-
Notifications
You must be signed in to change notification settings - Fork 1k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #2700 from Infisical/infisical-helm-auto-create-sa
Add support for auto creating SA for job and deployment
- Loading branch information
Showing
8 changed files
with
196 additions
and
25 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,66 @@ | ||
| # infisical-standalone | ||
|
|
||
|    | ||
|
|
||
| A helm chart to deploy Infisical | ||
|
|
||
| ## Requirements | ||
|
|
||
| | Repository | Name | Version | | ||
| |------------|------|---------| | ||
| | https://charts.bitnami.com/bitnami | postgresql | 14.1.3 | | ||
| | https://charts.bitnami.com/bitnami | redis | 18.14.0 | | ||
| | https://kubernetes.github.io/ingress-nginx | ingress-nginx | 4.0.13 | | ||
|
|
||
| ## Values | ||
|
|
||
| | Key | Type | Default | Description | | ||
| |-----|------|---------|-------------| | ||
| | fullnameOverride | string | `""` | Overrides the full name of the release, affecting resource names | | ||
| | infisical.affinity | object | `{}` | Node affinity settings for pod placement | | ||
| | infisical.autoDatabaseSchemaMigration | bool | `true` | Automatically migrates new database schema when deploying | | ||
| | infisical.databaseSchemaMigrationJob.image.pullPolicy | string | `"IfNotPresent"` | Pulls image only if not present on the node | | ||
| | infisical.databaseSchemaMigrationJob.image.repository | string | `"ghcr.io/groundnuty/k8s-wait-for"` | Image repository for migration wait job | | ||
| | infisical.databaseSchemaMigrationJob.image.tag | string | `"no-root-v2.0"` | Image tag version | | ||
| | infisical.deploymentAnnotations | object | `{}` | Custom annotations for Infisical deployment | | ||
| | infisical.enabled | bool | `true` | | | ||
| | infisical.fullnameOverride | string | `""` | Override for the full name of Infisical resources in this deployment | | ||
| | infisical.image.imagePullSecrets | list | `[]` | Secret references for pulling the image, if needed | | ||
| | infisical.image.pullPolicy | string | `"IfNotPresent"` | Pulls image only if not already present on the node | | ||
| | infisical.image.repository | string | `"infisical/infisical"` | Image repository for the Infisical service | | ||
| | infisical.image.tag | string | `"v0.93.1-postgres"` | Specific version tag of the Infisical image. View the latest version here https://hub.docker.com/r/infisical/infisical | | ||
| | infisical.kubeSecretRef | string | `"infisical-secrets"` | Kubernetes Secret reference containing Infisical root credentials | | ||
| | infisical.name | string | `"infisical"` | | | ||
| | infisical.podAnnotations | object | `{}` | Custom annotations for Infisical pods | | ||
| | infisical.replicaCount | int | `2` | Number of pod replicas for high availability | | ||
| | infisical.resources.limits.memory | string | `"600Mi"` | Memory limit for Infisical container | | ||
| | infisical.resources.requests.cpu | string | `"350m"` | CPU request for Infisical container | | ||
| | infisical.service.annotations | object | `{}` | Custom annotations for Infisical service | | ||
| | infisical.service.nodePort | string | `""` | Optional node port for service when using NodePort type | | ||
| | infisical.service.type | string | `"ClusterIP"` | Service type, can be changed based on exposure needs (e.g., LoadBalancer) | | ||
| | infisical.serviceAccount.annotations | object | `{}` | Custom annotations for the auto-created service account | | ||
| | infisical.serviceAccount.create | bool | `true` | Creates a new service account if true, with necessary permissions for this chart | | ||
| | infisical.serviceAccount.name | string | `nil` | Optional custom service account name, if existing service account is used | | ||
| | ingress.annotations | object | `{}` | Custom annotations for ingress resource | | ||
| | ingress.enabled | bool | `true` | Enable or disable ingress configuration | | ||
