diff --git a/docs/integrations/platforms/kubernetes/infisical-push-secret-crd.mdx b/docs/integrations/platforms/kubernetes/infisical-push-secret-crd.mdx
index 50f07bb76..936a37303 100644
--- a/docs/integrations/platforms/kubernetes/infisical-push-secret-crd.mdx
+++ b/docs/integrations/platforms/kubernetes/infisical-push-secret-crd.mdx
@@ -34,7 +34,7 @@ Before applying the InfisicalPushSecret CRD, you need to create a Kubernetes sec
metadata:
name: infisical-push-secret-demo
spec:
- resyncInterval: 1m
+ resyncInterval: 1m # Remove this field to disable automatic reconciliation of the InfisicalPushSecret CRD.
hostAPI: https://app.infisical.com/api
# Optional, defaults to no replacement.
@@ -124,7 +124,9 @@ After applying the InfisicalPushSecret CRD, you should notice that the secrets y
- The `resyncInterval` is a string-formatted duration that defines the time between each resync.
+ The `resyncInterval` is a string-formatted duration that defines the time between each resync. The field is optional, and will default to no automatic resync if not defined.
+
+ If you don't want to automatically reconcile the InfisicalPushSecret CRD on an interval, you can remove the `resyncInterval` field entirely from your InfisicalPushSecret CRD.
The format of the field is `[duration][unit]` where `duration` is a number and `unit` is a string representing the unit of time.
@@ -459,6 +461,126 @@ Using Go templates, you can format, combine, and create new key-value pairs of s
Please refer to the [templating functions documentation](/integrations/platforms/kubernetes/overview#available-helper-functions) for more information.
+## Using generators to push secrets
+
+Generators are a feature of the Infisical secrets operator that allows you to generate secrets on-reconcile and push them to Infisical. This is useful for secret rotation purposes, and fully operator-managed secrets.
+A generator is a custom resource that is installed on the cluster that defines the logic for generating a secret.
+
+Generators don't keep track of the secrets they generate, which means that on each reconciliation, a new value will be created and pushed.
+For this reason you may want to disable automatic reconciliation of the InfisicalPushSecret CRD. You can do this by removing `resyncInterval` from the InfisicalPushSecret CRD.
+
+**Supported generators**:
+- `Password`: Generates a random password of string format.
+- `UUID`: Generates a random v4 UUID.
+
+To use a generator, you must specify at least one generator in the `push.generators[]` field. An example of a generator usage can be seen here:
+
+
+ Define a generator in the `push.generators[]` field.
+
+
+ The name of the secret that will be created in Infisical.
+
+
+
+ The reference to the generator resource.
+
+ Valid fields:
+ - `kind`: The kind of the generator resource, must match the generator kind.
+ - `name`: The name of the generator resource.
+
+
+
+```yaml
+ push:
+ secret:
+ secretName: push-secret-source-secret
+ secretNamespace: dev
+ generators:
+ - destinationSecretName: password-generator # Name of the secret that will be created in Infisical
+ generatorRef:
+ kind: Password|UUID # Kind of the resource, must match the generator kind.
+ name: custom-generator # Name of the generator resource
+```
+
+
+
+
+ The Password generator is a custom resource that is installed on the cluster that defines the logic for generating a password.
+
+
+ - `kind`: The kind of the generator resource, must match the generator kind. For the Password generator, the kind is `Password`.
+ - `generator.passwordSpec`: The spec of the password generator.
+
+
+ - `length`: The length of the password.
+ - `digits`: The number of digits in the password.
+ - `symbols`: The number of symbols in the password.
+ - `symbolCharacters`: The characters to use for the symbols in the password.
+ - `noUpper`: Whether to include uppercase letters in the password.
+ - `allowRepeat`: Whether to allow repeating characters in the password.
+
+
+
+ ```yaml password-cluster-generator.yaml
+ apiVersion: secrets.infisical.com/v1alpha1
+ kind: ClusterGenerator
+ metadata:
+ name: password-generator
+ spec:
+ kind: Password
+ generator:
+ passwordSpec:
+ length: 10
+ digits: 5
+ symbols: 5
+ symbolCharacters: "-_$@"
+ noUpper: false
+ allowRepeat: true
+ ```
+
+ Example InfisicalPushSecret CRD using the Password generator:
+ ```yaml infisical-push-secret-crd.yaml
+ push:
+ generators:
+ - destinationSecretName: password-generator-test
+ generatorRef:
+ kind: Password
+ name: password-generator
+ ```
+
+
+ The UUID generator is a custom resource that is installed on the cluster that defines the logic for generating a UUID.
+
+ - `kind`: The kind of the generator resource, must match the generator kind. For the UUID generator, the kind is `UUID`.
+ - `generator.uuidSpec`: The spec of the UUID generator. For UUID's, this can be left empty.
+
+
+ ```yaml uuid-cluster-generator.yaml
+ apiVersion: secrets.infisical.com/v1alpha1
+ kind: ClusterGenerator
+ metadata:
+ name: uuid-generator
+ spec:
+ kind: UUID
+ generator:
+ uuidSpec:
+ ```
+
+ Example InfisicalPushSecret CRD using the UUID generator:
+ ```yaml infisical-push-secret-crd.yaml
+ push:
+ generators:
+ - destinationSecretName: uuid-generator-test
+ generatorRef:
+ kind: UUID
+ name: uuid-generator
+ ```
+
+
+
+
+
## Applying the InfisicalPushSecret CRD to your cluster
Once you have configured the `InfisicalPushSecret` CRD with the required fields, you can apply it to your cluster.
diff --git a/k8-operator/controllers/infisicalpushsecret/infisicalpushsecret_controller.go b/k8-operator/controllers/infisicalpushsecret/infisicalpushsecret_controller.go
index a9e22e406..47c55d698 100644
--- a/k8-operator/controllers/infisicalpushsecret/infisicalpushsecret_controller.go
+++ b/k8-operator/controllers/infisicalpushsecret/infisicalpushsecret_controller.go
@@ -108,6 +108,11 @@ func (r *InfisicalPushSecretReconciler) Reconcile(ctx context.Context, req ctrl.
return ctrl.Result{}, nil
}
+ if infisicalPushSecretCRD.Spec.Push.Secret == nil && infisicalPushSecretCRD.Spec.Push.Generators == nil {
+ logger.Info("No secret or generators found, skipping reconciliation. Please define ")
+ return ctrl.Result{}, nil
+ }
+
duration, err := util.ConvertIntervalToDuration(infisicalPushSecretCRD.Spec.ResyncInterval)
if err != nil {