Gateway deployment

| Protocol | Destination                          | Port | Purpose                                    |
| -------- | ------------------------------------ | ---- | ------------------------------------------ |
| TCP      | Relay Server IP/Hostname             | 2222 | SSH reverse tunnel establishment           |
| TCP      | Infisical instance host (US/EU, other)  | 443  | API communication and certificate requests |

For managed relays, allow outbound traffic to the provided relay server IP/hostname. For self-hosted relays, allow outbound traffic to your own relay server address.

If you are in a corporate environment with strict egress filtering, ensure outbound TCP 2222 to relay servers and outbound HTTPS 443 to Infisical API endpoints are allowed.

<Tip>
  For the full connection model, a complete port reference, and firewall details (including self-hosted relays and HTTP forward proxies), see the [Network Architecture](/documentation/platform/gateways/network-architecture) page.
</Tip>

<AccordionGroup>
  <Accordion title="Token Auth">
    A one-time enrollment token (1h expiry) bootstraps the gateway.

    <Tabs>
      <Tab title="Linux (Production)">
        ```bash
        sudo infisical gateway systemd install <gateway-name> \
          --enroll-method=token \
          --token=<enrollment-token> \
          --domain=<your-infisical-domain>
        sudo systemctl start <gateway-name>
        ```
      </Tab>
      <Tab title="Foreground">
        ```bash
        infisical gateway start <gateway-name> \
          --enroll-method=token \
          --token=<enrollment-token> \
          --domain=<your-infisical-domain>
        ```
      </Tab>
      <Tab title="Kubernetes (Helm)">
        Install the Infisical Helm chart repository:
        ```bash
        helm repo add infisical https://dl.cloudsmith.io/public/infisical/helm-charts/helm/charts/
        helm repo update
        ```

        Create a Kubernetes Secret with your enrollment token:
        ```bash
        kubectl create secret generic gateway-enrollment-token \
          --from-literal=enrollment-token=<enrollment-token>
        ```

        Install the gateway:
        ```bash
        helm install infisical-gateway infisical/infisical-gateway \
          --set gateway.name=<gateway-name> \
          --set gateway.enrollment.method=token \
          --set gateway.enrollment.token.existingSecretRef=gateway-enrollment-token \
          --set gateway.domain=<your-infisical-domain>
        ```

        <Info>
          A PersistentVolumeClaim is created by default to store enrollment credentials across pod restarts. The enrollment token is single-use. Without persistent storage, the gateway cannot restart after the initial enrollment.
        </Info>

        You can also pass the token inline (the chart creates the Secret for you):
        ```bash
        helm install infisical-gateway infisical/infisical-gateway \
          --set gateway.name=<gateway-name> \
          --set gateway.enrollment.method=token \
          --set gateway.enrollment.token.value=<enrollment-token> \
          --set gateway.domain=<your-infisical-domain>
        ```
      </Tab>
    </Tabs>
  </Accordion>
  <Accordion title="AWS Auth">
    The host must have AWS credentials whose principal matches your allowlist. The gateway re-authenticates via STS on every start.

    <Tabs>
      <Tab title="Linux (Production)">
        ```bash
        sudo infisical gateway systemd install <gateway-name> \
          --enroll-method=aws \
          --gateway-id=<gateway-id> \
          --domain=<your-infisical-domain>
        sudo systemctl start <gateway-name>
        ```
      </Tab>
      <Tab title="Foreground">
        ```bash
        infisical gateway start <gateway-name> \
          --enroll-method=aws \
          --gateway-id=<gateway-id> \
          --domain=<your-infisical-domain>
        ```
      </Tab>
      <Tab title="Kubernetes (Helm)">
        Install the Infisical Helm chart repository:
        ```bash
        helm repo add infisical https://dl.cloudsmith.io/public/infisical/helm-charts/helm/charts/
        helm repo update
        ```

        Install the gateway with [IAM Roles for Service Accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html):
        ```bash
        helm install infisical-gateway infisical/infisical-gateway \
          --set gateway.name=<gateway-name> \
          --set gateway.enrollment.method=aws \
          --set gateway.enrollment.aws.gatewayId=<gateway-id> \
          --set gateway.domain=<your-infisical-domain> \
          --set serviceAccount.annotations."eks\.amazonaws\.com/role-arn"=arn:aws:iam::<account-id>:role/<role-name>
        ```

        <Info>
          Ensure the IAM role's trust policy allows the Kubernetes service account to assume it, and that the role's ARN or account ID is in the gateway's AWS auth allowlist in the Infisical UI.
        </Info>
      </Tab>
    </Tabs>
  </Accordion>
  <Accordion title="Kubernetes Auth">
    The gateway sends the projected service account token of its own pod, and Infisical verifies it against your cluster's TokenReview API. Nothing has to be copied into the cluster, so this is the method to use when gateway creation is automated. The gateway re-authenticates on every start.

