Merge branch 'main' into main

docs/cli/commands/export.mdx

@@ -99,6 +99,15 @@ Export environment variables from the platform into a file format.
     Default value: `true`
   </Accordion>
 
+  <Accordion title="--path">
+    The `--path` flag indicates which project folder secrets will be injected from.
+
+    ```bash
+    # Example
+    infisical export --path="/path/to/folder" --env=dev
+    ```
+  </Accordion>
+
   <Accordion title="--tags">
     When working with tags, you can use this flag to filter and retrieve only secrets that are associated with a specific tag(s).
 

docs/cli/commands/secrets.mdx

@@ -51,6 +51,14 @@ This command enables you to perform CRUD (create, read, update, delete) operatio
 
     Default value: `dev`
   </Accordion>
+  <Accordion title="--path">
+    The `--path` flag indicates which project folder secrets will be injected from.
+
+    ```bash
+    # Example
+    infisical secrets --path="/" --env=dev
+    ```
+  </Accordion>
 
 </Accordion>
 
@@ -91,11 +99,11 @@ $ infisical secrets set STRIPE_API_KEY=sjdgwkeudyjwe DOMAIN=example.com HASH=jeb
     Default value: `dev`
   </Accordion>
   <Accordion title="--path">
-    Used to select the project folder in which the secrets will be set. Useful when creating new secrets under a particular path.
+    Used to select the project folder in which the secrets will be set. This is useful when creating new secrets under a particular path.
 
     ```bash
     # Example
-    infisical secrets set DOMAIN=example.com --path backend
+    infisical secrets set DOMAIN=example.com --path="common/backend"
     ```
   </Accordion>
 </Accordion>
@@ -116,6 +124,14 @@ $ infisical secrets set STRIPE_API_KEY=sjdgwkeudyjwe DOMAIN=example.com HASH=jeb
 
     Default value: `dev`
   </Accordion>
+  <Accordion title="--path">
+    The `--path` flag indicates which project folder secrets will be injected from. 
+
+    ```bash
+    # Example
+    infisical secrets delete <keyName1> <keyName2>... --path="/"
+    ```
+  </Accordion>
 </Accordion>
 
 <Accordion title="infisical secrets generate-example-env">

docs/contributing/overview.mdx

@@ -30,7 +30,7 @@ If you're ever in doubt about whether or not a proposed feature aligns with Infi
 ## Writing and submitting code
 
 Anyone can contribute code to Infisical. To get started, check out the [local development guide](/contributing/developing), make your changes, and submit a pull request to the main repository
-adhering to the [pull request guide](/).
+adhering to the [pull request guide](/contributing/pull-requests).
 
 
 ## Licensing

docs/documentation/getting-started/kubernetes.mdx

@@ -61,14 +61,18 @@ metadata:
 spec:
   # The host that should be used to pull secrets from. If left empty, the value specified in Global configuration will be used
   hostAPI: https://app.infisical.com/api
+  resyncInterval:
   authentication:
-    serviceToken: 
-      serviceTokenSecretReference: # <-- The secret's namespaced name that holds the project token for authentication in step 1
+    serviceToken:
+      serviceTokenSecretReference:
         secretName: service-token
         secretNamespace: option
-  managedSecretReference: 
+      secretsScope:
+        envSlug: dev
+        secretsPath: "/"
+  managedSecretReference:
     secretName: managed-secret # <-- the name of kubernetes secret that will be created
-    secretNamespace: default # <-- in what namespace it will be created in
+    secretNamespace: default # <-- where the kubernetes secret should be created
 ```
 
 ```

docs/documentation/platform/folder.mdx

@@ -37,6 +37,8 @@ For more information on integrations, [refer infisical integration](/integration
 
 You can scope the secrets that can be read and written using an Infisical token by providing the secret path option when creating the token.
 
