infisical: migrate all InfisicalSecrets to Kubernetes auth; drop universal-auth secret

applications/infisical/Infisical-secrets/affine-infisicalsecret.yaml

@@ -7,15 +7,17 @@ spec:
   hostAPI: https://infisical.jsme.be
   resyncInterval: 30
   authentication:
-    universalAuth:
+    kubernetesAuth:
+      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
       secretsScope:
         projectSlug: "kubernetes"
         envSlug: "prod"
         secretsPath: "/affine"
         recursive: true
-      credentialsRef:
-        secretName: infisical-universal-auth
-        secretNamespace: infisical
   managedSecretReference:
     secretName: affine-secrets
     secretNamespace: affine

applications/infisical/Infisical-secrets/authentik-infisicalsecret.yaml

@@ -7,15 +7,17 @@ spec:
   hostAPI: https://infisical.jsme.be
   resyncInterval: 30
   authentication:
-    universalAuth:
+    kubernetesAuth:
+      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
       secretsScope:
         projectSlug: "kubernetes"
         envSlug: "prod"
         secretsPath: "/authentik"
         recursive: true
-      credentialsRef:
-        secretName: infisical-universal-auth
-        secretNamespace: infisical
   managedSecretReference:
     secretName: authentik-secrets
     secretNamespace: authentik

applications/infisical/Infisical-secrets/azure-ddns-infisicalsecret.yaml

@@ -7,15 +7,17 @@ spec:
   hostAPI: https://infisical.jsme.be
   resyncInterval: 30
   authentication:
-    universalAuth:
+    kubernetesAuth:
+      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
       secretsScope:
         projectSlug: "kubernetes"
         envSlug: "prod"
         secretsPath: "/azure-ddns"
         recursive: true
-      credentialsRef:
-        secretName: infisical-universal-auth
-        secretNamespace: infisical
   managedSecretReference:
     secretName: azure-ddns-secrets
     secretNamespace: azure-ddns

applications/infisical/Infisical-secrets/crowdsec-infisicalsecret.yaml

@@ -0,0 +1,28 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: crowdsec-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    kubernetesAuth:
+      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/crowdsec"
+        recursive: true
+  managedSecretReference:
+    secretName: crowdsec-secrets
+    secretNamespace: crowdsec
+    secretType: Opaque
+# NOTE: add a secret "bouncer-key" (a long random string, e.g. `openssl rand -hex 32`)
+# under kubernetes / prod / /crowdsec in Infisical. It is shared by:
+#   - CrowdSec LAPI  (pre-registers the "envoy" bouncer via BOUNCER_KEY_envoy)
+#   - the kdwils envoy bouncer (authenticates to LAPI + AppSec)

applications/infisical/Infisical-secrets/gitea-infisicalsecret.yaml

@@ -7,15 +7,17 @@ spec:
   hostAPI: https://infisical.jsme.be
   resyncInterval: 30
   authentication:
-    universalAuth:
+    kubernetesAuth:
+      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
       secretsScope:
         projectSlug: "kubernetes"
         envSlug: "prod"
         secretsPath: "/gitea"
         recursive: true
-      credentialsRef:
-        secretName: infisical-universal-auth
-        secretNamespace: infisical
   managedSecretReference:
     secretName: gitea-secrets
     secretNamespace: gitea

applications/infisical/Infisical-secrets/gotify-infisicalsecret.yaml

@@ -7,15 +7,17 @@ spec:
   hostAPI: https://infisical.jsme.be
   resyncInterval: 30
   authentication:
-    universalAuth:
+    kubernetesAuth:
+      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
       secretsScope:
         projectSlug: "kubernetes"
         envSlug: "prod"
         secretsPath: "/gotify"
         recursive: true
-      credentialsRef:
-        secretName: infisical-universal-auth
-        secretNamespace: infisical
   managedSecretReference:
     secretName: gotify-secrets
     secretNamespace: gotify

applications/infisical/Infisical-secrets/immich-infisicalsecret.yaml

@@ -7,15 +7,17 @@ spec:
   hostAPI: https://infisical.jsme.be
   resyncInterval: 30
   authentication:
-    universalAuth:
+    kubernetesAuth:
+      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
       secretsScope:
         projectSlug: "kubernetes"
         envSlug: "prod"
         secretsPath: "/immich"
         recursive: true
-      credentialsRef:
-        secretName: infisical-universal-auth
-        secretNamespace: infisical
   managedSecretReference:
     secretName: immich-secrets
     secretNamespace: immich

