awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'main' of https://github.com/Infisical/infisical into feat/chef-data-bag-app-connection-secret-sync

Browse Source
This commit is contained in:
Piyush Gupta
2025-11-01 03:09:48 +05:30
parent 3f1607d5aa 7d8b28367e
commit b531e4ed5e
145 changed files with 4657 additions and 1490 deletions
Download Patch File Download Diff File Expand all files Collapse all files

125
docs/integrations/app-connections/northflank.mdx Normal file
View File

@@ -0,0 +1,125 @@
---
title: "Northflank Connection"
description: "Learn how to configure a Northflank Connection for Infisical."
---
Infisical supports the use of [API Tokens](https://northflank.com/docs/v1/api/use-the-api) to connect with Northflank.
<Tip>
Infisical recommends creating a specific API role for the app connection and only giving access to projects that will use the integration.
</Tip>
## Create a Northflank API Token
<Steps>
<Step title="Create an API Role">
Navigate to your team page and click **Create token**.
![Create API Role](/images/app-connections/northflank/step-1.png)
Click on **Create API role**.
![Create API Role](/images/app-connections/northflank/step-2.png)
Select all the projects you want this role to have access to, or leave this unchecked if you want to give access to all projects.
![Create API Role](/images/app-connections/northflank/step-3.png)
Add the **Projects** -> **Manage** -> **Read** permission.
![Create API Role](/images/app-connections/northflank/step-4-1.png)
Add the **Config & Secrets** -> **Secret Groups** -> **List**, **Update** and **Read Values** permissions.
![Create API Role](/images/app-connections/northflank/step-4-2.png)
Scroll to the bottom and save the API role.
</Step>
<Step title="Create an API Token">
Click on the **API** -> **Tokens** menu on the left and then click the **Create API token** button.
![Create API Token](/images/app-connections/northflank/step-5.png)
Give a name to the API token and click the **Use role** button for the new API role you just created.
![Create API Token](/images/app-connections/northflank/step-6.png)
Click the **View API token** icon to view and copy your token.
![Create API Token](/images/app-connections/northflank/step-7.png)
</Step>
</Steps>
## Create a Northflank Connection in Infisical
<Tabs>
<Tab title="Infisical UI">
<Steps>
<Step title="Navigate to App Connections">
In your Infisical dashboard, navigate to the **App Connections** page in the desired project.
![App Connections Tab](/images/app-connections/general/add-connection.png)
</Step>
<Step title="Select Northflank Connection">
Click **+ Add Connection** and choose **Northflank Connection** from the list of integrations.
![Select Northflank Connection](/images/app-connections/northflank/northflank-app-connection-option.png)
</Step>
<Step title="Fill out the Northflank Connection form">
Complete the form by providing:
- A descriptive name for the connection
- An optional description
- The API Token from the previous step
![Northflank Connection Modal](/images/app-connections/northflank/northflank-app-connection-form.png)
</Step>
<Step title="Connection created">
After submitting the form, your **Northflank Connection** will be successfully created and ready to use with your Infisical project.
![Northflank Connection Created](/images/app-connections/northflank/northflank-app-connection-generated.png)
</Step>
</Steps>
</Tab>
<Tab title="API">
To create a Northflank Connection via API, send a request to the [Create Northflank Connection](/api-reference/endpoints/app-connections/northflank/create) endpoint.
### Sample request
```bash Request
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/northflank \
--header 'Content-Type: application/json' \
--data '{
"name": "my-northflank-connection",
"method": "api-token",
"projectId": "abcdef12-3456-7890-abcd-ef1234567890",
"credentials": {
"apiToken": "[API TOKEN]"
}
}'
```
### Sample response
```bash Response
{
"appConnection": {
"id": "a1b2c3d4-5678-90ab-cdef-1234567890ab",
"name": "my-northflank-connection",
"description": null,
"projectId": "abcdef12-3456-7890-abcd-ef1234567890",
"version": 1,
"orgId": "abcdef12-3456-7890-abcd-ef1234567890",
"createdAt": "2025-01-23T10:15:00.000Z",
"updatedAt": "2025-01-23T10:15:00.000Z",
"isPlatformManagedCredentials": false,
"credentialsHash": "d41d8cd98f00b204e9800998ecf8427e",
"app": "northflank",
"method": "api-token",
"credentials": {}
}
}
```
</Tab>
</Tabs>

1
docs/integrations/platforms/kubernetes-injector.mdx
View File

@@ -63,6 +63,7 @@ The Infisical Agent Injector supports the following annotations:
- `init`: The init method will create an init container for the pod that will render the secrets into a shared volume mount within the pod. The agent init container will run before any other containers in the pod runs, including other init containers.
- `sidecar`: The sidecar method will create a sidecar container for the pod that will render the secrets into a shared volume mount within the pod. The agent sidecar container will run alongside the main container in the pod. This means that the secrets rendered will always be in sync with your Infisical secrets.
- `sidecar-init`: The sidecar-init method will create the init container and the sidecar container from the other two methods. The init container will run before any other container and fetch the secrets from the start and the sidecar container will keep the secrets in sync throughout the lifecycle of the deployment.
</Accordion>
<Accordion title="org.infisical.com/agent-config-map">
The agent config map annotation is used to specify the name of the config map that contains the configuration for the injector. The config map must be in the same namespace as the pod.

