infisical: migrate all InfisicalSecrets to Kubernetes auth; drop universal-auth secret

2026-07-16 21:18:47 +02:00
parent 7526ea0a1b
commit 1d026f8d57
23 changed files with 154 additions and 93 deletions
--- a/applications/infisical/Infisical-secrets/affine-infisicalsecret.yaml
+++ b/applications/infisical/Infisical-secrets/affine-infisicalsecret.yaml
@@ -7,15 +7,17 @@ spec:
  hostAPI: https://infisical.jsme.be
  resyncInterval: 30
  authentication:
-    universalAuth:
+    kubernetesAuth:
+      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
      secretsScope:
        projectSlug: "kubernetes"
        envSlug: "prod"
        secretsPath: "/affine"
        recursive: true
-      credentialsRef:
-        secretName: infisical-universal-auth
-        secretNamespace: infisical
  managedSecretReference:
    secretName: affine-secrets
    secretNamespace: affine
--- a/applications/infisical/Infisical-secrets/authentik-infisicalsecret.yaml
+++ b/applications/infisical/Infisical-secrets/authentik-infisicalsecret.yaml
@@ -7,15 +7,17 @@ spec:
  hostAPI: https://infisical.jsme.be
  resyncInterval: 30
  authentication:
-    universalAuth:
+    kubernetesAuth:
+      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
      secretsScope:
        projectSlug: "kubernetes"
        envSlug: "prod"
        secretsPath: "/authentik"
        recursive: true
-      credentialsRef:
-        secretName: infisical-universal-auth
-        secretNamespace: infisical
  managedSecretReference:
    secretName: authentik-secrets
    secretNamespace: authentik
--- a/applications/infisical/Infisical-secrets/azure-ddns-infisicalsecret.yaml
+++ b/applications/infisical/Infisical-secrets/azure-ddns-infisicalsecret.yaml
@@ -7,15 +7,17 @@ spec:
  hostAPI: https://infisical.jsme.be
  resyncInterval: 30
  authentication:
-    universalAuth:
+    kubernetesAuth:
+      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
      secretsScope:
        projectSlug: "kubernetes"
        envSlug: "prod"
        secretsPath: "/azure-ddns"
        recursive: true
-      credentialsRef:
-        secretName: infisical-universal-auth
-        secretNamespace: infisical
  managedSecretReference:
    secretName: azure-ddns-secrets
    secretNamespace: azure-ddns
--- a/applications/infisical/Infisical-secrets/crowdsec-infisicalsecret.yaml
+++ b/applications/infisical/Infisical-secrets/crowdsec-infisicalsecret.yaml
@@ -0,0 +1,28 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: crowdsec-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    kubernetesAuth:
+      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/crowdsec"
+        recursive: true
+  managedSecretReference:
+    secretName: crowdsec-secrets
+    secretNamespace: crowdsec
+    secretType: Opaque
+# NOTE: add a secret "bouncer-key" (a long random string, e.g. `openssl rand -hex 32`)
+# under kubernetes / prod / /crowdsec in Infisical. It is shared by:
+#   - CrowdSec LAPI  (pre-registers the "envoy" bouncer via BOUNCER_KEY_envoy)
+#   - the kdwils envoy bouncer (authenticates to LAPI + AppSec)
--- a/applications/infisical/Infisical-secrets/gitea-infisicalsecret.yaml
+++ b/applications/infisical/Infisical-secrets/gitea-infisicalsecret.yaml
@@ -7,15 +7,17 @@ spec:
  hostAPI: https://infisical.jsme.be
  resyncInterval: 30
  authentication:
-    universalAuth:
+    kubernetesAuth:
+      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
      secretsScope:
        projectSlug: "kubernetes"
        envSlug: "prod"
        secretsPath: "/gitea"
        recursive: true
-      credentialsRef:
-        secretName: infisical-universal-auth
-        secretNamespace: infisical
  managedSecretReference:
    secretName: gitea-secrets
    secretNamespace: gitea
--- a/applications/infisical/Infisical-secrets/gotify-infisicalsecret.yaml
+++ b/applications/infisical/Infisical-secrets/gotify-infisicalsecret.yaml
@@ -7,15 +7,17 @@ spec:
