mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-09-22 13:39:35 +00:00
documentation revamp
This commit is contained in:
Vladyslav Matsiiako
@@ -1,6 +1,6 @@
|
||||
---
|
||||
title: "Ansible"
|
||||
description: "How to use Infisical for secret management in Ansible"
|
||||
description: "Learn how to use Infisical for secret management in Ansible."
|
||||
---
|
||||
|
||||
The documentation for using Infisical to manage secrets in Ansible is currently available [here](https://galaxy.ansible.com/ui/repo/published/infisical/vault/).
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
title: "Docker Compose"
|
||||
description: "How to use Infisical to inject environment variables into services defined in your Docker Compose file."
|
||||
description: "Find out how to use Infisical to inject environment variables into services defined in your Docker Compose file."
|
||||
---
|
||||
|
||||
Prerequisites:
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
title: "Docker"
|
||||
description: "Learn how to feed secrets from Infisical into your Docker application"
|
||||
description: "Learn how to feed secrets from Infisical into your Docker application."
|
||||
---
|
||||
There are many methods to inject Infisical secrets into Docker-based applications.
|
||||
Regardless of the method you choose, they all inject secrets from Infisical as environment variables into your Docker container.
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
title: "Docker Run"
|
||||
description: "Pass secrets to your docker container at run time"
|
||||
description: "Learn how to pass secrets to your docker container at run time."
|
||||
---
|
||||
|
||||
This method allows you to feed secrets from Infisical into your container using the `--env-file` flag of `docker run` command.
|
||||
|
||||
164
docs/integrations/platforms/docker-swarm-with-agent.mdx
Normal file
164
docs/integrations/platforms/docker-swarm-with-agent.mdx
Normal file
@@ -0,0 +1,164 @@
|
||||
---
|
||||
title: 'Docker Swarm'
|
||||
description: "Learn how to manage secrets in Docker Swarm services."
|
||||
---
|
||||
|
||||
In this guide, we'll demonstrate how to use Infisical for managing secrets within Docker Swarm.
|
||||
Specifically, we'll set up a sidecar container using the [Infisical Agent](/infisical-agent/overview), which authenticates with Infisical to retrieve secrets and access tokens.
|
||||
These secrets are then stored in a shared volume accessible by other services in your Docker Swarm.
|
||||
|
||||
## Prerequisites
|
||||
- Infisical account
|
||||
- Docker version 20.10.24 or newer
|
||||
- Basic knowledge of Docker Swarm
|
||||
- [Git](https://git-scm.com/book/en/v2/Getting-Started-Installing-Git) installed on your system
|
||||
- Familiarity with the [Infisical Agent](/infisical-agent/overview)
|
||||
|
||||
## Objective
|
||||
Our goal is to deploy an Nginx instance in your Docker Swarm cluster, configured to display Infisical secrets on its landing page. This will provide hands-on experience in fetching and utilizing secrets from Infisical within Docker Swarm. The principles demonstrated here are also applicable to Docker Compose deployments.
|
||||
|
||||
<Steps>
|
||||
<Step title="Cloning the Guide Assets Repository">
|
||||
Start by cloning the [Infisical guide assets repository](https://github.com/Infisical/infisical-guides.git) from Github. This repository includes necessary assets for this and other Infisical guides. Focus on the `docker-swarm-with-agent` sub-directory, which we'll use as our working directory.
|
||||
</Step>
|
||||
|
||||
<Step title="Setting Up Authentication with Infisical">
|
||||
To allow the agent to fetch your Infisical secrets, choose an authentication method for the agent. For this guide, we will use [Universal Auth](/documentation/platform/identities/universal-auth) for authentication. Follow the instructions [here](/documentation/platform/identities/universal-auth) to generate a client ID and client secret.
|
||||
</Step>
|
||||
|
||||
<Step title="Entering Universal Auth Credentials">
|
||||
Copy the client ID and client secret obtained in the previous step into the `client-id` and `client-secret` text files, respectively.
|
||||
</Step>
|
||||
|
||||
<Step title="Configuring the Infisical Agent">
|
||||
The Infisical Agent will authenticate using Universal Auth and retrieve secrets for rendering as specified in the template(s).