| | ingress.hostName | string | `""` | Hostname for ingress access, e.g., app.example.com | | ||
| | ingress.ingressClassName | string | `"nginx"` | Specifies the ingress class, useful for multi-ingress setups | | ||
| | ingress.nginx.enabled | bool | `true` | Enable NGINX-specific settings, if using NGINX ingress controller | | ||
| | ingress.tls | list | `[]` | TLS settings for HTTPS access | | ||
| | nameOverride | string | `""` | Overrides the default release name | | ||
| | postgresql.auth.database | string | `"infisicalDB"` | Database name for Infisical | | ||
| | postgresql.auth.password | string | `"root"` | Password for PostgreSQL database access | | ||
| | postgresql.auth.username | string | `"infisical"` | Database username for PostgreSQL | | ||
| | postgresql.enabled | bool | `true` | Enables an in-cluster PostgreSQL deployment. To achieve HA for Postgres, we recommend deploying https://github.com/zalando/postgres-operator instead. | | ||
| | postgresql.fullnameOverride | string | `"postgresql"` | Full name override for PostgreSQL resources | | ||
| | postgresql.name | string | `"postgresql"` | PostgreSQL resource name | | ||
| | postgresql.useExistingPostgresSecret.enabled | bool | `false` | Set to true if using an existing Kubernetes secret that contains PostgreSQL connection string | | ||
| | postgresql.useExistingPostgresSecret.existingConnectionStringSecret.key | string | `""` | Key name in the Kubernetes secret that holds the connection string | | ||
| | postgresql.useExistingPostgresSecret.existingConnectionStringSecret.name | string | `""` | Kubernetes secret name containing the PostgreSQL connection string | | ||
| | redis.architecture | string | `"standalone"` | Redis deployment type (e.g., standalone or cluster) | | ||
| | redis.auth.password | string | `"mysecretpassword"` | Redis password | | ||
| | redis.cluster.enabled | bool | `false` | Clustered Redis deployment | | ||
| | redis.enabled | bool | `true` | Enables an in-cluster Redis deployment | | ||
| | redis.fullnameOverride | string | `"redis"` | Full name override for Redis resources | | ||
| | redis.name | string | `"redis"` | Redis resource name | | ||
| | redis.usePassword | bool | `true` | Requires a password for Redis authentication | |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,81 +1,139 @@ | ||
| # -- Overrides the default release name | ||
| nameOverride: "" | ||
|
|
||
| # -- Overrides the full name of the release, affecting resource names | ||
| fullnameOverride: "" | ||
|
|
||
| infisical: | ||
| enabled: true | ||
| name: infisical | ||
| enabled: true # -- Enable Infisical chart deployment | ||
| name: infisical # -- Sets the name of the deployment within this chart | ||
|
|
||
| # -- Automatically migrates new database schema when deploying | ||
| autoDatabaseSchemaMigration: true | ||
| databaseSchemaMigrationInitContainer: | ||
| image: "ghcr.io/groundnuty/k8s-wait-for:no-root-v2.0" | ||
| imagePullPolicy: IfNotPresent | ||
|
|
||
| databaseSchemaMigrationJob: | ||
| serviceAccountName: default | ||
|
|
||
| image: | ||
| # -- Image repository for migration wait job | ||
| repository: ghcr.io/groundnuty/k8s-wait-for | ||
| # -- Image tag version | ||
| tag: no-root-v2.0 | ||
| # -- Pulls image only if not present on the node | ||
| pullPolicy: IfNotPresent | ||
|
|
||
| serviceAccount: | ||
| # -- Creates a new service account if true, with necessary permissions for this chart | ||
| create: true | ||
| # -- Custom annotations for the auto-created service account | ||
| annotations: {} | ||
| # -- Optional custom service account name, if existing service account is used | ||
| name: null | ||
|
|
||
| # -- Override for the full name of Infisical resources in this deployment | ||
| fullnameOverride: "" | ||
| # -- Custom annotations for Infisical pods | ||
| podAnnotations: {} | ||
| # -- Custom annotations for Infisical deployment | ||
| deploymentAnnotations: {} | ||