58
docs/integrations/platforms/kubernetes/overview.mdx
View File

@@ -41,6 +41,29 @@ If you require stronger isolation and stricter access controls, a namespace-scop
```bash
helm install --generate-name infisical-helm-charts/secrets-operator
```
<Accordion title="Using your own service account">
By default a service account is created for the operator based on the operator release name.
You can bring your own service account by setting `controllerManager.serviceAccount.create` to `false` and setting `controllerManager.serviceAccount.name` to the name of the service account you want to use in your values.yaml file.
Example values.yaml file:
```yaml values.yaml
controllerManager:
serviceAccount:
create: false
name: my-service-account
# other values...
```
<Note>
Please note that if you set `controllerManager.serviceAccount.create` to `false`, the service account needs to already exist in the namespace you are installing the operator in.
</Note>
<Tip>
Custom service accounts are supported in chart version `0.10.11` and above. Please upgrade your helm chart to `0.10.11` or above before attempting to use custom service accounts.
</Tip>
</Accordion>
</Tab>
<Tab title="Namespace Scoped Installation">
The operator can be configured to watch and manage secrets in a specific namespace instead of having cluster-wide access. This is useful for:
@@ -67,6 +90,29 @@ If you require stronger isolation and stricter access controls, a namespace-scop
--set installCRDs=false
```
<Accordion title="Using your own service account">
By default a service account is created for the operator based on the operator release name.
You can bring your own service account by setting `controllerManager.serviceAccount.create` to `false` and setting `controllerManager.serviceAccount.name` to the name of the service account you want to use in your values.yaml file.
Example values.yaml file:
```yaml values.yaml
controllerManager:
serviceAccount:
create: false
name: my-service-account
# other values...
```
<Note>
Please note that if you set `controllerManager.serviceAccount.create` to `false`, the service account needs to already exist in the namespace you are installing the operator in.
</Note>
<Tip>
Custom service accounts are supported in chart version `0.10.11` and above. Please upgrade your helm chart to `0.10.11` or above before attempting to use custom service accounts.
</Tip>
</Accordion>
When scoped to a namespace, the operator will:
- Only watch InfisicalSecrets in the specified namespace
@@ -158,14 +204,17 @@ The Infisical Secrets Operator integrates with the [Sprig library](https://githu
## Global configuration
To configure global settings that will apply to all instances of `InfisicalSecret`, you can define these configurations in a Kubernetes ConfigMap.
For example, you can configure all `InfisicalSecret` instances to fetch secrets from a single backend API without specifying the `hostAPI` parameter for each instance.
To configure global settings that will apply to all CRD instances (`InfisicalSecret`, `InfisicalPushSecret`, and `InfisicalDynamicSecret`), you can define these configurations in a Kubernetes ConfigMap.
For example, you can configure all CRD instances to fetch secrets from a single backend API without specifying the `hostAPI` parameter for each instance.
### Available global properties
| Property | Description | Default value |
| -------- | --------------------------------------------------------------------------------- | ----------------------------- |
| hostAPI | If `hostAPI` in `InfisicalSecret` instance is left empty, this value will be used | https://app.infisical.com/api |
| hostAPI | If `hostAPI` in a CRD instance is left empty, this value will be used | https://app.infisical.com/api |
| tls.caRef.secretName | If `tls.caRef.secretName` in a CRD instance is left empty, this value will be used | - |
| tls.caRef.secretNamespace | If `tls.caRef.secretNamespace` in a CRD instance is left empty, this value will be used | - |
| tls.caRef.key | If `tls.caRef.key` in a CRD instance is left empty, this value will be used | - |
### Applying global configurations
@@ -185,6 +234,9 @@ metadata:
namespace: infisical-operator-system
data:
hostAPI: https://example.com/api # <-- global hostAPI
tls.caRef.secretName: custom-ca-certificate # <-- global TLS CA secret name
tls.caRef.secretNamespace: default # <-- global TLS CA secret namespace
tls.caRef.key: ca.crt # <-- global TLS CA secret key
```
Then apply this change via kubectl by running the following