|
||||
Adjust the `polling-interval` to control the frequency of secret updates.
|
||||
|
||||
In the example template, the secrets are rendered as an HTML page, which will be set as Nginx's home page to demonstrate successful secret retrieval and utilization.
|
||||
|
||||
<Tip>
|
||||
Remember to add your project id, environment slug and path of corresponding Infisical project to the secret template.
|
||||
</Tip>
|
||||
<Tabs>
|
||||
<Tab title="Agent Configuration">
|
||||
```yaml infisical-agent-config
|
||||
infisical:
|
||||
address: "https://app.infisical.com"
|
||||
auth:
|
||||
type: "universal-auth"
|
||||
config:
|
||||
client-id: "/run/secrets/infisical-universal-auth-client-id"
|
||||
client-secret: "/run/secrets/infisical-universal-auth-client-secret"
|
||||
remove_client_secret_on_read: false
|
||||
sinks:
|
||||
- type: "file"
|
||||
config:
|
||||
path: "/infisical-secrets/access-token"
|
||||
templates:
|
||||
- source-path: /run/secrets/nginx-home-page-template
|
||||
destination-path: /infisical-secrets/index.html
|
||||
config:
|
||||
polling-interval: 60s
|
||||
```
|
||||
<Info>
|
||||
Some paths contain `/run/secrets/` because the contents of those files reside in a [Docker secret](https://docs.docker.com/engine/swarm/secrets/#how-docker-manages-secrets).
|
||||
</Info>
|
||||
</Tab>
|
||||
<Tab title="Secret Template for Agent">
|
||||
```html nginx-home-page-template
|
||||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
<body>
|
||||
<h1>This file is rendered by Infisical agent template engine</h1>
|
||||
<p>Here are the secrets that have been fetched from Infisical and stored in your volume mount</p>
|
||||
<ol>
|
||||
{{- with secret "7df67a5f-d26a-4988-a375-7153c08149da" "dev" "/" }}
|
||||
{{- range . }}
|
||||
<li>{{ .Key }}={{ .Value }}</li>
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
</ol>
|
||||
</body>
|
||||
</html>
|
||||
```
|
||||
</Tab>
|
||||
</Tabs>
|
||||
</Step>
|
||||
|
||||
<Step title="Creating the Docker Compose File">
|
||||
Define the `infisical-agent` and `nginx` services in your Docker Compose file. `infisical-agent` will handle secret retrieval and storage. These secrets are stored in a volume, accessible by other services like Nginx.
|
||||
|
||||
```yaml docker-compose.yaml
|
||||
version: "3.1"
|
||||
|
||||
services:
|
||||
infisical-agent:
|
||||
container_name: infisical-agnet
|
||||
image: infisical/cli:0.18.0
|
||||
command: agent --config=/run/secrets/infisical-agent-config
|
||||
volumes:
|
||||
- infisical-agent:/infisical-secrets
|
||||
secrets:
|
||||
- infisical-universal-auth-client-id
|
||||
- infisical-universal-auth-client-secret
|
||||
- infisical-agent-config
|
||||
- nginx-home-page-template
|
||||
networks:
|
||||
- infisical_network
|
||||
|
||||
nginx:
|
||||
image: nginx:latest
|
||||
ports:
|
||||
- "80:80"
|
||||
volumes:
|
||||
- infisical-agent:/usr/share/nginx/html
|
||||
networks:
|
||||
- infisical_network
|
||||
|
||||
volumes:
|
||||
infisical-agent:
|
||||
|
||||
secrets:
|
||||
infisical-universal-auth-client-id:
|
||||
file: ./client-id
|
||||
infisical-universal-auth-client-secret:
|
||||
file: ./client-secret
|
||||
infisical-agent-config:
|
||||
file: ./infisical-agent-config
|
||||
nginx-home-page-template:
|
||||
file: ./nginx-home-page-template
|
||||
|
||||
|
||||
networks:
|
||||
infisical_network:
|
||||
```
|
||||
</Step>
|
||||
|
||||
<Step title="Initializing Docker Swarm">
|
||||
```
|
||||
docker swarm init
|
||||
```
|
||||
</Step>
|
||||
|
||||
<Step title="Deploying the Docker Stack">
|
||||
```
|
||||
docker stack deploy -c docker-compose.yaml agent-demo
|
||||
```
|
||||
</Step>
|
||||
|
||||
<Step title="Verifying Secret Consumption">
|
||||
To confirm that secrets are properly rendered and accessible, navigate to `http://localhost`. You should see the Infisical secrets displayed on the Nginx landing page.
