mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-09-22 13:39:35 +00:00
Merge branch 'main' into chore/contributing-docs-update
This commit is contained in:
Victor Santos
@@ -66,29 +66,72 @@ Infisical currently only supports two methods for connecting to Azure, which are
|
||||
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="Client Secret Authentication">
|
||||
Ensure your Azure application has the required permissions that Infisical needs for the Azure Client Secrets connection to work.
|
||||
|
||||
**Prerequisites:**
|
||||
- An active Azure setup.
|
||||
<AccordionGroup>
|
||||
|
||||
<Steps>
|
||||
<Step title="Assign API permissions to the application">
|
||||
For the Azure Client Secrets connection to work, assign the following permissions to your Azure application:
|
||||
<Accordion title="Client Secret Authentication">
|
||||
Ensure your Azure application has the required permissions that Infisical needs for the Azure Client Secrets connection to work.
|
||||
|
||||
**Prerequisites:**
|
||||
- An active Azure setup.
|
||||
|
||||
<Steps>
|
||||
<Step title="Assign API permissions to the application">
|
||||
For the Azure Client Secrets connection to work, assign the following permissions to your Azure application:
|
||||
|
||||
#### Required API Permissions
|
||||
|
||||
**Microsoft Graph**
|
||||
- `Application.ReadWrite.All`
|
||||
- `Application.ReadWrite.OwnedBy`
|
||||
- `Application.ReadWrite.All` (Delegated)
|
||||
- `Directory.ReadWrite.All` (Delegated)
|
||||
- `User.Read` (Delegated)
|
||||
|
||||
|
||||
</Step>
|
||||
</Steps>
|
||||
</Accordion>
|
||||
<Accordion title="Certificate Authentication">
|
||||
Ensure your Azure application has the required permissions that Infisical needs for the Azure Client Secrets connection to work.
|
||||
|
||||
**Prerequisites:**
|
||||
- An active Azure setup.
|
||||
|
||||
<Steps>
|
||||
<Step title="Assign API permissions to the application">
|
||||
For the Azure Client Secrets connection to work, assign the following permissions to your Azure application:
|
||||
|
||||
#### Required API Permissions
|
||||
|
||||
**Microsoft Graph**
|
||||
- `Application.ReadWrite.All`
|
||||
- `Application.ReadWrite.OwnedBy`
|
||||
- `Application.ReadWrite.All` (Delegated)
|
||||
- `Directory.ReadWrite.All` (Delegated)
|
||||
- `User.Read` (Delegated)
|
||||
|
||||
|
||||
</Step>
|
||||
|
||||
<Step title="Upload your certificate to your Azure App Registration">
|
||||
Navigate to the **Certificates & secrets** section of your Azure App Registration, and press the **Upload certificate** button.
|
||||
|
||||
Select the **Upload** button and upload your certificate.
|
||||
|
||||
|
||||
|
||||
<Tip>
|
||||
Keep in mind that both the certificate and its private key are required to configure the Azure Client Secrets connection in Infisical.
|
||||
</Tip>
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
</Accordion>
|
||||
|
||||
</AccordionGroup>
|
||||
|
||||
#### Required API Permissions
|
||||
|
||||
**Microsoft Graph**
|
||||
- `Application.ReadWrite.All`
|
||||
- `Application.ReadWrite.OwnedBy`
|
||||
- `Application.ReadWrite.All` (Delegated)
|
||||
- `Directory.ReadWrite.All` (Delegated)
|
||||
- `User.Read` (Delegated)
|
||||
|
||||
|
||||
</Step>
|
||||
</Steps>
|
||||
</Accordion>
|
||||
|
||||
## Setup Azure Connection in Infisical
|
||||
|
||||
@@ -123,6 +166,17 @@ Infisical currently only supports two methods for connecting to Azure, which are
|
||||
|
||||
</Step>
|
||||
</Tab>
|
||||
<Tab title="Certificate">
|
||||
<Step title="Create Connection">
|
||||
Fill in the **Tenant ID**, **Client ID**, **Certificate (PEM format)**, and **Private Key** fields with the Directory (Tenant) ID, Application (Client) ID, Certificate and Private Key you obtained in the [previous step](#certificate-authentication).
