mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-09-22 13:39:35 +00:00
catch up with main
This commit is contained in:
Tuan Dang
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Available"
|
||||
openapi: "GET /api/v1/app-connections/chef/available"
|
||||
---
|
||||
10
docs/api-reference/endpoints/app-connections/chef/create.mdx
Normal file
10
docs/api-reference/endpoints/app-connections/chef/create.mdx
Normal file
@@ -0,0 +1,10 @@
|
||||
---
|
||||
title: "Create"
|
||||
openapi: "POST /api/v1/app-connections/chef"
|
||||
---
|
||||
|
||||
<Note>
|
||||
Check out the configuration docs for [Chef
|
||||
Connections](/integrations/app-connections/chef) to learn how to obtain the
|
||||
required credentials.
|
||||
</Note>
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Delete"
|
||||
openapi: "DELETE /api/v1/app-connections/chef/{connectionId}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Get by ID"
|
||||
openapi: "GET /api/v1/app-connections/chef/{connectionId}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Get by Name"
|
||||
openapi: "GET /api/v1/app-connections/chef/connection-name/{connectionName}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "List"
|
||||
openapi: "GET /api/v1/app-connections/chef"
|
||||
---
|
||||
10
docs/api-reference/endpoints/app-connections/chef/update.mdx
Normal file
10
docs/api-reference/endpoints/app-connections/chef/update.mdx
Normal file
@@ -0,0 +1,10 @@
|
||||
---
|
||||
title: "Update"
|
||||
openapi: "PATCH /api/v1/app-connections/chef/{connectionId}"
|
||||
---
|
||||
|
||||
<Note>
|
||||
Check out the configuration docs for [Chef
|
||||
Connections](/integrations/app-connections/chef) to learn how to obtain the
|
||||
required credentials.
|
||||
</Note>
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Create"
|
||||
openapi: "POST /api/v1/secret-syncs/chef"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Delete"
|
||||
openapi: "DELETE /api/v1/secret-syncs/chef/{syncId}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Get by ID"
|
||||
openapi: "GET /api/v1/secret-syncs/chef/{syncId}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Get by Name"
|
||||
openapi: "GET /api/v1/secret-syncs/chef/sync-name/{syncName}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Import Secrets"
|
||||
openapi: "POST /api/v1/secret-syncs/chef/{syncId}/import-secrets"
|
||||
---
|
||||
4
docs/api-reference/endpoints/secret-syncs/chef/list.mdx
Normal file
4
docs/api-reference/endpoints/secret-syncs/chef/list.mdx
Normal file
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "List"
|
||||
openapi: "GET /api/v1/secret-syncs/chef"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Remove Secrets"
|
||||
openapi: "POST /api/v1/secret-syncs/chef/{syncId}/remove-secrets"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Sync Secrets"
|
||||
openapi: "POST /api/v1/secret-syncs/chef/{syncId}/sync-secrets"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Update"
|
||||
openapi: "PATCH /api/v1/secret-syncs/chef/{syncId}"
|
||||
---
|
||||
@@ -114,6 +114,7 @@
|
||||
"integrations/app-connections/bitbucket",
|
||||
"integrations/app-connections/camunda",
|
||||
"integrations/app-connections/checkly",
|
||||
"integrations/app-connections/chef",
|
||||
"integrations/app-connections/cloudflare",
|
||||
"integrations/app-connections/databricks",
|
||||
"integrations/app-connections/digital-ocean",
|
||||
@@ -540,6 +541,7 @@
|
||||
"integrations/secret-syncs/bitbucket",
|
||||
"integrations/secret-syncs/camunda",
|
||||
"integrations/secret-syncs/checkly",
|
||||
"integrations/secret-syncs/chef",
|
||||
"integrations/secret-syncs/cloudflare-pages",
|
||||
"integrations/secret-syncs/cloudflare-workers",
|
||||
"integrations/secret-syncs/databricks",
|
||||
@@ -814,7 +816,10 @@
|
||||
"groups": [
|
||||
{
|
||||
"group": "Infisical PAM",
|
||||
"pages": ["documentation/platform/pam/overview"]
|
||||
"pages": [
|
||||
"documentation/platform/pam/overview",
|
||||
"documentation/platform/pam/session-recording"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -1690,6 +1695,18 @@
|
||||
"api-reference/endpoints/app-connections/checkly/delete"
|
||||
]
|
||||
},
|
||||
{
|
||||
"group": "Chef",
|
||||
"pages": [
|
||||
"api-reference/endpoints/app-connections/chef/list",
|
||||
"api-reference/endpoints/app-connections/chef/available",
|
||||
"api-reference/endpoints/app-connections/chef/get-by-id",
|
||||
"api-reference/endpoints/app-connections/chef/get-by-name",
|
||||
"api-reference/endpoints/app-connections/chef/create",
|
||||
"api-reference/endpoints/app-connections/chef/update",
|
||||
"api-reference/endpoints/app-connections/chef/delete"
|
||||
]
|
||||
},
|
||||
{
|
||||
"group": "Cloudflare",
|
||||
"pages": [
|
||||
@@ -2181,6 +2198,20 @@
|
||||
"api-reference/endpoints/secret-syncs/checkly/remove-secrets"
|
||||
]
|
||||
},
|
||||
{
|
||||
"group": "Chef",
|
||||
"pages": [
|
||||
"api-reference/endpoints/secret-syncs/chef/list",
|
||||
"api-reference/endpoints/secret-syncs/chef/get-by-id",
|
||||
"api-reference/endpoints/secret-syncs/chef/get-by-name",
|
||||
"api-reference/endpoints/secret-syncs/chef/create",
|
||||
"api-reference/endpoints/secret-syncs/chef/update",
|
||||
"api-reference/endpoints/secret-syncs/chef/delete",
|
||||
"api-reference/endpoints/secret-syncs/chef/sync-secrets",
|
||||
"api-reference/endpoints/secret-syncs/chef/import-secrets",
|
||||
"api-reference/endpoints/secret-syncs/chef/remove-secrets"
|
||||
]
|
||||
},
|
||||
{
|
||||
"group": "Cloudflare Pages",
|
||||
"pages": [
|
||||
@@ -2336,6 +2367,7 @@
|
||||
"api-reference/endpoints/secret-syncs/laravel-forge/update",
|
||||
"api-reference/endpoints/secret-syncs/laravel-forge/delete",
|
||||
"api-reference/endpoints/secret-syncs/laravel-forge/sync-secrets",
|
||||
"api-reference/endpoints/secret-syncs/laravel-forge/import-secrets",
|
||||
"api-reference/endpoints/secret-syncs/laravel-forge/remove-secrets"
|
||||
]
|
||||
},
|
||||
|
||||
@@ -24,9 +24,11 @@ Infisical is designed to provide comprehensive, centralized, and efficient manag
|
||||
### 2. Projects
|
||||
|
||||
- **Definition and Role**: [Projects](/documentation/platform/project) are the highest-level construct within an [organization](/documentation/platform/organization) in Infisical. They serve as the primary container for all functionalities.
|
||||
- **Correspondence to Code Repositories**: Projects typically align with specific code repositories.
|
||||
- **Common Project Mappings**: Projects typically align with applications, services, or code repositories — each being a valid and common approach depending on your organizational structure.
|
||||
- **Functional Capabilities**: Each project encompasses features for managing secrets, certificates, and encryption keys, serving as the central hub for these resources.
|
||||
|
||||
<Note>Projects are isolated from one another. Secrets, certificates, and other resources cannot be shared or referenced across different projects. Each project maintains its own separate set of resources.</Note>
|
||||
|
||||
### 3. Environments
|
||||
|
||||
- **Purpose**: Environments are designed for organizing and compartmentalizing secrets within projects.
|
||||
@@ -40,8 +42,9 @@ Infisical is designed to provide comprehensive, centralized, and efficient manag
|
||||
|
||||
### 5. Imports
|
||||
|
||||
- **Purpose and Benefits**: To promote reusability and avoid redundancy, Infisical supports the use of imports. This allows secrets, folders, or entire environments to be referenced across multiple projects as needed.
|
||||
- **Best Practice**: Utilizing [secret imports](/documentation/platform/secret-reference#secret-imports) or [references](/documentation/platform/secret-reference#secret-referencing) ensures consistency and minimizes manual overhead.
|
||||
- **Purpose and Benefits**: To promote reusability and avoid redundancy within a project, Infisical supports the use of imports and references. This allows secrets, folders, or entire environments to be referenced within the same project as needed.
|
||||
- **Project Isolation**: Imports and references only work within a single project. Secrets cannot be imported or referenced across different projects, as projects are isolated from one another.
|
||||
- **Best Practice**: Utilizing [secret imports](/documentation/platform/secret-reference#secret-imports) or [references](/documentation/platform/secret-reference#secret-referencing) ensures consistency and minimizes manual overhead when managing secrets within a project.
|
||||
|
||||
### 6. Approval Workflows
|
||||
|
||||
|
||||
60
docs/documentation/platform/pam/session-recording.mdx
Normal file
60
docs/documentation/platform/pam/session-recording.mdx
Normal file
@@ -0,0 +1,60 @@
|
||||
---
|
||||
title: "Session Recording"
|
||||
sidebarTitle: "Session Recording"
|
||||
description: "Learn how Infisical records and stores session activity for auditing and monitoring."
