mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-09-22 13:39:35 +00:00
164 lines
4.7 KiB
Plaintext
164 lines
4.7 KiB
Plaintext
---
|
|
title: "Kubernetes"
|
|
description: "How to deploy Infisical with Kubernetes"
|
|
---
|
|
|
|
<Info>
|
|
Self-host vs. Infisical Cloud
|
|
|
|
Self-hosting Infisical means managing the service yourself, taking care of upgrades, scaling, security, etc.
|
|
|
|
If you're less technical and looking for a hands-free experience with minimal overhead then we recommend Infisical Cloud.
|
|
|
|
</Info>
|
|
|
|
**Prerequisites**
|
|
- You have understanding of [Kubernetes](https://kubernetes.io/)
|
|
- You have understanding of [Helm package manager](https://helm.sh/)
|
|
- You have [kubectl](https://kubernetes.io/docs/reference/kubectl/kubectl/) installed and connected to your kubernetes cluster
|
|
|
|
|
|
#### 1. Fill our environment variables
|
|
|
|
Before you can deploy the Helm chart, you must fill out the required environment variables. To do so, please copy the below file to a `.yaml` file.
|
|
Refer to the available [environment variables](../../self-hosting/configuration/envars) to learn more
|
|
|
|
<Accordion title="values.yaml">
|
|
```yaml
|
|
#####
|
|
# INFISICAL K8 DEFAULT VALUES FILE
|
|
# PLEASE REPLACE VALUES/EDIT AS REQUIRED
|
|
#####
|
|
|
|
nameOverride: ""
|
|
|
|
frontend:
|
|
name: frontend
|
|
podAnnotations: {}
|
|
deploymentAnnotations: {}
|
|
replicaCount: 2
|
|
image:
|
|
repository: infisical/frontend
|
|
pullPolicy: Always
|
|
tag: "latest" # It it highly recommended to select a specific tag for prod deployment so it is easy to rollback: https://hub.docker.com/r/infisical/frontend/tags
|
|
# kubeSecretRef: some-kube-secret-name
|
|
service:
|
|
# type of the frontend service
|
|
type: ClusterIP
|
|
# define the nodePort if service type is NodePort
|
|
# nodePort:
|
|
annotations: {}
|
|
|
|
backend:
|
|
name: backend
|
|
podAnnotations: {}
|
|
deploymentAnnotations: {}
|
|
replicaCount: 2
|
|
image:
|
|
repository: infisical/backend
|
|
pullPolicy: Always
|
|
tag: "latest" # It it highly recommended to select a specific tag for prod deployment so it is easy to rollback: https://hub.docker.com/r/infisical/backend/tags
|
|
# kubeSecretRef: some-kube-secret-name
|
|
service:
|
|
annotations: {}
|
|
|
|
mongodb:
|
|
name: mongodb
|
|
podAnnotations: {}
|
|
image:
|
|
repository: mongo
|
|
pullPolicy: IfNotPresent
|
|
tag: "latest"
|
|
service:
|
|
annotations: {}
|
|
|
|
# By default the backend will be connected to a Mongo instance in the cluster.
|
|
# However, it is recommended to add a managed document DB connection string because the DB instance in the cluster does not have persistence yet ( data will be deleted on next deploy).
|
|
# Learn about connection string type here https://www.mongodb.com/docs/manual/reference/connection-string/
|
|
mongodbConnection: {}
|
|
# externalMongoDBConnectionString: <>
|
|
|
|
ingress:
|
|
enabled: true
|
|
annotations:
|
|
kubernetes.io/ingress.class: "nginx"
|
|
hostName: example.com # replace with your domain
|
|
frontend:
|
|
path: /
|
|
pathType: Prefix
|
|
backend:
|
|
path: /api
|
|
pathType: Prefix
|
|
tls: []
|
|
|
|
|
|
## Complete Ingress example
|
|
# ingress:
|
|
# enabled: true
|
|
# annotations:
|
|
# kubernetes.io/ingress.class: "nginx"
|
|
# cert-manager.io/issuer: letsencrypt-nginx
|
|
# hostName: k8.infisical.com
|
|
# frontend:
|
|
# path: /
|
|
# pathType: Prefix
|
|
# backend:
|
|
# path: /api
|
|
# pathType: Prefix
|
|
# tls:
|
|
# - secretName: letsencrypt-nginx
|
|
# hosts:
|
|
# - k8.infisical.com
|
|
|
|
###
|
|
### YOU MUST FILL IN ALL SECRETS BELOW
|
|
###
|
|
backendEnvironmentVariables:
|
|
# Required keys for platform encryption/decryption ops. Replace with nacl sk keys
|
|
ENCRYPTION_KEY: MUST_REPLACE
|
|
|
|
# JWT
|
|
# Required secrets to sign JWT tokens
|
|
JWT_SIGNUP_SECRET: MUST_REPLACE
|
|
JWT_REFRESH_SECRET: MUST_REPLACE
|
|
JWT_AUTH_SECRET: MUST_REPLACE
|
|
|
|
# Mail/SMTP
|
|
# Required to send emails
|
|
SMTP_HOST: MUST_REPLACE
|
|
SMTP_NAME: MUST_REPLACE
|
|
SMTP_USERNAME: MUST_REPLACE
|
|
SMTP_PASSWORD: MUST_REPLACE
|
|
|
|
frontendEnvironmentVariables: {}
|
|
|
|
```
|
|
</Accordion>
|
|
|
|
Once you have a local copy of the values file, fill our the required environment variables and save the file.
|
|
|
|
|
|
#### 2. Install Infisical Helm repository
|
|
|
|
```bash
|
|
helm repo add infisical-helm-charts 'https://dl.cloudsmith.io/public/infisical/helm-charts/helm/charts/'
|
|
|
|
helm repo update
|
|
```
|
|
|
|
#### 3. Install the Helm chart
|
|
|
|
By default, the helm chart will be installed on your default namespace. If you wish to install the Chart on a different namespace, you may specify
|
|
that by adding the `--namespace <namespace-to-install-to>` to your `helm install` command.
|
|
|
|
```bash
|
|
## Installs to default namespace
|
|
helm install infisical-helm-charts/infisical --generate-name --values <path to the values.yaml you downloaded/created in step 2>
|
|
```
|
|
|
|
<Note>
|
|
If you have not filled out all of the required environment variables, you will see an error message prompting you to
|
|
do so.
|
|
</Note>
|
|
|
|
#### 4. Your Infisical installation is complete and should be running on the host name you specified in Ingress in `values.yaml`. |