awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-08 01:27:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #3818 from Infisical/feat/cli-bootstrap-create-k8-secret

Browse Source 
feat: added auto-bootstrap support to helm
This commit is contained in:
Maidul Islam
2025-06-24 17:03:13 -04:00
committed by GitHub
parent 3d2465ae41 0eb36d7e35
commit b59fa14bb6
13 changed files with 729 additions and 79 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/cli/commands/bootstrap.mdx
+126 -1
View File
@@ -75,8 +75,90 @@ This flag is required.
</Accordion>
<Accordion title="--ignore-if-bootstrapped">
Whether to continue without error if the instance has already been bootstrapped. Useful for idempotent automation scripts.
```bash
# Example
infisical bootstrap --ignore-if-bootstrapped
```
This flag is optional and defaults to `false`.
</Accordion>
<Accordion title="--output">
The type of output format for the bootstrap command. Supports `k8-secret` for Kubernetes secret integration. This flag is optional and defaults to "".
```bash
# Kubernetes secret output
infisical bootstrap --output=k8-secret --k8-secret-template='{"data":{"token":"{{.Identity.Credentials.Token}}"}}' --k8-secret-name=infisical-bootstrap --k8-secret-namespace=default
```
When using `k8-secret`, the command will create or update a Kubernetes secret directly in your cluster. Note that this option requires the command to be executed from within a Kubernetes pod with appropriate service account permissions.
</Accordion>
<Accordion title="--k8-secret-template">
The template to use for rendering the Kubernetes secret data/stringData section. Required when using `--output=k8-secret`. The template uses Go template syntax and has access to the bootstrap response data.
```bash
# Example template that stores the token
infisical bootstrap --k8-secret-template='{"data":{"token":"{{.Identity.Credentials.Token}}"}}'
# Example template with multiple fields
infisical bootstrap --k8-secret-template='{"stringData":{"token":"{{.Identity.Credentials.Token}}","org-id":"{{.Organization.ID}}","user-email":"{{.User.Email}}"}}'
```
Available template functions:
- `encodeBase64`: Base64 encode a string
Available data fields:
- `.Identity.Credentials.Token`: The machine identity token
- `.Identity.ID`: The identity ID
- `.Identity.Name`: The identity name
- `.Organization.ID`: The organization ID
- `.Organization.Name`: The organization name
- `.Organization.Slug`: The organization slug
- `.User.Email`: The admin user email
- `.User.ID`: The admin user ID
- `.User.FirstName`: The admin user first name
- `.User.LastName`: The admin user last name
This flag is required when using `k8-secret` output.
</Accordion>
<Accordion title="--k8-secret-name">
The name of the Kubernetes secret to create or update. Required when using `--output=k8-secret`.
```bash
# Example
infisical bootstrap --k8-secret-name=infisical-bootstrap-credentials
```
This flag is required when using `k8-secret` output.
</Accordion>
<Accordion title="--k8-secret-namespace">
The namespace where the Kubernetes secret should be created or updated. Required when using `--output=k8-secret`.
```bash
# Example
infisical bootstrap --k8-secret-namespace=infisical-system
```
This flag is required when using `k8-secret` output.
</Accordion>
## Response
### JSON Output (Default)
The command returns a JSON response with details about the created user, organization, and machine identity:
```json
@@ -105,6 +187,47 @@ The command returns a JSON response with details about the created user, organiz
}
```
### Kubernetes Secret Output
When using `--output=k8-secret`, the command creates or updates a Kubernetes secret in your cluster and logs the operation result. This is particularly useful for automated bootstrapping scenarios such as Kubernetes Jobs, GitOps workflows, or when you need to immediately store the admin credentials for use by other applications in your cluster.