  hostAPI: https://infisical.jsme.be
  resyncInterval: 30
  authentication:
-    universalAuth:
+    kubernetesAuth:
+      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
      secretsScope:
        projectSlug: "kubernetes"
        envSlug: "prod"
        secretsPath: "/gotify"
        recursive: true
-      credentialsRef:
-        secretName: infisical-universal-auth
-        secretNamespace: infisical
  managedSecretReference:
    secretName: gotify-secrets
    secretNamespace: gotify
--- a/applications/infisical/Infisical-secrets/immich-infisicalsecret.yaml
+++ b/applications/infisical/Infisical-secrets/immich-infisicalsecret.yaml
@@ -7,15 +7,17 @@ spec:
  hostAPI: https://infisical.jsme.be
  resyncInterval: 30
  authentication:
-    universalAuth:
+    kubernetesAuth:
+      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
      secretsScope:
        projectSlug: "kubernetes"
        envSlug: "prod"
        secretsPath: "/immich"
        recursive: true
-      credentialsRef:
-        secretName: infisical-universal-auth
-        secretNamespace: infisical
  managedSecretReference:
    secretName: immich-secrets
    secretNamespace: immich
--- a/applications/infisical/Infisical-secrets/jellyfin-infisicalsecret.yaml
+++ b/applications/infisical/Infisical-secrets/jellyfin-infisicalsecret.yaml
@@ -7,15 +7,17 @@ spec:
  hostAPI: https://infisical.jsme.be
  resyncInterval: 30
  authentication:
-    universalAuth:
+    kubernetesAuth:
+      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
      secretsScope:
        projectSlug: "kubernetes"
        envSlug: "prod"
        secretsPath: "/jellyfin"
        recursive: true
-      credentialsRef:
-        secretName: infisical-universal-auth
-        secretNamespace: infisical
  managedSecretReference:
    secretName: jellyfin-secrets
    secretNamespace: jellyfin
--- a/applications/infisical/Infisical-secrets/longhorn-infisicalsecret.yaml
+++ b/applications/infisical/Infisical-secrets/longhorn-infisicalsecret.yaml
@@ -7,15 +7,17 @@ spec:
  hostAPI: https://infisical.jsme.be
  resyncInterval: 30
  authentication:
-    universalAuth:
+    kubernetesAuth:
+      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
      secretsScope:
        projectSlug: "kubernetes"
        envSlug: "prod"
        secretsPath: "/longhorn"
        recursive: true
-      credentialsRef:
-        secretName: infisical-universal-auth
-        secretNamespace: infisical
  managedSecretReference:
    secretName: longhorn-secrets
    secretNamespace: longhorn-system
--- a/applications/infisical/Infisical-secrets/minecraft-infisicalsecret.yaml
+++ b/applications/infisical/Infisical-secrets/minecraft-infisicalsecret.yaml
@@ -7,15 +7,17 @@ spec:
  hostAPI: https://infisical.jsme.be
  resyncInterval: 30
  authentication:
-    universalAuth:
+    kubernetesAuth:
+      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
      secretsScope:
        projectSlug: "kubernetes"
        envSlug: "prod"
        secretsPath: "/minecraft"
        recursive: true
-      credentialsRef:
-        secretName: infisical-universal-auth
-        secretNamespace: infisical
  managedSecretReference:
    secretName: minecraft-secrets
    secretNamespace: minecraft
--- a/applications/infisical/Infisical-secrets/n8n-infisicalsecret.yaml
+++ b/applications/infisical/Infisical-secrets/n8n-infisicalsecret.yaml
@@ -7,15 +7,17 @@ spec:
  hostAPI: https://infisical.jsme.be
  resyncInterval: 30
  authentication:
-    universalAuth:
+    kubernetesAuth:
+      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
      secretsScope:
        projectSlug: "kubernetes"
        envSlug: "prod"
        secretsPath: "/n8n"
        recursive: true
-      credentialsRef:
-        secretName: infisical-universal-auth
-        secretNamespace: infisical
  managedSecretReference:
    secretName: n8n-secrets
    secretNamespace: n8n