|
||||
---
|
||||
|
||||
Infisical's Privileged Access Management (PAM) provides robust session recording capabilities to help you audit and monitor user activity across your infrastructure.
|
||||
|
||||
## How It Works
|
||||
|
||||
When a user initiates a session through the Infisical Gateway, a recording of the session begins. The gateway securely caches all recording data in temporary encrypted files on its local system.
|
||||
|
||||
Once the session concludes, the gateway transmits the complete recording to the Infisical platform for long-term, centralized storage. This asynchronous process ensures that sessions remain operational even if the connection to the Infisical platform is temporarily lost. After the upload is complete, administrators can search and review the session logs in the Infisical UI.
|
||||
|
||||
## What's Captured
|
||||
|
||||
The content captured during a session depends on the type of resource being accessed.
|
||||
|
||||
### Database Sessions
|
||||
|
||||
For database connections, Infisical captures all queries executed and their corresponding responses.
|
||||
|
||||
<Note>
|
||||
Support for additional resource types like SSH and RDP is coming soon.
|
||||
</Note>
|
||||
|
||||
## Viewing Recordings
|
||||
|
||||
To review session recordings:
|
||||
|
||||
1. Navigate to the **PAM Sessions** page in your project.
|
||||
2. Click on a session from the list to view its details.
|
||||
|
||||
|
||||
|
||||
The session details page provides key information, including the complete session logs, connection status, the user who initiated it, and more.
|
||||
|
||||
|
||||
|
||||
### Searching Logs
|
||||
|
||||
You can use the search bar to quickly find relevant information:
|
||||
|
||||
- **On the main Sessions page:** Search across all session logs to locate specific queries or outputs.
|
||||
- **On an individual session page:** Search within that specific session's logs to pinpoint activity.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## FAQ
|
||||
|
||||
<AccordionGroup>
|
||||
<Accordion title="Are session recordings encrypted?">
|
||||
Yes. All session recordings are encrypted at rest by default, ensuring your audit data is always secure.
|
||||
</Accordion>
|
||||
<Accordion title="Why aren't recordings streamed in real-time?">
|
||||
Currently, Infisical uses an asynchronous approach where the gateway records the entire session locally before uploading it. This design makes your PAM sessions more resilient, as they don't depend on a constant, active connection to the Infisical platform. We may introduce live streaming capabilities in a future release.
|
||||
</Accordion>
|
||||
</AccordionGroup>
|
||||
@@ -28,46 +28,54 @@ This section walks you through the complete end-to-end process of setting up Azu
|
||||
**Certificate Authority** to access the external CAs page. 
|
||||
</Step>
|
||||
<Step title="Create New Azure ADCS Certificate Service CA">
|
||||
Click **Create CA** and configure: - **Type**: Choose **Azure AD Certificate
|
||||
Service** - **Name**: Friendly name for this CA (e.g., "Production ADCS CA") -
|
||||
**App Connection**: Choose your ADCS connection from the dropdown 
|
||||
</Step>
|
||||
<Step title="Certificate Authority Created">
|
||||
Once created, your Azure ADCS Certificate Authority will appear in the list
|
||||
and be ready for use. 
|
||||
</Step>
|
||||
<Step title="Navigate to Subscribers">
|
||||
Go to **Subscribers** to access the subscribers page. 
|
||||
</Step>
|
||||
<Step title="Create New Subscriber">
|
||||
Click **Add Subscriber** and configure: - **Name**: Unique subscriber name
|
||||
(e.g., "web-server-certs") - **Certificate Authority**: Select your ADCS CA -
|
||||
**Common Name**: Certificate CN (e.g., "api.example.com") - **Certificate
|
||||
Template**: Select from dynamically loaded ADCS templates - **Subject
|
||||
Alternative Names**: DNS names, IP addresses, or email addresses - **TTL**:
|
||||
Certificate validity period (e.g., "1y" for 1 year) - **Additional Subject
|
||||
Fields**: Organization, OU, locality, state, country, email (if required by
|
||||
template) 
|
||||
</Step>
|
||||
<Step title="Subscriber Created">
|
||||
Your subscriber is now created and ready to issue certificates. 
|
||||
</Step>
|
||||
<Step title="Issue New Certificate">
|
||||
Click into your subscriber and click **Order Certificate** to generate a new
|
||||
certificate using your ADCS template. 
|
||||
</Step>
|
||||
<Step title="Certificate Created">
|
||||
Your certificate has been successfully issued by the ADCS server and is ready
|
||||
for use. 
|
||||
</Step>
|
||||
|
||||
<Step title="Create New Azure ADCS Certificate Service CA">
|
||||
Click **Create CA** and configure: - **Type**: Choose **Active Directory
|
||||
Certificate Services (AD CS)** - **Name**: Friendly name for this CA (e.g.,
|
||||
"Production ADCS CA") - **App Connection**: Choose your ADCS connection from
|
||||
the dropdown 
|
||||
</Step>
|
||||
|
||||
<Step title="Certificate Authority Created">
|
||||
Once created, your Azure ADCS Certificate Authority will appear in the list
|
||||
and be ready for use. 
|
||||
</Step>
|
||||
|
||||
<Step title="Navigate to Subscribers">
|
||||
Go to **Subscribers** to access the subscribers page. 
|
||||
</Step>
|
||||
|
||||
<Step title="Create New Subscriber">
|
||||
Click **Add Subscriber** and configure: - **Name**: Unique subscriber name
|
||||
(e.g., "web-server-certs") - **Certificate Authority**: Select your ADCS CA
|
||||
- **Common Name**: Certificate CN (e.g., "api.example.com") - **Certificate
|
||||
Template**: Select from dynamically loaded ADCS templates - **Subject
|
||||
Alternative Names**: DNS names, IP addresses, or email addresses - **TTL**:
|
||||
Certificate validity period (e.g., "1y" for 1 year) - **Additional Subject
|
||||
Fields**: Organization, OU, locality, state, country, email (if required by
|
||||
template) 
|
||||
</Step>
|
||||
|
||||
<Step title="Subscriber Created">
|
||||
Your subscriber is now created and ready to issue certificates. 
|
||||
</Step>
|
||||
|
||||
<Step title="Issue New Certificate">
|
||||
Click into your subscriber and click **Order Certificate** to generate a new
|
||||
certificate using your ADCS template. 
|
||||
</Step>
|
||||
|
||||
<Step title="Certificate Created">
|
||||
Your certificate has been successfully issued by the ADCS server and is
|
||||
ready for use. 
|
||||
</Step>
|
||||
|
||||
<Step title="View Certificate Details">
|
||||
Navigate to **Certificates** to view detailed information about all issued
|
||||
|
||||
BIN
docs/images/app-connections/chef/app-connection-form.png
Normal file
BIN
docs/images/app-connections/chef/app-connection-form.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 254 KiB |
BIN
docs/images/app-connections/chef/app-connection-generated.png
Normal file
BIN
docs/images/app-connections/chef/app-connection-generated.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 160 KiB |
BIN
docs/images/app-connections/chef/app-connection-option.png
Normal file
BIN
docs/images/app-connections/chef/app-connection-option.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 159 KiB |
BIN
docs/images/app-connections/chef/chef-connection-details.png
Normal file
BIN
docs/images/app-connections/chef/chef-connection-details.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 90 KiB |
BIN
docs/images/app-connections/chef/chef-dashboard.png
Normal file
BIN
docs/images/app-connections/chef/chef-dashboard.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 106 KiB |
BIN
docs/images/app-connections/chef/chef-folder.png
Normal file
BIN
docs/images/app-connections/chef/chef-folder.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 35 KiB |
BIN
docs/images/app-connections/chef/download-starter-kit.png
Normal file
BIN
docs/images/app-connections/chef/download-starter-kit.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 198 KiB |
BIN
docs/images/app-connections/chef/extract-starter-kit.png
Normal file
BIN
docs/images/app-connections/chef/extract-starter-kit.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 24 KiB |
BIN
docs/images/app-connections/chef/private-key-file.png
Normal file
BIN
docs/images/app-connections/chef/private-key-file.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 24 KiB |
BIN
docs/images/app-connections/chef/starter-kit.png
Normal file
BIN
docs/images/app-connections/chef/starter-kit.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 119 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 415 KiB |
BIN
docs/images/pam/session-recording/individual-session-page.png
Normal file
BIN
docs/images/pam/session-recording/individual-session-page.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 462 KiB |
BIN
docs/images/pam/session-recording/sessions-page-search.png
Normal file
BIN
docs/images/pam/session-recording/sessions-page-search.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 500 KiB |
BIN
docs/images/pam/session-recording/sessions-page.png
Normal file
BIN
docs/images/pam/session-recording/sessions-page.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 570 KiB |
BIN
docs/images/secret-syncs/chef/select-option.png
Normal file
BIN
docs/images/secret-syncs/chef/select-option.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 156 KiB |
BIN
docs/images/secret-syncs/chef/sync-created.png
Normal file
BIN
docs/images/secret-syncs/chef/sync-created.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 196 KiB |
BIN
docs/images/secret-syncs/chef/sync-destination.png
Normal file
BIN
docs/images/secret-syncs/chef/sync-destination.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 199 KiB |
BIN
docs/images/secret-syncs/chef/sync-details.png
Normal file
BIN
docs/images/secret-syncs/chef/sync-details.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 199 KiB |
BIN
docs/images/secret-syncs/chef/sync-options.png
Normal file
BIN
docs/images/secret-syncs/chef/sync-options.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 247 KiB |
BIN
docs/images/secret-syncs/chef/sync-review.png
Normal file
BIN
docs/images/secret-syncs/chef/sync-review.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 226 KiB |
BIN
docs/images/secret-syncs/chef/sync-source.png
Normal file
BIN
docs/images/secret-syncs/chef/sync-source.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 207 KiB |
150
docs/integrations/app-connections/chef.mdx
Normal file
150
docs/integrations/app-connections/chef.mdx
Normal file
@@ -0,0 +1,150 @@
|
||||
---
|
||||
title: "Chef Connection"
|
||||
description: "Learn how to configure a Chef Connection for Infisical."
