mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-10-05 00:26:24 +00:00
Merge pull request #2499 from akhilmhdh/doc/auth-method-fix
docs: added oidc method in login command method argument and changed order to make auth section first
This commit is contained in:
Akhil Mohan
+103
-101
@@ -22,107 +22,6 @@ If you have added multiple users, you can switch between the users by using the
|
|||||||
|
|
||||||
</Info>
|
</Info>
|
||||||
|
|
||||||
### Flags
|
|
||||||
|
|
||||||
The login command supports a number of flags that you can use for different authentication methods. Below is a list of all the flags that can be used with the login command.
|
|
||||||
|
|
||||||
<AccordionGroup>
|
|
||||||
<Accordion title="--method">
|
|
||||||
```bash
|
|
||||||
infisical login --method=<auth-method> # Optional, will default to 'user'.
|
|
||||||
```
|
|
||||||
|
|
||||||
#### Valid values for the `method` flag are:
|
|
||||||
- `user`: Login using email and password. (default)
|
|
||||||
- `universal-auth`: Login using a universal auth client ID and client secret.
|
|
||||||
- `kubernetes`: Login using a Kubernetes native auth.
|
|
||||||
- `azure`: Login using an Azure native auth.
|
|
||||||
- `gcp-id-token`: Login using a GCP ID token native auth.
|
|
||||||
- `gcp-iam`: Login using a GCP IAM.
|
|
||||||
- `aws-iam`: Login using an AWS IAM native auth.
|
|
||||||
|
|
||||||
</Accordion>
|
|
||||||
<Accordion title="--client-id">
|
|
||||||
```bash
|
|
||||||
infisical login --client-id=<client-id> # Optional, required if --method=universal-auth.
|
|
||||||
```
|
|
||||||
|
|
||||||
#### Description
|
|
||||||
The client ID of the universal auth machine identity. This is required if the `--method` flag is set to `universal-auth`.
|
|
||||||
|
|
||||||
<Tip>
|
|
||||||
The `client-id` flag can be substituted with the `INFISICAL_UNIVERSAL_AUTH_CLIENT_ID` environment variable.
|
|
||||||
</Tip>
|
|
||||||
|
|
||||||
</Accordion>
|
|
||||||
<Accordion title="--client-secret">
|
|
||||||
```bash
|
|
||||||
infisical login --client-secret=<client-secret> # Optional, required if --method=universal-auth.
|
|
||||||
```
|
|
||||||
#### Description
|
|
||||||
The client secret of the universal auth machine identity. This is required if the `--method` flag is set to `universal-auth`.
|
|
||||||
|
|
||||||
<Tip>
|
|
||||||
The `client-secret` flag can be substituted with the `INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET` environment variable.
|
|
||||||
</Tip>
|
|
||||||
|
|
||||||
</Accordion>
|
|
||||||
<Accordion title="--machine-identity-id">
|
|
||||||
```bash
|
|
||||||
infisical login --machine-identity-id=<your-machine-identity-id> # Optional, required if --method=kubernetes, azure, gcp-id-token, gcp-iam, or aws-iam.
|
|
||||||
```
|
|
||||||
|
|
||||||
#### Description
|
|
||||||
The ID of the machine identity. This is required if the `--method` flag is set to `kubernetes`, `azure`, `gcp-id-token`, `gcp-iam`, or `aws-iam`.
|
|
||||||
|
|
||||||
<Tip>
|
|
||||||
The `machine-identity-id` flag can be substituted with the `INFISICAL_MACHINE_IDENTITY_ID` environment variable.
|
|
||||||
</Tip>
|
|
||||||
|
|
||||||
</Accordion>
|
|
||||||
<Accordion title="--service-account-token-path">
|
|
||||||
```bash
|
|
||||||
infisical login --service-account-token-path=<service-account-token-path> # Optional Will default to '/var/run/secrets/kubernetes.io/serviceaccount/token'.
|
|
||||||
```
|
|
||||||
|
|
||||||
#### Description
|
|
||||||
The path to the Kubernetes service account token to use for authentication.
|
|
||||||
This is optional and will default to `/var/run/secrets/kubernetes.io/serviceaccount/token`.
