Jeffrey/Kubernetes-Manifests
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

infisical: repoint secret CRs at the rebuilt machine identity

Browse Source 
Also tracks the auth ServiceAccounts and RBAC in Git so a namespace rebuild restores Kubernetes auth on its own.
This commit is contained in:
Jeffrey
2026-08-23 20:08:28 +02:00
parent 7956c6b1b9
commit 3bec829396
21 changed files with 83 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
applications/infisical/Infisical-secrets/affine-infisicalsecret.yaml
+1 -1
View File
@@ -8,7 +8,7 @@ spec:
resyncInterval: 30
authentication:
kubernetesAuth:
identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
serviceAccountRef:
name: infisical-auth
namespace: infisical
applications/infisical/Infisical-secrets/authentik-infisicalsecret.yaml
+1 -1
View File
@@ -8,7 +8,7 @@ spec:
resyncInterval: 30
authentication:
kubernetesAuth:
identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
serviceAccountRef:
name: infisical-auth
namespace: infisical
applications/infisical/Infisical-secrets/azure-ddns-infisicalsecret.yaml
+1 -1
View File
@@ -8,7 +8,7 @@ spec:
resyncInterval: 30
authentication:
kubernetesAuth:
identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
serviceAccountRef:
name: infisical-auth
namespace: infisical
applications/infisical/Infisical-secrets/crowdsec-infisicalsecret.yaml
+1 -1
View File
@@ -8,7 +8,7 @@ spec:
resyncInterval: 30
authentication:
kubernetesAuth:
identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
serviceAccountRef:
name: infisical-auth
namespace: infisical
applications/infisical/Infisical-secrets/gitea-infisicalsecret.yaml
+1 -1
View File
@@ -8,7 +8,7 @@ spec:
resyncInterval: 30
authentication:
kubernetesAuth:
identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
serviceAccountRef:
name: infisical-auth
namespace: infisical
applications/infisical/Infisical-secrets/gotify-infisicalsecret.yaml
+1 -1
View File
@@ -8,7 +8,7 @@ spec:
resyncInterval: 30
authentication:
kubernetesAuth:
identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
serviceAccountRef:
name: infisical-auth
namespace: infisical
applications/infisical/Infisical-secrets/immich-infisicalsecret.yaml
+1 -1
View File
@@ -8,7 +8,7 @@ spec:
resyncInterval: 30
authentication:
kubernetesAuth:
identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
serviceAccountRef:
name: infisical-auth
namespace: infisical
applications/infisical/Infisical-secrets/jellyfin-infisicalsecret.yaml
+1 -1
View File
@@ -8,7 +8,7 @@ spec:
resyncInterval: 30
authentication:
kubernetesAuth:
identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
serviceAccountRef:
name: infisical-auth
namespace: infisical
applications/infisical/Infisical-secrets/longhorn-infisicalsecret.yaml
+1 -1
View File
@@ -8,7 +8,7 @@ spec:
resyncInterval: 30
authentication:
kubernetesAuth:
identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
serviceAccountRef:
name: infisical-auth
namespace: infisical
applications/infisical/Infisical-secrets/minecraft-infisicalsecret.yaml
+1 -1
View File
@@ -8,7 +8,7 @@ spec:
resyncInterval: 30
authentication:
kubernetesAuth:
identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
serviceAccountRef:
name: infisical-auth
namespace: infisical
applications/infisical/Infisical-secrets/n8n-infisicalsecret.yaml
+1 -1
View File
@@ -8,7 +8,7 @@ spec:
resyncInterval: 30
authentication:
kubernetesAuth:
identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
serviceAccountRef:
name: infisical-auth
namespace: infisical
applications/infisical/Infisical-secrets/netbootxyz-infisicalsecret.yaml
+1 -1
View File
@@ -8,7 +8,7 @@ spec:
resyncInterval: 30
authentication:
kubernetesAuth:
identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
serviceAccountRef:
name: infisical-auth
namespace: infisical
applications/infisical/Infisical-secrets/openwebui-infisicalsecret.yaml
+1 -1
View File
