mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-09-22 13:39:35 +00:00
Merge branch 'main' into ENG-2773
This commit is contained in:
x032205
@@ -5,12 +5,12 @@ description: "Learn how to stream Infisical Audit Logs to external logging provi
|
||||
|
||||
<Info>
|
||||
Audit log streams is a paid feature.
|
||||
|
||||
|
||||
If you're using Infisical Cloud, then it is available under the **Enterprise Tier**. If you're self-hosting Infisical,
|
||||
then you should contact team@infisical.com to purchase an enterprise license to use it.
|
||||
</Info>
|
||||
|
||||
Infisical Audit Log Streaming enables you to transmit your organization's Audit Logs to external logging providers for monitoring and analysis.
|
||||
Infisical Audit Log Streaming enables you to transmit your organization's Audit Logs to external logging providers for monitoring and analysis.
|
||||
|
||||
The logs are formatted in JSON, requiring your logging provider to support JSON-based log parsing.
|
||||
|
||||
@@ -118,7 +118,7 @@ Each log entry sent to the external logging provider will follow the same struct
|
||||
|
||||
### Audit Logs Structure
|
||||
<ParamField path="id" type="string" required>
|
||||
The unique identifier for the log entry.
|
||||
The unique identifier for the log entry.
|
||||
</ParamField>
|
||||
|
||||
<ParamField path="actor" type="platform | user | service | identity | scimClient | unknownUser" required>
|
||||
@@ -168,7 +168,7 @@ Each log entry sent to the external logging provider will follow the same struct
|
||||
<Note>
|
||||
If the `actor` field is set to `platform`, `scimClient`, or `unknownUser`, the `actorMetadata` field will be an empty object.
|
||||
</Note>
|
||||
|
||||
|
||||
</ParamField>
|
||||
|
||||
<ParamField path="ipAddress" type="string" required>
|
||||
@@ -178,7 +178,7 @@ Each log entry sent to the external logging provider will follow the same struct
|
||||
<ParamField path="eventType" type="string" required>
|
||||
The type of event that occurred. Below you can see a list of possible event types. More event types will be added in the future as we expand our audit logs further.
|
||||
|
||||
`get-secrets`, `delete-secrets`, `get-secret`, `create-secret`, `update-secret`, `delete-secret`, `get-workspace-key`, `authorize-integration`, `update-integration-auth`, `unauthorize-integration`, `create-integration`, `delete-integration`, `add-trusted-ip`, `update-trusted-ip`, `delete-trusted-ip`, `create-service-token`, `delete-service-token`, `create-identity`, `update-identity`, `delete-identity`, `login-identity-universal-auth`, `add-identity-universal-auth`, `update-identity-universal-auth`, `get-identity-universal-auth`, `create-identity-universal-auth-client-secret`, `revoke-identity-universal-auth-client-secret`, `get-identity-universal-auth-client-secret`, `create-environment`, `update-environment`, `delete-environment`, `add-workspace-member`, `remove-workspace-member`, `create-folder`, `update-folder`, `delete-folder`, `create-webhook`, `update-webhook-status`, `delete-webhook`, `get-secret-imports`, `create-secret-import`, `update-secret-import`, `delete-secret-import`, `update-user-workspace-role`, `update-user-workspace-denied-permissions`, `create-certificate-authority`, `get-certificate-authority`, `update-certificate-authority`, `delete-certificate-authority`, `get-certificate-authority-csr`, `get-certificate-authority-cert`, `sign-intermediate`, `import-certificate-authority-cert`, `get-certificate-authority-crl`, `issue-cert`, `get-cert`, `delete-cert`, `revoke-cert`, `get-cert-body`, `create-pki-alert`, `get-pki-alert`, `update-pki-alert`, `delete-pki-alert`, `create-pki-collection`, `get-pki-collection`, `update-pki-collection`, `delete-pki-collection`, `get-pki-collection-items`, `add-pki-collection-item`, `delete-pki-collection-item`, `org-admin-accessed-project`, `create-certificate-template`, `update-certificate-template`, `delete-certificate-template`, `get-certificate-template`, `create-certificate-template-est-config`, `update-certificate-template-est-config`, `get-certificate-template-est-config`, `update-project-slack-config`, `get-project-slack-config`, `integration-synced`, `create-shared-secret`, `delete-shared-secret`, `read-shared-secret`.
