mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-09-22 13:39:35 +00:00
misc: updated docs
This commit is contained in:
@@ -6,7 +6,7 @@ description: "How to use Infisical to inject secrets directly into Kubernetes po
|
|||||||
## Overview
|
## Overview
|
||||||
|
|
||||||
The Infisical CSI provider allows you to use Infisical with the [Secrets Store CSI driver](https://secrets-store-csi-driver.sigs.k8s.io) to inject secrets directly into your Kubernetes pods through a volume mount.
|
The Infisical CSI provider allows you to use Infisical with the [Secrets Store CSI driver](https://secrets-store-csi-driver.sigs.k8s.io) to inject secrets directly into your Kubernetes pods through a volume mount.
|
||||||
In contrast to the [Infisical Kubernetes Operator](https://infisical.com/docs/integrations/platforms/kubernetes), the Infisical CSI provider will allow you to sync Infisical secrets directly to pods, removing the need for Kubernetes secret resources.
|
In contrast to the [Infisical Kubernetes Operator](https://infisical.com/docs/integrations/platforms/kubernetes), the Infisical CSI provider will allow you to sync Infisical secrets directly to pods as files, removing the need for Kubernetes secret resources.
|
||||||
|
|
||||||
```mermaid
|
```mermaid
|
||||||
flowchart LR
|
flowchart LR
|
||||||
@@ -28,7 +28,7 @@ The following features are supported by the Infisical CSI Provider:
|
|||||||
|
|
||||||
- Integration with Secrets Store CSI Driver for direct pod mounting
|
- Integration with Secrets Store CSI Driver for direct pod mounting
|
||||||
- Authentication using Kubernetes service accounts via machine identities
|
- Authentication using Kubernetes service accounts via machine identities
|
||||||
- Secret rotation and auto-syncing when enabled via CSI Driver
|
- Auto-syncing secrets when enabled via CSI Driver
|
||||||
- Configurable secret paths and file mounting locations
|
- Configurable secret paths and file mounting locations
|
||||||
- Installation via Helm
|
- Installation via Helm
|
||||||
|
|
||||||
@@ -68,12 +68,12 @@ The flags configure the following:
|
|||||||
- `syncSecret.enabled=true`: Enables syncing secrets to Kubernetes secrets
|
- `syncSecret.enabled=true`: Enables syncing secrets to Kubernetes secrets
|
||||||
|
|
||||||
<Info>
|
<Info>
|
||||||
If you do not wish to use the secret rotation feature of the secrets store CSI
|
If you do not wish to use the auto-syncing feature of the secrets store CSI
|
||||||
driver, you can omit the `enableSecretRotation` and the `rotationPollInterval`
|
driver, you can omit the `enableSecretRotation` and the `rotationPollInterval`
|
||||||
flags. Do note that by default, secrets from Infisical are only fetched and
|
flags. Do note that by default, secrets from Infisical are only fetched and
|
||||||
mounted during pod creation. If there are any changes made to the secrets in
|
mounted during pod creation. If there are any changes made to the secrets in
|
||||||
Infisical, they will not propagate to the pods unless secret rotation is
|
Infisical, they will not propagate to the pods unless auto-syncing is enabled
|
||||||
enabled for the CSI driver.
|
for the CSI driver.
|
||||||
</Info>
|
</Info>
|
||||||
|
|
||||||
### Install Infisical CSI Provider
|
### Install Infisical CSI Provider
|
||||||
@@ -115,7 +115,7 @@ You can refer to the documentation for setting it up [here](https://infisical.co
|
|||||||
### Creating Secret Provider Class
|
### Creating Secret Provider Class
|
||||||
|
|
||||||
With the Secrets Store CSI driver and the Infisical CSI provider installed, create a Kubernetes [SecretProviderClass](https://secrets-store-csi-driver.sigs.k8s.io/concepts.html#secretproviderclass) resource to establish
|
With the Secrets Store CSI driver and the Infisical CSI provider installed, create a Kubernetes [SecretProviderClass](https://secrets-store-csi-driver.sigs.k8s.io/concepts.html#secretproviderclass) resource to establish
|
||||||
the connection between the CSI driver and the Infisical CSI provider for secret retrieval. You can create as much Secret Provider Classes as needed for your cluster.
