From 3bec829396ff50b05f0f84d7d7629703080bd7d0 Mon Sep 17 00:00:00 2001 From: Jeffrey Smeets Date: Sun, 23 Aug 2026 20:08:28 +0200 Subject: [PATCH] infisical: repoint secret CRs at the rebuilt machine identity Also tracks the auth ServiceAccounts and RBAC in Git so a namespace rebuild restores Kubernetes auth on its own. --- .../affine-infisicalsecret.yaml | 2 +- .../authentik-infisicalsecret.yaml | 2 +- .../azure-ddns-infisicalsecret.yaml | 2 +- .../crowdsec-infisicalsecret.yaml | 2 +- .../gitea-infisicalsecret.yaml | 2 +- .../gotify-infisicalsecret.yaml | 2 +- .../immich-infisicalsecret.yaml | 2 +- .../jellyfin-infisicalsecret.yaml | 2 +- .../longhorn-infisicalsecret.yaml | 2 +- .../minecraft-infisicalsecret.yaml | 2 +- .../n8n-infisicalsecret.yaml | 2 +- .../netbootxyz-infisicalsecret.yaml | 2 +- .../openwebui-infisicalsecret.yaml | 2 +- .../outline-infisicalsecret.yaml | 2 +- .../passbolt-infisicalsecret.yaml | 2 +- .../pelican-infisicalsecret.yaml | 2 +- .../resume-infisicalsecret.yaml | 2 +- .../searxng-infisicalsecret.yaml | 2 +- .../vaultwarden-infisicalsecret.yaml | 2 +- .../victoria-metrics-infisicalsecret.yaml | 2 +- applications/infisical/serviceaccounts.yaml | 63 +++++++++++++++++++ 21 files changed, 83 insertions(+), 20 deletions(-) create mode 100644 applications/infisical/serviceaccounts.yaml diff --git a/applications/infisical/Infisical-secrets/affine-infisicalsecret.yaml b/applications/infisical/Infisical-secrets/affine-infisicalsecret.yaml index 8ae51f0..5932b84 100644 --- a/applications/infisical/Infisical-secrets/affine-infisicalsecret.yaml +++ b/applications/infisical/Infisical-secrets/affine-infisicalsecret.yaml @@ -8,7 +8,7 @@ spec: resyncInterval: 30 authentication: kubernetesAuth: - identityId: "9f65814e-bf4c-42fc-b382-26be15b11416" + identityId: "5458def7-7c63-40d2-95da-41c614d0933a" serviceAccountRef: name: infisical-auth namespace: infisical diff --git a/applications/infisical/Infisical-secrets/authentik-infisicalsecret.yaml b/applications/infisical/Infisical-secrets/authentik-infisicalsecret.yaml index df4b83e..4c4d66d 100644 --- a/applications/infisical/Infisical-secrets/authentik-infisicalsecret.yaml +++ b/applications/infisical/Infisical-secrets/authentik-infisicalsecret.yaml @@ -8,7 +8,7 @@ spec: resyncInterval: 30 authentication: kubernetesAuth: - identityId: "9f65814e-bf4c-42fc-b382-26be15b11416" + identityId: "5458def7-7c63-40d2-95da-41c614d0933a" serviceAccountRef: name: infisical-auth namespace: infisical diff --git a/applications/infisical/Infisical-secrets/azure-ddns-infisicalsecret.yaml b/applications/infisical/Infisical-secrets/azure-ddns-infisicalsecret.yaml index 290e520..59cc55c 100644 --- a/applications/infisical/Infisical-secrets/azure-ddns-infisicalsecret.yaml +++ b/applications/infisical/Infisical-secrets/azure-ddns-infisicalsecret.yaml @@ -8,7 +8,7 @@ spec: resyncInterval: 30 authentication: kubernetesAuth: - identityId: "9f65814e-bf4c-42fc-b382-26be15b11416" + identityId: "5458def7-7c63-40d2-95da-41c614d0933a" serviceAccountRef: name: infisical-auth namespace: infisical diff --git a/applications/infisical/Infisical-secrets/crowdsec-infisicalsecret.yaml b/applications/infisical/Infisical-secrets/crowdsec-infisicalsecret.yaml index 2410c38..0aa56a3 100644 --- a/applications/infisical/Infisical-secrets/crowdsec-infisicalsecret.yaml +++ b/applications/infisical/Infisical-secrets/crowdsec-infisicalsecret.yaml @@ -8,7 +8,7 @@ spec: resyncInterval: 30 authentication: kubernetesAuth: - identityId: "9f65814e-bf4c-42fc-b382-26be15b11416" + identityId: "5458def7-7c63-40d2-95da-41c614d0933a" serviceAccountRef: name: infisical-auth namespace: infisical diff --git a/applications/infisical/Infisical-secrets/gitea-infisicalsecret.yaml