|
||||
|
||||
|
||||
</Step>
|
||||
|
||||
<Step title="Clean up">
|
||||
```
|
||||
docker stack rm agent-demo
|
||||
```
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
## Considerations
|
||||
- Secret Updates: Applications that access secrets directly from the volume mount will receive updates in real-time, in accordance with the `polling-interval` set in agent config.
|
||||
- In-Memory Secrets: If your application loads secrets into memory, the new secrets will be available to the application on the next deployment.
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
title: "Docker Entrypoint"
|
||||
description: "How to use Infisical to inject environment variables into a Docker container."
|
||||
description: "Learn how to use Infisical to inject environment variables into a Docker container."
|
||||
---
|
||||
|
||||
This approach allows you to inject secrets from Infisical directly into your application.
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
title: 'Amazon ECS'
|
||||
description: "How to deliver secrets to Amazon Elastic Container Service"
|
||||
description: "Learn how to deliver secrets to Amazon Elastic Container Service."
|
||||
---
|
||||
|
||||
|
||||
|
||||
108
docs/integrations/platforms/infisical-agent.mdx
Normal file
108
docs/integrations/platforms/infisical-agent.mdx
Normal file
@@ -0,0 +1,108 @@
|
||||
---
|
||||
title: "Infisical Agent"
|
||||
description: "This page describes how to manage secrets using Infisical Agent."
|
||||
---
|
||||
|
||||
Infisical Agent is a client daemon that simplifies the adoption of Infisical by providing a more scalable and user-friendly approach for applications to interact with Infisical.
|
||||
It eliminates the need to modify application logic by enabling clients to decide how they want their secrets rendered through the use of templates.
|
||||
|
||||
<img height="200" src="../images/agent/infisical-agent-diagram.png" />
|
||||
|
||||
### Key features:
|
||||
- Token renewal: Automatically authenticates with Infisical and deposits renewed access tokens at specified path for applications to consume
|
||||
- Templating: Renders secrets via user provided templates to desired formats for applications to consume
|
||||
|
||||
### Token renewal
|
||||
The Infisical agent can help manage the life cycle of access tokens. The token renewal process is split into two main components: a `Method`, which is the authentication process suitable for your current setup, and `Sinks`, which are the places where the agent deposits the new access token whenever it receives updates.
|
||||
|
||||
When the Infisical Agent is started, it will attempt to obtain a valid access token using the authentication method you have configured. If the agent is unable to fetch a valid token, the agent will keep trying, increasing the time between each attempt.
|
||||
|
||||
Once a access token is successfully fetched, the agent will make sure the access token stays valid, continuing to renew it before it expires.
|
||||
|
||||
Every time the agent successfully retrieves a new access token, it writes the new token to the Sinks you've configured.
|
||||
|
||||
<Info>
|
||||
Access tokens can be utilized with Infisical SDKs or directly in API requests to retrieve secrets from Infisical
|
||||
</Info>
|
||||
|
||||
### Templating
|
||||
The Infisical agent can help deliver formatted secrets to your application in a variety of environments. To achieve this, the agent will retrieve secrets from Infisical, format them using a specified template, and then save these formatted secrets to a designated file path.
|
||||
|
||||
Templating process is done through the use of Go language's [text/template feature](https://pkg.go.dev/text/template). Multiple template definitions can be set in the agent configuration file to generate a variety of formatted secret files.
|
||||
|
||||
When the agent is started and templates are defined in the agent configuration file, the agent will attempt to acquire a valid access token using the set authentication method outlined in the agent's configuration.
|
||||
If this initial attempt is unsuccessful, the agent will momentarily pauses before continuing to make more attempts.
|
||||
|
||||
Once the agent successfully obtains a valid access token, the agent proceeds to fetch the secrets from Infisical using it.
