Infisical Gateway Helm chart

image:
  repository: infisical/cli
  tag: "0.44.6"
  pullPolicy: IfNotPresent

# Machine identity flow: name of the K8s Secret containing env vars like INFISICAL_AUTH_METHOD, etc.
# Only used when gateway.enrollment.method is unset.
secret:
  name: "infisical-gateway-environment"

gateway:
  # Name of the gateway created in the Infisical UI. Required when enrollment.method is set.
  name: ""

  # Infisical instance URL (e.g. https://app.infisical.com). Required when enrollment.method is set.
  domain: ""

  enrollment:
    # Enrollment method: "token", "aws", "gcp", or "kubernetes".
    # Leave empty to use the legacy machine identity flow (env vars from secret.name).
    method: ""

    # Token enrollment settings (method=token)
    token:
      # Inline enrollment token value. Mutually exclusive with existingSecretRef.
      value: ""
      # Name of an existing K8s Secret containing the enrollment token.
      existingSecretRef: ""
      # Key within the secret that holds the enrollment token.
      secretKey: "enrollment-token"

    # AWS enrollment settings (method=aws)
    aws:
      # Required when method=aws. Gateway ID from the Infisical UI.
      gatewayId: ""

    # GCP enrollment settings (method=gcp)
    gcp:
      # Required when method=gcp. Gateway ID from the Infisical UI.
      gatewayId: ""
      # How the gateway proves its GCP identity: "gce" reads an identity token from the instance
      # metadata server, which covers GKE workload identity; "iam" signs a JWT through the IAM
      # Credentials API. Leave empty for the CLI default of "gce".
      type: ""
      # Only for type=iam, and only when the pod has no workload identity to sign with. Path to a
      # service account key file, which you mount with extraVolumes and extraVolumeMounts.
      serviceAccountKeyFilePath: ""

    # Kubernetes enrollment settings (method=kubernetes).
    kubernetes:
      # Required when method=kubernetes. Gateway ID from the Infisical UI.
      gatewayId: ""
      # Path to the projected service account token. Only override for a non-default mount.
      serviceAccountTokenPath: ""
      # Set true only if TokenReview permission comes from somewhere other than this chart: a token
      # reviewer JWT configured on the gateway in Infisical, or a binding you manage yourself.
      # Required to install with serviceAccount.createAsAuthDelegator disabled.
      externalTokenReview: false

    # Name of a K8s Secret whose key-value pairs are injected as env vars.
    # Use this to provide credentials for the enrollment method (e.g. AWS keys, GCP credentials).
    # Not needed when credentials are provided via workload identity (IRSA, GCP Workload Identity, etc.).
    credentialsSecretRef: ""

  # Specific relay to connect to. Leave empty for automatic selection.
  relayName: ""

  # Stable host:port advertised by a gateway accepting direct connections.
  # Requires an image.tag of 0.43.131 or newer; older images reject the flag and the pod
  # crash-loops on startup.
  listenAddress: ""

  pamSessionRecordingsDirectory: /var/lib/infisical/session_recordings

# Persistent storage for the gateway (credentials and session recordings).
# Required when enrollment.method=token so credentials survive pod restarts.
# Optional when enrollment.method is aws, gcp or kubernetes, since all three re-authenticate
# on every start.
# For legacy machine-identity installs (no enrollment.method), persistence only takes effect
# when existingClaim is provided.
persistence:
  enabled: true
  storageClass: ""
  size: 5Gi
  accessModes:
    - ReadWriteOnce
  existingClaim: ""

resources:
  limits:
    cpu: 500m
    memory: 128Mi
  requests:
    cpu: 100m
    memory: 128Mi

imagePullSecrets: []
nameOverride: ""
fullnameOverride: ""

serviceAccount:
  create: true
  automount: true
  createAsAuthDelegator: true
  annotations: {}
  name: ""

podAnnotations: {}
podLabels: {}
podSecurityContext:
  runAsNonRoot: true
  fsGroup: 1000

securityContext:
  runAsNonRoot: true
  runAsUser: 1000

affinity: {}
tolerations: {}
nodeSelector: {}
service:
  type: ClusterIP
  # Port the Service exposes. Empty means the port from gateway.listenAddress, which is the port
  # the platform dials. Only set this to put a different port in front of the gateway.
  port: ""

ingress:
  enabled: false

# Extra environment variables for the gateway container
extraEnv: []
#  - name: LOG_LEVEL
#    value: debug
#  - name: MY_SECRET
#    valueFrom:
#      secretKeyRef:
#        name: my-secret
#        key: my-key

# Load environment variables from Secrets or ConfigMaps
extraEnvFrom: []
#  - secretRef:
#      name: my-secret
#  - configMapRef:
#      name: my-configmap

# Extra arguments appended to the gateway container command
extraArgs: []
#  - --log-level=debug

# Additional volumes to attach to the gateway pod
extraVolumes: []
#  - name: gcp-service-account-key
#    secret:
#      secretName: gcp-service-account-key

# Additional volume mounts for the gateway container
extraVolumeMounts: []
#  - name: gcp-service-account-key
#    mountPath: /var/secrets/gcp
#    readOnly: true

# Extra Kubernetes manifests to deploy with this chart
extraObjects: []