|
||||
`get-secrets`, `delete-secrets`, `get-secret`, `create-secret`, `update-secret`, `delete-secret`, `get-workspace-key`, `authorize-integration`, `update-integration-auth`, `unauthorize-integration`, `create-integration`, `delete-integration`, `add-trusted-ip`, `update-trusted-ip`, `delete-trusted-ip`, `create-service-token`, `delete-service-token`, `create-identity`, `update-identity`, `delete-identity`, `login-identity-universal-auth`, `add-identity-universal-auth`, `update-identity-universal-auth`, `get-identity-universal-auth`, `create-identity-universal-auth-client-secret`, `revoke-identity-universal-auth-client-secret`, `get-identity-universal-auth-client-secret`, `create-environment`, `update-environment`, `delete-environment`, `add-workspace-member`, `remove-workspace-member`, `create-folder`, `update-folder`, `delete-folder`, `create-webhook`, `update-webhook-status`, `delete-webhook`, `webhook-triggered`, `get-secret-imports`, `create-secret-import`, `update-secret-import`, `delete-secret-import`, `update-user-workspace-role`, `update-user-workspace-denied-permissions`, `create-certificate-authority`, `get-certificate-authority`, `update-certificate-authority`, `delete-certificate-authority`, `get-certificate-authority-csr`, `get-certificate-authority-cert`, `sign-intermediate`, `import-certificate-authority-cert`, `get-certificate-authority-crl`, `issue-cert`, `get-cert`, `delete-cert`, `revoke-cert`, `get-cert-body`, `create-pki-alert`, `get-pki-alert`, `update-pki-alert`, `delete-pki-alert`, `create-pki-collection`, `get-pki-collection`, `update-pki-collection`, `delete-pki-collection`, `get-pki-collection-items`, `add-pki-collection-item`, `delete-pki-collection-item`, `org-admin-accessed-project`, `create-certificate-template`, `update-certificate-template`, `delete-certificate-template`, `get-certificate-template`, `create-certificate-template-est-config`, `update-certificate-template-est-config`, `get-certificate-template-est-config`, `update-project-slack-config`, `get-project-slack-config`, `integration-synced`, `create-shared-secret`, `delete-shared-secret`, `read-shared-secret`.
|
||||
</ParamField>
|
||||
|
||||
<ParamField path="eventMetadata" type="object" required>
|
||||
@@ -219,4 +219,4 @@ Each log entry sent to the external logging provider will follow the same struct
|
||||
The name of the project where the event occurred.
|
||||
|
||||
The `projectName` field will only be present if the event occurred at the project level, not the organization level.
|
||||
</ParamField>
|
||||
</ParamField>
|
||||
|
||||
@@ -32,7 +32,8 @@ Infisical needs an initial AWS IAM user with the required permissions to create
|
||||
"iam:ListUserPolicies",
|
||||
"iam:PutUserPolicy",
|
||||
"iam:AddUserToGroup",
|
||||
"iam:RemoveUserFromGroup"
|
||||
"iam:RemoveUserFromGroup",
|
||||
"iam:TagUser"
|
||||
],
|
||||
"Resource": ["*"]
|
||||
}
|
||||
|
||||
@@ -162,6 +162,12 @@ This feature is ideal for scenarios where you need to:
|
||||
tokens for the target service account.
|
||||
</Note>
|
||||
|
||||
<Note>
|
||||
When using Gateway authentication, the Gateway will access the Kubernetes API server
|
||||
using its internal cluster URL (typically https://kubernetes.default.svc) and TLS configuration.
|
||||
You don't need to specify these values separately in the dynamic secret configuration.
|
||||
</Note>
|
||||
|
||||
1. Deploy the Infisical Gateway in your cluster
|
||||
2. Set up RBAC permissions for the Gateway's service account:
|
||||
```yaml rbac.yaml
|
||||
@@ -206,6 +212,7 @@ This feature is ideal for scenarios where you need to:
|
||||
- Automatically clean up service accounts after token expiration
|
||||
- Assign different roles to different users or applications
|
||||
- Maintain strict control over service account permissions
|
||||
- Support multiple namespaces with a single dynamic secret configuration
|
||||
|
||||
### Prerequisites
|
||||
|
||||
@@ -213,6 +220,16 @@ This feature is ideal for scenarios where you need to:
|
||||
- Cluster access token with permissions to create service accounts and manage RBAC
|
||||
- (Optional) [Gateway](/documentation/platform/gateways/overview) for private cluster access
|
||||
|
||||
### Namespace Support
|
||||
|
||||
When configuring a dynamic secret, you can specify multiple allowed namespaces as a comma-separated list. During lease creation, you can then specify which namespace to use from this allowed list. This provides flexibility while maintaining security by:
|
||||
|
||||
- Allowing a single dynamic secret configuration to support multiple namespaces
|
||||
- Restricting service account creation to only the specified allowed namespaces
|
||||
- Enabling fine-grained control over which namespaces can be used for each lease
|
||||
|
||||
For example, if you configure a dynamic secret with allowed namespaces "default,kube-system,monitoring", you can create leases that use any of these namespaces while preventing access to other namespaces in your cluster.
