759 lines
19 KiB
JSON
759 lines
19 KiB
JSON
{
|
|
"slug": "infisical-helm",
|
|
"kind": "helm",
|
|
"metadata": {
|
|
"name": "Infisical",
|
|
"description": "Helm values and Kubernetes secret manifests for deploying the Infisical standalone chart with external PostgreSQL, Redis, Traefik ingress, and homelab-friendly defaults.",
|
|
"tags": [
|
|
"secrets",
|
|
"kubernetes",
|
|
"helm",
|
|
"postgresql",
|
|
"redis",
|
|
"traefik"
|
|
],
|
|
"icon": {
|
|
"provider": "selfhst",
|
|
"id": "infisical",
|
|
"color": "amber"
|
|
},
|
|
"draft": false,
|
|
"version": {
|
|
"name": "v0.158.0",
|
|
"source_dep_name": "infisical/infisical",
|
|
"source_dep_version": "v0.158.0"
|
|
}
|
|
},
|
|
"variables": [
|
|
{
|
|
"name": "general",
|
|
"title": "General",
|
|
"items": [
|
|
{
|
|
"name": "release_name",
|
|
"type": "str",
|
|
"title": "Release Name",
|
|
"required": true,
|
|
"default": "infisical",
|
|
"description": "Helm release name.",
|
|
"config": {
|
|
"placeholder": "infisical"
|
|
}
|
|
},
|
|
{
|
|
"name": "namespace",
|
|
"type": "str",
|
|
"title": "Namespace",
|
|
"required": true,
|
|
"default": "infisical",
|
|
"description": "Kubernetes namespace for Infisical resources.",
|
|
"config": {
|
|
"placeholder": "infisical"
|
|
}
|
|
},
|
|
{
|
|
"name": "replica_count",
|
|
"type": "int",
|
|
"title": "Replicas",
|
|
"required": true,
|
|
"default": 1,
|
|
"description": "Number of Infisical application replicas. Keep one replica for initial bootstrap, then scale out after testing.",
|
|
"config": {
|
|
"placeholder": "1"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"name": "infisical",
|
|
"title": "Infisical",
|
|
"items": [
|
|
{
|
|
"name": "infisical_site_url",
|
|
"type": "str",
|
|
"title": "Site URL",
|
|
"required": true,
|
|
"default": "https://infisical.home.arpa",
|
|
"config": {
|
|
"placeholder": "https://infisical.home.arpa"
|
|
}
|
|
},
|
|
{
|
|
"name": "infisical_secret_name",
|
|
"type": "str",
|
|
"title": "Kubernetes Secret Name",
|
|
"required": true,
|
|
"default": "infisical-secrets",
|
|
"description": "Kubernetes Secret referenced by infisical.kubeSecretRef.",
|
|
"config": {
|
|
"placeholder": "infisical-secrets"
|
|
}
|
|
},
|
|
{
|
|
"name": "infisical_encryption_key",
|
|
"type": "secret",
|
|
"title": "Encryption Key",
|
|
"required": true,
|
|
"description": "Infisical ENCRYPTION_KEY. Back this up securely; losing it makes stored secrets unrecoverable.",
|
|
"config": {
|
|
"autogenerated": {
|
|
"length": 32,
|
|
"characters": [
|
|
"0",
|
|
"1",
|
|
"2",
|
|
"3",
|
|
"4",
|
|
"5",
|
|
"6",
|
|
"7",
|
|
"8",
|
|
"9",
|
|
"a",
|
|
"b",
|
|
"c",
|
|
"d",
|
|
"e",
|
|
"f"
|
|
]
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"name": "infisical_auth_secret",
|
|
"type": "secret",
|
|
"title": "Auth Secret",
|
|
"required": true,
|
|
"config": {
|
|
"autogenerated": {
|
|
"kind": "base64",
|
|
"bytes": 32
|
|
}
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"name": "networking",