+You can provide the folder path as glob if you want to have access to multiple folders and the tokens do support multi-environment.
+
 ![folder scoped service token](../../images/project-folder-token.png)
 
 For more information, [refer infisical token section.](./token)

docs/documentation/platform/secret-reference.mdx

@@ -0,0 +1,26 @@
+---
+title: "Reference Secrets"
+description: "How to use reference secrets in Infisical"
+---
+
+You can use the interpolation syntax to reference a secret in the same environment, another folder, or another environment
+The interpolation syntax is a way of referencing a secret by using a special placeholder. The placeholder is the name of the secret, followed by the environment or folder name, separated by a colon. 
+
+For example, to reference a secret named mysecret in the same environment, you would use the placeholder `${mysecret}`.
+
+While for another environment like `test` would be `${test.mysecret}`
+
+Some more examples of referencing  are 
+
+| Syntax                | Environment | Folder       | Secret Key |
+| --------------------- | ----------- | ------------ | ---------- |
+| `${KEY1}`               | same env    | ssame folder | KEY1       |
+| `${dev.KEY2}`           | dev         | /            | KEY2       |
+| `${test.frontend.KEY2}` | test        | /frontend    | KEY2       |
+
+# Permission system for reference
+
+When you use the infisical CLI to log in, the permission system will work the same way as your user permissions. 
+This means that if you have permission to access other environments, your references to those environments will be resolved.
+
+When using the Infisical CLI with a service token, the service token must have permissions to the referenced environment and folder path.

docs/integrations/cloud/laravel-forge.mdx

@@ -9,23 +9,23 @@ Prerequisites:
 
 ## Navigate to your project's integrations tab
 
-![integrations](../../images/null)
+![integrations](../../images/integrations.png)
 
 ## Enter your Laravel Forge Access Token and Server Id
 
 Obtain a Laravel Forge access token in API Tokens
 
-![integrations laravel forge dashboard](../../images/null)
-![integrations laravel forge api tokens](../../images/null)
+![integrations laravel forge dashboard](../../images/integrations-laravelforge-dashboard.png)
+![integrations laravel forge api tokens](../../images/integrations-laravelforge-api.png)
 
-Obtain a Laravel Forge server id in Servers
+Obtain your Laravel Forge Server ID in Servers > Server ID
 
-![integrations laravel forge server](../../images/null)
-![integrations laravel forge server id](../../images/null)
+![integrations laravel forge server](../../images/integrations-laravelforge-servers.png)
+![integrations laravel forge server id](../../images/integrations-laravelforge-serverid.png)
 
-Press on the Laravel Forge tile and input your Laravel Forge access token and server id to grant Infisical access to your Laravel Forge account.
+Press on the Laravel Forge tile and input your Laravel Forge access token and server ID to grant Infisical access to your Laravel Forge account.
 
-![integrations laravel forge authorization](../../images/null)
+![integrations laravel forge authorization](../../images/integrations-laravelforge-auth.png)
 
 <Info>
   If this is your project's first cloud integration, then you'll have to grant
@@ -38,5 +38,5 @@ Press on the Laravel Forge tile and input your Laravel Forge access token and se
 
 Select which Infisical environment secrets you want to sync to which Laravel Forge site and press create integration to start syncing secrets to Laravel Forge.
 
-![integrations laravel forge](../../images/null)
-![integrations laravel forge](../../images/null)
+![integrations laravel forge](../../images/integrations-laravelforge-create.png)
+![integrations laravel forge](../../images/integrations-laravelforge.png)

docs/integrations/frameworks/terraform.mdx

@@ -44,10 +44,17 @@ provider "infisical" {
 
 ### 3. Fetch Infisical Secrets
 
-Use the `infisical_secrets` data source to fetch your secrets. This is defined with an empty block `{}` as the provider automatically fetches all secrets associated with your service token.
+Use the `infisical_secrets` data source to fetch your secrets. In this block, you must set the `env_slug` and `folder_path` to scope the secrets you want. 
+
+`env_slug` is the slug of the environment name. This slug name can be found under the project settings page on the Infisical dashboard. 
+
+`folder_path` is the path to the folder in a given environment. The path `/` for root of the environment where as `/folder1` is the folder at the root of the environment.
 
 ```hcl main.tf
-data "infisical_secrets" "my-secrets" {}
+data "infisical_secrets" "my-secrets" {
+  env_slug    = "dev"
+  folder_path = "/some-folder/another-folder"
+}
 ```
 