|
||||
|
||||
<Tip>
|
||||
The private key is never transmitted to Azure, and it is only used to sign the client assertion used to authenticate with Azure.
|
||||
</Tip>
|
||||
|
||||
|
||||
</Step>
|
||||
</Tab>
|
||||
</Tabs>
|
||||
</Step>
|
||||
<Step title="Connection Created">
|
||||
|
||||
@@ -48,6 +48,8 @@ While specifying an authentication method is mandatory to start the agent, confi
|
||||
| Field | Description |
|
||||
| ------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| `infisical.address` | The URL of the Infisical service. Default: `"https://app.infisical.com"`. |
|
||||
| `infisical.exit-after-auth` | Whether to exit the agent after authentication and first secret render. Default: `"false"`. |
|
||||
| `infisical.revoke-credentials-on-shutdown` | Whether to revoke all managed dynamic secret leases and identity access tokens on shutdown. Default: `"false"`. |
|
||||
| `auth.type` | The type of authentication method used. Available options: `universal-auth`, `kubernetes`, `azure`, `gcp-id-token`, `gcp-iam`, `aws-iam` |
|
||||
| `auth.config.identity-id` | The file path where the machine identity id is stored<br/><br/>This field is required when using any of the following auth types: `kubernetes`, `azure`, `gcp-id-token`, `gcp-iam`, or `aws-iam`. |
|
||||
| `auth.config.service-account-token` | Path to the Kubernetes service account token to use (optional)<br/><br/>Default: `/var/run/secrets/kubernetes.io/serviceaccount/token` |
|
||||
@@ -58,7 +60,7 @@ While specifying an authentication method is mandatory to start the agent, confi
|
||||
| `sinks[].type` | The type of sink in a list of sinks. Each item specifies a sink type. Currently, only `"file"` type is available. |
|
||||
| `sinks[].config.path` | The file path where the access token should be stored for each sink in the list. |
|
||||
| `templates[].source-path` | The path to the template file that should be used to render secrets. |
|
||||
| `templates[].template-content` | The inline secret template to be used for rendering the secrets. |
|
||||
| `templates[].template-content` | The inline secret template to be used for rendering the secrets. |
|
||||
| `templates[].destination-path` | The path where the rendered secrets from the source template will be saved to. |
|
||||
| `templates[].config.polling-interval` | How frequently to check for secret changes. Default: `5 minutes` (optional) |
|
||||
| `templates[].config.execute.command` | The command to execute when secret change is detected (optional) |
|
||||
|
||||
@@ -145,6 +145,17 @@ The entire config needs to be of string format and needs to be assigned to the `
|
||||
The address of your Infisical instance. This field is optional and will default to `https://app.infisical.com` if not provided.
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="infisical.revoke-credentials-on-shutdown">
|
||||
Whether to revoke all managed dynamic secret leases and identity access tokens on shutdown. Default: `"false"`.
|
||||
|
||||
If this is set to `true`, all managed dynamic secret leases and identity access tokens will be revoked when a `SIGTERM` signal is sent to the agents container _(such as when a pod is terminated or when the pod is restarted)_.
|
||||
**Note:** In disaster events such as cluster power outages, a `SIGTERM` signal won't be sent to the agents container, and the credentials will not be revoked.
|
||||
|
||||
<Note>
|
||||
Note that this is currently unsupported on Windows-based pods, and will only work when injecting into Linux-based pods.
|
||||
</Note>
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="infisical.auth.type">
|
||||
The authentication type to use to connect to Infisical. Currently only the `kubernetes` authentication type is supported.
|
||||
You can refer to our [Kubernetes Auth](/documentation/platform/identities/kubernetes-auth) documentation for more information on how to create a machine identity for Kubernetes Auth.
|
||||
|
||||
Reference in New Issue
Block a user