AUTH_SECRET=$(openssl rand -base64 32)
ENCRYPTION_KEY=$(openssl rand -hex 16)
REDIS_URL=redis://default:[email protected]:6379
DB_CONNECTION_URI=postgresql://infisical:[email protected]:5432/infisical

apiVersion: v1
kind: Secret
metadata:
  name: infisical-secrets
  namespace: $ns
type: Opaque
stringData:
  AUTH_SECRET: $AUTH_SECRET
  ENCRYPTION_KEY: $ENCRYPTION_KEY
EOF

apiVersion: v1
kind: Secret
metadata:
  name: infisical-secrets
type: Opaque
stringData:
  AUTH_SECRET: $AUTH_SECRET
  ENCRYPTION_KEY: $ENCRYPTION_KEY
  REDIS_URL: $REDIS_URL
  DB_CONNECTION_URI: $DB_CONNECTION_URI

kubectl create secret generic \
--from-literal=clientId="$clientId" \
--from-literal=clientSecret="$clientSecret" \
-n kube-system \
infisical-universal-auth-credentials

apiVersion: v1
data:
  clientId: NjNkYWY2N2QtZDA4My00MTFkLTgxMGQtNzc4MzcyZTkwNDA0
  clientSecret: YTkxZDEyYzE3YzQwYzI4MzA5ZDAwMzQ5YjYzNjQ5NDg5ZTJjMTI0YzNjOTJkMDhhZDdjYzk3ODlkMDQwNGYzMg==
kind: Secret
metadata:
  name: infisical-universal-auth-credentials
  namespace: kube-system
type: Opaque

apiVersion: secrets.infisical.com/v1alpha1
kind: InfisicalSecret
metadata:
  name: infisicalsecret-cicd
  namespace: cicd
spec:
  hostAPI: http://infisical-infisical-standalone-infisical.datastore.svc.cluster.local:8080/api
  resyncInterval: 10 #sec
  authentication:
    # Make sure to only have 1 authentication method defined, serviceToken/universalAuth.
    # If you have multiple authentication methods defined, it may cause issues.
    universalAuth:
      secretsScope:
        projectSlug: infra
        envSlug: dev # "dev", "staging", "prod", etc..
        secretsPath: "/test1" # Root is "/"
        recursive: true # Fetch all secrets from the specified path and all sub-directories. Default is false.
      
      credentialsRef:
        secretName: infisical-universal-auth-credentials
        secretNamespace: kube-system

  managedSecretReference:
    secretName: infisical-managed-secret
    secretNamespace: cicd
    creationPolicy: "Orphan" ## Owner | Orphan (default)
    # secretType: kubernetes.io/dockerconfigjson

apiVersion: secrets.infisical.com/v1alpha1
kind: InfisicalSecret
metadata:
  name: infisicalsecret-sample
  labels:
    label-to-be-passed-to-managed-secret: sample-value
  annotations:
    example.com/annotation-to-be-passed-to-managed-secret: "sample-value"
spec:
  #if public domain
  hostAPI: https://app.infisical.com/api
  #if internal domain
  #hostAPI: http://<backend-svc-name>.<namespace>.svc.cluster.local:4000/api
  resyncInterval: 10 #sec
  authentication:
    # Make sure to only have 1 authentication method defined, serviceToken/universalAuth.
    # If you have multiple authentication methods defined, it may cause issues.
    universalAuth:
      secretsScope:
        projectSlug: <project-slug>
        envSlug: <env-slug> # "dev", "staging", "prod", etc..
        secretsPath: "<secrets-path>" # Root is "/"
        recursive: true # Fetch all secrets from the specified path and all sub-directories. Default is false.
      
      credentialsRef:
        secretName: infisical-universal-auth-credentials
        secretNamespace: kube-system

      # Service tokens are deprecated and will be removed in the near future. Please use Machine Identities for authenticating with Infisical.
    serviceToken:
      serviceTokenSecretReference:
        secretName: service-token
        secretNamespace: default
      secretsScope:
        envSlug: <env-slug>
        secretsPath: <secrets-path> # Root is "/"
        recursive: true # Fetch all secrets from the specified path and all sub-directories. Default is false.

  managedSecretReference:
    secretName: managed-secret
    secretNamespace: default
    creationPolicy: "Orphan" ## Owner | Orphan (default)
    # secretType: kubernetes.io/dockerconfigjson