 ### 4. Define Outputs

docs/integrations/platforms/kubernetes.mdx

@@ -38,10 +38,9 @@ The operator can be install via [Helm](helm.sh) or [kubectl](https://github.com/
 </Tabs>
 
 ## Sync Infisical Secrets to your cluster
-To retrieve secrets from an Infisical project and save them as native Kubernetes secrets within a specific namespace, utilize the `InfisicalSecret` custom resource definition (CRD). 
-This resource can be created after installing the Infisical operator. For each new managed secret, you will need to create a new InfisicalSecret CRD.
+Once you have installed the operator to your cluster, you'll need to create a `InfisicalSecret` custom resource definition (CRD). 
 
-```yaml
+```yaml example-infisical-secret-crd.yaml
 apiVersion: secrets.infisical.com/v1alpha1
 kind: InfisicalSecret
 metadata:
@@ -50,15 +49,18 @@ metadata:
 spec:
   # The host that should be used to pull secrets from. If left empty, the value specified in Global configuration will be used
   hostAPI: https://app.infisical.com/api
-  resyncInterval: 60 # <-- the time in seconds between secret re-sync. Faster re-syncs will require higher rate limits
+  resyncInterval:
   authentication:
     serviceToken:
       serviceTokenSecretReference:
         secretName: service-token
         secretNamespace: option
+      secretsScope:
+        envSlug: dev
+        secretsPath: "/"
   managedSecretReference:
     secretName: managed-secret # <-- the name of kubernetes secret that will be created
-    secretNamespace: default # <-- where the kubernetes secret that will be created
+    secretNamespace: default # <-- where the kubernetes secret should be created
 ```
 ### InfisicalSecret CRD properties
 
@@ -86,45 +88,59 @@ Default re-sync interval is every 1 minute.
 </Accordion>
 
 <Accordion title="authentication">
-  The `authentication` property tells the operator where it should look to find credentials needed to fetch secrets from Infisical.
+  This block defines the method that will be used to authenticate with Infisical so that secrets can be fetched. Currently, only [Service Tokens](../../documentation/platform/token) can be used to authenticate with Infisical. 
+</Accordion>
 
-  <Tabs>
-    <Tab title="Service Token">
-      Authenticating with service tokens is a great option when you have a small number of services you'd like to fetch secrets for and are looking for the least amount of setup. 
-      
-      #### 1. Generate service token 
+<Accordion title="authentication.serviceToken.serviceTokenSecretReference">
+  The service token required to authenticate with Infisical needs to be stored in a Kubernetes secret. This block defines the reference to the name and name space of secret that stores this service token. 
+  Follow the instructions below to create and store the service token in a Kubernetes secrets and reference it in your CRD.
 
-      You can generate a [service token](../../documentation/platform/token) for an Infisical project by heading over to the Infisical dashboard then to Project Settings.
+  #### 1. Generate service token 
 
-      #### 2. Create Kubernetes secret containing service token 
+  You can generate a [service token](../../documentation/platform/token) for an Infisical project by heading over to the Infisical dashboard then to Project Settings.
 
-      Once you have generated the service token, you will need to create a Kubernetes secret containing the service token you generated. 
-      To quickly create a Kubernetes secret containing the generated service token, you can run the command below.
+  #### 2. Create Kubernetes secret containing service token 
 