|
|
||||||
|
|
||||||
<Tip>
|
|
||||||
The `service-account-token-path` flag can be substituted with the `INFISICAL_KUBERNETES_SERVICE_ACCOUNT_TOKEN_PATH` environment variable.
|
|
||||||
</Tip>
|
|
||||||
|
|
||||||
</Accordion>
|
|
||||||
<Accordion title="--service-account-key-file-path">
|
|
||||||
```bash
|
|
||||||
infisical login --service-account-key-file-path=<gcp-service-account-key-file-path> # Optional, but required if --method=gcp-iam.
|
|
||||||
```
|
|
||||||
|
|
||||||
#### Description
|
|
||||||
The path to your GCP service account key file. This is required if the `--method` flag is set to `gcp-iam`.
|
|
||||||
|
|
||||||
<Tip>
|
|
||||||
The `service-account-key-path` flag can be substituted with the `INFISICAL_GCP_IAM_SERVICE_ACCOUNT_KEY_FILE_PATH` environment variable.
|
|
||||||
</Tip>
|
|
||||||
|
|
||||||
</Accordion>
|
|
||||||
</AccordionGroup>
|
|
||||||
|
|
||||||
<Accordion title="--oidc-jwt">
|
|
||||||
```bash
|
|
||||||
infisical login --oidc-jwt=<oidc-jwt-token>
|
|
||||||
```
|
|
||||||
|
|
||||||
#### Description
|
|
||||||
The JWT provided by an identity provider for OIDC authentication.
|
|
||||||
|
|
||||||
<Tip>
|
|
||||||
The `oidc-jwt` flag can be substituted with the `INFISICAL_OIDC_AUTH_JWT` environment variable.
|
|
||||||
</Tip>
|
|
||||||
|
|
||||||
</Accordion>
|
|
||||||
|
|
||||||
### Authentication Methods
|
### Authentication Methods
|
||||||
|
|
||||||
The Infisical CLI supports multiple authentication methods. Below are the available authentication methods, with their respective flags.
|
The Infisical CLI supports multiple authentication methods. Below are the available authentication methods, with their respective flags.
|
||||||
@@ -321,6 +220,109 @@ The Infisical CLI supports multiple authentication methods. Below are the availa
|
|||||||
</Accordion>
|
</Accordion>
|
||||||
</AccordionGroup>
|
</AccordionGroup>
|
||||||
|
|
||||||
|
### Flags
|
||||||
|
|
||||||
|
The login command supports a number of flags that you can use for different authentication methods. Below is a list of all the flags that can be used with the login command.
|
||||||
|
|
||||||
|
<AccordionGroup>
|
||||||
|
<Accordion title="--method">
|
||||||
|
```bash
|
||||||
|
infisical login --method=<auth-method> # Optional, will default to 'user'.
|
||||||
|
```
|
||||||
|
|
||||||
|
#### Valid values for the `method` flag are:
|
||||||
|
- `user`: Login using email and password. (default)
|
||||||
|
- `universal-auth`: Login using a universal auth client ID and client secret.
|
||||||
|
- `kubernetes`: Login using a Kubernetes native auth.
|
||||||
|
- `azure`: Login using an Azure native auth.
|
||||||
|
- `gcp-id-token`: Login using a GCP ID token native auth.
|
||||||
|
- `gcp-iam`: Login using a GCP IAM.
|
||||||
|
- `aws-iam`: Login using an AWS IAM native auth.
|
||||||
|
- `oidc-auth`: Login using oidc auth.
|
||||||
|
|
||||||
|
</Accordion>
|
||||||
|
<Accordion title="--client-id">
|
||||||
|
```bash
|
||||||
|
infisical login --client-id=<client-id> # Optional, required if --method=universal-auth.
|
||||||
|
```
|
||||||
|
|
||||||
|
#### Description
|
||||||
|
The client ID of the universal auth machine identity. This is required if the `--method` flag is set to `universal-auth`.
|
||||||
|
|
||||||
|
<Tip>
|
||||||
|
The `client-id` flag can be substituted with the `INFISICAL_UNIVERSAL_AUTH_CLIENT_ID` environment variable.