|
||||
---
|
||||
|
||||
<Info>
|
||||
Chef App Connection is a paid feature.
|
||||
|
||||
If you're using Infisical Cloud, then it is available under the **Enterprise Tier**. If you're self-hosting Infisical,
|
||||
then you should contact team@infisical.com to purchase an enterprise license to use it.
|
||||
|
||||
</Info>
|
||||
|
||||
Infisical supports the use of User Private Key to connect with Chef Server.
|
||||
|
||||
Please access your **starter kit** to get all the required information to create a Chef Connection.
|
||||
|
||||
<Accordion title="If you don't have a starter kit">
|
||||
<Warning>
|
||||
If you download a new starter kit, your previous private key/user key will
|
||||
no longer be valid. Please make sure to update all the places that use the
|
||||
previous private key.
|
||||
</Warning>
|
||||
<Steps>
|
||||
<Step title="Navigate to your Chef Server Dashboard, and click on the 'Organizations' tab">
|
||||
|
||||
</Step>
|
||||
<Step title="Click on the organization you want to connect to, and then click on the 'Starter Kit' button">
|
||||
|
||||
</Step>
|
||||
<Step title="Click on the 'Download Starter Kit' button to download the starter kit">
|
||||
|
||||
</Step>
|
||||
<Step title='Download the starter kit zip file and extract the contents'>
|
||||
|
||||
</Step>
|
||||
</Steps>
|
||||
</Accordion>
|
||||
|
||||
<Steps>
|
||||
<Step title="Open your starter kit's folder">
|
||||
Open your starter kit's folder(or `chef-repo`) and navigate to the `.chef`
|
||||
folder.
|
||||
<Note>
|
||||
Please make sure you have hidden files visible in your file explorer.
|
||||
</Note>
|
||||
|
||||
</Step>
|
||||
<Step title='Copy the private key'>
|
||||
In the `.chef` folder, you will find a `[your-username].pem` file. 
|
||||
|
||||
**Private Key:** Copy the content of the private key file.
|
||||
|
||||
</Step>
|
||||
<Step title='Open the config.rb file'>
|
||||
Open the `config.rb` file and copy the content of the file.
|
||||
|
||||
|
||||
**User Name(1):** The user name of the chef user.
|
||||
|
||||
**Server URL(2):** The server url of the chef server.
|
||||
|
||||
**Organization Name(3):** The organization name of the chef server.
|
||||
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
## Create a Chef Connection in Infisical via UI
|
||||
|
||||
<Tabs>
|
||||
<Tab title="Infisical UI">
|
||||
<Steps>
|
||||
<Step title="Navigate to App Connections">
|
||||
In your Infisical dashboard, navigate to the **App Connections** page in the desired project.
|
||||
|
||||
</Step>
|
||||
<Step title="Select Chef Connection">
|
||||
Click **+ Add Connection** and choose **Chef** Connection from the list of integrations.
|
||||
|
||||
</Step>
|
||||
<Step title="Fill out the Chef Connection form">
|
||||
Complete the form by providing:
|
||||
- A descriptive name for the connection
|
||||
- An optional description
|
||||
- Server URL(optional): The URL of the Chef server to connect with (defaults to https://api.chef.io)
|
||||
- Organization short name
|
||||
- User name
|
||||
- Private key: Your Chef user's private key (.pem file)
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Connection created">
|
||||
After submitting the form, your **Chef Connection** will be successfully created and ready to use with your Infisical project.
|
||||
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
</Tab>
|
||||
|
||||
<Tab title="API">
|
||||
To create a Chef Connection via API, send a request to the [Create Chef Connection](/api-reference/endpoints/app-connections/chef/create) endpoint.
|
||||
|
||||
### Sample request
|
||||
|
||||
```bash Request
|
||||
curl --request POST \
|
||||
--url https://app.infisical.com/api/v1/app-connections/chef \
|
||||
--header 'Content-Type: application/json' \
|
||||
--data '{
|
||||
"name": "my-chef-connection",
|
||||
"method": "user-key",
|
||||
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
|
||||
"credentials": {
|
||||
"orgName": "my-org",
|
||||
"userName": "my-user",
|
||||
"privateKey": "your-private-key"
|
||||
}
|
||||
}'
|
||||
```
|
||||
|
||||
### Sample response
|
||||
|
||||
```bash Response
|
||||
{
|
||||
"appConnection": {
|
||||
"id": "a1b2c3d4-5678-90ab-cdef-1234567890ab",
|
||||
"name": "my-chef-connection",
|
||||
"description": null,
|
||||
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
|
||||
"version": 1,
|
||||
"orgId": "abcdef12-3456-7890-abcd-ef1234567890",
|
||||
"createdAt": "2025-10-13T10:15:00.000Z",
|
||||
"updatedAt": "2025-10-13T10:15:00.000Z",
|
||||
"isPlatformManagedCredentials": false,
|
||||
"credentialsHash": "d41d8cd98f00b204e9800998ecf8427e",
|
||||
"app": "chef",
|
||||
"method": "user-key",
|
||||
"credentials": {
|
||||
"orgName": "my-org",
|
||||
"userName": "my-user",
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
</Tab>
|
||||
</Tabs>
|
||||
162
docs/integrations/secret-syncs/chef.mdx
Normal file
162
docs/integrations/secret-syncs/chef.mdx
Normal file
@@ -0,0 +1,162 @@
|
||||
---
|
||||
title: "Chef Sync"
|
||||
description: "Learn how to configure a Chef Sync for Infisical."
|
||||
---
|
||||
|
||||
<Info>
|
||||
Chef Sync is a paid feature.
|
||||
|
||||
If you're using Infisical Cloud, then it is available under the **Enterprise Tier**. If you're self-hosting Infisical,
|
||||
then you should contact team@infisical.com to purchase an enterprise license to use it.
|
||||
|
||||
</Info>
|
||||
|
||||
**Prerequisites:**
|
||||
|
||||
- Create a [Chef Connection](/integrations/app-connections/chef)
|
||||
|
||||
<Tabs>
|
||||
<Tab title="Infisical UI">
|
||||
<Steps>
|
||||
<Step title="Add Sync">
|
||||
Navigate to **Project** > **Integrations** and select the **Secret Syncs** tab. Click on the **Add Sync** button.
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Select 'Chef'">
|
||||
|
||||
</Step>
|
||||
<Step title="Configure source">
|
||||
Configure the **Source** from where secrets should be retrieved, then click **Next**.
|
||||
|
||||
|
||||
|
||||
- **Environment**: The project environment to retrieve secrets from.
|
||||
- **Secret Path**: The folder path to retrieve secrets from.
|
||||
|
||||
<Tip>
|
||||
If you need to sync secrets from multiple folder locations, check out [secret imports](/documentation/platform/secret-reference#secret-imports).
|
||||
</Tip>
|
||||
</Step>
|
||||
<Step title="Configure destination">
|
||||
Configure the **Destination** to where secrets should be deployed, then click **Next**.
|
||||
|
||||
|
||||
|
||||
- **Chef Connection**: The Chef Connection to authenticate with.
|
||||
- **Data Bag**: The Data Bag to sync secrets to.
|
||||
- **Data Bag Item**: The Data Bag Item to sync secrets to.
|
||||
</Step>
|
||||
<Step title="Configure Sync Options">
|
||||
Configure the **Sync Options** to specify how secrets should be synced, then click **Next**.
|
||||
|
||||
|
||||
|
||||
- **Initial Sync Behavior**: Determines how Infisical should resolve the initial sync.
|
||||
- **Overwrite Destination Secrets**: Removes any secrets at the destination endpoint not present in Infisical.
|
||||
- **Import Secrets (Prioritize Infisical)**: Imports secrets from the destination endpoint before syncing, prioritizing values from Infisical over Chef when keys conflict.
|
||||
- **Import Secrets (Prioritize Chef)**: Imports secrets from the destination endpoint before syncing, prioritizing values from Chef over Infisical when keys conflict.
|
||||
- **Key Schema**: Template that determines how secret names are transformed when syncing, using `{{secretKey}}` as a placeholder for the original secret name and `{{environment}}` for the environment.
|
||||
<Note>
|
||||
We highly recommend using a Key Schema to ensure that Infisical only manages the specific keys you intend, keeping everything else untouched.
|
||||
</Note>
|
||||
- **Auto-Sync Enabled**: If enabled, secrets will automatically be synced from the source location when changes occur. Disable to enforce manual syncing only.
|
||||
- **Disable Secret Deletion**: If enabled, Infisical will not remove secrets from the sync destination. Enable this option if you intend to manage some secrets manually outside of Infisical.
|
||||
</Step>
|
||||
<Step title="Configure details">
|
||||
Configure the **Details** of your Chef Sync, then click **Next**.
|
||||
|
||||
|
||||
|
||||
- **Name**: The name of your sync. Must be slug-friendly.
|
||||
- **Description**: An optional description for your sync.
|
||||
</Step>
|
||||
<Step title="Review configuration">
|
||||
Review your Chef Sync configuration, then click **Create Sync**.