| # -- Number of pod replicas for high availability | ||
| replicaCount: 2 | ||
|
|
||
| image: | ||
| # -- Image repository for the Infisical service | ||
| repository: infisical/infisical | ||
| tag: "v0.46.3-postgres" | ||
| # -- Specific version tag of the Infisical image. View the latest version here https://hub.docker.com/r/infisical/infisical | ||
| tag: "v0.93.1-postgres" | ||
| # -- Pulls image only if not already present on the node | ||
| pullPolicy: IfNotPresent | ||
| # -- Secret references for pulling the image, if needed | ||
| imagePullSecrets: [] | ||
|
|
||
| # -- Node affinity settings for pod placement | ||
| affinity: {} | ||
| # -- Kubernetes Secret reference containing Infisical root credentials | ||
| kubeSecretRef: "infisical-secrets" | ||
|
|
||
| service: | ||
| # -- Custom annotations for Infisical service | ||
| annotations: {} | ||
| # -- Service type, can be changed based on exposure needs (e.g., LoadBalancer) | ||
| type: ClusterIP | ||
| # -- Optional node port for service when using NodePort type | ||
| nodePort: "" | ||
|
|
||
| resources: | ||
| limits: | ||
| # -- Memory limit for Infisical container | ||
| memory: 600Mi | ||
| requests: | ||
| # -- CPU request for Infisical container | ||
| cpu: 350m | ||
|
|
||
| ingress: | ||
| # -- Enable or disable ingress configuration | ||
| enabled: true | ||
| # -- Hostname for ingress access, e.g., app.example.com | ||
| hostName: "" | ||
| # -- Specifies the ingress class, useful for multi-ingress setups | ||
| ingressClassName: nginx | ||
|
|
||
| nginx: | ||
| # -- Enable NGINX-specific settings, if using NGINX ingress controller | ||
| enabled: true | ||
|
|
||
| # -- Custom annotations for ingress resource | ||
| annotations: {} | ||
| # -- TLS settings for HTTPS access | ||
| tls: | ||
| [] | ||
| # -- TLS secret name for HTTPS | ||
| # - secretName: letsencrypt-prod | ||
| # -- Domain name to associate with the TLS certificate | ||
| # hosts: | ||
| # - some.domain.com | ||
|
|
||
| postgresql: | ||
| # -- When enabled, this will start up a in cluster Postgres | ||
| # -- Enables an in-cluster PostgreSQL deployment. To achieve HA for Postgres, we recommend deploying https://github.com/zalando/postgres-operator instead. | ||
| enabled: true | ||
| # -- PostgreSQL resource name | ||
| name: "postgresql" | ||
| # -- Full name override for PostgreSQL resources | ||
| fullnameOverride: "postgresql" | ||
|
|
||
| auth: | ||
| # -- Database username for PostgreSQL | ||
| username: infisical | ||
| # -- Password for PostgreSQL database access | ||
| password: root | ||
| # -- Database name for Infisical | ||
| database: infisicalDB | ||
|
|
||
| useExistingPostgresSecret: | ||
| # -- When this is enabled, postgresql.enabled needs to be false | ||
| # -- Set to true if using an existing Kubernetes secret that contains PostgreSQL connection string | ||
| enabled: false | ||
| # -- The name from where to get the existing postgresql connection string | ||
| existingConnectionStringSecret: | ||
| # -- The name of the secret that contains the postgres connection string | ||
| # -- Kubernetes secret name containing the PostgreSQL connection string | ||
| name: "" | ||
| # -- Secret key name that contains the postgres connection string | ||
| # -- Key name in the Kubernetes secret that holds the connection string | ||
| key: "" | ||
|
|
||
| redis: | ||
| # -- Enables an in-cluster Redis deployment | ||
| enabled: true | ||
| # -- Redis resource name | ||
| name: "redis" | ||
| # -- Full name override for Redis resources | ||
| fullnameOverride: "redis" | ||
|
|
||
| cluster: | ||
| # -- Clustered Redis deployment | ||
| enabled: false | ||
|
|
||
| # -- Requires a password for Redis authentication | ||
| usePassword: true | ||
|
|
||
| auth: | ||
| # -- Redis password | ||
| password: "mysecretpassword" | ||
|
|
||
| # -- Redis deployment type (e.g., standalone or cluster) | ||
| architecture: standalone |