--- a/applications/infisical/Infisical-secrets/openwebui-infisicalsecret.yaml
+++ b/applications/infisical/Infisical-secrets/openwebui-infisicalsecret.yaml
@@ -7,15 +7,17 @@ spec:
  hostAPI: https://infisical.jsme.be
  resyncInterval: 30
  authentication:
-    universalAuth:
+    kubernetesAuth:
+      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
      secretsScope:
        projectSlug: "kubernetes"
        envSlug: "prod"
        secretsPath: "/openwebui"
        recursive: true
-      credentialsRef:
-        secretName: infisical-universal-auth
-        secretNamespace: infisical
  managedSecretReference:
    secretName: openwebui-secrets
    secretNamespace: openwebui
--- a/applications/infisical/Infisical-secrets/outline-infisicalsecret.yaml
+++ b/applications/infisical/Infisical-secrets/outline-infisicalsecret.yaml
@@ -7,15 +7,17 @@ spec:
  hostAPI: https://infisical.jsme.be
  resyncInterval: 30
  authentication:
-    universalAuth:
+    kubernetesAuth:
+      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
      secretsScope:
        projectSlug: "kubernetes"
        envSlug: "prod"
        secretsPath: "/outline"
        recursive: true
-      credentialsRef:
-        secretName: infisical-universal-auth
-        secretNamespace: infisical
  managedSecretReference:
    secretName: outline-secrets
    secretNamespace: outline
--- a/applications/infisical/Infisical-secrets/passbolt-infisicalsecret.yaml
+++ b/applications/infisical/Infisical-secrets/passbolt-infisicalsecret.yaml
@@ -7,15 +7,17 @@ spec:
  hostAPI: https://infisical.jsme.be
  resyncInterval: 30
  authentication:
-    universalAuth:
+    kubernetesAuth:
+      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
      secretsScope:
        projectSlug: "kubernetes"
        envSlug: "prod"
        secretsPath: "/passbolt"
        recursive: true
-      credentialsRef:
-        secretName: infisical-universal-auth
-        secretNamespace: infisical
  managedSecretReference:
    secretName: passbolt-secrets
    secretNamespace: passbolt
--- a/applications/infisical/Infisical-secrets/pelican-infisicalsecret.yaml
+++ b/applications/infisical/Infisical-secrets/pelican-infisicalsecret.yaml
@@ -7,15 +7,17 @@ spec:
  hostAPI: https://infisical.jsme.be
  resyncInterval: 30
  authentication:
-    universalAuth:
+    kubernetesAuth:
+      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
      secretsScope:
        projectSlug: "kubernetes"
        envSlug: "prod"
        secretsPath: "/pelican"
        recursive: true
-      credentialsRef:
-        secretName: infisical-universal-auth
-        secretNamespace: infisical
  managedSecretReference:
    secretName: pelican-secrets
    secretNamespace: pelican
--- a/applications/infisical/Infisical-secrets/resume-infisicalsecret.yaml
+++ b/applications/infisical/Infisical-secrets/resume-infisicalsecret.yaml
@@ -7,15 +7,17 @@ spec:
  hostAPI: https://infisical.jsme.be
  resyncInterval: 30
  authentication:
-    universalAuth:
+    kubernetesAuth:
+      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
      secretsScope:
        projectSlug: "kubernetes"
        envSlug: "prod"
        secretsPath: "/reactive_resume"
        recursive: true
-      credentialsRef:
-        secretName: infisical-universal-auth
-        secretNamespace: infisical
  managedSecretReference:
    secretName: resume-secrets
    secretNamespace: resume
--- a/applications/infisical/Infisical-secrets/searxng-infisicalsecret.yaml
+++ b/applications/infisical/Infisical-secrets/searxng-infisicalsecret.yaml
@@ -7,15 +7,17 @@ spec:
  hostAPI: https://infisical.jsme.be
  resyncInterval: 30
  authentication:
-    universalAuth:
+    kubernetesAuth:
+      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
      secretsScope:
        projectSlug: "kubernetes"
        envSlug: "prod"
        secretsPath: "/searxng"
        recursive: true
-      credentialsRef:
