awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin' into ldap

Browse Source
This commit is contained in:
Tuan Dang
2024-03-10 12:31:06 -07:00
parent 7594929042 f1b7653a52
commit feb7563eab
59 changed files with 2755 additions and 547 deletions
Download Patch File Download Diff File Expand all files Collapse all files

97
docs/cli/commands/secrets.mdx
View File

@@ -8,24 +8,28 @@ infisical secrets
```
## Description
This command enables you to perform CRUD (create, read, update, delete) operations on secrets within your Infisical project. With it, you can view, create, update, and delete secrets in your environment.
### Sub-commands
### Sub-commands
<Accordion title="infisical secrets" defaultOpen="true">
Use this command to print out all of the secrets in your project
```bash
$ infisical secrets
```
```bash
$ infisical secrets
```
### Environment variables
### Environment variables
<Accordion title="INFISICAL_TOKEN">
Used to fetch secrets via a [service token](/documentation/platform/token) apposed to logged in credentials. Simply, export this variable in the terminal before running this command.
```bash
# Example
# Example
export INFISICAL_TOKEN=st.63e03c4a97cb4a747186c71e.ed5b46a34c078a8f94e8228f4ab0ff97.4f7f38034811995997d72badf44b42ec
```
</Accordion>
<Accordion title="INFISICAL_DISABLE_UPDATE_CHECK">
@@ -34,22 +38,26 @@ This command enables you to perform CRUD (create, read, update, delete) operatio
To use, simply export this variable in the terminal before running this command.
```bash
# Example
# Example
export INFISICAL_DISABLE_UPDATE_CHECK=true
```
</Accordion>
### Flags
### Flags
<Accordion title="--expand">
Parse shell parameter expansions in your secrets
Default value: `true`
</Accordion>
<Accordion title="--env">
Used to select the environment name on which actions should be taken on
Default value: `dev`
</Accordion>
<Accordion title="--path">
The `--path` flag indicates which project folder secrets will be injected from.
@@ -58,6 +66,7 @@ This command enables you to perform CRUD (create, read, update, delete) operatio
# Example
infisical secrets --path="/" --env=dev
```
</Accordion>
</Accordion>
@@ -65,38 +74,55 @@ This command enables you to perform CRUD (create, read, update, delete) operatio
<Accordion title="infisical secrets get">
This command allows you selectively print the requested secrets by name
```bash
$ infisical secrets get <secret-name-a> <secret-name-b> ...
```bash
$ infisical secrets get <secret-name-a> <secret-name-b> ...
# Example
$ infisical secrets get DOMAIN
# Example
$ infisical secrets get DOMAIN
```
```
### Flags
### Flags
<Accordion title="--env">
Used to select the environment name on which actions should be taken on
Default value: `dev`
</Accordion>
<Accordion title="--raw-value">
Used to print the plain value of a single requested secret without any table style.
Default value: `false`
Example: `infisical secrets get DOMAIN --raw-value`
<Tip>
When running in CI/CD environments or in a script, set `INFISICAL_DISABLE_UPDATE_CHECK` env to `true`. This will help hide any CLI update messages and only show the secret value.
</Tip>
</Accordion>
</Accordion>
<Accordion title="infisical secrets set">
This command allows you to set or update secrets in your environment. If the secret key provided already exists, its value will be updated with the new value.
This command allows you to set or update secrets in your environment. If the secret key provided already exists, its value will be updated with the new value.
If the secret key does not exist, a new secret will be created using both the key and value provided.
```bash
$ infisical secrets set <key1=value1> <key2=value2>...
## Example
## Example
$ infisical secrets set STRIPE_API_KEY=sjdgwkeudyjwe DOMAIN=example.com HASH=jebhfbwe
```
### Flags
### Flags
<Accordion title="--env">
Used to select the environment name on which actions should be taken on
Default value: `dev`
</Accordion>
<Accordion title="--path">
Used to select the project folder in which the secrets will be set. This is useful when creating new secrets under a particular path.
@@ -105,43 +131,48 @@ $ infisical secrets set STRIPE_API_KEY=sjdgwkeudyjwe DOMAIN=example.com HASH=jeb
# Example
infisical secrets set DOMAIN=example.com --path="common/backend"
```
</Accordion>
</Accordion>
<Accordion title="infisical secrets delete">
This command allows you to delete secrets by their name(s).
```bash
$ infisical secrets delete <keyName1> <keyName2>...
```bash
$ infisical secrets delete <keyName1> <keyName2>...
## Example
$ infisical secrets delete STRIPE_API_KEY DOMAIN HASH
```
## Example
$ infisical secrets delete STRIPE_API_KEY DOMAIN HASH
```
### Flags
### Flags
<Accordion title="--env">
Used to select the environment name on which actions should be taken on
Default value: `dev`
</Accordion>
<Accordion title="--path">
The `--path` flag indicates which project folder secrets will be injected from.
The `--path` flag indicates which project folder secrets will be injected from.
```bash
# Example
infisical secrets delete <keyName1> <keyName2>... --path="/"
```
</Accordion>
</Accordion>
<Accordion title="infisical secrets folders">
This command allows you to fetch, create and delete folders from within a path from a given project.
```bash
$ infisical secrets folders
```
```bash
$ infisical secrets folders
```
### sub commands
### sub commands
<Accordion title="get">
Used to fetch all folders within a path in a given project
```
@@ -179,6 +210,7 @@ $ infisical secrets set STRIPE_API_KEY=sjdgwkeudyjwe DOMAIN=example.com HASH=jeb
Default value: ``
</Accordion>
</Accordion>
<Accordion title="delete">
@@ -194,10 +226,11 @@ $ infisical secrets set STRIPE_API_KEY=sjdgwkeudyjwe DOMAIN=example.com HASH=jeb
</Accordion>
<Accordion title="--name">
Name of the folder to be deleted within selected `--path`
Name of the folder to be deleted within selected `--path`
Default value: ``
</Accordion>
</Accordion>
</Accordion>
@@ -210,14 +243,16 @@ To place default values in your example .env file, you can simply include the sy
```bash
$ infisical secrets generate-example-env
## Example
## Example
$ infisical secrets generate-example-env > .example-env
```
### Flags
### Flags
<Accordion title="--env">
Used to select the environment name on which actions should be taken on
Default value: `dev`
</Accordion>
</Accordion>