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Sync created">
|
||||
If enabled, your Chef Sync will begin syncing your secrets to the destination endpoint.
|
||||
|
||||
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
</Tab>
|
||||
|
||||
<Tab title="API">
|
||||
To create a **Chef Sync**, make an API request to the [Create Chef Sync](/api-reference/endpoints/secret-syncs/chef/create) API endpoint.
|
||||
|
||||
### Sample request
|
||||
|
||||
```bash Request
|
||||
curl --request POST \
|
||||
--url https://app.infisical.com/api/v1/secret-syncs/chef \
|
||||
--header 'Content-Type: application/json' \
|
||||
--data '{
|
||||
"name": "my-chef-sync",
|
||||
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"description": "sync to chef site",
|
||||
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"environment": "dev",
|
||||
"secretPath": "/",
|
||||
"isEnabled": true,
|
||||
"isAutoSyncEnabled": true,
|
||||
"syncOptions": {
|
||||
"initialSyncBehavior": "overwrite-destination",
|
||||
"disableSecretDeletion": false
|
||||
},
|
||||
"destinationConfig": {
|
||||
"dataBagName": "my-data-bag",
|
||||
"dataBagItemName": "my-data-bag-item"
|
||||
}
|
||||
}'
|
||||
```
|
||||
|
||||
### Sample response
|
||||
|
||||
```bash Response
|
||||
{
|
||||
"secretSync": {
|
||||
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"name": "my-chef-sync",
|
||||
"description": "sync to chef site",
|
||||
"folderId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"createdAt": "2025-07-19T12:00:00Z",
|
||||
"updatedAt": "2025-07-19T12:00:00Z",
|
||||
"syncStatus": "succeeded",
|
||||
"lastSyncJobId": "job-1234",
|
||||
"lastSyncMessage": null,
|
||||
"lastSyncedAt": "2025-07-19T12:00:00Z",
|
||||
"syncOptions": {
|
||||
"initialSyncBehavior": "overwrite-destination",
|
||||
"disableSecretDeletion": false
|
||||
},
|
||||
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"connection": {
|
||||
"app": "chef",
|
||||
"name": "my-chef-connection",
|
||||
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
|
||||
},
|
||||
"environment": {
|
||||
"slug": "dev",
|
||||
"name": "Development",
|
||||
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
|
||||
},
|
||||
"folder": {
|
||||
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"path": "/"
|
||||
},
|
||||
"destination": "chef",
|
||||
"destinationConfig": {
|
||||
"dataBagName": "my-data-bag",
|
||||
"dataBagItemName": "my-data-bag-item"
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
</Tab>
|
||||
</Tabs>
|
||||
@@ -27,7 +27,9 @@ Both approaches provide the same metrics data in OTEL format, so you can choose
|
||||
- Access to deploy monitoring services (Prometheus, Grafana, etc.)
|
||||
- Basic understanding of Prometheus and Grafana
|
||||
|
||||
## Environment Variables
|
||||
## Setup
|
||||
|
||||
### Environment Variables
|
||||
|
||||
Configure the following environment variables in your Infisical backend:
|
||||
|
||||
@@ -37,287 +39,304 @@ OTEL_TELEMETRY_COLLECTION_ENABLED=true
|
||||
|
||||
# Choose export type: "prometheus" or "otlp"
|
||||
OTEL_EXPORT_TYPE=prometheus
|
||||
|
||||
# For OTLP push mode, also configure:
|
||||
# OTEL_EXPORT_OTLP_ENDPOINT=http://otel-collector:4318/v1/metrics
|
||||
# OTEL_COLLECTOR_BASIC_AUTH_USERNAME=your_collector_username
|
||||
# OTEL_COLLECTOR_BASIC_AUTH_PASSWORD=your_collector_password
|
||||
# OTEL_OTLP_PUSH_INTERVAL=30000
|
||||
```
|
||||
|
||||
**Note**: The `OTEL_COLLECTOR_BASIC_AUTH_USERNAME` and `OTEL_COLLECTOR_BASIC_AUTH_PASSWORD` values must match the credentials configured in your OpenTelemetry Collector's `basicauth/server` extension. These are not hardcoded values - you configure them in your collector configuration file.
|
||||
<Tabs>
|
||||
<Tab title="Pull-based Monitoring (Prometheus)">
|
||||
This approach exposes metrics on port 9464 at the `/metrics` endpoint, allowing Prometheus to scrape the data. The metrics are exposed in Prometheus format but originate from OpenTelemetry instrumentation.
|
||||
|
||||
## Option 1: Pull-based Monitoring (Prometheus)
|
||||
### Configuration
|
||||
|
||||
This approach exposes metrics on port 9464 at the `/metrics` endpoint, allowing Prometheus to scrape the data. The metrics are exposed in Prometheus format but originate from OpenTelemetry instrumentation.
|
||||
<Steps>
|
||||
<Step title="Enable Prometheus export in Infisical">
|
||||
```bash
|
||||
OTEL_TELEMETRY_COLLECTION_ENABLED=true
|
||||
OTEL_EXPORT_TYPE=prometheus
|
||||
```
|
||||
</Step>
|
||||
|
||||
### Configuration
|
||||
<Step title="Expose the metrics port">
|
||||
Expose the metrics port in your Infisical backend:
|
||||
|
||||
1. **Enable Prometheus export in Infisical**:
|
||||
- **Docker**: Expose port 9464
|
||||
- **Kubernetes**: Create a service exposing port 9464
|
||||
- **Other**: Ensure port 9464 is accessible to your monitoring stack
|
||||
</Step>
|
||||
|
||||
```bash
|
||||
OTEL_TELEMETRY_COLLECTION_ENABLED=true
|
||||
OTEL_EXPORT_TYPE=prometheus
|
||||
```
|
||||
|
||||
2. **Expose the metrics port** in your Infisical backend:
|
||||
|
||||
- **Docker**: Expose port 9464
|
||||
- **Kubernetes**: Create a service exposing port 9464
|
||||
- **Other**: Ensure port 9464 is accessible to your monitoring stack
|
||||
|
||||
3. **Create Prometheus configuration** (`prometheus.yml`):
|
||||
|
||||
```yaml
|
||||
global:
|
||||
scrape_interval: 30s
|
||||
evaluation_interval: 30s
|
||||
|
||||
scrape_configs:
|
||||
- job_name: "infisical"
|
||||
scrape_interval: 30s
|
||||
static_configs:
|
||||
- targets: ["infisical-backend:9464"] # Adjust hostname/port based on your deployment
|
||||
metrics_path: "/metrics"
|
||||
```
|
||||
|
||||
**Note**: Replace `infisical-backend:9464` with the actual hostname and port where your Infisical backend is running. This could be:
|
||||
|
||||
- **Docker Compose**: `infisical-backend:9464` (service name)
|
||||
- **Kubernetes**: `infisical-backend.default.svc.cluster.local:9464` (service name)
|
||||
- **Bare Metal**: `192.168.1.100:9464` (actual IP address)
|
||||
- **Cloud**: `your-infisical.example.com:9464` (domain name)
|
||||
|
||||
### Deployment Options
|
||||
|
||||
#### Docker Compose
|
||||
<Step title="Create Prometheus configuration">
|
||||
Create `prometheus.yml`:
|
||||
|
||||
```yaml
|
||||
services:
|
||||
global:
|
||||
scrape_interval: 30s
|
||||
evaluation_interval: 30s
|
||||
|
||||
scrape_configs:
|
||||
- job_name: "infisical"
|
||||
scrape_interval: 30s
|
||||
static_configs:
|
||||
- targets: ["infisical-backend:9464"] # Adjust hostname/port based on your deployment
|
||||
metrics_path: "/metrics"
|
||||
```
|
||||
|
||||
<Note>
|
||||
Replace `infisical-backend:9464` with the actual hostname and port where your Infisical backend is running. This could be:
|
||||
|
||||
- **Docker Compose**: `infisical-backend:9464` (service name)
|
||||
- **Kubernetes**: `infisical-backend.default.svc.cluster.local:9464` (service name)
|
||||
- **Bare Metal**: `192.168.1.100:9464` (actual IP address)
|
||||
- **Cloud**: `your-infisical.example.com:9464` (domain name)
|
||||
</Note>
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
### Deployment Options
|
||||
|
||||
Once you've configured Infisical to expose metrics, you'll need to deploy Prometheus to scrape and store them. Below are examples for different deployment environments. Choose the option that matches your infrastructure.