    Before deploying, configure the Kubernetes auth method on the gateway's detail page:

    | Field | Description |
    | --- | --- |
    | **Gateway** | Optional. Routes the check through an existing gateway or gateway pool instead of Infisical calling the API server directly. Use this when the API server has no address Infisical can reach. |
    | **Review Mode** | Shown once a proxy is selected. See the private cluster section below. |
    | **Kubernetes Host** | The cluster API server URL, reachable from Infisical (for example `https://my-cluster.example.com:6443`). Not required when Review Mode is Gateway as Reviewer. |
    | **Allowed Namespaces** | Namespaces whose service accounts may authenticate as this gateway. Supports `*` wildcards. |
    | **Allowed Service Account Names** | Service account names that may authenticate as this gateway. Supports `*` wildcards. |
    | **Allowed Audience** | Optional. The audience the token must carry. |
    | **CA Certificate** | The CA that issued the API server's certificate. Needed unless that certificate is already trusted by the public trust store, which for a cluster CA it will not be. |
    | **Token Reviewer JWT** | Optional. A token with the `system:auth-delegator` ClusterRole. Leave empty to let the gateway's own service account review its token, which the Helm chart configures by default. |

    At least one of **Allowed Namespaces** or **Allowed Service Account Names** must be set, so that not every pod in the cluster can enroll as the gateway.

    ### Clusters with a private API server

    By default Infisical calls your API server directly, which requires an address it can reach. If your API server is private, select a gateway or gateway pool under **Gateway** and the check is tunnelled through it instead. Two modes are available:

    | Review Mode | Who performs the check | Requires |
    | --- | --- | --- |
    | **Gateway as Reviewer** | The selected gateway, using its own service account | That gateway runs as a pod in the same cluster. No host or reviewer token needed. |
    | **Manual Token Reviewer JWT (API)** | Infisical, tunnelling through the gateway | A Kubernetes host and a reviewer token. Works from any gateway that can reach the API server, including one on a VM in the same network. |

    A gateway pool can only be used with **Manual Token Reviewer JWT (API)**, where any healthy member performs the check and one gateway going offline does not stop the others from authenticating. **Gateway as Reviewer** requires a specific gateway, because in that mode the selected gateway decides the outcome and pool membership can change after the config is saved.

    <Warning>
      A gateway cannot review its own token. The proxy runs over the gateway's own tunnel, which only exists once it has already authenticated, so the reviewer must be a different gateway that is already enrolled and connected.

      This means the **first** gateway in a private cluster cannot use Kubernetes auth. Enrol it with an enrollment token or AWS auth, then point later gateways at it. Deleting a gateway that other gateways use as their reviewer is refused until they are pointed elsewhere.
    </Warning>

    <Tabs>
      <Tab title="Kubernetes (Helm)">
        Install the Infisical Helm chart repository:
        ```bash
        helm repo add infisical https://dl.cloudsmith.io/public/infisical/helm-charts/helm/charts/
        helm repo update
        ```

        Install the gateway:
        ```bash
        helm install infisical-gateway infisical/infisical-gateway \
          --namespace infisical-gateway --create-namespace \
          --set gateway.name=<gateway-name> \
          --set gateway.enrollment.method=kubernetes \
          --set gateway.enrollment.kubernetes.gatewayId=<gateway-id> \
          --set gateway.domain=<your-infisical-domain>
        ```

        <Info>
          The chart binds the gateway's service account to the `system:auth-delegator` ClusterRole by default, which is what lets its own token act as the token reviewer. Set `serviceAccount.createAsAuthDelegator=false` only if you configure a separate **Token Reviewer JWT** on the gateway instead.
        </Info>

        Make sure the release namespace and service account name match the allowlists you configured. With the command above, that is namespace `infisical-gateway` and service account `infisical-gateway`.
      </Tab>
      <Tab title="Other in-cluster deployment">
        If you deploy the gateway container yourself rather than through the chart, run it with:
        ```bash
        infisical gateway start <gateway-name> \
          --enroll-method=kubernetes \
          --gateway-id=<gateway-id> \
          --domain=<your-infisical-domain>
        ```

        The pod needs its service account token automounted (the default), and either the service account must hold the `system:auth-delegator` ClusterRole or a separate **Token Reviewer JWT** must be configured on the gateway.
      </Tab>
    </Tabs>

    <Warning>
      Infisical must be able to reach the cluster's API server to review the token. For a cluster with no publicly reachable API server, use Token or AWS auth instead.
    </Warning>
  </Accordion>
</AccordionGroup>

<Warning>
  The systemd install command requires Linux with root/sudo privileges.
</Warning>

<Info>
  Token-method enrollment tokens are single-use and expire after 1 hour. If the token expires before deployment, click **Show deploy command** again on the detail page to generate a new one.
</Info>

<Info>
  You can safely re-run the same command to restart the gateway. The CLI detects the token has already been used locally and skips enrollment automatically.
</Info>

nc -zv <relay-ip> 2222

curl -I https://app.infisical.com

nc -zv <relay-ip> 2222