2
docs/documentation/platform/secret-reference.mdx
View File

@@ -10,7 +10,7 @@ This means that updating the value of a base secret propagates directly to other
<Note>
Currently, the secret referencing feature is only supported by the
[Infisical CLI](/cli/overview) and [native integrations](/integrations/overview).
[Infisical CLI](/cli/overview), [native integrations](/integrations/overview) and [Infisical Agent](/infisical-agent/overview).
We intend to add support for it to the [Node SDK](https://infisical.com/docs/sdks/languages/node),
[Python SDK](https://infisical.com/docs/sdks/languages/python), and [Java SDK](https://infisical.com/docs/sdks/languages/java) this quarter.

BIN
docs/images/docker-swarm-secrets-complete.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 73 KiB

BIN
docs/images/integrations/heroku/integrations-heroku-create.png
View File

Binary file not shown.
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 179 KiB

After

Width:  |  Height:  |  Size: 533 KiB

BIN
docs/images/integrations/heroku/integrations-heroku.png
View File

Binary file not shown.
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 371 KiB

After

Width:  |  Height:  |  Size: 700 KiB

164
docs/infisical-agent/guides/docker-swarm-with-agent.mdx Normal file
View File

@@ -0,0 +1,164 @@
---
title: 'Docker Swarm'
description: "How to manage secrets in Docker Swarm services"
---
In this guide, we'll demonstrate how to use Infisical for managing secrets within Docker Swarm.
Specifically, we'll set up a sidecar container using the [Infisical Agent](/infisical-agent/overview), which authenticates with Infisical to retrieve secrets and access tokens.
These secrets are then stored in a shared volume accessible by other services in your Docker Swarm.
## Prerequisites
- Infisical account
- Docker version 20.10.24 or newer
- Basic knowledge of Docker Swarm
- [Git](https://git-scm.com/book/en/v2/Getting-Started-Installing-Git) installed on your system
- Familiarity with the [Infisical Agent](/infisical-agent/overview)
## Objective
Our goal is to deploy an Nginx instance in your Docker Swarm cluster, configured to display Infisical secrets on its landing page. This will provide hands-on experience in fetching and utilizing secrets from Infisical within Docker Swarm. The principles demonstrated here are also applicable to Docker Compose deployments.
<Steps>
<Step title="Cloning the Guide Assets Repository">
Start by cloning the [Infisical guide assets repository](https://github.com/Infisical/infisical-guides.git) from Github. This repository includes necessary assets for this and other Infisical guides. Focus on the `docker-swarm-with-agent` sub-directory, which we'll use as our working directory.
</Step>
<Step title="Setting Up Authentication with Infisical">
To allow the agent to fetch your Infisical secrets, choose an authentication method for the agent. For this guide, we will use [Universal Auth](/documentation/platform/identities/universal-auth) for authentication. Follow the instructions [here](/documentation/platform/identities/universal-auth) to generate a client ID and client secret.
</Step>
<Step title="Entering Universal Auth Credentials">
Copy the client ID and client secret obtained in the previous step into the `client-id` and `client-secret` text files, respectively.
</Step>
<Step title="Configuring the Infisical Agent">
The Infisical Agent will authenticate using Universal Auth and retrieve secrets for rendering as specified in the template(s).