|
||||
|
||||
<Tabs>
|
||||
<Tab title="Docker Compose">
|
||||
```yaml
|
||||
services:
|
||||
prometheus:
|
||||
image: prom/prometheus:latest
|
||||
ports:
|
||||
- "9090:9090"
|
||||
volumes:
|
||||
- ./prometheus.yml:/etc/prometheus/prometheus.yml:ro
|
||||
command:
|
||||
- "--config.file=/etc/prometheus/prometheus.yml"
|
||||
|
||||
grafana:
|
||||
image: grafana/grafana:latest
|
||||
ports:
|
||||
- "3000:3000"
|
||||
environment:
|
||||
- GF_SECURITY_ADMIN_USER=admin
|
||||
- GF_SECURITY_ADMIN_PASSWORD=admin
|
||||
```
|
||||
</Tab>
|
||||
<Tab title="Kubernetes">
|
||||
```yaml
|
||||
# prometheus-deployment.yaml
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: prometheus
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: prometheus
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: prometheus
|
||||
spec:
|
||||
containers:
|
||||
- name: prometheus
|
||||
image: prom/prometheus:latest
|
||||
ports:
|
||||
- containerPort: 9090
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /etc/prometheus
|
||||
volumes:
|
||||
- name: config
|
||||
configMap:
|
||||
name: prometheus-config
|
||||
|
||||
---
|
||||
# prometheus-service.yaml
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: prometheus
|
||||
spec:
|
||||
selector:
|
||||
app: prometheus
|
||||
ports:
|
||||
- port: 9090
|
||||
targetPort: 9090
|
||||
type: ClusterIP
|
||||
```
|
||||
</Tab>
|
||||
<Tab title="Helm">
|
||||
```bash
|
||||
helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
|
||||
helm install prometheus prometheus-community/prometheus \
|
||||
--set server.config.global.scrape_interval=30s \
|
||||
--set server.config.scrape_configs[0].job_name=infisical \
|
||||
--set server.config.scrape_configs[0].static_configs[0].targets[0]=infisical-backend:9464
|
||||
```
|
||||
</Tab>
|
||||
</Tabs>
|
||||
|
||||
</Tab>
|
||||
<Tab title="Push-based Monitoring (OTLP)">
|
||||
This approach sends metrics directly to an OpenTelemetry Collector via the OTLP protocol. This gives you the most flexibility as you can configure the collector to export to multiple backends simultaneously.
|
||||
|
||||
### Configuration
|
||||
|
||||
<Steps>
|
||||
<Step title="Enable OTLP export in Infisical">
|
||||
```bash
|
||||
OTEL_TELEMETRY_COLLECTION_ENABLED=true
|
||||
OTEL_EXPORT_TYPE=otlp
|
||||
OTEL_EXPORT_OTLP_ENDPOINT=http://otel-collector:4318/v1/metrics
|
||||
OTEL_COLLECTOR_BASIC_AUTH_USERNAME=infisical
|
||||
OTEL_COLLECTOR_BASIC_AUTH_PASSWORD=infisical
|
||||
OTEL_OTLP_PUSH_INTERVAL=30000
|
||||
```
|
||||
</Step>
|
||||
|
||||
<Step title="Create OpenTelemetry Collector configuration">
|
||||
Create `otel-collector-config.yaml`:
|
||||
|
||||
```yaml
|
||||
extensions:
|
||||
health_check:
|
||||
pprof:
|
||||
zpages:
|
||||
basicauth/server:
|
||||
htpasswd:
|
||||
inline: |
|
||||
your_username:your_password
|
||||
|
||||
receivers:
|
||||
otlp:
|
||||
protocols:
|
||||
http:
|
||||
endpoint: 0.0.0.0:4318
|
||||
auth:
|
||||
authenticator: basicauth/server
|
||||
|
||||
prometheus:
|
||||
image: prom/prometheus:latest
|
||||
ports:
|
||||
- "9090:9090"
|
||||
volumes:
|
||||
- ./prometheus.yml:/etc/prometheus/prometheus.yml:ro
|
||||
command:
|
||||
- "--config.file=/etc/prometheus/prometheus.yml"
|
||||
config:
|
||||
scrape_configs:
|
||||
- job_name: otel-collector
|
||||
scrape_interval: 30s
|
||||
static_configs:
|
||||
- targets: [infisical-backend:9464]
|
||||
metric_relabel_configs:
|
||||
- action: labeldrop
|
||||
regex: "service_instance_id|service_name"
|
||||
|
||||
grafana:
|
||||
image: grafana/grafana:latest
|
||||
ports:
|
||||
- "3000:3000"
|
||||
environment:
|
||||
- GF_SECURITY_ADMIN_USER=admin
|
||||
- GF_SECURITY_ADMIN_PASSWORD=admin
|
||||
processors:
|
||||
batch:
|
||||
|
||||
exporters:
|
||||
prometheus:
|
||||
endpoint: "0.0.0.0:8889"
|
||||
auth:
|
||||
authenticator: basicauth/server
|
||||
resource_to_telemetry_conversion:
|
||||
enabled: true
|
||||
|
||||
service:
|
||||
extensions: [basicauth/server, health_check, pprof, zpages]
|
||||
pipelines:
|
||||
metrics:
|
||||
receivers: [otlp]
|
||||
processors: [batch]
|
||||
exporters: [prometheus]
|
||||
```
|
||||
|
||||
#### Kubernetes
|
||||
<Warning>
|
||||
Replace `your_username:your_password` with your chosen credentials. These must match the values you set in Infisical's `OTEL_COLLECTOR_BASIC_AUTH_USERNAME` and `OTEL_COLLECTOR_BASIC_AUTH_PASSWORD` environment variables.
|
||||
</Warning>
|
||||
</Step>
|
||||
|
||||
<Step title="Create Prometheus configuration">
|
||||
Create Prometheus configuration for the collector:
|
||||
|
||||
```yaml
|
||||
# prometheus-deployment.yaml
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: prometheus
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: prometheus
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: prometheus
|
||||
spec:
|
||||
containers:
|
||||
- name: prometheus
|
||||
image: prom/prometheus:latest
|
||||
ports:
|
||||
- containerPort: 9090
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /etc/prometheus
|
||||
volumes:
|
||||
- name: config
|
||||
configMap:
|
||||
name: prometheus-config
|
||||
global:
|
||||
scrape_interval: 30s
|
||||
evaluation_interval: 30s
|
||||
|
||||
---
|
||||
# prometheus-service.yaml
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: prometheus
|
||||
spec:
|
||||
selector:
|
||||
app: prometheus
|
||||
ports:
|
||||
- port: 9090
|
||||
targetPort: 9090
|
||||
type: ClusterIP
|
||||
scrape_configs:
|
||||
- job_name: "otel-collector"
|
||||
scrape_interval: 30s
|
||||
static_configs:
|
||||
- targets: ["otel-collector:8889"] # Adjust hostname/port based on your deployment
|
||||
metrics_path: "/metrics"
|
||||
```
|
||||
|
||||
#### Helm
|
||||
<Note>
|
||||
Replace `otel-collector:8889` with the actual hostname and port where your OpenTelemetry Collector is running. This could be:
|
||||
|
||||
```bash
|
||||
helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
|
||||
helm install prometheus prometheus-community/prometheus \
|
||||
--set server.config.global.scrape_interval=30s \
|
||||
--set server.config.scrape_configs[0].job_name=infisical \
|
||||
--set server.config.scrape_configs[0].static_configs[0].targets[0]=infisical-backend:9464
|
||||
```
|
||||
- **Docker Compose**: `otel-collector:8889` (service name)
|
||||
- **Kubernetes**: `otel-collector.default.svc.cluster.local:8889` (service name)
|
||||
- **Bare Metal**: `192.168.1.100:8889` (actual IP address)
|
||||
- **Cloud**: `your-collector.example.com:8889` (domain name)
|
||||
</Note>
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
## Option 2: Push-based Monitoring (OTLP)
|
||||
### Deployment Options
|
||||
|
||||
This approach sends metrics directly to an OpenTelemetry Collector via the OTLP protocol. This gives you the most flexibility as you can configure the collector to export to multiple backends simultaneously.
|
||||
After configuring Infisical and the OpenTelemetry Collector, you'll need to deploy the collector to receive metrics from Infisical. Below are examples for different deployment environments. Choose the option that matches your infrastructure.