applications/infisical/Infisical-secrets/jellyfin-infisicalsecret.yaml

@@ -7,15 +7,17 @@ spec:
   hostAPI: https://infisical.jsme.be
   resyncInterval: 30
   authentication:
-    universalAuth:
+    kubernetesAuth:
+      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
       secretsScope:
         projectSlug: "kubernetes"
         envSlug: "prod"
         secretsPath: "/jellyfin"
         recursive: true
-      credentialsRef:
-        secretName: infisical-universal-auth
-        secretNamespace: infisical
   managedSecretReference:
     secretName: jellyfin-secrets
     secretNamespace: jellyfin

applications/infisical/Infisical-secrets/longhorn-infisicalsecret.yaml

@@ -7,15 +7,17 @@ spec:
   hostAPI: https://infisical.jsme.be
   resyncInterval: 30
   authentication:
-    universalAuth:
+    kubernetesAuth:
+      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
       secretsScope:
         projectSlug: "kubernetes"
         envSlug: "prod"
         secretsPath: "/longhorn"
         recursive: true
-      credentialsRef:
-        secretName: infisical-universal-auth
-        secretNamespace: infisical
   managedSecretReference:
     secretName: longhorn-secrets
     secretNamespace: longhorn-system

applications/infisical/Infisical-secrets/minecraft-infisicalsecret.yaml

@@ -7,15 +7,17 @@ spec:
   hostAPI: https://infisical.jsme.be
   resyncInterval: 30
   authentication:
-    universalAuth:
+    kubernetesAuth:
+      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
       secretsScope:
         projectSlug: "kubernetes"
         envSlug: "prod"
         secretsPath: "/minecraft"
         recursive: true
-      credentialsRef:
-        secretName: infisical-universal-auth
-        secretNamespace: infisical
   managedSecretReference:
     secretName: minecraft-secrets
     secretNamespace: minecraft

applications/infisical/Infisical-secrets/n8n-infisicalsecret.yaml

@@ -7,15 +7,17 @@ spec:
   hostAPI: https://infisical.jsme.be
   resyncInterval: 30
   authentication:
-    universalAuth:
+    kubernetesAuth:
+      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
       secretsScope:
         projectSlug: "kubernetes"
         envSlug: "prod"
         secretsPath: "/n8n"
         recursive: true
-      credentialsRef:
-        secretName: infisical-universal-auth
-        secretNamespace: infisical
   managedSecretReference:
     secretName: n8n-secrets
     secretNamespace: n8n

applications/infisical/Infisical-secrets/openwebui-infisicalsecret.yaml

@@ -7,15 +7,17 @@ spec:
   hostAPI: https://infisical.jsme.be
   resyncInterval: 30
   authentication:
-    universalAuth:
+    kubernetesAuth:
+      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
       secretsScope:
         projectSlug: "kubernetes"
         envSlug: "prod"
         secretsPath: "/openwebui"
         recursive: true
-      credentialsRef:
-        secretName: infisical-universal-auth
-        secretNamespace: infisical
   managedSecretReference:
     secretName: openwebui-secrets
     secretNamespace: openwebui

applications/infisical/Infisical-secrets/outline-infisicalsecret.yaml

@@ -7,15 +7,17 @@ spec:
   hostAPI: https://infisical.jsme.be
   resyncInterval: 30
   authentication:
-    universalAuth:
+    kubernetesAuth:
+      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
       secretsScope:
         projectSlug: "kubernetes"
         envSlug: "prod"
         secretsPath: "/outline"
         recursive: true
-      credentialsRef:
-        secretName: infisical-universal-auth
-        secretNamespace: infisical
   managedSecretReference:
     secretName: outline-secrets
     secretNamespace: outline

applications/infisical/Infisical-secrets/passbolt-infisicalsecret.yaml

@@ -7,15 +7,17 @@ spec:
   hostAPI: https://infisical.jsme.be
   resyncInterval: 30
   authentication:
-    universalAuth:
+    kubernetesAuth:
+      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
       secretsScope:
         projectSlug: "kubernetes"
         envSlug: "prod"
         secretsPath: "/passbolt"
         recursive: true
-      credentialsRef:
-        secretName: infisical-universal-auth
-        secretNamespace: infisical
   managedSecretReference:
     secretName: passbolt-secrets
     secretNamespace: passbolt

applications/infisical/Infisical-secrets/pelican-infisicalsecret.yaml

@@ -7,15 +7,17 @@ spec:
   hostAPI: https://infisical.jsme.be
   resyncInterval: 30
   authentication:
-    universalAuth:
+    kubernetesAuth:
+      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
       secretsScope:
         projectSlug: "kubernetes"
         envSlug: "prod"
         secretsPath: "/pelican"
         recursive: true
-      credentialsRef:
-        secretName: infisical-universal-auth
-        secretNamespace: infisical
   managedSecretReference:
     secretName: pelican-secrets
     secretNamespace: pelican