@@ -8,7 +8,7 @@ spec:
resyncInterval: 30
authentication:
kubernetesAuth:
identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
serviceAccountRef:
name: infisical-auth
namespace: infisical
applications/infisical/Infisical-secrets/outline-infisicalsecret.yaml
+1 -1
View File
@@ -8,7 +8,7 @@ spec:
resyncInterval: 30
authentication:
kubernetesAuth:
identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
serviceAccountRef:
name: infisical-auth
namespace: infisical
applications/infisical/Infisical-secrets/passbolt-infisicalsecret.yaml
+1 -1
View File
@@ -8,7 +8,7 @@ spec:
resyncInterval: 30
authentication:
kubernetesAuth:
identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
serviceAccountRef:
name: infisical-auth
namespace: infisical
applications/infisical/Infisical-secrets/pelican-infisicalsecret.yaml
+1 -1
View File
@@ -8,7 +8,7 @@ spec:
resyncInterval: 30
authentication:
kubernetesAuth:
identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
serviceAccountRef:
name: infisical-auth
namespace: infisical
applications/infisical/Infisical-secrets/resume-infisicalsecret.yaml
+1 -1
View File
@@ -8,7 +8,7 @@ spec:
resyncInterval: 30
authentication:
kubernetesAuth:
identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
serviceAccountRef:
name: infisical-auth
namespace: infisical
applications/infisical/Infisical-secrets/searxng-infisicalsecret.yaml
+1 -1
View File
@@ -8,7 +8,7 @@ spec:
resyncInterval: 30
authentication:
kubernetesAuth:
identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
serviceAccountRef:
name: infisical-auth
namespace: infisical
applications/infisical/Infisical-secrets/vaultwarden-infisicalsecret.yaml
+1 -1
View File
@@ -8,7 +8,7 @@ spec:
resyncInterval: 30
authentication:
kubernetesAuth:
identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
serviceAccountRef:
name: infisical-auth
namespace: infisical
applications/infisical/Infisical-secrets/victoria-metrics-infisicalsecret.yaml
+1 -1
View File
@@ -8,7 +8,7 @@ spec:
resyncInterval: 30
authentication:
kubernetesAuth:
identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
serviceAccountRef:
name: infisical-auth
namespace: infisical
applications/infisical/serviceaccounts.yaml
+63
View File
@@ -0,0 +1,63 @@
# Kubernetes-native auth for the InfisicalSecret operator.
# infisical-auth: the identity the CRDs mint short-lived tokens for.
# infisical-token-reviewer: its JWT is pasted into Infisical's Kubernetes Auth
# config so Infisical can call TokenReview. Bound to system:auth-delegator below.
apiVersion: v1
kind: ServiceAccount
metadata:
name: infisical-auth
namespace: infisical
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: infisical-token-reviewer
namespace: infisical
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: infisical-token-reviewer
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: system:auth-delegator
subjects:
- kind: ServiceAccount
name: infisical-token-reviewer
namespace: infisical
---
# The operator needs to mint tokens for infisical-auth; without this it falls
# back to the legacy SA .secrets[] lookup and never gets a token.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: infisical-operator-token-creator
rules:
- apiGroups: [""]
resources: ["serviceaccounts/token"]
verbs: ["create"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: infisical-operator-token-creator
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: infisical-operator-token-creator
subjects:
- kind: ServiceAccount
name: infisical-opera-controller-manager
namespace: infisical-operator
---
# Long-lived token for the reviewer SA. `kubectl create token` expires; the
# value pasted into Infisical's Kubernetes Auth config must not.
apiVersion: v1
kind: Secret
metadata:
name: infisical-token-reviewer
namespace: infisical
annotations:
kubernetes.io/service-account.name: infisical-token-reviewer
type: kubernetes.io/service-account-token