b/applications/infisical/Infisical-secrets/gitea-infisicalsecret.yaml index 4925a9c..5fa2bcc 100644 --- a/applications/infisical/Infisical-secrets/gitea-infisicalsecret.yaml +++ b/applications/infisical/Infisical-secrets/gitea-infisicalsecret.yaml @@ -8,7 +8,7 @@ spec: resyncInterval: 30 authentication: kubernetesAuth: - identityId: "9f65814e-bf4c-42fc-b382-26be15b11416" + identityId: "5458def7-7c63-40d2-95da-41c614d0933a" serviceAccountRef: name: infisical-auth namespace: infisical diff --git a/applications/infisical/Infisical-secrets/gotify-infisicalsecret.yaml b/applications/infisical/Infisical-secrets/gotify-infisicalsecret.yaml index 15e81fe..0cf62ce 100644 --- a/applications/infisical/Infisical-secrets/gotify-infisicalsecret.yaml +++ b/applications/infisical/Infisical-secrets/gotify-infisicalsecret.yaml @@ -8,7 +8,7 @@ spec: resyncInterval: 30 authentication: kubernetesAuth: - identityId: "9f65814e-bf4c-42fc-b382-26be15b11416" + identityId: "5458def7-7c63-40d2-95da-41c614d0933a" serviceAccountRef: name: infisical-auth namespace: infisical diff --git a/applications/infisical/Infisical-secrets/immich-infisicalsecret.yaml b/applications/infisical/Infisical-secrets/immich-infisicalsecret.yaml index ce6bd9c..1bc3da9 100644 --- a/applications/infisical/Infisical-secrets/immich-infisicalsecret.yaml +++ b/applications/infisical/Infisical-secrets/immich-infisicalsecret.yaml @@ -8,7 +8,7 @@ spec: resyncInterval: 30 authentication: kubernetesAuth: - identityId: "9f65814e-bf4c-42fc-b382-26be15b11416" + identityId: "5458def7-7c63-40d2-95da-41c614d0933a" serviceAccountRef: name: infisical-auth namespace: infisical diff --git a/applications/infisical/Infisical-secrets/jellyfin-infisicalsecret.yaml b/applications/infisical/Infisical-secrets/jellyfin-infisicalsecret.yaml index ce1195a..9a36e16 100644 --- a/applications/infisical/Infisical-secrets/jellyfin-infisicalsecret.yaml +++ b/applications/infisical/Infisical-secrets/jellyfin-infisicalsecret.yaml @@ -8,7 +8,7 @@ spec: resyncInterval: 30 authentication: kubernetesAuth: - identityId: "9f65814e-bf4c-42fc-b382-26be15b11416" + identityId: "5458def7-7c63-40d2-95da-41c614d0933a" serviceAccountRef: name: infisical-auth namespace: infisical diff --git a/applications/infisical/Infisical-secrets/longhorn-infisicalsecret.yaml b/applications/infisical/Infisical-secrets/longhorn-infisicalsecret.yaml index 6adf232..268267c 100644 --- a/applications/infisical/Infisical-secrets/longhorn-infisicalsecret.yaml +++ b/applications/infisical/Infisical-secrets/longhorn-infisicalsecret.yaml @@ -8,7 +8,7 @@ spec: resyncInterval: 30 authentication: kubernetesAuth: - identityId: "9f65814e-bf4c-42fc-b382-26be15b11416" + identityId: "5458def7-7c63-40d2-95da-41c614d0933a" serviceAccountRef: name: infisical-auth namespace: infisical diff --git a/applications/infisical/Infisical-secrets/minecraft-infisicalsecret.yaml b/applications/infisical/Infisical-secrets/minecraft-infisicalsecret.yaml index 796a47e..bb39e65 100644 --- a/applications/infisical/Infisical-secrets/minecraft-infisicalsecret.yaml +++ b/applications/infisical/Infisical-secrets/minecraft-infisicalsecret.yaml @@ -8,7 +8,7 @@ spec: resyncInterval: 30 authentication: kubernetesAuth: - identityId: "9f65814e-bf4c-42fc-b382-26be15b11416" + identityId: "5458def7-7c63-40d2-95da-41c614d0933a" serviceAccountRef: name: infisical-auth namespace: infisical diff --git a/applications/infisical/Infisical-secrets/n8n-infisicalsecret.yaml b/applications/infisical/Infisical-secrets/n8n-infisicalsecret.yaml index 2adb800..7ccb86a 100644 --- a/applications/infisical/Infisical-secrets/n8n-infisicalsecret.yaml +++ b/applications/infisical/Infisical-secrets/n8n-infisicalsecret.yaml @@ -8,7 +8,7 @@ spec: resyncInterval: 30 authentication: kubernetesAuth: - identityId: "9f65814e-bf4c-42fc-b382-26be15b11416" + identityId: "5458def7-7c63-40d2-95da-41c614d0933a" serviceAccountRef: name: infisical-auth namespace: infisical diff --git a/applications/infisical/Infisical-secrets/netbootxyz-infisicalsecret.yaml b/applications/infisical/Infisical-secrets/netbootxyz-infisicalsecret.yaml index fbe4864..caf7b97 100644 --- a/applications/infisical/Infisical-secrets/netbootxyz-infisicalsecret.yaml +++ b/applications/infisical/Infisical-secrets/netbootxyz-infisicalsecret.yaml @@ -8,7 +8,7 @@ spec: resyncInterval: 30 authentication: kubernetesAuth: - identityId: "9f65814e-bf4c-42fc-b382-26be15b11416" + identityId: "5458def7-7c63-40d2-95da-41c614d0933a" serviceAccountRef: name: infisical-auth namespace: infisical diff --git a/applications/infisical/Infisical-secrets/openwebui-infisicalsecret.yaml b/applications/infisical/Infisical-secrets/openwebui-infisicalsecret.yaml index eddf212..9361b0d 100644 --- a/applications/infisical/Infisical-secrets/openwebui-infisicalsecret.yaml +++ b/applications/infisical/Infisical-secrets/openwebui-infisicalsecret.yaml @@ -8,7 +8,7 @@ spec: resyncInterval: 30 authentication: kubernetesAuth: - identityId: "9f65814e-bf4c-42fc-b382-26be15b11416" + identityId: "5458def7-7c63-40d2-95da-41c614d0933a" serviceAccountRef: name: infisical-auth namespace: infisical diff --git a/applications/infisical/Infisical-secrets/outline-infisicalsecret.yaml b/applications/infisical/Infisical-secrets/outline-infisicalsecret.yaml index 5d2de44..425f0fa 100644 --- a/applications/infisical/Infisical-secrets/outline-infisicalsecret.yaml +++ b/applications/infisical/Infisical-secrets/outline-infisicalsecret.yaml @@ -8,7 +8,7 @@ spec: resyncInterval: 30 authentication: kubernetesAuth: - identityId: "9f65814e-bf4c-42fc-b382-26be15b11416" + identityId: "5458def7-7c63-40d2-95da-41c614d0933a" serviceAccountRef: name: infisical-auth namespace: infisical diff --git a/applications/infisical/Infisical-secrets/passbolt-infisicalsecret.yaml b/applications/infisical/Infisical-secrets/passbolt-infisicalsecret.yaml index 9d22dad..94f3399 100644 --- a/applications/infisical/Infisical-secrets/passbolt-infisicalsecret.yaml +++ b/applications/infisical/Infisical-secrets/passbolt-infisicalsecret.yaml @@ -8,7 +8,7 @@ spec: resyncInterval: 30 authentication: kubernetesAuth: - identityId: "9f65814e-bf4c-42fc-b382-26be15b11416" + identityId: "5458def7-7c63-40d2-95da-41c614d0933a" serviceAccountRef: name: infisical-auth namespace: infisical diff --git a/applications/infisical/Infisical-secrets/pelican-infisicalsecret.yaml b/applications/infisical/Infisical-secrets/pelican-infisicalsecret.yaml index 9a869d7..ee589cd 100644 --- a/applications/infisical/Infisical-secrets/pelican-infisicalsecret.yaml +++ b/applications/infisical/Infisical-secrets/pelican-infisicalsecret.yaml @@ -8,7 +8,7 @@ spec: resyncInterval: 30 authentication: kubernetesAuth: - identityId: "9f65814e-bf4c-42fc-b382-26be15b11416" + identityId: "5458def7-7c63-40d2-95da-41c614d0933a" serviceAccountRef: name: infisical-auth namespace: infisical diff --git a/applications/infisical/Infisical-secrets/resume-infisicalsecret.yaml b/applications/infisical/Infisical-secrets/resume-infisicalsecret.yaml index 6af1128..dfce15a 100644 --- a/applications/infisical/Infisical-secrets/resume-infisicalsecret.yaml +++ b/applications/infisical/Infisical-secrets/resume-infisicalsecret.yaml @@ -8,7 +8,7 @@ spec: resyncInterval: 30 authentication: kubernetesAuth: - identityId: "9f65814e-bf4c-42fc-b382-26be15b11416" + identityId: "5458def7-7c63-40d2-95da-41c614d0933a" serviceAccountRef: name: infisical-auth namespace: infisical diff --git