Kubernetes Operator

- 1.33
- 1.32
- 1.31
- 1.30
- 1.29

- Amazon Elastic Kubernetes Service (EKS)
- Google Kubernetes Engine (GKE)
- Microsoft Azure Kubernetes Service (AKS)
- Oracle Container Engine for Kubernetes (OKE)
- Red Hat OpenShift

It may work in other Kubernetes distributions, but those are not officially supported. Please report any issues [here](https://github.com/Infisical/infisical/issues).

helm repo add infisical-helm-charts 'https://dl.cloudsmith.io/public/infisical/helm-charts/helm/charts/' 

helm repo update

```bash
helm install --generate-name infisical-helm-charts/secrets-operator
```

- **Enhanced Security**: Limit the operator's permissions to only specific namespaces instead of cluster-wide access
- **Multi-tenant Clusters**: Run separate operator instances for different teams or applications
- **Resource Isolation**: Ensure operators in different namespaces don't interfere with each other
- **Development & Testing**: Run development and production operators side by side in isolated namespaces

<Note>
  For multiple namespace-scoped installations, only the first installation should install CRDs. Subsequent installations should set `installCRDs: false` to avoid conflicts as CRDs are cluster-wide resources.
</Note>

### Single Namespace
```bash
# First namespace installation (with CRDs)
helm install operator-namespaced infisical-helm-charts/secrets-operator \
  --namespace single-namespace \
  --set scopedNamespaces=single-namespace \
  --set scopedRBAC=true
```

<Accordion title="Using values.yaml file">
```yaml values-operator1.yaml
  scopedNamespaces: single-namespace
  scopedRBAC: true
  installCRDs: true
```
</Accordion>


### Multiple Namespaces
```bash
 helm install operator-1 infisical-helm-charts/secrets-operator \
  --namespace ns1 \
  --set scopedNamespaces=ns1 \
  --set scopedRBAC=true \
  --set installCRDs=true # Only install CRDs once in the cluster (default is true)

helm install operator-namespace2 infisical-helm-charts/secrets-operator \
  --namespace ns2 \
  --set scopedNamespaces=ns2 \
  --set scopedRBAC=true \
  --set installCRDs=false # Do not install CRDs in subsequent namespace installations
```

<Accordion title="Using values.yaml file">
```yaml values-operator1.yaml
  scopedNamespaces: ns1
  scopedRBAC: true
  installCRDs: false
```

```yaml values-operator2.yaml
  scopedNamespaces: ns2
  scopedRBAC: true
  installCRDs: false
```
</Accordion>


### Multiple namespaces with one operator installation
```bash
  helm install operator infisical-helm-charts/secrets-operator \
  --namespace operator-namespace \
  --set "scopedNamespaces={ns1,ns2,ns3}" \
  --set scopedRBAC=true
```
<Accordion title="Using values.yaml file">
```yaml values.yaml
  scopedNamespaces:
    - ns1
    - ns2
    - ns3
  scopedRBAC: true
```

</Accordion>

controllerManager:
  serviceAccount:
    create: false
    name: my-service-account
# other values...

telemetry:
  serviceMonitor:
    enabled: true
    # ... other telemetry configuration (optional) ...

telemetry:
  serviceMonitor:
    enabled: true

    selectors: {}
    scheme: https
    port: https
    path: /metrics
    bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
    interval: 30s
    scrapeTimeout: 10s

helm install prometheus prometheus-community/kube-prometheus-stack \
  --namespace monitoring \
  --create-namespace
```

helm install infisical-secrets-operator infisical-helm-charts/secrets-operator \
  --set telemetry.serviceMonitor.enabled=true
```

Check that the ServiceMonitor appears in your operator's namespace.

Open [http://localhost:9090/targets](http://localhost:9090/targets) and verify the operator target shows **UP**.

# Total reconciliations
controller_runtime_reconcile_total

# P99 latency
histogram_quantile(0.99, rate(controller_runtime_reconcile_time_seconds_bucket[5m]))

# Memory usage (MB)
process_resident_memory_bytes / 1024 / 1024

---
spec:
  hostAPI: https://app.infisical.com/api
  tls:
    caRef:
      secretName: custom-ca-certificate
      secretNamespace: default
      key: ca.crt
---

apiVersion: v1
kind: Namespace
metadata:
  name: infisical-operator-system
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: infisical-config
  namespace: infisical-operator-system
data:
  hostAPI: https://example.com/api # <-- global hostAPI
  tls.caRef.secretName: custom-ca-certificate # <-- global TLS CA secret name
  tls.caRef.secretNamespace: default # <-- global TLS CA secret namespace
  tls.caRef.key: ca.crt # <-- global TLS CA secret key

kubectl apply -f infisical-config.yaml

$ kubectl get infisicalSecrets
NAME                     AGE
infisicalsecret-sample   12s

$ kubectl describe infisicalSecret infisicalsecret-sample
...
Spec:
...
Status:
  Conditions:
    Last Transition Time:  2022-12-18T04:29:09Z
    Message:               Infisical controller has located the Infisical token in provided Kubernetes secret
    Reason:                OK
    Status:                True
    Type:                  secrets.infisical.com/LoadedInfisicalToken
    Last Transition Time:  2022-12-18T04:29:10Z
    Message:               Failed to update secret because: 400 Bad Request
    Reason:                Error
    Status:                False
    Type:                  secrets.infisical.com/ReadyToSyncSecrets
Events:                    <none>