|
||||
|
||||
### Configuration
|
||||
<Tabs>
|
||||
<Tab title="Docker Compose">
|
||||
```yaml
|
||||
services:
|
||||
otel-collector:
|
||||
image: otel/opentelemetry-collector-contrib:latest
|
||||
ports:
|
||||
- 4318:4318 # OTLP http receiver
|
||||
- 8889:8889 # Prometheus exporter metrics
|
||||
volumes:
|
||||
- ./otel-collector-config.yaml:/etc/otelcol-contrib/config.yaml:ro
|
||||
command:
|
||||
- "--config=/etc/otelcol-contrib/config.yaml"
|
||||
```
|
||||
</Tab>
|
||||
<Tab title="Kubernetes">
|
||||
```yaml
|
||||
# otel-collector-deployment.yaml
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: otel-collector
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: otel-collector
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: otel-collector
|
||||
spec:
|
||||
containers:
|
||||
- name: otel-collector
|
||||
image: otel/opentelemetry-collector-contrib:latest
|
||||
ports:
|
||||
- containerPort: 4318
|
||||
- containerPort: 8889
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /etc/otelcol-contrib
|
||||
volumes:
|
||||
- name: config
|
||||
configMap:
|
||||
name: otel-collector-config
|
||||
```
|
||||
</Tab>
|
||||
<Tab title="Helm">
|
||||
```bash
|
||||
helm repo add open-telemetry https://open-telemetry.github.io/opentelemetry-helm-charts
|
||||
helm install otel-collector open-telemetry/opentelemetry-collector \
|
||||
--set config.receivers.otlp.protocols.http.endpoint=0.0.0.0:4318 \
|
||||
--set config.exporters.prometheus.endpoint=0.0.0.0:8889
|
||||
```
|
||||
</Tab>
|
||||
</Tabs>
|
||||
|
||||
1. **Enable OTLP export in Infisical**:
|
||||
|
||||
```bash
|
||||
OTEL_TELEMETRY_COLLECTION_ENABLED=true
|
||||
OTEL_EXPORT_TYPE=otlp
|
||||
OTEL_EXPORT_OTLP_ENDPOINT=http://otel-collector:4318/v1/metrics
|
||||
OTEL_COLLECTOR_BASIC_AUTH_USERNAME=infisical
|
||||
OTEL_COLLECTOR_BASIC_AUTH_PASSWORD=infisical
|
||||
OTEL_OTLP_PUSH_INTERVAL=30000
|
||||
```
|
||||
|
||||
2. **Create OpenTelemetry Collector configuration** (`otel-collector-config.yaml`):
|
||||
|
||||
```yaml
|
||||
extensions:
|
||||
health_check:
|
||||
pprof:
|
||||
zpages:
|
||||
basicauth/server:
|
||||
htpasswd:
|
||||
inline: |
|
||||
your_username:your_password
|
||||
|
||||
receivers:
|
||||
otlp:
|
||||
protocols:
|
||||
http:
|
||||
endpoint: 0.0.0.0:4318
|
||||
auth:
|
||||
authenticator: basicauth/server
|
||||
|
||||
prometheus:
|
||||
config:
|
||||
scrape_configs:
|
||||
- job_name: otel-collector
|
||||
scrape_interval: 30s
|
||||
static_configs:
|
||||
- targets: [infisical-backend:9464]
|
||||
metric_relabel_configs:
|
||||
- action: labeldrop
|
||||
regex: "service_instance_id|service_name"
|
||||
|
||||
processors:
|
||||
batch:
|
||||
|
||||
exporters:
|
||||
prometheus:
|
||||
endpoint: "0.0.0.0:8889"
|
||||
auth:
|
||||
authenticator: basicauth/server
|
||||
resource_to_telemetry_conversion:
|
||||
enabled: true
|
||||
|
||||
service:
|
||||
extensions: [basicauth/server, health_check, pprof, zpages]
|
||||
pipelines:
|
||||
metrics:
|
||||
receivers: [otlp]
|
||||
processors: [batch]
|
||||
exporters: [prometheus]
|
||||
```
|
||||
|
||||
**Important**: Replace `your_username:your_password` with your chosen credentials. These must match the values you set in Infisical's `OTEL_COLLECTOR_BASIC_AUTH_USERNAME` and `OTEL_COLLECTOR_BASIC_AUTH_PASSWORD` environment variables.
|
||||
|
||||
3. **Create Prometheus configuration** for the collector:
|
||||
|
||||
```yaml
|
||||
global:
|
||||
scrape_interval: 30s
|
||||
evaluation_interval: 30s
|
||||
|
||||
scrape_configs:
|
||||
- job_name: "otel-collector"
|
||||
scrape_interval: 30s
|
||||
static_configs:
|
||||
- targets: ["otel-collector:8889"] # Adjust hostname/port based on your deployment
|
||||
metrics_path: "/metrics"
|
||||
```
|
||||
|
||||
**Note**: Replace `otel-collector:8889` with the actual hostname and port where your OpenTelemetry Collector is running. This could be:
|
||||
|
||||
- **Docker Compose**: `otel-collector:8889` (service name)
|
||||
- **Kubernetes**: `otel-collector.default.svc.cluster.local:8889` (service name)
|
||||
- **Bare Metal**: `192.168.1.100:8889` (actual IP address)
|
||||
- **Cloud**: `your-collector.example.com:8889` (domain name)
|
||||
|
||||
### Deployment Options
|
||||
|
||||
#### Docker Compose
|
||||
|
||||
```yaml
|
||||
services:
|
||||
otel-collector:
|
||||
image: otel/opentelemetry-collector-contrib:latest
|
||||
ports:
|
||||
- 4318:4318 # OTLP http receiver
|
||||
- 8889:8889 # Prometheus exporter metrics
|
||||
volumes:
|
||||
- ./otel-collector-config.yaml:/etc/otelcol-contrib/config.yaml:ro
|
||||
command:
|
||||
- "--config=/etc/otelcol-contrib/config.yaml"
|
||||
```
|
||||
|
||||
#### Kubernetes
|
||||
|
||||
```yaml
|
||||
# otel-collector-deployment.yaml
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: otel-collector
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: otel-collector
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: otel-collector
|
||||
spec:
|
||||
containers:
|
||||
- name: otel-collector
|
||||
image: otel/opentelemetry-collector-contrib:latest
|
||||
ports:
|
||||
- containerPort: 4318
|
||||
- containerPort: 8889
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /etc/otelcol-contrib
|
||||
volumes:
|
||||
- name: config
|
||||
configMap:
|
||||
name: otel-collector-config
|
||||
```
|
||||
|
||||
#### Helm
|
||||
|
||||
```bash
|
||||
helm repo add open-telemetry https://open-telemetry.github.io/opentelemetry-helm-charts
|
||||
helm install otel-collector open-telemetry/opentelemetry-collector \
|
||||
--set config.receivers.otlp.protocols.http.endpoint=0.0.0.0:4318 \
|
||||
--set config.exporters.prometheus.endpoint=0.0.0.0:8889
|
||||
```
|
||||
</Tab>
|
||||
</Tabs>
|
||||
|
||||
## Available Metrics
|
||||
|
||||
@@ -327,166 +346,211 @@ Infisical exposes the following key metrics in OpenTelemetry format:
|
||||
|
||||
These metrics track all HTTP API requests to Infisical, including request counts, latency, and errors. Use these to monitor overall API health, identify performance bottlenecks, and track usage patterns across users and machine identities.
|
||||
|
||||
#### Total API Requests
|
||||
<AccordionGroup>
|
||||
<Accordion title="Total API Requests">
|
||||
**Metric Name**: `infisical.http.server.request.count`
|
||||
|
||||
- **Metric Name**: `infisical.http.server.request.count`
|
||||
- **Type**: Counter
|
||||
- **Unit**: `{request}`
|
||||
- **Description**: Total number of API requests to Infisical (covers both human users and machine identities)
|
||||
- **Attributes**:
|
||||
- `infisical.organization.id` (string): Organization ID
|
||||
- `infisical.organization.name` (string): Organization name (e.g., "Platform Engineering Team")
|
||||
- `infisical.user.id` (string, optional): User ID if human user
|
||||
- `infisical.user.email` (string, optional): User email (e.g., "jane.doe@cisco.com")
|
||||
- `infisical.identity.id` (string, optional): Machine identity ID
|
||||
- `infisical.identity.name` (string, optional): Machine identity name (e.g., "prod-k8s-operator")
|
||||
- `infisical.auth.method` (string, optional): Auth method used
|
||||
- `http.request.method` (string): HTTP method (GET, POST, PUT, DELETE)
|
||||
- `http.route` (string): API endpoint route pattern
|
||||
- `http.response.status_code` (int): HTTP status code
|
||||
- `infisical.project.id` (string, optional): Project ID
|
||||
- `infisical.project.name` (string, optional): Project name
|
||||
- `user_agent.original` (string, optional): User agent string
|
||||
- `client.address` (string, optional): IP address
|
||||
**Type**: Counter
|
||||
|
||||
#### Request Duration
|
||||
**Unit**: `{request}`
|
||||
|
||||
- **Metric Name**: `infisical.http.server.request.duration`
|
||||
- **Type**: Histogram
|
||||
- **Unit**: `s` (seconds)
|
||||
- **Description**: API request latency
|
||||
- **Buckets**: [0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1, 2.5, 5, 10]
|
||||
- **Attributes**:
|
||||
- `infisical.organization.id` (string): Organization ID
|
||||
- `infisical.organization.name` (string): Organization name
|
||||
- `infisical.user.id` (string, optional): User ID if human user
|
||||
- `infisical.user.email` (string, optional): User email
|
||||
- `infisical.identity.id` (string, optional): Machine identity ID
|
||||
- `infisical.identity.name` (string, optional): Machine identity name
|
||||
- `http.request.method` (string): HTTP method
|
||||
- `http.route` (string): API endpoint route pattern
|
||||
- `http.response.status_code` (int): HTTP status code
|
||||
- `infisical.project.id` (string, optional): Project ID
|
||||
- `infisical.project.name` (string, optional): Project name
|
||||
**Description**: Total number of API requests to Infisical (covers both human users and machine identities)
|
||||
|
||||
#### API Errors by Actor
|
||||
**Attributes**:
|
||||
- `infisical.organization.id` (string): Organization ID
|
||||
- `infisical.organization.name` (string): Organization name (e.g., "Platform Engineering Team")
|
||||
- `infisical.user.id` (string, optional): User ID if human user
|
||||
- `infisical.user.email` (string, optional): User email (e.g., "jane.doe@cisco.com")
|
||||
- `infisical.identity.id` (string, optional): Machine identity ID
|
||||
- `infisical.identity.name` (string, optional): Machine identity name (e.g., "prod-k8s-operator")
|
||||
- `infisical.auth.method` (string, optional): Auth method used
|
||||
- `http.request.method` (string): HTTP method (GET, POST, PUT, DELETE)
|
||||
- `http.route` (string): API endpoint route pattern
|
||||
- `http.response.status_code` (int): HTTP status code
|
||||
- `infisical.project.id` (string, optional): Project ID
|
||||
- `infisical.project.name` (string, optional): Project name
|
||||
- `user_agent.original` (string, optional): User agent string
|
||||
- `client.address` (string, optional): IP address
|
||||
</Accordion>
|
||||
|
||||
- **Metric Name**: `infisical.http.server.error.count`
|
||||
- **Type**: Counter
|
||||
- **Unit**: `{error}`
|
||||
- **Description**: API errors grouped by actor (for identifying misconfigured services)
|
||||
- **Attributes**:
|
||||
- `infisical.organization.id` (string): Organization ID
|
||||
- `infisical.organization.name` (string): Organization name
|
||||
- `infisical.user.id` (string, optional): User ID if human
|
||||
- `infisical.user.email` (string, optional): User email
|
||||
- `infisical.identity.id` (string, optional): Identity ID if machine
|
||||
- `infisical.identity.name` (string, optional): Identity name
|
||||
- `http.route` (string): API endpoint where error occurred
|
||||
- `http.request.method` (string): HTTP method
|
||||
- `error.type` (string): Error category/type (client_error, server_error, auth_error, rate_limit_error, etc.)