Adjust the `polling-interval` to control the frequency of secret updates.
In the example template, the secrets are rendered as an HTML page, which will be set as Nginx's home page to demonstrate successful secret retrieval and utilization.
<Tip>
Remember to add your project id, environment slug and path of corresponding Infisical project to the secret template.
</Tip>
<Tabs>
<Tab title="Agent Configuration">
```yaml infisical-agent-config
infisical:
address: "https://app.infisical.com"
auth:
type: "universal-auth"
config:
client-id: "/run/secrets/infisical-universal-auth-client-id"
client-secret: "/run/secrets/infisical-universal-auth-client-secret"
remove_client_secret_on_read: false
sinks:
- type: "file"
config:
path: "/infisical-secrets/access-token"
templates:
- source-path: /run/secrets/nginx-home-page-template
destination-path: /infisical-secrets/index.html
config:
polling-interval: 60s
```
<Info>
Some paths contain `/run/secrets/` because the contents of those files reside in a [Docker secret](https://docs.docker.com/engine/swarm/secrets/#how-docker-manages-secrets).
</Info>
</Tab>
<Tab title="Secret Template for Agent">
```html nginx-home-page-template
<!DOCTYPE html>
<html lang="en">
<body>
<h1>This file is rendered by Infisical agent template engine</h1>
<p>Here are the secrets that have been fetched from Infisical and stored in your volume mount</p>
<ol>
{{- with secret "7df67a5f-d26a-4988-a375-7153c08149da" "dev" "/" }}
{{- range . }}
<li>{{ .Key }}={{ .Value }}</li>
{{- end }}
{{- end }}
</ol>
</body>
</html>
```
</Tab>
</Tabs>
</Step>
<Step title="Creating the Docker Compose File">
Define the `infisical-agent` and `nginx` services in your Docker Compose file. `infisical-agent` will handle secret retrieval and storage. These secrets are stored in a volume, accessible by other services like Nginx.
```yaml docker-compose.yaml
version: "3.1"
services:
infisical-agent:
container_name: infisical-agnet
image: infisical/cli:0.18.0
command: agent --config=/run/secrets/infisical-agent-config
volumes:
- infisical-agent:/infisical-secrets
secrets:
- infisical-universal-auth-client-id
- infisical-universal-auth-client-secret
- infisical-agent-config
- nginx-home-page-template
networks:
- infisical_network
nginx:
image: nginx:latest
ports:
- "80:80"
volumes:
- infisical-agent:/usr/share/nginx/html
networks:
- infisical_network
volumes:
infisical-agent:
secrets:
infisical-universal-auth-client-id:
file: ./client-id
infisical-universal-auth-client-secret:
file: ./client-secret
infisical-agent-config:
file: ./infisical-agent-config
nginx-home-page-template:
file: ./nginx-home-page-template
networks:
infisical_network:
```
</Step>
<Step title="Initializing Docker Swarm">
```
docker swarm init
```
</Step>
<Step title="Deploying the Docker Stack">
```
docker stack deploy -c docker-compose.yaml agent-demo
```
</Step>
<Step title="Verifying Secret Consumption">
To confirm that secrets are properly rendered and accessible, navigate to `http://localhost`. You should see the Infisical secrets displayed on the Nginx landing page.
![Nginx displaying Infisical secrets](/images/docker-swarm-secrets-complete.png)
</Step>
<Step title="Clean up">
```
docker stack rm agent-demo
```
</Step>
</Steps>
## Considerations
- Secret Updates: Applications that access secrets directly from the volume mount will receive updates in real-time, in accordance with the `polling-interval` set in agent config.
- In-Memory Secrets: If your application loads secrets into memory, the new secrets will be available to the application on the next deployment.