a/applications/infisical/Infisical-secrets/searxng-infisicalsecret.yaml b/applications/infisical/Infisical-secrets/searxng-infisicalsecret.yaml index 9355674..5218eeb 100644 --- a/applications/infisical/Infisical-secrets/searxng-infisicalsecret.yaml +++ b/applications/infisical/Infisical-secrets/searxng-infisicalsecret.yaml @@ -8,7 +8,7 @@ spec: resyncInterval: 30 authentication: kubernetesAuth: - identityId: "9f65814e-bf4c-42fc-b382-26be15b11416" + identityId: "5458def7-7c63-40d2-95da-41c614d0933a" serviceAccountRef: name: infisical-auth namespace: infisical diff --git a/applications/infisical/Infisical-secrets/vaultwarden-infisicalsecret.yaml b/applications/infisical/Infisical-secrets/vaultwarden-infisicalsecret.yaml index 3ae3963..00a34cc 100644 --- a/applications/infisical/Infisical-secrets/vaultwarden-infisicalsecret.yaml +++ b/applications/infisical/Infisical-secrets/vaultwarden-infisicalsecret.yaml @@ -8,7 +8,7 @@ spec: resyncInterval: 30 authentication: kubernetesAuth: - identityId: "9f65814e-bf4c-42fc-b382-26be15b11416" + identityId: "5458def7-7c63-40d2-95da-41c614d0933a" serviceAccountRef: name: infisical-auth namespace: infisical diff --git a/applications/infisical/Infisical-secrets/victoria-metrics-infisicalsecret.yaml b/applications/infisical/Infisical-secrets/victoria-metrics-infisicalsecret.yaml index afc6c98..bf44537 100644 --- a/applications/infisical/Infisical-secrets/victoria-metrics-infisicalsecret.yaml +++ b/applications/infisical/Infisical-secrets/victoria-metrics-infisicalsecret.yaml @@ -8,7 +8,7 @@ spec: resyncInterval: 30 authentication: kubernetesAuth: - identityId: "9f65814e-bf4c-42fc-b382-26be15b11416" + identityId: "5458def7-7c63-40d2-95da-41c614d0933a" serviceAccountRef: name: infisical-auth namespace: infisical diff --git a/applications/infisical/serviceaccounts.yaml b/applications/infisical/serviceaccounts.yaml new file mode 100644 index 0000000..eaf721f --- /dev/null +++ b/applications/infisical/serviceaccounts.yaml @@ -0,0 +1,63 @@ +# Kubernetes-native auth for the InfisicalSecret operator. +# infisical-auth: the identity the CRDs mint short-lived tokens for. +# infisical-token-reviewer: its JWT is pasted into Infisical's Kubernetes Auth +# config so Infisical can call TokenReview. Bound to system:auth-delegator below. +apiVersion: v1 +kind: ServiceAccount +metadata: + name: infisical-auth + namespace: infisical +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: infisical-token-reviewer + namespace: infisical +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: infisical-token-reviewer +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: system:auth-delegator +subjects: + - kind: ServiceAccount + name: infisical-token-reviewer + namespace: infisical +--- +# The operator needs to mint tokens for infisical-auth; without this it falls +# back to the legacy SA .secrets[] lookup and never gets a token. +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: infisical-operator-token-creator +rules: + - apiGroups: [""] + resources: ["serviceaccounts/token"] + verbs: ["create"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: infisical-operator-token-creator +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: infisical-operator-token-creator +subjects: + - kind: ServiceAccount + name: infisical-opera-controller-manager + namespace: infisical-operator +--- +# Long-lived token for the reviewer SA. `kubectl create token` expires; the +# value pasted into Infisical's Kubernetes Auth config must not. +apiVersion: v1 +kind: Secret +metadata: + name: infisical-token-reviewer + namespace: infisical + annotations: + kubernetes.io/service-account.name: infisical-token-reviewer +type: kubernetes.io/service-account-token