|
|
"title": "Networking",
|
|
"items": [
|
|
{
|
|
"name": "service_type",
|
|
"type": "enum",
|
|
"title": "Service Type",
|
|
"required": true,
|
|
"default": "ClusterIP",
|
|
"description": "Kubernetes Service type for the Infisical application.",
|
|
"config": {
|
|
"options": [
|
|
"ClusterIP",
|
|
"NodePort",
|
|
"LoadBalancer"
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"name": "ingress_enabled",
|
|
"type": "bool",
|
|
"title": "Ingress",
|
|
"required": false,
|
|
"default": true
|
|
},
|
|
{
|
|
"name": "ingress_host",
|
|
"type": "str",
|
|
"title": "Ingress Host",
|
|
"required": true,
|
|
"default": "infisical.home.arpa",
|
|
"description": "FQDN for Infisical ingress.",
|
|
"needs": [
|
|
"ingress_enabled=true"
|
|
],
|
|
"config": {
|
|
"placeholder": "infisical.home.arpa"
|
|
}
|
|
},
|
|
{
|
|
"name": "ingress_class_name",
|
|
"type": "str",
|
|
"title": "Ingress Class",
|
|
"required": true,
|
|
"default": "traefik",
|
|
"description": "Ingress class name.",
|
|
"needs": [
|
|
"ingress_enabled=true"
|
|
],
|
|
"config": {
|
|
"placeholder": "traefik"
|
|
}
|
|
},
|
|
{
|
|
"name": "ingress_nginx_enabled",
|
|
"type": "bool",
|
|
"title": "Bundled NGINX Ingress",
|
|
"required": false,
|
|
"default": false,
|
|
"description": "Enable the chart's bundled ingress-nginx controller. Disable this when using an existing Traefik ingress controller.",
|
|
"needs": [
|
|
"ingress_enabled=true"
|
|
]
|
|
},
|
|
{
|
|
"name": "traefik_entrypoint",
|
|
"type": "str",
|
|
"title": "Traefik Entrypoint",
|
|
"required": false,
|
|
"default": "websecure",
|
|
"description": "Traefik router entrypoint annotation. Leave empty for non-Traefik ingress controllers.",
|
|
"needs": [
|
|
"ingress_enabled=true"
|
|
],
|
|
"config": {
|
|
"placeholder": "websecure"
|
|
}
|
|
},
|
|
{
|
|
"name": "ingress_tls_enabled",
|
|
"type": "bool",
|
|
"title": "TLS",
|
|
"required": false,
|
|
"default": true,
|
|
"needs": [
|
|
"ingress_enabled=true"
|
|
]
|
|
},
|
|
{
|
|
"name": "ingress_tls_secret",
|
|
"type": "str",
|
|
"title": "TLS Secret",
|
|
"required": true,
|
|
"default": "infisical-tls",
|
|
"description": "Kubernetes TLS secret name.",
|
|
"needs": [
|
|
"ingress_enabled=true",
|
|
"ingress_tls_enabled=true"
|
|
],
|
|
"config": {
|
|
"placeholder": "infisical-tls"
|
|
}
|
|
},
|
|
{
|
|
"name": "ingress_certmanager_enabled",
|
|
"type": "bool",
|
|
"title": "Cert Manager Annotation",
|
|
"required": false,
|
|
"default": false,
|
|
"description": "Add cert-manager cluster issuer annotation to the Ingress.",
|
|
"needs": [
|
|
"ingress_enabled=true",
|
|
"ingress_tls_enabled=true"
|
|
]
|
|
},
|
|
{
|
|
"name": "certmanager_issuer",
|
|
"type": "str",
|
|
"title": "ClusterIssuer",
|
|
"required": true,
|
|
"default": "letsencrypt-prod",
|
|
"description": "cert-manager ClusterIssuer name.",
|
|
"needs": [
|
|
"ingress_enabled=true",
|
|
"ingress_tls_enabled=true",