## Kubernetes Integration
### Prerequisites for k8-secret Output
When running with `--output=k8-secret`, the command must be executed from within a Kubernetes pod with proper service account permissions. The command automatically:
1. Reads the service account token from `/var/run/secrets/kubernetes.io/serviceaccount/token`
2. Reads the CA certificate from `/var/run/secrets/kubernetes.io/serviceaccount/ca.crt`
3. Gets the Kubernetes API server URL from environment variables (`KUBERNETES_SERVICE_HOST` and `KUBERNETES_SERVICE_PORT_HTTPS`)
### Required RBAC Permissions
Your service account needs the following permissions:
```yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: infisical-bootstrap
rules:
- apiGroups: [""]
resources: ["secrets"]
verbs: ["get", "create", "update"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: infisical-bootstrap
subjects:
- kind: ServiceAccount
name: your-service-account
roleRef:
kind: Role
name: infisical-bootstrap
apiGroup: rbac.authorization.k8s.io
```
## Usage with Automation
For automation purposes, you can extract just the machine identity token from the response:
@@ -127,6 +250,8 @@ echo "Token has been captured and can be used for authentication"
## Notes
- The bootstrap process can only be performed once on a fresh Infisical instance
- All flags are required for the bootstrap process to complete successfully
- All core flags (domain, email, password, organization) are required for the bootstrap process to complete successfully
- Security controls prevent privilege escalation: instance admin identities cannot be managed by non-instance admin users and identities
- The generated admin user account can be used to log in via the UI if needed
- When using `k8-secret` output, the command must run within a Kubernetes pod with proper service account permissions
- The `--ignore-if-bootstrapped` flag is useful for making bootstrap scripts idempotent
docs/self-hosting/guides/automated-bootstrapping.mdx
+155 -43
View File
@@ -5,13 +5,13 @@ description: "Learn how to provision and configure Infisical instances programma
Infisical's Automated Bootstrapping feature enables you to provision and configure an Infisical instance without using the UI, allowing for complete automation through static configuration files, API calls, or CLI commands. This is especially valuable for enterprise environments where automated deployment and infrastructure-as-code practices are essential.
## Overview
The bootstrapping workflow automates creating an admin user account, initializing an organization for the entire instance, establishing an **instance admin machine identity** with full administrative permissions, and returning the machine identity credentials for further automation.
The Automated Bootstrapping workflow automates the following processes:
- Creating an admin user account
- Initializing an organization for the entire instance
- Establishing an **instance admin machine identity** with full administrative permissions
- Returning the machine identity credentials for further automation
## Prerequisites
- An Infisical instance launched with all required configuration variables
- Access to the Infisical CLI or the ability to make API calls to the instance
- Network connectivity to the Infisical instance
## Key Concepts
@@ -20,15 +20,9 @@ The Automated Bootstrapping workflow automates the following processes:
![Instance Admin Identity](/images/self-hosting/guides/automated-bootstrapping/identity-instance-admin.png)
- **Token Auth**: The instance admin machine identity uses [Token Auth](/documentation/platform/identities/token-auth), providing a JWT token that can be used directly to make authenticated requests to the Infisical API.
## Prerequisites
- An Infisical instance launched with all required configuration variables
- Access to the Infisical CLI or the ability to make API calls to the instance
- Network connectivity to the Infisical instance
## Bootstrap Methods
You can bootstrap an Infisical instance using either the API or the CLI.
You can bootstrap an Infisical instance using the API, CLI, or Helm chart.
<Tabs>
<Tab title="Using the API">
@@ -51,6 +45,37 @@ You can bootstrap an Infisical instance using either the API or the CLI.
