awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

doc: added daemonset and statefulset auto-redeploy example

Browse Source
This commit is contained in:
Sheen
2025-05-04 15:28:12 +00:00
parent d1122886fd
commit f5e34ea59e
1 changed files with 76 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

80
docs/integrations/platforms/kubernetes/infisical-secret-crd.mdx
View File

@@ -1230,13 +1230,13 @@ To address this, we added functionality to automatically redeploy your deploymen
#### Enabling Automatic Redeployment
To enable auto redeployment you simply have to add the following annotation to the deployment, statefulset, or daemonset that consumes a managed secret.
To enable auto redeployment you simply have to add the following annotation to the Deployment, StatefulSet, or DaemonSet that consumes a managed secret.
```yaml
secrets.infisical.com/auto-reload: "true"
```
<Accordion title="Deployment example with auto redeploy enabled">
<Accordion title="Deployment example">
```yaml
apiVersion: apps/v1
kind: Deployment
@@ -1266,10 +1266,82 @@ secrets.infisical.com/auto-reload: "true"
- containerPort: 80
```
</Accordion>
<Accordion title="DaemonSet example">
```yaml
apiVersion: apps/v1
kind: DaemonSet
metadata:
name: log-agent
labels:
app: log-agent
annotations:
secrets.infisical.com/auto-reload: "true" # <- redeployment annotation
spec:
selector:
matchLabels:
app: log-agent
template:
metadata:
labels:
app: log-agent
spec:
containers:
- name: log-agent
image: mycompany/log-agent:latest
envFrom:
- secretRef:
name: managed-secret # <- name of the managed secret
volumeMounts:
- name: config-volume
mountPath: /etc/config
readOnly: true
volumes:
- name: config-volume
secret:
secretName: managed-secret
```
</Accordion>
<Accordion title="StatefulSet example">
```yaml
apiVersion: apps/v1
kind: StatefulSet
metadata:
name: db-worker
labels:
app: db-worker
annotations:
secrets.infisical.com/auto-reload: "true" # <- redeployment annotation
spec:
selector:
matchLabels:
app: db-worker
serviceName: "db-worker"
replicas: 2
template:
metadata:
labels:
app: db-worker
spec:
containers:
- name: db-worker
image: mycompany/db-worker:stable
env:
- name: DATABASE_PASSWORD
valueFrom:
secretKeyRef:
name: managed-secret
key: DB_PASSWORD
ports:
- containerPort: 5432
```
</Accordion>
<Info>
#### How it works
When a secret change occurs, the operator will check to see which deployments are using the operator-managed Kubernetes secret that received the update.
Then, for each deployment that has this annotation present, a rolling update will be triggered.
When a managed secret is updated, the operator checks for any Deployments, DaemonSets, or StatefulSets that consume the updated secret and have the annotation
`secrets.infisical.com/auto-reload: "true"`. For each matching workload, the operator triggers a rolling restart to ensure it picks up the latest secret values.
</Info>
## Using Managed ConfigMap In Your Deployment