11
docs/integrations/cloud/heroku.mdx
View File

@@ -30,6 +30,17 @@ description: "How to sync secrets from Infisical to Heroku"
Select which Infisical environment secrets you want to sync to which Heroku app and press create integration to start syncing secrets to Heroku.
![integrations heroku](../../images/integrations/heroku/integrations-heroku-create.png)
Here's some guidance on each field:
- Project Environment: The environment in the current Infisical project from which you want to sync secrets from.
- Secrets Path: The path in the current Infisical project from which you want to sync secrets from such as `/` (for secrets that do not reside in a folder) or `/foo/bar` (for secrets nested in a folder, in this case a folder called `bar` in another folder called `foo`).
- Heroku App: The application in Heroku that you want to sync secrets to.
- Initial Sync Behavior (default is **Import - Prefer values from Infisical**): The behavior of the first sync operation triggered after creating the integration.
- **No Import - Overwrite all values in Heroku**: Sync secrets and overwrite any existing secrets in Heroku.
- **Import - Prefer values from Infisical**: Import secrets from Heroku to Infisical; if a secret with the same name already exists in Infisical, do nothing. Afterwards, sync secrets to Heroku.
- **Import - Prefer values from Heroku**: Import secrets from Heroku to Infisical; if a secret with the same name already exists in Infisical, replace its value with the one from Heroku. Afterwards, sync secrets to Heroku.
![integrations heroku](../../images/integrations/heroku/integrations-heroku.png)
</Step>
</Steps>

21
docs/mint.json
View File

@@ -236,12 +236,27 @@
{
"group": "Agent",
"pages": [
"infisical-agent/overview"
"infisical-agent/overview",
{
"group": "Use cases",
"pages": [
"infisical-agent/guides/docker-swarm-with-agent",
"integrations/platforms/ecs-with-agent"
]
}
]
},
{
"group": "Infrastructure Integrations",
"pages": [
{
"group": "Container orchestrators",
"pages": [
"integrations/platforms/kubernetes",
"infisical-agent/guides/docker-swarm-with-agent",
"integrations/platforms/ecs-with-agent"
]
},
{
"group": "Docker",
"pages": [
@@ -251,10 +266,8 @@
"integrations/platforms/docker-compose"
]
},
"integrations/platforms/kubernetes",
"integrations/frameworks/terraform",
"integrations/platforms/ansible",
"integrations/platforms/ecs-with-agent"
"integrations/platforms/ansible"
]
},
{