💡 핵심 요약 (Executive Summary)
본 가이드는 crd infisical set 핵심 가이드 및 실전 아키텍처의 핵심 개념, 실전 구성 명령어 및 아키텍처 베스트 프랙티스를 다룹니다. 클라우드 네이티브 및 인프라 엔지니어링 실무에 즉시 활용 가능하도록 체계적으로 정리했습니다.
📑 Table of Contents
Secret: infisical-secrets
Reference & Guidelines (NOTE)
infisical 설치시에 사용되는 비밀키 등 환경정보
env
bash
AUTH_SECRET=$(openssl rand -base64 32)
ENCRYPTION_KEY=$(openssl rand -hex 16)
REDIS_URL=redis://default:[email protected]:6379
DB_CONNECTION_URI=postgresql://infisical:[email protected]:5432/infisicaldefault
yaml
apiVersion: v1
kind: Secret
metadata:
name: infisical-secrets
namespace: $ns
type: Opaque
stringData:
AUTH_SECRET: $AUTH_SECRET
ENCRYPTION_KEY: $ENCRYPTION_KEY
EOFexternal DB, Redis
yaml
apiVersion: v1
kind: Secret
metadata:
name: infisical-secrets
type: Opaque
stringData:
AUTH_SECRET: $AUTH_SECRET
ENCRYPTION_KEY: $ENCRYPTION_KEY
REDIS_URL: $REDIS_URL
DB_CONNECTION_URI: $DB_CONNECTION_URISecret: universal-auth-credentials
Reference & Guidelines (NOTE)
kubernetes secret-operator사용 시 InfisicalSecret에서 참조 가능한 clientId, clientSecret
generate
bash
kubectl create secret generic \
--from-literal=clientId="$clientId" \
--from-literal=clientSecret="$clientSecret" \
-n kube-system \
infisical-universal-auth-credentialssample
yaml
apiVersion: v1
data:
clientId: NjNkYWY2N2QtZDA4My00MTFkLTgxMGQtNzc4MzcyZTkwNDA0
clientSecret: YTkxZDEyYzE3YzQwYzI4MzA5ZDAwMzQ5YjYzNjQ5NDg5ZTJjMTI0YzNjOTJkMDhhZDdjYzk3ODlkMDQwNGYzMg==
kind: Secret
metadata:
name: infisical-universal-auth-credentials
namespace: kube-system
type: OpaqueInfisicalSecret
Reference & Guidelines (NOTE)
kubernetes secret-operator사용 시 infisical의 특정 project, env, path를 kubernetes의 특정 ns, secret으로 동기화하겠다는 명세서
impl
yaml
apiVersion: secrets.infisical.com/v1alpha1
kind: InfisicalSecret
metadata:
name: infisicalsecret-cicd
namespace: cicd
spec:
hostAPI: http://infisical-infisical-standalone-infisical.datastore.svc.cluster.local:8080/api
resyncInterval: 10 #sec
authentication:
# Make sure to only have 1 authentication method defined, serviceToken/universalAuth.
# If you have multiple authentication methods defined, it may cause issues.
universalAuth:
secretsScope:
projectSlug: infra
envSlug: dev # "dev", "staging", "prod", etc..
secretsPath: "/test1" # Root is "/"
recursive: true # Fetch all secrets from the specified path and all sub-directories. Default is false.
credentialsRef:
secretName: infisical-universal-auth-credentials
secretNamespace: kube-system
managedSecretReference:
secretName: infisical-managed-secret
secretNamespace: cicd
creationPolicy: "Orphan" ## Owner | Orphan (default)
# secretType: kubernetes.io/dockerconfigjsonsample
yaml
apiVersion: secrets.infisical.com/v1alpha1
kind: InfisicalSecret
metadata:
name: infisicalsecret-sample
labels:
label-to-be-passed-to-managed-secret: sample-value
annotations:
example.com/annotation-to-be-passed-to-managed-secret: "sample-value"
spec:
#if public domain
hostAPI: https://app.infisical.com/api
#if internal domain
#hostAPI: http://<backend-svc-name>.<namespace>.svc.cluster.local:4000/api
resyncInterval: 10 #sec
authentication:
# Make sure to only have 1 authentication method defined, serviceToken/universalAuth.
# If you have multiple authentication methods defined, it may cause issues.
universalAuth:
secretsScope:
projectSlug: <project-slug>
envSlug: <env-slug> # "dev", "staging", "prod", etc..
secretsPath: "<secrets-path>" # Root is "/"
recursive: true # Fetch all secrets from the specified path and all sub-directories. Default is false.
credentialsRef:
secretName: infisical-universal-auth-credentials
secretNamespace: kube-system
# Service tokens are deprecated and will be removed in the near future. Please use Machine Identities for authenticating with Infisical.
serviceToken:
serviceTokenSecretReference:
secretName: service-token
secretNamespace: default
secretsScope:
envSlug: <env-slug>
secretsPath: <secrets-path> # Root is "/"
recursive: true # Fetch all secrets from the specified path and all sub-directories. Default is false.
managedSecretReference:
secretName: managed-secret
secretNamespace: default
creationPolicy: "Orphan" ## Owner | Orphan (default)
# secretType: kubernetes.io/dockerconfigjson
Leave a Reply