|
the connection between the CSI driver and the Infisical CSI provider for secret retrieval. You can create as many Secret Provider Classes as needed for your cluster.
|
||||||
|
|
||||||
```yaml
|
```yaml
|
||||||
apiVersion: secrets-store.csi.x-k8s.io/v1
|
apiVersion: secrets-store.csi.x-k8s.io/v1
|
||||||
@@ -126,6 +126,7 @@ spec:
|
|||||||
provider: infisical
|
provider: infisical
|
||||||
parameters:
|
parameters:
|
||||||
infisicalUrl: "https://app.infisical.com"
|
infisicalUrl: "https://app.infisical.com"
|
||||||
|
authMethod: "kubernetes"
|
||||||
identityId: "ad2f8c67-cbe2-417a-b5eb-1339776ec0b3"
|
identityId: "ad2f8c67-cbe2-417a-b5eb-1339776ec0b3"
|
||||||
projectId: "09eda1f8-85a3-47a9-8a6f-e27f133b2a36"
|
projectId: "09eda1f8-85a3-47a9-8a6f-e27f133b2a36"
|
||||||
envSlug: "prod"
|
envSlug: "prod"
|
||||||
@@ -157,6 +158,11 @@ spec:
|
|||||||
this should be omitted.
|
this should be omitted.
|
||||||
</Accordion>
|
</Accordion>
|
||||||
|
|
||||||
|
<Accordion title="authMethod">
|
||||||
|
The auth method to use for authenticating the Infisical CSI provider with
|
||||||
|
Infisical. For now, the only supported method is `kubernetes`.
|
||||||
|
</Accordion>
|
||||||
|
|
||||||
<Accordion title="identityId">
|
<Accordion title="identityId">
|
||||||
The ID of the machine identity to use for authenticating the Infisical CSI
|
The ID of the machine identity to use for authenticating the Infisical CSI
|
||||||
provider with your Infisical organization. This should be the machine identity
|
provider with your Infisical organization. This should be the machine identity
|
||||||
@@ -249,3 +255,26 @@ kubectl logs csi-secrets-store-csi-driver-7h4jp -n=kube-system
|
|||||||
## Best Practices
|
## Best Practices
|
||||||
|
|
||||||
For additional guidance on setting this up for your production cluster, you can refer to the Secrets Store CSI driver documentation [here](https://secrets-store-csi-driver.sigs.k8s.io/topics/best-practices).
|
For additional guidance on setting this up for your production cluster, you can refer to the Secrets Store CSI driver documentation [here](https://secrets-store-csi-driver.sigs.k8s.io/topics/best-practices).
|
||||||
|
|
||||||
|
## Frequently Asked Questions
|
||||||
|
|
||||||
|
<AccordionGroup>
|
||||||
|
<Accordion title="Is it possible to sync Infisical secrets as ENV?">
|
||||||
|
Yes, you can use secrets as environment variables in your pods. This requires two steps:
|
||||||
|
|
||||||
|
1. Enable syncing to Kubernetes secrets using `syncSecret.enabled=true` in the CSI driver configuration.
|
||||||
|
2. Configure your pod to use these synced Kubernetes secrets as environment variables.
|
||||||
|
|
||||||
|
You can find detailed examples in the [Secrets Store CSI driver documentation](https://secrets-store-csi-driver.sigs.k8s.io/topics/set-as-env-var).
|
||||||
|
|
||||||
|
</Accordion>
|
||||||
|
</AccordionGroup>
|
||||||
|
|
||||||
|
<AccordionGroup>
|
||||||
|
<Accordion title="Do I have to list out every Infisical single secret that I want to sync?">
|
||||||
|
Yes, you will need to explicitly list each secret you want to sync in the
|
||||||
|
Secret Provider Class configuration. This is a common requirement across all
|
||||||
|
CSI providers as the Secrets Store CSI Driver architecture requires specific
|
||||||
|
mapping of secrets to their mounted file locations.
|
||||||
|
</Accordion>
|
||||||
|
</AccordionGroup>
|
||||||
|
|||||||
Reference in New Issue
Block a user