|
||||
It then formats these secrets using the user provided templates and writes the formatted data to configured file paths.
|
||||
|
||||
## Agent configuration file
|
||||
|
||||
To set up the authentication method for token renewal and to define secret templates, the Infisical agent requires a YAML configuration file containing properties defined below.
|
||||
While specifying an authentication method is mandatory to start the agent, configuring sinks and secret templates are optional.
|
||||
|
||||
| Field | Description |
|
||||
| ---------------------------- | ----------- |
|
||||
| `infisical.address` | The URL of the Infisical service. Default: `"https://app.infisical.com"`. |
|
||||
| `auth.type` | The type of authentication method used. Only `"universal-auth"` type is currently available |
|
||||
| `auth.config.client-id` | The file path where the universal-auth client id is stored. |
|
||||
| `auth.config.client-secret` | The file path where the universal-auth client secret is stored. |
|
||||
| `auth.config.remove_client_secret_on_read` | This will instruct the agent to remove the client secret from disk. |
|
||||
| `sinks[].type` | The type of sink in a list of sinks. Each item specifies a sink type. Currently, only `"file"` type is available. |
|
||||
| `sinks[].config.path` | The file path where the access token should be stored for each sink in the list. |
|
||||
| `templates[].source-path` | The path to the template file that should be used to render secrets. |
|
||||
| `templates[].destination-path` | The path where the rendered secrets from the source template will be saved to. |
|
||||
| `templates[].config.polling-interval` | How frequently to check for secret changes. Default: `60s` (optional) |
|
||||
| `templates[].config.execute.command` | The command to execute when secret change is detected (optional) |
|
||||
| `templates[].config.execute.timeout` | How long in seconds to wait for command to execute before timing out (optional) |
|
||||
|
||||
|
||||
## Quick start Infisical Agent
|
||||
To install the Infisical agent, you must first install the [Infisical CLI](../cli/overview) in the desired environment where you'd like the agent to run. This is because the Infisical agent is a sub-command of the Infisical CLI.
|
||||
|
||||
Once you have the CLI installed, you will need to provision programmatic access for the agent via [Universal Auth](/documentation/platform/identities/universal-auth). To obtain a **Client ID** and a **Client Secret**, follow the step by step guide outlined [here](/documentation/platform/identities/universal-auth).
|
||||
|
||||
Next, create agent config file as shown below.
|
||||
|
||||
```yaml example-agent-config-file.yaml
|
||||
infisical:
|
||||
address: "https://app.infisical.com"
|
||||
auth:
|
||||
type: "universal-auth"
|
||||
config:
|
||||
client-id: "./client-id"
|
||||
client-secret: "./client-secret"
|
||||
remove_client_secret_on_read: false
|
||||
sinks:
|
||||
- type: "file"
|
||||
config:
|
||||
path: "/some/path/to/store/access-token/file-name"
|
||||
templates:
|
||||
- source-path: my-dot-ev-secret-template
|
||||
destination-path: /some/path/.env
|
||||
config:
|
||||
polling-interval: 60s
|
||||
execute:
|
||||
timeout: 30
|
||||
command: ./reload-app.sh
|
||||
```
|
||||
|
||||
Above is an example agent configuration file that defines the token authentication method, one sink location (where to deposit access tokens after renewal) and a secret template.
|
||||
|
||||
|
||||
```text my-dot-ev-secret-template
|
||||
{{- with secret "6553ccb2b7da580d7f6e7260" "dev" "/" }}
|
||||
{{- range . }}
|
||||
{{ .Key }}={{ .Value }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
```
|
||||
|
||||
The secret template above will be used to render the secrets where the key and the value are separated by `=` sign. You'll notice that a custom function named `secret` is used to fetch the secrets.
|
||||
This function takes the following arguments: `secret "<project-id>" "<environment-slug>" "<secret-path>"`.
|
||||
|
||||
```bash
|
||||
infisical agent --config example-agent-config-file.yaml
|
||||
```
|
||||
|
||||
After defining the agent configuration file, run the command above pointing to the path where the agent configuration is located.
|
||||
Reference in New Issue
Block a user