": "{{ .Organization.Name }}"
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### Benefits
|
||||
|
||||
- **Zero-Touch Deployment**: Complete Infisical setup without manual intervention
|
||||
- **Infrastructure as Code**: Bootstrap configuration is versioned with your Helm values
|
||||
- **Secure Token Storage**: Admin identity credentials are immediately stored in Kubernetes secrets
|
||||
- **Integration Ready**: The created secret can be referenced by other applications or automation tools
|
||||
|
||||
### Security Considerations
|
||||
|
||||
- The bootstrap job requires permissions to create secrets in the specified namespace
|
||||
- Bootstrap credentials should be stored securely and rotated regularly
|
||||
- The generated admin token has full instance privileges and should be protected accordingly
|
||||
- Consider using Kubernetes RBAC to restrict access to the generated secret
|
||||
|
||||
## API Response Structure
|
||||
|
||||
The bootstrap process returns a JSON response with details about the created user, organization, and machine identity:
|
||||
|
||||
Reference in New Issue
Block a user