160
docs/integrations/secret-syncs/northflank.mdx Normal file
View File

@@ -0,0 +1,160 @@
---
title: "Northflank Sync"
description: "Learn how to configure a Northflank Sync for Infisical."
---
**Prerequisites:**
- Create a [Northflank Connection](/integrations/app-connections/northflank)
<Tabs>
<Tab title="Infisical UI">
<Steps>
<Step title="Add Sync">
Navigate to **Project** > **Integrations** and select the **Secret Syncs** tab. Click on the **Add Sync** button.
![Secret Syncs Tab](/images/secret-syncs/general/secret-sync-tab.png)
</Step>
<Step title="Select 'Northflank'">
![Select Northflank](/images/secret-syncs/northflank/select-option.png)
</Step>
<Step title="Configure source">
Configure the **Source** from where secrets should be retrieved, then click **Next**.
![Configure Source](/images/secret-syncs/northflank/configure-source.png)
- **Environment**: The project environment to retrieve secrets from.
- **Secret Path**: The folder path to retrieve secrets from.
<Tip>
If you need to sync secrets from multiple folder locations, check out [secret imports](/documentation/platform/secret-reference#secret-imports).
</Tip>
</Step>
<Step title="Configure destination">
Configure the **Destination** to where secrets should be deployed, then click **Next**.
![Configure Destination](/images/secret-syncs/northflank/configure-destination.png)
- **Northflank Connection**: The Northflank Connection to authenticate with.
- **Project**: The Northflank project to sync secrets to.
- **Secret Group**: The Northflank secret group to sync secrets to.
</Step>
<Step title="Configure sync options">
Configure the **Sync Options** to specify how secrets should be synced, then click **Next**.
![Configure Sync Options](/images/secret-syncs/northflank/configure-sync-options.png)
- **Initial Sync Behavior**: Determines how Infisical should resolve the initial sync.
- **Overwrite Destination Secrets**: Removes any secrets at the destination endpoint not present in Infisical.
- **Import Destination Secrets - Prioritize Infisical Values**: Imports any secrets present in the Northflank destination prior to syncing, prioritizing values from Infisical over Northflank when keys conflict.
- **Import Destination Secrets - Prioritize Northflank Values**: Imports any secrets present in the Northflank destination prior to syncing, prioritizing values from Northflank over Infisical when keys conflict.
- **Key Schema**: Template that determines how secret names are transformed when syncing, using `{{secretKey}}` as a placeholder for the original secret name and `{{environment}}` for the environment.
<Note>
We highly recommend using a Key Schema to ensure that Infisical only manages the specific keys you intend, keeping everything else untouched.
</Note>
- **Auto-Sync Enabled**: If enabled, secrets will automatically be synced from the source location when changes occur. Disable to enforce manual syncing only.
- **Disable Secret Deletion**: If enabled, Infisical will not remove secrets from the sync destination. Enable this option if you intend to manage some secrets manually outside of Infisical.
</Step>
<Step title="Configure details">
Configure the **Details** of your Northflank Sync, then click **Next**.
![Configure Details](/images/secret-syncs/northflank/configure-details.png)
- **Name**: The name of your sync. Must be slug-friendly.
- **Description**: An optional description for your sync.
</Step>
<Step title="Review configuration">
Review your Northflank Sync configuration, then click **Create Sync**.
![Review Configuration](/images/secret-syncs/northflank/review-configuration.png)
</Step>
<Step title="Sync created">
If enabled, your Northflank Sync will begin syncing your secrets to the destination endpoint.
![Sync Created](/images/secret-syncs/northflank/sync-created.png)
</Step>
</Steps>
</Tab>
<Tab title="API">
To create a **Northflank Sync**, make an API request to the [Create Northflank Sync](/api-reference/endpoints/secret-syncs/northflank/create) API endpoint.
### Sample request
```bash Request
curl --request POST \
--url https://app.infisical.com/api/v1/secret-syncs/northflank \
--header 'Content-Type: application/json' \
--data '{
"name": "my-northflank-sync",
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"description": "an example sync",
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"environment": "dev",
"secretPath": "/my-secrets",
"isAutoSyncEnabled": true,
"syncOptions": {
"initialSyncBehavior": "overwrite-destination",
"keySchema": "INFISICAL_{{secretKey}}"
},
"destinationConfig": {
"projectId": "my-project-id",
"secretGroupId": "my-secret-group-id"
}
}'
```
### Sample response
```json Response
{
"secretSync": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"name": "my-northflank-sync",
"description": "an example sync",
"isAutoSyncEnabled": true,
"version": 1,
"folderId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"createdAt": "2023-11-07T05:31:56Z",
"updatedAt": "2023-11-07T05:31:56Z",
"syncStatus": "succeeded",
"lastSyncJobId": "123",
"lastSyncMessage": null,
"lastSyncedAt": "2023-11-07T05:31:56Z",
"importStatus": null,
"lastImportJobId": null,
"lastImportMessage": null,
"lastImportedAt": null,
"removeStatus": null,
"lastRemoveJobId": null,
"lastRemoveMessage": null,
"lastRemovedAt": null,
"syncOptions": {
"initialSyncBehavior": "overwrite-destination",
"keySchema": "INFISICAL_{{secretKey}}",
"disableSecretDeletion": false
},
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"connection": {
"app": "northflank",
"name": "my-northflank-connection",
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
},
"environment": {
"slug": "dev",
"name": "Development",
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
},
"folder": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"path": "/my-secrets"
},
"destination": "northflank",
"destinationConfig": {
"projectId": "my-project-id",
"secretGroupId": "my-secret-group-id"
}
}
}
```
</Tab>
</Tabs>