|
||||
|
||||
### Authentication Setup
|
||||
|
||||
Choose your authentication method:
|
||||
@@ -318,6 +335,12 @@ This feature is ideal for scenarios where you need to:
|
||||
manage service accounts, their tokens, and RBAC resources.
|
||||
</Note>
|
||||
|
||||
<Note>
|
||||
When using Gateway authentication, the Gateway will access the Kubernetes API server
|
||||
using its internal cluster URL (typically https://kubernetes.default.svc) and TLS configuration.
|
||||
You don't need to specify these values separately in the dynamic secret configuration.
|
||||
</Note>
|
||||
|
||||
1. Deploy the Infisical Gateway in your cluster
|
||||
2. Set up RBAC permissions for the Gateway's service account:
|
||||
```yaml rbac.yaml
|
||||
@@ -401,13 +424,13 @@ This feature is ideal for scenarios where you need to:
|
||||
Select a gateway for private cluster access. If not specified, the Internet Gateway will be used.
|
||||
</ParamField>
|
||||
<ParamField path="Cluster URL" type="string" required>
|
||||
Kubernetes API server URL (e.g., https://kubernetes.default.svc)
|
||||
Kubernetes API server URL (e.g., https://kubernetes.default.svc). Not required when using Gateway authentication as the Gateway will use its internal cluster URL.
|
||||
</ParamField>
|
||||
<ParamField path="Enable SSL" type="boolean">
|
||||
Whether to enable SSL verification for the Kubernetes API server connection.
|
||||
Whether to enable SSL verification for the Kubernetes API server connection. Not required when using Gateway authentication as the Gateway will use its internal TLS configuration.
|
||||
</ParamField>
|
||||
<ParamField path="CA" type="string">
|
||||
Custom CA certificate for the Kubernetes API server. Leave blank to use the system/public CA.
|
||||
Custom CA certificate for the Kubernetes API server. Leave blank to use the system/public CA. Not required when using Gateway authentication as the Gateway will use its internal TLS configuration.
|
||||
</ParamField>
|
||||
<ParamField path="Auth Method" type="string" required>
|
||||
Choose between Token (API) or Gateway authentication. If using Gateway, the Gateway must be deployed in your Kubernetes cluster.
|
||||
@@ -418,18 +441,30 @@ This feature is ideal for scenarios where you need to:
|
||||
<ParamField path="Credential Type" type="string" required>
|
||||
Choose between Static (predefined service account) or Dynamic (temporary service accounts with role assignments)
|
||||
</ParamField>
|
||||
<ParamField path="Service Account Name" type="string" required>
|
||||
Name of the service account to generate tokens for (required for Static credentials)
|
||||
</ParamField>
|
||||
<ParamField path="Namespace" type="string" required>
|
||||
Kubernetes namespace where the service account exists or will be created
|
||||
</ParamField>
|
||||
<ParamField path="Role Type" type="string" required>
|
||||
Type of role to assign (ClusterRole or Role) (required for Dynamic credentials)
|
||||
</ParamField>
|
||||
<ParamField path="Role" type="string" required>
|
||||
Name of the role to assign to the temporary service account (required for Dynamic credentials)
|
||||
</ParamField>
|
||||
|
||||
<Tabs>
|
||||
<Tab title="Static Credentials Parameters">
|
||||
<ParamField path="Service Account Name" type="string" required>
|
||||
Name of the service account to generate tokens for
|
||||
</ParamField>
|
||||
<ParamField path="Namespace" type="string" required>
|
||||
Kubernetes namespace where the service account exists
|
||||
</ParamField>
|
||||
</Tab>
|
||||
|
||||
<Tab title="Dynamic Credentials Parameters">
|
||||
<ParamField path="Allowed Namespaces" type="string" required>
|
||||
Kubernetes namespace(s) where the service accounts will be created. You can specify multiple namespaces as a comma-separated list (e.g., "default,kube-system"). During lease creation, you can specify which namespace to use from this allowed list.