|
|
"ingress_certmanager_enabled=true"
|
|
],
|
|
"config": {
|
|
"placeholder": "letsencrypt-prod"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"name": "database",
|
|
"title": "PostgreSQL",
|
|
"items": [
|
|
{
|
|
"name": "database_external",
|
|
"type": "bool",
|
|
"title": "External PostgreSQL",
|
|
"required": false,
|
|
"default": true
|
|
},
|
|
{
|
|
"name": "database_secret_name",
|
|
"type": "str",
|
|
"title": "DB Secret Name",
|
|
"required": true,
|
|
"default": "infisical-postgres",
|
|
"description": "Kubernetes Secret containing DB_CONNECTION_URI for external PostgreSQL.",
|
|
"needs": [
|
|
"database_external=true"
|
|
],
|
|
"config": {
|
|
"placeholder": "infisical-postgres"
|
|
}
|
|
},
|
|
{
|
|
"name": "database_connection_uri",
|
|
"type": "secret",
|
|
"title": "DB Connection URI",
|
|
"required": true,
|
|
"default": "postgresql://infisical:CHANGE_ME@postgres.example.internal:5432/infisical?sslmode=disable",
|
|
"description": "Full PostgreSQL connection URI for external databases. URL-encode special characters in usernames/passwords.",
|
|
"needs": [
|
|
"database_external=true"
|
|
],
|
|
"config": {
|
|
"placeholder": "postgresql://infisical:password@postgres.example.internal:5432/infisical?sslmode=disable"
|
|
}
|
|
},
|
|
{
|
|
"name": "database_user",
|
|
"type": "str",
|
|
"title": "Database User",
|
|
"required": true,
|
|
"default": "infisical",
|
|
"needs": [
|
|
"database_external=false"
|
|
],
|
|
"config": {
|
|
"placeholder": "infisical"
|
|
}
|
|
},
|
|
{
|
|
"name": "database_name",
|
|
"type": "str",
|
|
"title": "Database Name",
|
|
"required": true,
|
|
"default": "infisical",
|
|
"needs": [
|
|
"database_external=false"
|
|
],
|
|
"config": {
|
|
"placeholder": "infisical"
|
|
}
|
|
},
|
|
{
|
|
"name": "database_password",
|
|
"type": "secret",
|
|
"title": "Database Password",
|
|
"required": true,
|
|
"description": "PostgreSQL password for the bundled database, written to helm-secrets.yaml.",
|
|
"needs": [
|
|
"database_external=false"
|
|
],
|
|
"config": {
|
|
"autogenerated": {
|
|
"length": 32,
|
|
"characters": [
|
|
"a",
|
|
"b",
|
|
"c",
|
|
"d",
|
|
"e",
|
|
"f",
|
|
"g",
|
|
"h",
|
|
"i",
|
|
"j",
|
|
"k",
|
|
"l",
|
|
"m",
|
|
"n",
|
|
"o",
|
|
"p",
|
|
"q",
|
|
"r",
|
|
"s",
|
|
"t",
|
|
"u",
|
|
"v",
|
|
"w",
|
|
"x",
|
|
"y",
|
|
"z",
|
|
"A",
|
|
"B",
|
|
"C",
|
|
"D",
|
|
"E",
|
|
"F",
|
|
"G",
|
|
"H",
|
|
"I",
|
|
"J",
|
|
"K",
|
|
"L",
|
|
"M",
|
|
"N",
|
|
"O",
|
|
"P",
|
|
"Q",
|
|
"R",
|
|
"S",
|
|
"T",
|
|
"U",
|
|
"V",
|
|
"W",
|
|
"X",
|
|
"Y",
|
|
"Z",
|
|
"0",
|
|
"1",
|
|
"2",
|
|
"3",
|
|
"4",
|
|
"5",
|
|
"6",
|
|
"7",
|
|
"8",
|
|
"9"
|
|
]
|
|
}
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"name": "redis",
|
|
"title": "Redis",
|
|
"items": [
|
|
{
|
|
"name": "redis_external",
|
|
"type": "bool",
|
|
"title": "External Redis",
|
|
"required": false,
|
|
"default": false
|
|
},
|
|
{
|
|
"name": "redis_url",