|
||||||
|
</Tip>
|
||||||
|
|
||||||
|
</Accordion>
|
||||||
|
<Accordion title="--client-secret">
|
||||||
|
```bash
|
||||||
|
infisical login --client-secret=<client-secret> # Optional, required if --method=universal-auth.
|
||||||
|
```
|
||||||
|
#### Description
|
||||||
|
The client secret of the universal auth machine identity. This is required if the `--method` flag is set to `universal-auth`.
|
||||||
|
|
||||||
|
<Tip>
|
||||||
|
The `client-secret` flag can be substituted with the `INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET` environment variable.
|
||||||
|
</Tip>
|
||||||
|
|
||||||
|
</Accordion>
|
||||||
|
<Accordion title="--machine-identity-id">
|
||||||
|
```bash
|
||||||
|
infisical login --machine-identity-id=<your-machine-identity-id> # Optional, required if --method=kubernetes, azure, gcp-id-token, gcp-iam, or aws-iam.
|
||||||
|
```
|
||||||
|
|
||||||
|
#### Description
|
||||||
|
The ID of the machine identity. This is required if the `--method` flag is set to `kubernetes`, `azure`, `gcp-id-token`, `gcp-iam`, or `aws-iam`.
|
||||||
|
|
||||||
|
<Tip>
|
||||||
|
The `machine-identity-id` flag can be substituted with the `INFISICAL_MACHINE_IDENTITY_ID` environment variable.
|
||||||
|
</Tip>
|
||||||
|
|
||||||
|
</Accordion>
|
||||||
|
<Accordion title="--service-account-token-path">
|
||||||
|
```bash
|
||||||
|
infisical login --service-account-token-path=<service-account-token-path> # Optional Will default to '/var/run/secrets/kubernetes.io/serviceaccount/token'.
|
||||||
|
```
|
||||||
|
|
||||||
|
#### Description
|
||||||
|
The path to the Kubernetes service account token to use for authentication.
|
||||||
|
This is optional and will default to `/var/run/secrets/kubernetes.io/serviceaccount/token`.
|
||||||
|
|
||||||
|
<Tip>
|
||||||
|
The `service-account-token-path` flag can be substituted with the `INFISICAL_KUBERNETES_SERVICE_ACCOUNT_TOKEN_PATH` environment variable.
|
||||||
|
</Tip>
|
||||||
|
|
||||||
|
</Accordion>
|
||||||
|
<Accordion title="--service-account-key-file-path">
|
||||||
|
```bash
|
||||||
|
infisical login --service-account-key-file-path=<gcp-service-account-key-file-path> # Optional, but required if --method=gcp-iam.
|
||||||
|
```
|
||||||
|
|
||||||
|
#### Description
|
||||||
|
The path to your GCP service account key file. This is required if the `--method` flag is set to `gcp-iam`.
|
||||||
|
|
||||||
|
<Tip>
|
||||||
|
The `service-account-key-path` flag can be substituted with the `INFISICAL_GCP_IAM_SERVICE_ACCOUNT_KEY_FILE_PATH` environment variable.
|
||||||
|
</Tip>
|
||||||
|
|
||||||
|
</Accordion>
|
||||||
|
</AccordionGroup>
|
||||||
|
|
||||||
|
<Accordion title="--oidc-jwt">
|
||||||
|
```bash
|
||||||
|
infisical login --oidc-jwt=<oidc-jwt-token>
|
||||||
|
```
|
||||||
|
|
||||||
|
#### Description
|
||||||
|
The JWT provided by an identity provider for OIDC authentication.
|
||||||
|
|
||||||
|
<Tip>
|
||||||
|
The `oidc-jwt` flag can be substituted with the `INFISICAL_OIDC_AUTH_JWT` environment variable.
|
||||||
|
</Tip>
|
||||||
|
|
||||||
|
</Accordion>
|
||||||
|
|
||||||
|
|
||||||
### Machine Identity Authentication Quick Start
|
### Machine Identity Authentication Quick Start
|
||||||
|
|
||||||
In this example we'll be using the `universal-auth` method to login to obtain an Infisical access token, which we will then use to fetch secrets with.
|
In this example we'll be using the `universal-auth` method to login to obtain an Infisical access token, which we will then use to fetch secrets with.
|
||||||
|
|||||||
Reference in New Issue
Block a user