Fredric News

Infisical 비밀 관리: Machine Identity 생성 및 K8s 연동

💡 핵심 요약 (Executive Summary)

본 가이드는 infisical 핵심 가이드 및 실전 아키텍처의 핵심 개념, 실전 구성 명령어 및 아키텍처 베스트 프랙티스를 다룹니다. 클라우드 네이티브 및 인프라 엔지니어링 실무에 즉시 활용 가능하도록 체계적으로 정리했습니다.

📑 Table of Contents

API Reference

🔗 https://infisical.com/docs/api-reference/overview/introduction

api-root: /api

계층구조
secret 논리구조
  • Organization → Project(workspace) → Environment → Secret (on Path)
인증구조
  • Universal Auth: Organization → identity → (identity=universalAuth일 경우) Client
  • identity 종류:
  • Universal Auth
  • Kubernetes Auth
  • GCP Auth
  • AWS Auth
  • Azure Auth
Universal auth
POST /v1/auth/universal-auth/login (최초 accessToken 발행)
bash
clientId=63daf67d-d083-411d-810d-778372e90404
clientSecret=a91d12c17c40c28309d00349b63649489e2c124c3c92d08ad7cc9789d0404f32
endpoint=https://vault.fredric.playground.cld
accessToken=$(curl --request POST \
--url ${endpoint}/api/v1/auth/universal-auth/login \
--header 'Content-Type: application/json' \
--data "{
  \"clientId\": \"${clientId}\",
  \"clientSecret\": \"${clientSecret}\"
}" | jq -r '.accessToken')
GET /v1/auth/universal-auth/identities/{identityId} (identity-Universal-auth 조회)
bash
identityId=1ceac786-6125-4af8-b3be-76c222cb22fa
curl --request GET \
  --url ${endpoint}/api/v1/auth/universal-auth/identities/${identityId} \
  --header "Authorization: Bearer ${accessToken}" | jq
Organizations
GET /v2/organizations/{orgId}/memberships (User ↔ Org 멤버쉽 조회)
bash
orgId=fb2f9df8-9e65-4350-9fb2-05b3b517d9e8
curl --request GET \
  --url ${endpoint}/api/v2/organizations/${orgId}/memberships \
  --header "Authorization: Bearer ${accessToken}" | jq
GET /v2/organizations/{orgId}/identity-memberships (identity ↔ org 멤버쉽 조회)
bash
orgId=fb2f9df8-9e65-4350-9fb2-05b3b517d9e8
curl --request GET \
  --url ${endpoint}/api/v2/organizations/${orgId}/identity-memberships \
  --header "Authorization: Bearer ${accessToken}" | jq
GET /v2/organizations/{orgId}/workspaces (get all Projects in Organization)
bash
orgId=fb2f9df8-9e65-4350-9fb2-05b3b517d9e8
curl --request GET \
  --url ${endpoint}/api/v2/organizations/${organizationId}/workspaces \
  --header "Authorization: Bearer ${accessToken}" | jq
Projects
GET /v1/workspace/{projectid} (get Project details, all Envs in Project)
bash
projectid=9ea51bab-cb9c-4dd1-a42f-320f1ef6baf9
curl --request GET \
  --url ${endpoint}/api/v1/workspace/${projectid} \
  --header "Authorization: Bearer ${accessToken}" | jq
ProjectIdentities
GET /v2/workspace/{projectId}/identity-memberships (identity ↔ project 멤버쉽 조회)
bash
projectid=9ea51bab-cb9c-4dd1-a42f-320f1ef6baf9
curl --request GET \
  --url ${endpoint}/api/v2/workspace/${projectid}/identity-memberships \
  --header "Authorization: Bearer ${accessToken}" | jq
Environments
Secrets
GET /v3/secrets/raw (get Secret List in environment)
  • workspace Slug
bash
workspaceSlug=infra-pswh
  environment=dev
  recursive=true
  secretPath=%2Ftest1 #"/" = %2F
  curl --request GET \
    --url "${endpoint}/api/v3/secrets/raw?workspaceSlug=${workspaceSlug}&environment=${environment}&recursive=${recursive}&secretPath=${secretPath}" \
    --header "Authorization: Bearer ${accessToken}" | jq
  • workspace ID
bash
workspaceId=9ea51bab-cb9c-4dd1-a42f-320f1ef6baf9
  environment=dev
  recursive=true
  secretPath=%2Ftest1 #"/" = %2F
  curl --request GET \
    --url "${endpoint}/api/v3/secrets/raw?workspaceId=${workspaceId}&environment=${environment}&recursive=${recursive}&secretPath=${secretPath}" \
    --header "Authorization: Bearer ${accessToken}" | jq
Integrations
GET /v1/workspace/{workspaceId}/authorizations (List Auth)
bash
workspaceId=9ea51bab-cb9c-4dd1-a42f-320f1ef6baf9
curl --request GET \
  --url ${endpoint}/api/v1/workspace/${workspaceId}/authorizations \
  --header "Authorization: Bearer ${accessToken}" | jq
Service Tokens (deprecated)
GET /v2/service-token (get service token)
bash
curl --request GET \
  --url ${endpoint}/api/v2/service-token \
  --header "Authorization: Bearer ${accessToken}" | jq
Audit Logs (need upgrade plan)
GET /v1/workspace/{workspaceId}/audit-logs (Export auditlog)
bash
workspaceId=c9bd15a4-7295-4a4d-89ab-e66d0df63844
curl --request GET \
  --url ${endpoint}/api/v1/workspace/${workspaceId}/audit-logs \
  --header "Authorization: Bearer ${accessToken}" | jq

Features

인증토큰 관리
  1. 머신 Identity 생성

  2. Access Control>Machine Identity 화면에서 Create Identity 버튼 클릭

  3. Name 지정 후 Create

  4. Identity Client 시크릿 생성

  5. 생성한 Identity(Client)의 시크릿 관리팝업 접근 (열쇠모양)

  6. New Client Secret 입력 후 Create

  7. 생성된 Client Secret을 복제 (이후 조회불가)

  8. 프로젝트에 Identity 등록

  9. 프로젝트내에서 Access Control>Machine Identity 화면의 Add Identity 클릭

  10. Identity와 Role을 선택한 후 Create

  11. ClientID / ClientSecret을 kubernetes secret 등록
    (secrets-operator: 에서 사용하기 위함)

bash
clientId=63daf67d-d083-411d-810d-778372e90404
   clientSecret=a91d12c17c40c28309d00349b63649489e2c124c3c92d08ad7cc9789d0404f32
   kubectl create secret generic infisical-universal-auth-credentials --from-literal=clientId="$clientId" --from-literal=clientSecret="$clientSecret" -n kube-system
  1. curl Login (액세스토큰 발행)
bash
clientId=63daf67d-d083-411d-810d-778372e90404
   clientSecret=a91d12c17c40c28309d00349b63649489e2c124c3c92d08ad7cc9789d0404f32
   endpoint=https://vault.fredric.playground.cld
   curl --request POST \
   --url ${endpoint}/api/v1/auth/universal-auth/login \
   --header 'Content-Type: application/json' \
   --data "{
     \"clientId\": \"${clientId}\",
     \"clientSecret\": \"${clientSecret}\"
   }" | jq

Posted:

/

Category:

Author:

fredric

Tags:

, , , , , , , , , , , , , , ,

Comments

Leave a Reply

Your email address will not be published. Required fields are marked *