infisical: repoint secret CRs at the rebuilt machine identity

Also tracks the auth ServiceAccounts and RBAC in Git so a namespace rebuild restores Kubernetes auth on its own.

applications/infisical/Infisical-secrets/affine-infisicalsecret.yaml

@@ -8,7 +8,7 @@ spec:
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical

applications/infisical/Infisical-secrets/authentik-infisicalsecret.yaml

@@ -8,7 +8,7 @@ spec:
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical

applications/infisical/Infisical-secrets/azure-ddns-infisicalsecret.yaml

@@ -8,7 +8,7 @@ spec:
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical

applications/infisical/Infisical-secrets/crowdsec-infisicalsecret.yaml

@@ -8,7 +8,7 @@ spec:
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical

applications/infisical/Infisical-secrets/gitea-infisicalsecret.yaml

@@ -8,7 +8,7 @@ spec:
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical

applications/infisical/Infisical-secrets/gotify-infisicalsecret.yaml

@@ -8,7 +8,7 @@ spec:
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical

applications/infisical/Infisical-secrets/immich-infisicalsecret.yaml

@@ -8,7 +8,7 @@ spec:
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical

applications/infisical/Infisical-secrets/jellyfin-infisicalsecret.yaml

@@ -8,7 +8,7 @@ spec:
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical

applications/infisical/Infisical-secrets/longhorn-infisicalsecret.yaml

@@ -8,7 +8,7 @@ spec:
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical

applications/infisical/Infisical-secrets/minecraft-infisicalsecret.yaml

@@ -8,7 +8,7 @@ spec:
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical

applications/infisical/Infisical-secrets/n8n-infisicalsecret.yaml

@@ -8,7 +8,7 @@ spec:
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical

applications/infisical/Infisical-secrets/netbootxyz-infisicalsecret.yaml

@@ -8,7 +8,7 @@ spec:
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical

applications/infisical/Infisical-secrets/openwebui-infisicalsecret.yaml

@@ -8,7 +8,7 @@ spec:
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical

applications/infisical/Infisical-secrets/outline-infisicalsecret.yaml

@@ -8,7 +8,7 @@ spec:
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical

applications/infisical/Infisical-secrets/passbolt-infisicalsecret.yaml

@@ -8,7 +8,7 @@ spec:
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical

applications/infisical/Infisical-secrets/pelican-infisicalsecret.yaml

@@ -8,7 +8,7 @@ spec:
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical

applications/infisical/Infisical-secrets/resume-infisicalsecret.yaml

@@ -8,7 +8,7 @@ spec:
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical

applications/infisical/Infisical-secrets/searxng-infisicalsecret.yaml

@@ -8,7 +8,7 @@ spec:
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical

applications/infisical/Infisical-secrets/vaultwarden-infisicalsecret.yaml

@@ -8,7 +8,7 @@ spec:
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical

applications/infisical/Infisical-secrets/victoria-metrics-infisicalsecret.yaml

@@ -8,7 +8,7 @@ spec:
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical

applications/infisical/serviceaccounts.yaml

@@ -0,0 +1,63 @@
+# Kubernetes-native auth for the InfisicalSecret operator.
+# infisical-auth: the identity the CRDs mint short-lived tokens for.
+# infisical-token-reviewer: its JWT is pasted into Infisical's Kubernetes Auth
+# config so Infisical can call TokenReview. Bound to system:auth-delegator below.
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: infisical-auth
+  namespace: infisical
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: infisical-token-reviewer
+  namespace: infisical
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: infisical-token-reviewer
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:auth-delegator
+subjects:
+  - kind: ServiceAccount
+    name: infisical-token-reviewer
+    namespace: infisical
+---
+# The operator needs to mint tokens for infisical-auth; without this it falls
+# back to the legacy SA .secrets[] lookup and never gets a token.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: infisical-operator-token-creator
+rules:
+  - apiGroups: [""]
+    resources: ["serviceaccounts/token"]
+    verbs: ["create"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: infisical-operator-token-creator
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: infisical-operator-token-creator
+subjects:
+  - kind: ServiceAccount
+    name: infisical-opera-controller-manager
+    namespace: infisical-operator
+---
+# Long-lived token for the reviewer SA. `kubectl create token` expires; the
+# value pasted into Infisical's Kubernetes Auth config must not.
+apiVersion: v1
+kind: Secret
+metadata:
+  name: infisical-token-reviewer
+  namespace: infisical
+  annotations:
+    kubernetes.io/service-account.name: infisical-token-reviewer
+type: kubernetes.io/service-account-token