-        secretName: infisical-universal-auth
-        secretNamespace: infisical
  managedSecretReference:
    secretName: searxng-secrets
    secretNamespace: searxng
--- a/applications/infisical/Infisical-secrets/uptime-kuma-infisicalsecret.yaml
+++ b/applications/infisical/Infisical-secrets/uptime-kuma-infisicalsecret.yaml
@@ -7,15 +7,17 @@ spec:
  hostAPI: https://infisical.jsme.be
  resyncInterval: 30
  authentication:
-    universalAuth:
+    kubernetesAuth:
+      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
      secretsScope:
        projectSlug: "kubernetes"
        envSlug: "prod"
        secretsPath: "/uptime-kuma"
        recursive: true
-      credentialsRef:
-        secretName: infisical-universal-auth
-        secretNamespace: infisical
  managedSecretReference:
    secretName: uptime-kuma-secrets
    secretNamespace: uptime-kuma
--- a/applications/infisical/Infisical-secrets/vaultwarden-infisicalsecret.yaml
+++ b/applications/infisical/Infisical-secrets/vaultwarden-infisicalsecret.yaml
@@ -7,15 +7,17 @@ spec:
  hostAPI: https://infisical.jsme.be
  resyncInterval: 30
  authentication:
-    universalAuth:
+    kubernetesAuth:
+      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
      secretsScope:
        projectSlug: "kubernetes"
        envSlug: "prod"
        secretsPath: "/vaultwarden"
        recursive: true
-      credentialsRef:
-        secretName: infisical-universal-auth
-        secretNamespace: infisical
  managedSecretReference:
    secretName: vaultwarden-secrets
    secretNamespace: vaultwarden
--- a/applications/infisical/Infisical-secrets/victoria-metrics-infisicalsecret.yaml
+++ b/applications/infisical/Infisical-secrets/victoria-metrics-infisicalsecret.yaml
@@ -7,15 +7,17 @@ spec:
  hostAPI: https://infisical.jsme.be
  resyncInterval: 30
  authentication:
-    universalAuth:
+    kubernetesAuth:
+      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
      secretsScope:
        projectSlug: "kubernetes"
        envSlug: "prod"
        secretsPath: "/victoria-metrics"
        recursive: true
-      credentialsRef:
-        secretName: infisical-universal-auth
-        secretNamespace: infisical
  managedSecretReference:
    secretName: victoria-metrics-secrets
    secretNamespace: victoria-metrics
--- a/applications/infisical/Infisical-secrets/zipline-infisicalsecret.yaml
+++ b/applications/infisical/Infisical-secrets/zipline-infisicalsecret.yaml
@@ -7,15 +7,17 @@ spec:
  hostAPI: https://infisical.jsme.be
  resyncInterval: 30
  authentication:
-    universalAuth:
+    kubernetesAuth:
+      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
      secretsScope:
        projectSlug: "kubernetes"
        envSlug: "prod"
        secretsPath: "/zipline"
        recursive: true
-      credentialsRef:
-        secretName: infisical-universal-auth
-        secretNamespace: infisical
  managedSecretReference:
    secretName: zipline-secrets
    secretNamespace: zipline
--- a/applications/infisical/universal-auth-secret.yaml
+++ b/applications/infisical/universal-auth-secret.yaml
@@ -1,9 +0,0 @@
-# apiVersion: v1
-# kind: Secret
-# metadata:
-#   name: infisical-universal-auth
-#   namespace: infisical
-# type: Opaque
-# stringData:
-#   clientId: ""
-#   clientSecret: ""
--- a/infra/longhorn/longhorn-infisicalsecret.yaml
+++ b/infra/longhorn/longhorn-infisicalsecret.yaml
@@ -7,15 +7,17 @@ spec:
  hostAPI: https://infisical.jsme.be
  resyncInterval: 30
  authentication:
-    universalAuth:
+    kubernetesAuth:
+      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
      secretsScope:
        projectSlug: "kubernetes"
        envSlug: "prod"
        secretsPath: "/longhorn"
        recursive: true
-      credentialsRef:
-        secretName: infisical-universal-auth
-        secretNamespace: infisical
  managedSecretReference:
    secretName: cifs-secret
    secretNamespace: longhorn-system