|
||||
</ParamField>
|
||||
<ParamField path="Role Type" type="string" required>
|
||||
Type of role to assign (ClusterRole or Role)
|
||||
</ParamField>
|
||||
<ParamField path="Role" type="string" required>
|
||||
Name of the role to assign to the temporary service account
|
||||
</ParamField>
|
||||
</Tab>
|
||||
</Tabs>
|
||||
|
||||
<ParamField path="Audiences" type="array">
|
||||
Optional list of audiences to include in the generated token
|
||||
</ParamField>
|
||||
|
||||
@@ -4,38 +4,130 @@ description: "Learn how to rollback secrets and configurations to any snapshot w
|
||||
---
|
||||
|
||||
<Info>
|
||||
Point-in-Time Recovery is a paid feature.
|
||||
|
||||
If you're using Infisical Cloud, then it is available under the **Pro Tier**. If you're self-hosting Infisical,
|
||||
then you should contact sales@infisical.com to purchase an enterprise license to use it.
|
||||
Point-in-Time Recovery is a paid feature. If you're using Infisical Cloud,
|
||||
then it is available under the **Pro Tier**. If you're self-hosting Infisical,
|
||||
then you should contact sales@infisical.com to purchase an enterprise license
|
||||
to use it.
|
||||
</Info>
|
||||
|
||||
Infisical's point-in-time recovery functionality allows secrets to be rolled back to any point in time for any given [folder](./folder) or [environment](/documentation/platform/project#project-environments).
|
||||
Every time a secret is updated, a new snapshot is taken – capturing the state of the folder and environment at that point of time.
|
||||
|
||||
## Snapshots
|
||||
<Tabs>
|
||||
<Tab title="Commits Interface">
|
||||
## Understanding Commits
|
||||
|
||||
Similar to Git, a commit (also known as snapshot) in Infisical is the state of your project's secrets at a specific point in time scoped to
|
||||
an environment and [folder](./folder) within it.
|
||||
Similar to Git, a commit in Infisical represents a snapshot of changes made to your project's resources at a specific point in time. Each commit is scoped to an environment and [folder](./folder) within it. Unlike the legacy snapshot system, the new commits interface provides granular tracking of individual changes, allowing you to see exactly what was modified, added, or removed in each commit.
|
||||
|
||||
To view a list of snapshots for the current folder, press the **Commits** button.
|
||||
### Accessing Commits
|
||||
|
||||
|
||||
From your secrets management interface, you can access the commits functionality by clicking the **Commits Button**. This button is located in the top-right area of your secrets view and shows the number of commits for the current folder (e.g., "4 Commits").
|
||||
|
||||
This opens up a sidebar from which you can select to view a particular snapshot:
|
||||
|
||||
|
||||
|
||||
### Commits List View
|
||||
|
||||
## Rolling back
|
||||
The commits page displays a comprehensive chronological history of all changes made to your environment and folders:
|
||||
|
||||
After pressing on a snapshot from the sidebar, you can view it and roll back the state
|
||||
of the folder to that point in time by pressing the **Rollback** button.
|
||||
|
||||
|
||||
|
||||
- **Chronological Sorting**: Commits are grouped by date
|
||||
- **Commit Information**: Each commit shows:
|
||||
- Commit message
|
||||
- Author information
|
||||
- Relative timestamp
|
||||
- Unique commit hash identifier
|
||||
- **Search Functionality**: Use the search bar to quickly find specific commits
|
||||
- **Sorting Options**: Sort commits by various criteria using the sort controls
|
||||
|
||||
Rolling back secrets to a past snapshot creates a creates a snapshot at the top of the stack and updates secret versions.
|
||||
### Detailed Commit Inspection
|
||||
|
||||
<Note>
|
||||
Rollbacks are localized to not affect other folders within the same environment. This means each [folder](./folder) maintains its own independent history of changes, offering precise and isolated control over rollback actions.
|
||||
Put differently, every [folder](./folder) possesses a distinct and separate timeline, providing granular control when managing your secrets.
|
||||
</Note>
|
||||
Clicking on any commit from the list opens a detailed view showing the list of changes made in that commit.