-d '{"email":"[email protected]","password":"your-secure-password","organization":"your-org-name"}' \
http://your-infisical-instance.com/api/v1/admin/bootstrap
```
### API Response Structure
The bootstrap process returns a JSON response with details about the created user, organization, and machine identity:
```json
{
"identity": {
"credentials": {
"token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZGVudGl0eUlkIjoiZGIyMjQ3OTItZWQxOC00Mjc3LTlkYWUtNTdlNzUyMzE1ODU0IiwiaWRlbnRpdHlBY2Nlc3NUb2tlbklkIjoiZmVkZmZmMGEtYmU3Yy00NjViLWEwZWEtZjM5OTNjMTg4OGRlIiwiYXV0aFRva2VuVHlwZSI6ImlkZW50aXR5QWNjZXNzVG9rZW4iLCJpYXQiOjE3NDIzMjI0ODl9.mqcZZqIFqER1e9ubrQXp8FbzGYi8nqqZwfMvz09g-8Y"
},
"id": "db224792-ed18-4277-9dae-57e752315854",
"name": "Instance Admin Identity"
},
"message": "Successfully bootstrapped instance",
"organization": {
"id": "b56bece0-42f5-4262-b25e-be7bf5f84957",
"name": "dog",
"slug": "dog-v-e5l"
},
"user": {
"email": "[email protected]",
"firstName": "Admin",
"id": "a418f355-c8da-453c-bbc8-6c07208eeb3c",
"lastName": "User",
"superAdmin": true,
"username": "[email protected]"
}
}
```
</Tab>
<Tab title="Using the CLI">
Use the [Infisical CLI](/cli/commands/bootstrap) to bootstrap the instance and extract the token for immediate use in automation:
@@ -60,39 +85,126 @@ You can bootstrap an Infisical instance using either the API or the CLI.
```
This example command pipes the output through `jq` to extract only the machine identity token, making it easy to capture and use directly in automation scripts or export as an environment variable for tools like Terraform.
### API Response Structure
The bootstrap process returns a JSON response with details about the created user, organization, and machine identity:
```json
{
"identity": {
"credentials": {
"token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZGVudGl0eUlkIjoiZGIyMjQ3OTItZWQxOC00Mjc3LTlkYWUtNTdlNzUyMzE1ODU0IiwiaWRlbnRpdHlBY2Nlc3NUb2tlbklkIjoiZmVkZmZmMGEtYmU3Yy00NjViLWEwZWEtZjM5OTNjMTg4OGRlIiwiYXV0aFRva2VuVHlwZSI6ImlkZW50aXR5QWNjZXNzVG9rZW4iLCJpYXQiOjE3NDIzMjI0ODl9.mqcZZqIFqER1e9ubrQXp8FbzGYi8nqqZwfMvz09g-8Y"
},
"id": "db224792-ed18-4277-9dae-57e752315854",
"name": "Instance Admin Identity"
},
"message": "Successfully bootstrapped instance",
"organization": {
"id": "b56bece0-42f5-4262-b25e-be7bf5f84957",
"name": "dog",
"slug": "dog-v-e5l"
},
"user": {
"email": "[email protected]",
"firstName": "Admin",
"id": "a418f355-c8da-453c-bbc8-6c07208eeb3c",
"lastName": "User",
"superAdmin": true,
"username": "[email protected]"
}
}
```
</Tab>
<Tab title="Helm Chart">
When deploying Infisical using the official [Helm chart](/self-hosting/deployment-options/kubernetes-helm#kubernetes-via-helm-chart), you can enable automatic bootstrapping that runs as part of the deployment process. This eliminates the need to manually bootstrap the instance after deployment.
The bootstrapping process automatically generates a Kubernetes secret containing the instance admin token, which can then be referenced by Crossplane providers, Terraform operators, or other automation systems for further infrastructure provisioning and configuration.