|
|
"type": "secret",
|
|
"title": "Redis URL",
|
|
"required": true,
|
|
"default": "redis://:CHANGE_ME@redis.example.internal:6379",
|
|
"description": "Full Redis URL for external Redis.",
|
|
"needs": [
|
|
"redis_external=true"
|
|
],
|
|
"config": {
|
|
"placeholder": "redis://:password@redis.example.internal:6379"
|
|
}
|
|
},
|
|
{
|
|
"name": "redis_password",
|
|
"type": "secret",
|
|
"title": "Redis Password",
|
|
"required": true,
|
|
"description": "Redis password for the bundled Redis chart, written to helm-secrets.yaml.",
|
|
"needs": [
|
|
"redis_external=false"
|
|
],
|
|
"config": {
|
|
"autogenerated": {
|
|
"length": 32,
|
|
"characters": [
|
|
"a",
|
|
"b",
|
|
"c",
|
|
"d",
|
|
"e",
|
|
"f",
|
|
"g",
|
|
"h",
|
|
"i",
|
|
"j",
|
|
"k",
|
|
"l",
|
|
"m",
|
|
"n",
|
|
"o",
|
|
"p",
|
|
"q",
|
|
"r",
|
|
"s",
|
|
"t",
|
|
"u",
|
|
"v",
|
|
"w",
|
|
"x",
|
|
"y",
|
|
"z",
|
|
"A",
|
|
"B",
|
|
"C",
|
|
"D",
|
|
"E",
|
|
"F",
|
|
"G",
|
|
"H",
|
|
"I",
|
|
"J",
|
|
"K",
|
|
"L",
|
|
"M",
|
|
"N",
|
|
"O",
|
|
"P",
|
|
"Q",
|
|
"R",
|
|
"S",
|
|
"T",
|
|
"U",
|
|
"V",
|
|
"W",
|
|
"X",
|
|
"Y",
|
|
"Z",
|
|
"0",
|
|
"1",
|
|
"2",
|
|
"3",
|
|
"4",
|
|
"5",
|
|
"6",
|
|
"7",
|
|
"8",
|
|
"9"
|
|
]
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"name": "redis_persistence_enabled",
|
|
"type": "bool",
|
|
"title": "Redis Persistence",
|
|
"required": false,
|
|
"default": true,
|
|
"needs": [
|
|
"redis_external=false"
|
|
]
|
|
},
|
|
{
|
|
"name": "redis_storage_class",
|
|
"type": "str",
|
|
"title": "Redis StorageClass",
|
|
"required": false,
|
|
"default": "ceph-rbd",
|
|
"description": "StorageClass for the bundled Redis PVC.",
|
|
"needs": [
|
|
"redis_external=false",
|
|
"redis_persistence_enabled=true"
|
|
],
|
|
"config": {
|
|
"placeholder": "ceph-rbd"
|
|
}
|
|
},
|
|
{
|
|
"name": "redis_storage_size",
|
|
"type": "str",
|
|
"title": "Redis Storage Size",
|
|
"required": false,
|
|
"default": "2Gi",
|
|
"description": "PVC size for the bundled Redis chart.",
|
|
"needs": [
|
|
"redis_external=false",
|
|
"redis_persistence_enabled=true"
|
|
],
|
|
"config": {
|
|
"placeholder": "2Gi"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"name": "resources",
|
|
"title": "Resources",
|
|
"items": [
|
|
{
|
|
"name": "resources_cpu_request",
|
|
"type": "str",
|
|
"title": "CPU Request",
|
|
"required": false,
|
|
"default": "250m",
|
|
"config": {
|
|
"placeholder": "250m"
|
|
}
|
|
},
|
|
{
|
|
"name": "resources_memory_request",
|
|
"type": "str",
|
|
"title": "Memory Request",
|
|
"required": false,
|
|
"default": "512Mi",
|
|
"config": {
|
|
"placeholder": "512Mi"
|
|
}
|
|
},
|
|
{
|
|
"name": "resources_memory_limit",
|
|
"type": "str",
|
|
"title": "Memory Limit",
|
|
"required": false,
|
|
"default": "1000Mi",
|
|
"config": {
|
|
"placeholder": "1000Mi"
|
|
}
|
|
},
|
|
{
|
|
"name": "redis_cpu_request",
|
|
"type": "str",
|
|
"title": "Redis CPU Request",
|
|