|
||||
|
||||
|
||||
|
||||
#### Change Categories
|
||||
|
||||
The commit changes details can be grouped into the following categories:
|
||||
|
||||
**Folder Changes**
|
||||
- Shows folder additions, modifications, or deletions
|
||||
- Displays the folder properties changes in JSON format, including:
|
||||
- Folder name
|
||||
- Folder description
|
||||
|
||||
**Secret Changes**
|
||||
- Lists all secrets that were added, updated, or removed
|
||||
- Shows the complete secret configuration including:
|
||||
- Secret key and value
|
||||
- Comments, tags and metadata
|
||||
- Encoding settings (e.g., skipMultilineEncoding)
|
||||
- Values are displayed with appropriate masking for security
|
||||
|
||||
**Visual Indicators**
|
||||
- Green "+" indicators show additions
|
||||
- Red "-" indicators show deletions
|
||||
- Modified content shows both old and new states
|
||||
|
||||
### Restoration Options
|
||||
|
||||
Each commit provides two distinct restoration methods accessible via the **Restore Options** dropdown:
|
||||
|
||||
|
||||
|
||||
#### Revert changes
|
||||
This option provides surgical precision for undoing specific modifications:
|
||||
|
||||
- **Granular Control**: Reverts only the specific changes introduced in that individual commit
|
||||
- **Selective Restoration**: Preserves all other changes made after the commit
|
||||
- **Targeted Undo**: Perfect for reversing a specific problematic change without affecting other work
|
||||
- **Minimal Impact**: Only affects the resources that were modified in that particular commit
|
||||
- **Use Case**: Ideal when you want to undo a specific change while keeping all other modifications intact
|
||||
|
||||
#### Roll back to this commit
|
||||
This option performs a complete restoration to the selected point in time:
|
||||
|
||||
|
||||
|
||||
- **Complete State Restoration**: Returns the entire folder to its exact state at the time of this commit
|
||||
- **Restore All Child Folders**: If enabled, it'll also restore all nested folders to their exact state at the time of this commit.
|
||||
- **Destructive Operation**: Discards ALL changes made after the selected commit
|
||||
- **New Commit Creation**: Creates a new commit representing this rollback operation
|
||||
- **Use Case**: Ideal when you want to completely undo a series of changes and return to a known good state
|
||||
|
||||
**Warning**: This operation will undo all modifications made after the selected commit, which may include multiple secrets and configuration changes.
|
||||
|
||||
</Tab>
|
||||
<Tab title="Legacy Snapshots (Deprecated)">
|
||||
<Warning>
|
||||
The snapshots interface is deprecated and will be removed in a future version. Please use the new Commits interface for more granular point-in-time recovery operations.
|
||||
</Warning>
|
||||
|
||||
## Snapshots
|
||||
|
||||
Similar to Git, a commit (also known as snapshot) in Infisical is the state of your project's secrets at a specific point in time scoped to
|
||||
an environment and [folder](./folder) within it.
|
||||
|
||||
To view a list of snapshots for the current folder, press the **Commits** button.
|
||||
|
||||
|
||||
|
||||
This opens up a sidebar from which you can select to view a particular snapshot:
|
||||
|
||||
|
||||
|
||||
## Rolling back
|
||||
|
||||
After pressing on a snapshot from the sidebar, you can view it and roll back the state
|
||||
of the folder to that point in time by pressing the **Rollback** button.
|
||||
|
||||
|
||||
|
||||
Rolling back secrets to a past snapshot creates a snapshot at the top of the stack and updates secret versions.
|
||||
|
||||
<Note>
|
||||
Rollbacks are localized to not affect other folders within the same environment. This means each [folder](./folder) maintains its own independent history of changes, offering precise and isolated control over rollback actions.
|
||||
Put differently, every [folder](./folder) possesses a distinct and separate timeline, providing granular control when managing your secrets.
|
||||
</Note>
|
||||
|
||||
</Tab>
|
||||
</Tabs>
|
||||
|
||||
@@ -27,7 +27,7 @@ If the signature in the header matches the signature that you generated, then yo
|
||||
|
||||
```json
|
||||
{
|
||||
"event": "secret.modified",
|
||||
"event": "secrets.modified",
|
||||
"project": {
|
||||
"workspaceId": "the workspace id",
|
||||
"environment": "project environment",
|
||||
|
||||
Reference in New Issue
Block a user