### Configuration
Enable auto bootstrapping in your Helm values by setting `autoBootstrap.enabled: true` and providing the necessary configuration:
```yaml
autoBootstrap:
enabled: true
organization: "My Organization"
secretTemplate: '{"data":{"token":"{{.Identity.Credentials.Token}}"}}'
secretDestination:
name: "infisical-bootstrap-secret"
namespace: "default" # defaults to release namespace if not specified
credentialSecret:
name: "infisical-bootstrap-credentials"
```
You'll also need to create a secret containing the bootstrap credentials before deployment. The secret must contain `INFISICAL_ADMIN_EMAIL` and `INFISICAL_ADMIN_PASSWORD` keys:
```bash
kubectl create secret generic infisical-bootstrap-credentials \
--from-literal=INFISICAL_ADMIN_EMAIL="[email protected]" \
--from-literal=INFISICAL_ADMIN_PASSWORD="your-secure-password" \
--namespace=release-namespace
```
### How It Works
The Helm chart auto bootstrap feature:
1. **Post-Install Hook**: Runs automatically after the main Infisical deployment is complete
2. **Readiness Check**: Uses an init container with curl to wait for Infisical to be ready by polling the `/api/status` endpoint
3. **Bootstrap Execution**: Uses the Infisical CLI to bootstrap the instance
4. **Kubernetes Secret Creation**: Creates a Kubernetes secret directly via the Kubernetes API using the rendered template
5. **RBAC**: Automatically configures the necessary permissions (`get`, `create`, `update` on secrets) for the bootstrap job
### Template System
The `secretTemplate` field allows you to customize the data section of the created Kubernetes secret. The template has access to the full bootstrap response with the following available data fields:
- `{{ .Identity.Credentials.Token }}`: The admin machine identity token
- `{{ .Identity.ID }}`: The identity ID
- `{{ .Identity.Name }}`: The identity name
- `{{ .Organization.ID }}`: The organization ID
- `{{ .Organization.Name }}`: The organization name
- `{{ .Organization.Slug }}`: The organization slug
- `{{ .User.Email }}`: The admin user email
- `{{ .User.ID }}`: The admin user ID
- `{{ .User.FirstName }}`: The admin user first name
- `{{ .User.LastName }}`: The admin user last name
The template also supports the `encodeBase64` function for base64 encoding values.
Example template for storing multiple values:
```yaml
secretTemplate: |
{
"data": {
"infisical_token": "{{ .Identity.Credentials.Token }}",
"admin_email": "{{ .User.Email }}",
"organization": "{{ .Organization.Name }}"
}
}
```
### Benefits
- **Zero-Touch Deployment**: Complete Infisical setup without manual intervention
- **Infrastructure as Code**: Bootstrap configuration is versioned with your Helm values
- **Secure Token Storage**: Admin identity credentials are immediately stored in Kubernetes secrets
- **Integration Ready**: The created secret can be referenced by other applications or automation tools
### Security Considerations
- The bootstrap job requires permissions to create secrets in the specified namespace
- Bootstrap credentials should be stored securely and rotated regularly
- The generated admin token has full instance privileges and should be protected accordingly
- Consider using Kubernetes RBAC to restrict access to the generated secret
</Tab>
</Tabs>
## API Response Structure
The bootstrap process returns a JSON response with details about the created user, organization, and machine identity:
```json
{
"identity": {
"credentials": {
"token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZGVudGl0eUlkIjoiZGIyMjQ3OTItZWQxOC00Mjc3LTlkYWUtNTdlNzUyMzE1ODU0IiwiaWRlbnRpdHlBY2Nlc3NUb2tlbklkIjoiZmVkZmZmMGEtYmU3Yy00NjViLWEwZWEtZjM5OTNjMTg4OGRlIiwiYXV0aFRva2VuVHlwZSI6ImlkZW50aXR5QWNjZXNzVG9rZW4iLCJpYXQiOjE3NDIzMjI0ODl9.mqcZZqIFqER1e9ubrQXp8FbzGYi8nqqZwfMvz09g-8Y"
},
"id": "db224792-ed18-4277-9dae-57e752315854",
"name": "Instance Admin Identity"
},
"message": "Successfully bootstrapped instance",
"organization": {
"id": "b56bece0-42f5-4262-b25e-be7bf5f84957",
"name": "dog",
"slug": "dog-v-e5l"
},
"user": {
"email": "[email protected]",
"firstName": "Admin",
"id": "a418f355-c8da-453c-bbc8-6c07208eeb3c",
"lastName": "User",
"superAdmin": true,
"username": "[email protected]"
}
}
```
## Using the Instance Admin Machine Identity Token
The bootstrap process automatically creates a machine identity with Token Auth configured. The returned token has instance-level admin privileges (the highest level of access) and should be treated with the same security considerations as a root credential.