applications/infisical/Infisical-secrets/resume-infisicalsecret.yaml

@@ -7,15 +7,17 @@ spec:
   hostAPI: https://infisical.jsme.be
   resyncInterval: 30
   authentication:
-    universalAuth:
+    kubernetesAuth:
+      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
       secretsScope:
         projectSlug: "kubernetes"
         envSlug: "prod"
         secretsPath: "/reactive_resume"
         recursive: true
-      credentialsRef:
-        secretName: infisical-universal-auth
-        secretNamespace: infisical
   managedSecretReference:
     secretName: resume-secrets
     secretNamespace: resume

applications/infisical/Infisical-secrets/searxng-infisicalsecret.yaml

@@ -7,15 +7,17 @@ spec:
   hostAPI: https://infisical.jsme.be
   resyncInterval: 30
   authentication:
-    universalAuth:
+    kubernetesAuth:
+      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
       secretsScope:
         projectSlug: "kubernetes"
         envSlug: "prod"
         secretsPath: "/searxng"
         recursive: true
-      credentialsRef:
-        secretName: infisical-universal-auth
-        secretNamespace: infisical
   managedSecretReference:
     secretName: searxng-secrets
     secretNamespace: searxng

applications/infisical/Infisical-secrets/uptime-kuma-infisicalsecret.yaml

@@ -7,15 +7,17 @@ spec:
   hostAPI: https://infisical.jsme.be
   resyncInterval: 30
   authentication:
-    universalAuth:
+    kubernetesAuth:
+      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
       secretsScope:
         projectSlug: "kubernetes"
         envSlug: "prod"
         secretsPath: "/uptime-kuma"
         recursive: true
-      credentialsRef:
-        secretName: infisical-universal-auth
-        secretNamespace: infisical
   managedSecretReference:
     secretName: uptime-kuma-secrets
     secretNamespace: uptime-kuma

applications/infisical/Infisical-secrets/vaultwarden-infisicalsecret.yaml

@@ -7,15 +7,17 @@ spec:
   hostAPI: https://infisical.jsme.be
   resyncInterval: 30
   authentication:
-    universalAuth:
+    kubernetesAuth:
+      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
       secretsScope:
         projectSlug: "kubernetes"
         envSlug: "prod"
         secretsPath: "/vaultwarden"
         recursive: true
-      credentialsRef:
-        secretName: infisical-universal-auth
-        secretNamespace: infisical
   managedSecretReference:
     secretName: vaultwarden-secrets
     secretNamespace: vaultwarden

applications/infisical/Infisical-secrets/victoria-metrics-infisicalsecret.yaml

@@ -7,15 +7,17 @@ spec:
   hostAPI: https://infisical.jsme.be
   resyncInterval: 30
   authentication:
-    universalAuth:
+    kubernetesAuth:
+      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
       secretsScope:
         projectSlug: "kubernetes"
         envSlug: "prod"
         secretsPath: "/victoria-metrics"
         recursive: true
-      credentialsRef:
-        secretName: infisical-universal-auth
-        secretNamespace: infisical
   managedSecretReference:
     secretName: victoria-metrics-secrets
     secretNamespace: victoria-metrics

applications/infisical/Infisical-secrets/zipline-infisicalsecret.yaml

@@ -7,15 +7,17 @@ spec:
   hostAPI: https://infisical.jsme.be
   resyncInterval: 30
   authentication:
-    universalAuth:
+    kubernetesAuth:
+      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
       secretsScope:
         projectSlug: "kubernetes"
         envSlug: "prod"
         secretsPath: "/zipline"
         recursive: true
-      credentialsRef:
-        secretName: infisical-universal-auth
-        secretNamespace: infisical
   managedSecretReference:
     secretName: zipline-secrets
     secretNamespace: zipline

applications/infisical/universal-auth-secret.yaml

@@ -1,9 +0,0 @@
-# apiVersion: v1
-# kind: Secret
-# metadata:
-#   name: infisical-universal-auth
-#   namespace: infisical
-# type: Opaque
-# stringData:
-#   clientId: ""
-#   clientSecret: ""

infra/longhorn/longhorn-infisicalsecret.yaml

@@ -7,15 +7,17 @@ spec:
   hostAPI: https://infisical.jsme.be
   resyncInterval: 30
   authentication:
-    universalAuth:
+    kubernetesAuth:
+      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
       secretsScope:
         projectSlug: "kubernetes"
         envSlug: "prod"
         secretsPath: "/longhorn"
         recursive: true
-      credentialsRef:
-        secretName: infisical-universal-auth
-        secretNamespace: infisical
   managedSecretReference:
     secretName: cifs-secret
     secretNamespace: longhorn-system