Fredric News

Infisical Secret Mgmt: Machine Identity & K8s

๐Ÿ’ก Infisical Secret Mgmt: Machine Identity & K8s โ€” Executive Summary

Technical architectural analysis, practical configuration manifests, and deployment instructions for Infisical Secret Mgmt: Machine Identity & K8s.

API Reference

๐Ÿ”— https://infisical.com/docs/api-reference/overview/introduction

api-root: /api

Hierarchy
secret logical structure
  • Organization โ†’ Project(workspace) โ†’ Environment โ†’ Secret (on Path)
Authentication structure
  • Universal Auth: Organization โ†’ identity โ†’ (if identity=universalAuth) Client
  • identity type:
  • Universal Auth
  • Kubernetes Auth
  • GCP Auth
  • AWS Auth
  • Azure Auth
Universal auth
POST /v1/auth/universal-auth/login (issue initial accessToken)
bash
clientId=63daf67d-d083-411d-810d-778372e90404
clientSecret=a91d12c17c40c28309d00349b63649489e2c124c3c92d08ad7cc9789d0404f32
endpoint=https://vault.fredric.playground.cld
accessToken=$(curl --request POST \
--url ${endpoint}/api/v1/auth/universal-auth/login \
--header 'Content-Type: application/json' \
--data "{
  \"clientId\": \"${clientId}\",
  \"clientSecret\": \"${clientSecret}\"
}" | jq -r '.accessToken')
GET /v1/auth/universal-auth/identities/{identityId} (identity-Universal-auth lookup)
bash
identityId=1ceac786-6125-4af8-b3be-76c222cb22fa
curl --request GET \
  --url ${endpoint}/api/v1/auth/universal-auth/identities/${identityId} \
  --header "Authorization: Bearer ${accessToken}" | jq
Organizations
GET /v2/organizations/{orgId}/memberships (User โ†” Org membership search)
bash
orgId=fb2f9df8-9e65-4350-9fb2-05b3b517d9e8
curl --request GET \
  --url ${endpoint}/api/v2/organizations/${orgId}/memberships \
  --header "Authorization: Bearer ${accessToken}" | jq
GET /v2/organizations/{orgId}/identity-memberships (identity โ†” org membership search)
bash
orgId=fb2f9df8-9e65-4350-9fb2-05b3b517d9e8
curl --request GET \
  --url ${endpoint}/api/v2/organizations/${orgId}/identity-memberships \
  --header "Authorization: Bearer ${accessToken}" | jq
GET /v2/organizations/{orgId}/workspaces (get all Projects in Organization)
bash
orgId=fb2f9df8-9e65-4350-9fb2-05b3b517d9e8
curl --request GET \
  --url ${endpoint}/api/v2/organizations/${organizationId}/workspaces \
  --header "Authorization: Bearer ${accessToken}" | jq
Projects
GET /v1/workspace/{projectid} (get Project details, all Envs in Project)
bash
projectid=9ea51bab-cb9c-4dd1-a42f-320f1ef6baf9
curl --request GET \
  --url ${endpoint}/api/v1/workspace/${projectid} \
  --header "Authorization: Bearer ${accessToken}" | jq
ProjectIdentities
GET /v2/workspace/{projectId}/identity-memberships (identity โ†” project membership search)
bash
projectid=9ea51bab-cb9c-4dd1-a42f-320f1ef6baf9
curl --request GET \
  --url ${endpoint}/api/v2/workspace/${projectid}/identity-memberships \
  --header "Authorization: Bearer ${accessToken}" | jq
Environments
Secrets
GET /v3/secrets/raw (get Secret List in environment)
  • workspace Slug
bash
workspaceSlug=infra-pswh
  environment=dev
  recursive=true
  secretPath=%2Ftest1 #"/" = %2F
  curl --request GET \
    --url "${endpoint}/api/v3/secrets/raw?workspaceSlug=${workspaceSlug}&environment=${environment}&recursive=${recursive}&secretPath=${secretPath}" \
    --header "Authorization: Bearer ${accessToken}" | jq
  • workspace ID
bash
workspaceId=9ea51bab-cb9c-4dd1-a42f-320f1ef6baf9
  environment=dev
  recursive=true
  secretPath=%2Ftest1 #"/" = %2F
  curl --request GET \
    --url "${endpoint}/api/v3/secrets/raw?workspaceId=${workspaceId}&environment=${environment}&recursive=${recursive}&secretPath=${secretPath}" \
    --header "Authorization: Bearer ${accessToken}" | jq
Integrations
GET /v1/workspace/{workspaceId}/authorizations (List Auth)
bash
workspaceId=9ea51bab-cb9c-4dd1-a42f-320f1ef6baf9
curl --request GET \
  --url ${endpoint}/api/v1/workspace/${workspaceId}/authorizations \
  --header "Authorization: Bearer ${accessToken}" | jq
Service Tokens (deprecated)
GET /v2/service-token (get service token)
bash
curl --request GET \
  --url ${endpoint}/api/v2/service-token \
  --header "Authorization: Bearer ${accessToken}" | jq
Audit Logs (need upgrade plan)
GET /v1/workspace/{workspaceId}/audit-logs (Export auditlog)
bash
workspaceId=c9bd15a4-7295-4a4d-89ab-e66d0df63844
curl --request GET \
  --url ${endpoint}/api/v1/workspace/${workspaceId}/audit-logs \
  --header "Authorization: Bearer ${accessToken}" | jq

Features

Authentication token management
  1. Create machine identity

  2. Click the Create Identity button on the Access Control>Machine Identity screen

  3. After specifying Name, Create

  4. Create Identity Client Secret

  5. Access to the secret management popup of the created Identity (Client) (key shape)

  6. Enter New Client Secret and then Create

  7. Replica created Client Secret (cannot be viewed later)

  8. Register identity to project

  9. Click Add Identity on the Access Control>Machine Identity screen within the project.

  10. Select Identity and Role and then Create

  11. Register ClientID / ClientSecret to kubernetes secret
    (for use in secrets-operator:)

bash
clientId=63daf67d-d083-411d-810d-778372e90404
   clientSecret=a91d12c17c40c28309d00349b63649489e2c124c3c92d08ad7cc9789d0404f32
   kubectl create secret generic infisical-universal-auth-credentials --from-literal=clientId="$clientId" --from-literal=clientSecret="$clientSecret" -n kube-system
  1. curl Login (Access Token Issuance)
bash
clientId=63daf67d-d083-411d-810d-778372e90404
   clientSecret=a91d12c17c40c28309d00349b63649489e2c124c3c92d08ad7cc9789d0404f32
   endpoint=https://vault.fredric.playground.cld
   curl --request POST \
   --url ${endpoint}/api/v1/auth/universal-auth/login \
   --header 'Content-Type: application/json' \
   --data "{
     \"clientId\": \"${clientId}\",
     \"clientSecret\": \"${clientSecret}\"
   }" | jq

Posted:

/

Category:

Author:

fredric

Tags:

, , , , , , , , , , , , , , , ,

Comments

Leave a Reply

Your email address will not be published. Required fields are marked *