|
||||
- `infisical.project.id` (string, optional): Project ID
|
||||
- `infisical.project.name` (string, optional): Project name
|
||||
- `client.address` (string, optional): IP address
|
||||
- `user_agent.original` (string, optional): User agent information
|
||||
<Accordion title="Request Duration">
|
||||
**Metric Name**: `infisical.http.server.request.duration`
|
||||
|
||||
**Type**: Histogram
|
||||
|
||||
**Unit**: `s` (seconds)
|
||||
|
||||
**Description**: API request latency
|
||||
|
||||
**Buckets**: [0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1, 2.5, 5, 10]
|
||||
|
||||
**Attributes**:
|
||||
- `infisical.organization.id` (string): Organization ID
|
||||
- `infisical.organization.name` (string): Organization name
|
||||
- `infisical.user.id` (string, optional): User ID if human user
|
||||
- `infisical.user.email` (string, optional): User email
|
||||
- `infisical.identity.id` (string, optional): Machine identity ID
|
||||
- `infisical.identity.name` (string, optional): Machine identity name
|
||||
- `http.request.method` (string): HTTP method
|
||||
- `http.route` (string): API endpoint route pattern
|
||||
- `http.response.status_code` (int): HTTP status code
|
||||
- `infisical.project.id` (string, optional): Project ID
|
||||
- `infisical.project.name` (string, optional): Project name
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="API Errors by Actor">
|
||||
**Metric Name**: `infisical.http.server.error.count`
|
||||
|
||||
**Type**: Counter
|
||||
|
||||
**Unit**: `{error}`
|
||||
|
||||
**Description**: API errors grouped by actor (for identifying misconfigured services)
|
||||
|
||||
**Attributes**:
|
||||
- `infisical.organization.id` (string): Organization ID
|
||||
- `infisical.organization.name` (string): Organization name
|
||||
- `infisical.user.id` (string, optional): User ID if human
|
||||
- `infisical.user.email` (string, optional): User email
|
||||
- `infisical.identity.id` (string, optional): Identity ID if machine
|
||||
- `infisical.identity.name` (string, optional): Identity name
|
||||
- `http.route` (string): API endpoint where error occurred
|
||||
- `http.request.method` (string): HTTP method
|
||||
- `error.type` (string): Error category/type (client_error, server_error, auth_error, rate_limit_error, etc.)
|
||||
- `infisical.project.id` (string, optional): Project ID
|
||||
- `infisical.project.name` (string, optional): Project name
|
||||
- `client.address` (string, optional): IP address
|
||||
- `user_agent.original` (string, optional): User agent information
|
||||
</Accordion>
|
||||
</AccordionGroup>
|
||||
|
||||
### Secret Operations Metrics
|
||||
|
||||
These metrics provide visibility into secret access patterns, helping you understand which secrets are being accessed, by whom, and from where. Essential for security auditing and access pattern analysis.
|
||||
|
||||
#### Secret Read Operations
|
||||
|
||||
- **Metric Name**: `infisical.secret.read.count`
|
||||
- **Type**: Counter
|
||||
- **Unit**: `{operation}`
|
||||
- **Description**: Number of secret read operations
|
||||
- **Attributes**:
|
||||
- `infisical.organization.id` (string): Organization ID
|
||||
- `infisical.organization.name` (string): Organization name
|
||||
- `infisical.project.id` (string): Project ID
|
||||
- `infisical.project.name` (string): Project name (e.g., "payment-service-secrets")
|
||||
- `infisical.environment` (string): Environment (dev, staging, prod)
|
||||
- `infisical.secret.path` (string): Path to secrets (e.g., "/microservice-a/database")
|
||||
- `infisical.secret.name` (string, optional): Name of secret
|
||||
- `infisical.user.id` (string, optional): User ID if human
|
||||
- `infisical.user.email` (string, optional): User email
|
||||
- `infisical.identity.id` (string, optional): Machine identity ID
|
||||
- `infisical.identity.name` (string, optional): Machine identity name
|
||||
- `user_agent.original` (string, optional): User agent/SDK information
|
||||
- `client.address` (string, optional): IP address
|
||||
<AccordionGroup>
|
||||
<Accordion title="Secret Read Operations">
|
||||
**Metric Name**: `infisical.secret.read.count`
|
||||
|
||||
**Type**: Counter
|
||||
|
||||
**Unit**: `{operation}`
|
||||
|
||||
**Description**: Number of secret read operations
|
||||
|
||||
**Attributes**:
|
||||
- `infisical.organization.id` (string): Organization ID
|
||||
- `infisical.organization.name` (string): Organization name
|
||||
- `infisical.project.id` (string): Project ID
|
||||
- `infisical.project.name` (string): Project name (e.g., "payment-service-secrets")
|
||||
- `infisical.environment` (string): Environment (dev, staging, prod)
|
||||
- `infisical.secret.path` (string): Path to secrets (e.g., "/microservice-a/database")
|
||||
- `infisical.secret.name` (string, optional): Name of secret
|
||||
- `infisical.user.id` (string, optional): User ID if human
|
||||
- `infisical.user.email` (string, optional): User email
|
||||
- `infisical.identity.id` (string, optional): Machine identity ID
|
||||
- `infisical.identity.name` (string, optional): Machine identity name
|
||||
- `user_agent.original` (string, optional): User agent/SDK information
|
||||
- `client.address` (string, optional): IP address
|
||||
</Accordion>
|
||||
</AccordionGroup>
|
||||
|
||||
### Authentication Metrics
|
||||
|
||||
These metrics track authentication attempts and outcomes, enabling you to monitor login success rates, detect potential security threats, and identify authentication issues.
|
||||
|
||||
#### Login Attempts
|
||||
|
||||
- **Metric Name**: `infisical.auth.attempt.count`
|
||||
- **Type**: Counter
|
||||
- **Unit**: `{attempt}`
|
||||
- **Description**: Authentication attempts (both successful and failed)
|
||||
- **Attributes**:
|
||||
- `infisical.organization.id` (string): Organization ID
|
||||
- `infisical.organization.name` (string): Organization name
|
||||
- `infisical.user.id` (string, optional): User ID if human (if identifiable)
|
||||
- `infisical.user.email` (string, optional): User email (if identifiable)
|
||||
- `infisical.identity.id` (string, optional): Identity ID if machine (if identifiable)
|
||||
- `infisical.identity.name` (string, optional): Identity name (if identifiable)
|
||||
- `infisical.auth.method` (string): Authentication method attempted
|
||||
- `infisical.auth.result` (string): success or failure
|
||||
- `error.type` (string, optional): Reason for failure if failed (invalid_credentials, expired_token, invalid_token, etc.)
|
||||
- `client.address` (string): IP address
|
||||
- `user_agent.original` (string, optional): User agent/client information
|
||||
- `infisical.auth.attempt.username` (string, optional): Attempted username/email (if available)
|
||||
|
||||
### Legacy Metrics
|
||||
|
||||
These metrics are from the previous instrumentation and may be deprecated in future versions. Consider migrating to the new Core API Metrics for more comprehensive observability.
