migrate

2026-07-20 09:23:17 -04:00
parent c1315882da
commit 72272e4006
3179 changed files with 562960 additions and 14 deletions
@@ -0,0 +1,12 @@
+---
+# Sensitive Helm values. Store this file securely and do not commit rendered real secrets.
+<%- if not database_external %>
+postgresql:
+  auth:
+    password: "<< database_password >>"
+<%- endif %>
+<%- if not redis_external %>
+redis:
+  auth:
+    password: "<< redis_password >>"
+<%- endif %>
@@ -0,0 +1,8 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: << namespace >>
+  labels:
+    app.kubernetes.io/name: infisical
+    app.kubernetes.io/instance: << release_name >>
@@ -0,0 +1,16 @@
+<%- if database_external %>
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: << database_secret_name >>
+  namespace: << namespace >>
+  labels:
+    app.kubernetes.io/name: infisical
+    app.kubernetes.io/instance: << release_name >>
+type: Opaque
+stringData:
+  DB_CONNECTION_URI: "<< database_connection_uri >>"
+<%- else %>
+# External PostgreSQL is disabled; the chart-managed PostgreSQL credentials are in helm-secrets.yaml.
+<%- endif %>
@@ -0,0 +1,29 @@
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: << infisical_secret_name >>
+  namespace: << namespace >>
+  labels:
+    app.kubernetes.io/name: infisical
+    app.kubernetes.io/instance: << release_name >>
+type: Opaque
+stringData:
+  AUTH_SECRET: "<< infisical_auth_secret >>"
+  ENCRYPTION_KEY: "<< infisical_encryption_key >>"
+  SITE_URL: "<< infisical_site_url >>"
+  <%- if redis_external %>
+  REDIS_URL: "<< redis_url >>"
+  <%- endif %>
+  <%- if email_enabled %>
+  SMTP_HOST: "<< email_host >>"
+  SMTP_PORT: "<< email_port >>"
+  SMTP_FROM_ADDRESS: "<< email_from_address >>"
+  SMTP_FROM_NAME: "<< email_from_name >>"
+  SMTP_USERNAME: "<< email_username >>"
+  SMTP_PASSWORD: "<< email_password >>"
+  SMTP_SECURE: "<< email_secure | lower >>"
+  SMTP_REQUIRE_TLS: "<< email_require_tls | lower >>"
+  SMTP_IGNORE_TLS: "<< email_ignore_tls | lower >>"
+  <%- endif %>
+
@@ -0,0 +1,110 @@
+---
+# Infisical standalone Helm chart values.
+# Chart repo: https://dl.cloudsmith.io/public/infisical/helm-charts/helm/charts/
+# Install example:
+# helm upgrade --install << release_name >> infisical-helm-charts/infisical-standalone \
+#   --version 1.9.0 \
+#   --namespace << namespace >> \
+#   --values values.yaml \
+#   --values helm-secrets.yaml
+
+infisical:
+  enabled: true
+  name: << release_name >>
+  replicaCount: << replica_count >>
+
+  image:
+    repository: infisical/infisical
+    tag: "v0.158.0"
+    pullPolicy: IfNotPresent
+
+  # This Kubernetes Secret must contain AUTH_SECRET, ENCRYPTION_KEY, SITE_URL,
+  # and optional SMTP/REDIS_URL keys. See secret.yaml.
+  kubeSecretRef: << infisical_secret_name >>
+
+  service:
+    type: << service_type >>
+
+  autoBootstrap:
+    enabled: false
+
+  serviceAccount:
+    create: true
+
+  resources:
+    requests:
+      cpu: << resources_cpu_request >>
+      memory: << resources_memory_request >>
+    limits:
+      memory: << resources_memory_limit >>
+
+<%- if ingress_enabled %>
+ingress:
+  enabled: true
+  hostName: << ingress_host >>
+  ingressClassName: << ingress_class_name >>
+  nginx:
+    enabled: << ingress_nginx_enabled | lower >>
+  annotations:
+    <%- if traefik_entrypoint %>
+    traefik.ingress.kubernetes.io/router.entrypoints: << traefik_entrypoint >>
+    <%- endif %>
+    <%- if ingress_tls_enabled %>
+    traefik.ingress.kubernetes.io/router.tls: "true"
+    <%- endif %>
+    <%- if ingress_certmanager_enabled %>
+    cert-manager.io/cluster-issuer: << certmanager_issuer >>
+    <%- endif %>
+  <%- if ingress_tls_enabled %>
+  tls:
+    - secretName: << ingress_tls_secret >>
+      hosts:
+        - << ingress_host >>
+  <%- endif %>
+<%- else %>
+ingress:
+  enabled: false
+<%- endif %>
+
+ingress-nginx:
+  enabled: << ingress_nginx_enabled | lower >>
+
+postgresql:
+<%- if database_external %>
+  enabled: false
+  useExistingPostgresSecret:
+    enabled: true
+    existingConnectionStringSecret:
+      name: << database_secret_name >>
+      key: DB_CONNECTION_URI
+<%- else %>
+  enabled: true
+  auth:
+    username: << database_user >>
+    database: << database_name >>
+<%- endif %>
+
+redis:
+<%- if redis_external %>
+  enabled: false
+<%- else %>
+  enabled: true
+  architecture: standalone
+  usePassword: true
+  auth:
+    # Override the real password from helm-secrets.yaml.
+    password: "REPLACE_FROM_HELM_SECRETS_FILE"
+  master:
+    persistence:
+      enabled: << redis_persistence_enabled | lower >>
+      <%- if redis_persistence_enabled %>
+      storageClass: << redis_storage_class >>
+      size: << redis_storage_size >>
+      <%- endif %>
+    resources:
+      requests:
+        cpu: << redis_cpu_request >>
+        memory: << redis_memory_request >>
+      limits:
+        memory: << redis_memory_limit >>
+<%- endif %>