-      ``` bash
-      kubectl create secret generic service-token --from-literal=infisicalToken=<your-service-token-here> 
-      ```
+  Once you have generated the service token, you will need to create a Kubernetes secret containing the service token you generated. 
+  To quickly create a Kubernetes secret containing the generated service token, you can run the command below. Make sure you replace `<your-service-token-here>` with your service token.
 
-      #### 3. Add reference for the Kubernetes secret containing service token 
+  ``` bash
+  kubectl create secret generic service-token --from-literal=infisicalToken=<your-service-token-here> 
+  ```
 
-      Once the secret is created, add the name and namespace of the secret that was just created under `authentication.serviceToken.serviceTokenSecretReference` field in the InfisicalSecret resource.
+  #### 3. Add reference for the Kubernetes secret containing service token 
 
-      ## Example
-      ```yaml
-      apiVersion: secrets.infisical.com/v1alpha1
-      kind: InfisicalSecret
-      metadata:
-        name: infisicalsecret-sample-crd
-      spec:
-        authentication:
-          serviceToken: 
-            serviceTokenSecretReference:
-              secretName: service-token # <-- name of the Kubernetes secret that stores our service token
-              secretNamespace: option # <-- namespace of the Kubernetes secret that stores our service token
-        ...
-      ```
-    </Tab>
-  </Tabs>
+  Once the secret is created, add the name and namespace of the secret that was just created under `authentication.serviceToken.serviceTokenSecretReference` field in the InfisicalSecret resource.
+
+  ## Example
+  ```yaml
+  apiVersion: secrets.infisical.com/v1alpha1
+  kind: InfisicalSecret
+  metadata:
+    name: infisicalsecret-sample-crd
+  spec:
+    authentication:
+      serviceToken: 
+        serviceTokenSecretReference:
+          secretName: service-token # <-- name of the Kubernetes secret that stores our service token
+          secretNamespace: option # <-- namespace of the Kubernetes secret that stores our service token
+    ...
+  ```
+</Accordion>
+
+<Accordion title="authentication.serviceToken.secretsScope">
+  This block defines the scope of what secrets should be fetched. This is needed as your service token can have access to multiple folders and environments.
+  A scope is defined by `envSlug` and `secretsPath`. 
+  
+  #### envSlug
+
+  This refers to the short hand name of an environment. For example for the `development` environment the environment slug is `dev`. You can locate the slug of your environment by heading to your project settings in the Infisical dashboard.
+
+  #### secretsPath
+  
+  secretsPath is the path to the secret in the given environment. For example a path of `/` would refer to the root of the environment whereas `/folder1` would refer to the secrets in folder1 from the root.
+
+  Both fields are required.
 </Accordion>
 
 <Accordion title="managedSecretReference">
@@ -135,6 +151,14 @@ The managed secret be should be created in the same namespace as the deployment
 
 </Accordion>
 
+### Apply the Infisical CRD to your cluster 
+Once you have configured the Infisical CRD with the required fields, you can apply it to your cluster. 
+After applying, you should notice that the managed secret has been created in the desired namespace your specified.
+
+```
+kubectl apply -f example-infisical-secret-crd.yaml
+```
+
 ### Verify managed secret creation 
 
 To verify that the operator has successfully created the managed secret, you can check the secrets in the namespace that was specified. 

docs/mint.json

@@ -110,6 +110,7 @@
         "documentation/platform/organization",
         "documentation/platform/project",
         "documentation/platform/folder",
+        "documentation/platform/secret-reference",
         "documentation/platform/pit-recovery",
         "documentation/platform/secret-versioning",
         "documentation/platform/audit-logs",

docs/self-hosting/configuration/envars.mdx

@@ -105,7 +105,7 @@ Other environment variables are listed below to increase the functionality of yo
     </ParamField>
 
     <ParamField query="CLIENT_SLUG_VERCEL" type="string" default="none" optional>
-      OAuth2 slug for Netlify integration
+      OAuth2 slug for Vercel integration
     </ParamField>
   </Tab>
   <Tab title="Auth Integrations">

docs/self-hosting/overview.mdx

@@ -25,13 +25,6 @@ Choose from a variety of deployment options listed below to get started.
   <Card title="Fly.io" color="#dc2626" href="deployment-options/fly.io">
     Use our standalone docker image to deploy on Fly.io
   </Card>
-  <Card
-    title="Laravel Forge"
-    color="#17B69B"
-    href="deployment-options/laravel-forge"
-  >
-    Use our standalone docker image to deploy on Laravel Forge
-  </Card>
   <Card title="Render.com" color="#dc2626" href="deployment-options/render">
     Install on Render using our standalone docker image
   </Card>