|
||||
|
||||
- `API_latency` - API request latency histogram in milliseconds (Labels: `route`, `method`, `statusCode`)
|
||||
- `API_errors` - API error count histogram (Labels: `route`, `method`, `type`, `name`)
|
||||
<AccordionGroup>
|
||||
<Accordion title="Login Attempts">
|
||||
**Metric Name**: `infisical.auth.attempt.count`
|
||||
|
||||
**Type**: Counter
|
||||
|
||||
**Unit**: `{attempt}`
|
||||
|
||||
**Description**: Authentication attempts (both successful and failed)
|
||||
|
||||
**Attributes**:
|
||||
- `infisical.organization.id` (string): Organization ID
|
||||
- `infisical.organization.name` (string): Organization name
|
||||
- `infisical.user.id` (string, optional): User ID if human (if identifiable)
|
||||
- `infisical.user.email` (string, optional): User email (if identifiable)
|
||||
- `infisical.identity.id` (string, optional): Identity ID if machine (if identifiable)
|
||||
- `infisical.identity.name` (string, optional): Identity name (if identifiable)
|
||||
- `infisical.auth.method` (string): Authentication method attempted
|
||||
- `infisical.auth.result` (string): success or failure
|
||||
- `error.type` (string, optional): Reason for failure if failed (invalid_credentials, expired_token, invalid_token, etc.)
|
||||
- `client.address` (string): IP address
|
||||
- `user_agent.original` (string, optional): User agent/client information
|
||||
- `infisical.auth.attempt.username` (string, optional): Attempted username/email (if available)
|
||||
</Accordion>
|
||||
</AccordionGroup>
|
||||
|
||||
### Integration & Secret Sync Metrics
|
||||
|
||||
These metrics monitor secret synchronization operations between Infisical and external systems, helping you track sync health, identify integration failures, and troubleshoot connectivity issues.
|
||||
|
||||
- `integration_secret_sync_errors` - Integration secret sync error count
|
||||
<AccordionGroup>
|
||||
<Accordion title="integration_secret_sync_errors">
|
||||
Integration secret sync error count
|
||||
|
||||
- **Labels**: `version`, `integration`, `integrationId`, `type`, `status`, `name`, `projectId`
|
||||
- **Example**: Monitor integration sync failures across different services
|
||||
- **Labels**: `version`, `integration`, `integrationId`, `type`, `status`, `name`, `projectId`
|
||||
- **Example**: Monitor integration sync failures across different services
|
||||
</Accordion>
|
||||
|
||||
- `secret_sync_sync_secrets_errors` - Secret sync operation error count
|
||||
<Accordion title="secret_sync_sync_secrets_errors">
|
||||
Secret sync operation error count
|
||||
|
||||
- **Labels**: `version`, `destination`, `syncId`, `projectId`, `type`, `status`, `name`
|
||||
- **Example**: Track secret sync failures to external systems
|
||||
- **Labels**: `version`, `destination`, `syncId`, `projectId`, `type`, `status`, `name`
|
||||
- **Example**: Track secret sync failures to external systems
|
||||
</Accordion>
|
||||
|
||||
- `secret_sync_import_secrets_errors` - Secret import operation error count
|
||||
<Accordion title="secret_sync_import_secrets_errors">
|
||||
Secret import operation error count
|
||||
|
||||
- **Labels**: `version`, `destination`, `syncId`, `projectId`, `type`, `status`, `name`
|
||||
- **Example**: Monitor secret import failures
|
||||
- **Labels**: `version`, `destination`, `syncId`, `projectId`, `type`, `status`, `name`
|
||||
- **Example**: Monitor secret import failures
|
||||
</Accordion>
|
||||
|
||||
- `secret_sync_remove_secrets_errors` - Secret removal operation error count
|
||||
- **Labels**: `version`, `destination`, `syncId`, `projectId`, `type`, `status`, `name`
|
||||
- **Example**: Track secret removal operation failures
|
||||
<Accordion title="secret_sync_remove_secrets_errors">
|
||||
Secret removal operation error count
|
||||
|
||||
- **Labels**: `version`, `destination`, `syncId`, `projectId`, `type`, `status`, `name`
|
||||
- **Example**: Track secret removal operation failures
|
||||
</Accordion>
|
||||
</AccordionGroup>
|
||||
|
||||
### System Metrics
|
||||
|
||||
These low-level HTTP metrics are automatically collected by OpenTelemetry's instrumentation layer, providing baseline performance data for all HTTP traffic.
|
||||
|
||||
- `http_server_duration` - HTTP server request duration metrics (histogram buckets, count, sum)
|
||||
- `http_client_duration` - HTTP client request duration metrics (histogram buckets, count, sum)
|
||||
<AccordionGroup>
|
||||
<Accordion title="http_server_duration">
|
||||
HTTP server request duration metrics (histogram buckets, count, sum)
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="http_client_duration">
|
||||
HTTP client request duration metrics (histogram buckets, count, sum)
|
||||
</Accordion>
|
||||
</AccordionGroup>
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### Common Issues
|
||||
<Accordion title="Metrics not appearing">
|
||||
If your metrics are not showing up in Prometheus or your monitoring system, check the following:
|
||||
|
||||
1. **Metrics not appearing**:
|
||||
- Verify `OTEL_TELEMETRY_COLLECTION_ENABLED=true` is set in your Infisical environment variables
|
||||
- Ensure the correct `OTEL_EXPORT_TYPE` is set (`prometheus` or `otlp`)
|
||||
- Check network connectivity between Infisical and your monitoring services (Prometheus or OTLP collector)
|
||||
- For pull-based monitoring: Verify port 9464 is exposed and accessible
|
||||
- For push-based monitoring: Verify the OTLP endpoint URL is correct and reachable
|
||||
- Check Infisical backend logs for any errors related to metrics export
|
||||
</Accordion>
|
||||
|
||||
- Check if `OTEL_TELEMETRY_COLLECTION_ENABLED=true`
|
||||
- Verify the correct `OTEL_EXPORT_TYPE` is set
|
||||
- Check network connectivity between services
|
||||
<Accordion title="Authentication errors">
|
||||
If you're experiencing authentication errors with the OpenTelemetry Collector:
|
||||
|
||||
2. **Authentication errors**:
|
||||
|
||||
- Verify basic auth credentials in OTLP configuration
|
||||
- Check if credentials match between Infisical and collector
|
||||
- Verify basic auth credentials in your OTLP configuration match between Infisical and the collector
|
||||
- Check that `OTEL_COLLECTOR_BASIC_AUTH_USERNAME` and `OTEL_COLLECTOR_BASIC_AUTH_PASSWORD` match the credentials in your `otel-collector-config.yaml`
|
||||
- Ensure the htpasswd format in the collector configuration is correct
|
||||
- Test the collector endpoint manually using curl with the same credentials to verify they work
|
||||
</Accordion>
|
||||
|
||||
@@ -47,6 +47,7 @@ export const AppConnectionsBrowser = () => {
|
||||
{"name": "Auth0", "slug": "auth0", "path": "/integrations/app-connections/auth0", "description": "Learn how to connect your Auth0 to pull secrets from Infisical.", "category": "Identity & Auth"},
|
||||
{"name": "Okta", "slug": "okta", "path": "/integrations/app-connections/okta", "description": "Learn how to connect your Okta to pull secrets from Infisical.", "category": "Identity & Auth"},
|
||||
{"name": "Laravel Forge", "slug": "laravel-forge", "path": "/integrations/app-connections/laravel-forge", "description": "Learn how to connect your Laravel Forge to pull secrets from Infisical.", "category": "Hosting"},
|
||||
{"name": "Chef", "slug": "chef", "path": "/integrations/app-connections/chef", "description": "Learn how to connect your Chef to pull secrets from Infisical.", "category": "DevOps Tools"},
|
||||
{"name": "Northflank", "slug": "northflank", "path": "/integrations/app-connections/northflank", "description": "Learn how to connect your Northflank projects to pull secrets from Infisical.", "category": "Hosting"}
|
||||
].sort(function(a, b) {
|
||||
return a.name.toLowerCase().localeCompare(b.name.toLowerCase());
|
||||
|
||||
@@ -38,6 +38,7 @@ export const SecretSyncsBrowser = () => {
|
||||
{"name": "OCI Vault", "slug": "oci-vault", "path": "/integrations/secret-syncs/oci-vault", "description": "Learn how to sync secrets from Infisical to OCI Vault.", "category": "Cloud Providers"},
|
||||
{"name": "Zabbix", "slug": "zabbix", "path": "/integrations/secret-syncs/zabbix", "description": "Learn how to sync secrets from Infisical to Zabbix.", "category": "Monitoring"},
|
||||
{"name": "Laravel Forge", "slug": "laravel-forge", "path": "/integrations/secret-syncs/laravel-forge", "description": "Learn how to sync secrets from Infisical to Laravel Forge.", "category": "Hosting"},
|
||||
{"name": "Chef", "slug": "chef", "path": "/integrations/secret-syncs/chef", "description": "Learn how to sync secrets from Infisical to Chef.", "category": "DevOps Tools"},
|
||||
{"name": "Northflank", "slug": "northflank", "path": "/integrations/secret-syncs/northflank", "description": "Learn how to sync secrets from Infisical to Northflank projects.", "category": "Hosting"}
|
||||
].sort(function(a, b) {
|
||||
return a.name.toLowerCase().localeCompare(b.name.toLowerCase());
|
||||
|
||||
Reference in New Issue
Block a user