diff --git a/applications/infisical/infisical-endpointslice.yaml b/applications/infisical/infisical-endpointslice.yaml deleted file mode 100644 index 90c7b86..0000000 --- a/applications/infisical/infisical-endpointslice.yaml +++ /dev/null @@ -1,18 +0,0 @@ -apiVersion: discovery.k8s.io/v1 -kind: EndpointSlice -metadata: - name: infisical - namespace: infisical - labels: - kubernetes.io/service-name: infisical -addressType: IPv4 -ports: - - port: 8080 - protocol: TCP -endpoints: - - addresses: - - "10.8.11.98" - conditions: - ready: true - serving: true - terminating: false diff --git a/applications/infisical/infisical-service.yaml b/applications/infisical/infisical-service.yaml deleted file mode 100644 index 85d9108..0000000 --- a/applications/infisical/infisical-service.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: infisical - namespace: infisical -spec: - ports: - - protocol: TCP - port: 8080 - targetPort: 8080 - type: ClusterIP \ No newline at end of file diff --git a/applications/infisical/infisical/deployment.yaml b/applications/infisical/infisical/deployment.yaml new file mode 100644 index 0000000..38724d6 --- /dev/null +++ b/applications/infisical/infisical/deployment.yaml @@ -0,0 +1,72 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: infisical-backend + namespace: infisical +spec: + replicas: 1 + selector: + matchLabels: + app: infisical-backend + strategy: + type: RollingUpdate + rollingUpdate: + maxUnavailable: 0 + template: + metadata: + labels: + app: infisical-backend + spec: + # The backend runs DB migrations on startup, so wait for Postgres to be ready. + initContainers: + - name: wait-for-db + image: postgres:14-alpine + command: + - sh + - -c + - "until pg_isready -h infisical-postgres -p 5432 -U $POSTGRES_USER; do echo waiting for db; sleep 2; done" + env: + - name: POSTGRES_USER + valueFrom: + secretKeyRef: + name: infisical-secrets + key: POSTGRES_USER + containers: + - name: backend + image: infisical/infisical:v0.162.6 # pinned — bump deliberately + ports: + - containerPort: 8080 + # ENCRYPTION_KEY, AUTH_SECRET, DB_CONNECTION_URI, REDIS_URL (+ POSTGRES_* — ignored) come from the Secret + envFrom: + - secretRef: + name: infisical-secrets + env: + - name: NODE_ENV + value: production + - name: SITE_URL + value: https://infisical.jsme.be + - name: OTEL_TELEMETRY_COLLECTION_ENABLED + value: "false" + # Allow Core to reach the in-cluster Kubernetes API (kubernetes.default.svc, + # a private ClusterIP) for Kubernetes Auth token review. Off by default (SSRF guard). + - name: ALLOW_INTERNAL_IP_CONNECTIONS + value: "true" + readinessProbe: + httpGet: + path: /api/status + port: 8080 + initialDelaySeconds: 20 + periodSeconds: 10 + failureThreshold: 12 + livenessProbe: + httpGet: + path: /api/status + port: 8080 + initialDelaySeconds: 60 + periodSeconds: 20 + resources: + requests: + cpu: 250m + memory: 512Mi + limits: + memory: 1Gi diff --git a/applications/infisical/infisical/service.yaml b/applications/infisical/infisical/service.yaml new file mode 100644 index 0000000..99b8c65 --- /dev/null +++ b/applications/infisical/infisical/service.yaml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: Service +metadata: + name: infisical-backend + namespace: infisical + labels: + app: infisical-backend +spec: + selector: + app: infisical-backend + ports: + - name: http + port: 8080 + targetPort: 8080 diff --git a/applications/infisical/namespace.yaml b/applications/infisical/namespace.yaml new file mode 100644 index 0000000..acc316b --- /dev/null +++ b/applications/infisical/namespace.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: infisical diff --git a/applications/infisical/postgres/service.yaml b/applications/infisical/postgres/service.yaml new file mode 100644 index 0000000..6c86adb --- /dev/null +++ b/applications/infisical/postgres/service.yaml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: Service +metadata: + name: infisical-postgres + namespace: infisical + labels: + app: infisical-postgres +spec: + selector: + app: infisical-postgres + ports: + - name: postgres + port: 5432 + targetPort: 5432 diff --git a/applications/infisical/postgres/statefulset.yaml b/applications/infisical/postgres/statefulset.yaml new file mode 100644 index 0000000..ff669aa --- /dev/null +++ b/applications/infisical/postgres/statefulset.yaml @@ -0,0 +1,64 @@ +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: infisical-postgres + namespace: infisical +spec: + serviceName: infisical-postgres + replicas: 1 + selector: + matchLabels: + app: infisical-postgres + template: + metadata: + labels: + app: infisical-postgres + spec: + containers: + - name: postgres + image: postgres:14-alpine + ports: + - containerPort: 5432 + env: + # Keep data in a subdir so an RWO volume's lost+found doesn't block initdb + - name: PGDATA + value: /var/lib/postgresql/data/pgdata + - name: POSTGRES_USER + valueFrom: + secretKeyRef: + name: infisical-secrets + key: POSTGRES_USER + - name: POSTGRES_PASSWORD + valueFrom: + secretKeyRef: + name: infisical-secrets + key: POSTGRES_PASSWORD + - name: POSTGRES_DB + valueFrom: + secretKeyRef: + name: infisical-secrets + key: POSTGRES_DB + volumeMounts: + - name: data + mountPath: /var/lib/postgresql/data + readinessProbe: + exec: + command: ["sh", "-c", "pg_isready -U $POSTGRES_USER -d $POSTGRES_DB"] + initialDelaySeconds: 5 + periodSeconds: 5 + timeoutSeconds: 10 + failureThreshold: 10 + livenessProbe: + exec: + command: ["sh", "-c", "pg_isready -U $POSTGRES_USER -d $POSTGRES_DB"] + initialDelaySeconds: 30 + periodSeconds: 15 + volumeClaimTemplates: + - metadata: + name: data + spec: + accessModes: ["ReadWriteOnce"] + storageClassName: longhorn + resources: + requests: + storage: 8Gi diff --git a/applications/infisical/secret.yaml b/applications/infisical/secret.yaml new file mode 100644 index 0000000..37bb179 --- /dev/null +++ b/applications/infisical/secret.yaml @@ -0,0 +1,23 @@ +# ⚠️ BOOTSTRAP SECRETS — do NOT commit this file to Git in plaintext. +# Infisical can't manage its own bootstrap secrets (chicken/egg), so these live +# in a plain Secret. Manage via SOPS/sealed-secrets or `kubectl create secret` +# out-of-band. Values below were randomly generated for you. +# +# ENCRYPTION_KEY : openssl rand -hex 16 +# AUTH_SECRET : openssl rand -base64 32 +# +# DB_CONNECTION_URI password MUST match POSTGRES_PASSWORD. +apiVersion: v1 +kind: Secret +metadata: + name: infisical-secrets + namespace: infisical +type: Opaque +stringData: + ENCRYPTION_KEY: "" + AUTH_SECRET: "" + POSTGRES_USER: "" + POSTGRES_PASSWORD: "" + POSTGRES_DB: "" + DB_CONNECTION_URI: "" + REDIS_URL: "" diff --git a/applications/infisical/valkey/service.yaml b/applications/infisical/valkey/service.yaml new file mode 100644 index 0000000..299c345 --- /dev/null +++ b/applications/infisical/valkey/service.yaml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: Service +metadata: + name: infisical-valkey + namespace: infisical + labels: + app: infisical-valkey +spec: + selector: + app: infisical-valkey + ports: + - name: valkey + port: 6379 + targetPort: 6379 diff --git a/applications/infisical/valkey/statefulset.yaml b/applications/infisical/valkey/statefulset.yaml new file mode 100644 index 0000000..65c507a --- /dev/null +++ b/applications/infisical/valkey/statefulset.yaml @@ -0,0 +1,40 @@ +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: infisical-valkey + namespace: infisical +spec: + serviceName: infisical-valkey + replicas: 1 + selector: + matchLabels: + app: infisical-valkey + template: + metadata: + labels: + app: infisical-valkey + spec: + containers: + - name: valkey + # Valkey is a drop-in, Redis-protocol-compatible replacement for Redis. + image: valkey/valkey:8-alpine + args: ["--appendonly", "yes"] + ports: + - containerPort: 6379 + volumeMounts: + - name: data + mountPath: /data + readinessProbe: + exec: + command: ["valkey-cli", "ping"] + initialDelaySeconds: 5 + periodSeconds: 10 + volumeClaimTemplates: + - metadata: + name: data + spec: + accessModes: ["ReadWriteOnce"] + storageClassName: longhorn + resources: + requests: + storage: 1Gi diff --git a/infra/argocd/applications/infisical-application.yaml b/infra/argocd/applications/infisical-application.yaml index e782294..4f49b90 100644 --- a/infra/argocd/applications/infisical-application.yaml +++ b/infra/argocd/applications/infisical-application.yaml @@ -11,7 +11,9 @@ spec: targetRevision: HEAD directory: recurse: true - exclude: universal-auth-secret.yaml + # secret.yaml holds Infisical's own bootstrap secrets — applied out-of-band, + # committed here only as an emptied template. Never let ArgoCD apply it. + exclude: secret.yaml destination: server: https://kubernetes.default.svc namespace: infisical