"required": false,
|
|
"default": "50m",
|
|
"needs": [
|
|
"redis_external=false"
|
|
],
|
|
"config": {
|
|
"placeholder": "50m"
|
|
}
|
|
},
|
|
{
|
|
"name": "redis_memory_request",
|
|
"type": "str",
|
|
"title": "Redis Memory Request",
|
|
"required": false,
|
|
"default": "128Mi",
|
|
"needs": [
|
|
"redis_external=false"
|
|
],
|
|
"config": {
|
|
"placeholder": "128Mi"
|
|
}
|
|
},
|
|
{
|
|
"name": "redis_memory_limit",
|
|
"type": "str",
|
|
"title": "Redis Memory Limit",
|
|
"required": false,
|
|
"default": "256Mi",
|
|
"needs": [
|
|
"redis_external=false"
|
|
],
|
|
"config": {
|
|
"placeholder": "256Mi"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"name": "email",
|
|
"title": "Email",
|
|
"toggle": "email_enabled",
|
|
"items": [
|
|
{
|
|
"name": "email_enabled",
|
|
"type": "bool",
|
|
"title": "SMTP Email",
|
|
"required": false,
|
|
"default": false,
|
|
"description": "Add SMTP keys to the Infisical Kubernetes Secret."
|
|
},
|
|
{
|
|
"name": "email_host",
|
|
"type": "str",
|
|
"title": "SMTP Host",
|
|
"required": true,
|
|
"default": "smtp.home.arpa",
|
|
"needs": [
|
|
"email_enabled=true"
|
|
],
|
|
"config": {
|
|
"placeholder": "smtp.home.arpa"
|
|
}
|
|
},
|
|
{
|
|
"name": "email_port",
|
|
"type": "int",
|
|
"title": "SMTP Port",
|
|
"required": true,
|
|
"default": 587,
|
|
"needs": [
|
|
"email_enabled=true"
|
|
],
|
|
"config": {
|
|
"placeholder": "587"
|
|
}
|
|
},
|
|
{
|
|
"name": "email_from_address",
|
|
"type": "str",
|
|
"title": "From Address",
|
|
"required": true,
|
|
"default": "infisical@home.arpa",
|
|
"needs": [
|
|
"email_enabled=true"
|
|
],
|
|
"config": {
|
|
"placeholder": "infisical@home.arpa"
|
|
}
|
|
},
|
|
{
|
|
"name": "email_from_name",
|
|
"type": "str",
|
|
"title": "From Name",
|
|
"required": false,
|
|
"default": "Infisical",
|
|
"needs": [
|
|
"email_enabled=true"
|
|
],
|
|
"config": {
|
|
"placeholder": "Infisical"
|
|
}
|
|
},
|
|
{
|
|
"name": "email_username",
|
|
"type": "str",
|
|
"title": "SMTP Username",
|
|
"required": true,
|
|
"default": "",
|
|
"needs": [
|
|
"email_enabled=true"
|
|
],
|
|
"config": {
|
|
"placeholder": "user@example.com"
|
|
}
|
|
},
|
|
{
|
|
"name": "email_password",
|
|
"type": "secret",
|
|
"title": "SMTP Password",
|
|
"required": false,
|
|
"default": "",
|
|
"needs": [
|
|
"email_enabled=true"
|
|
]
|
|
},
|
|
{
|
|
"name": "email_secure",
|
|
"type": "bool",
|
|
"title": "SMTP Secure",
|
|
"required": false,
|
|
"default": false,
|
|
"needs": [
|
|
"email_enabled=true"
|
|
]
|
|
},
|
|
{
|
|
"name": "email_require_tls",
|
|
"type": "bool",
|
|
"title": "Require TLS",
|
|
"required": false,
|
|
"default": true,
|
|
"needs": [
|
|
"email_enabled=true"
|
|
]
|
|
},
|
|
{
|
|
"name": "email_ignore_tls",
|
|
"type": "bool",
|
|
"title": "Ignore TLS",
|
|
"required": false,
|
|
"default": false,
|
|
"needs": [
|
|
"email_enabled=true"
|
|
]
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|