Kubernetes Operator - Infisical

import KubernetesOperatorInstall from "/snippets/kubernetes-operator-install.mdx";

The Infisical Kubernetes Operator automates secret management between Infisical and your Kubernetes cluster. It syncs secrets from Infisical into Kubernetes, pushes secrets from Kubernetes to Infisical, and manages dynamic secrets with time-bound leases.

For usage details, CRD reference, and examples, see the Kubernetes Operator documentation.

Installation

Uninstall

The managed secrets created by the operator will not be deleted when the operator is uninstalled.

bash

helm uninstall <release-name>

Configuration Reference

Parameter	Default	Description
`hostAPI`	`"https://app.infisical.com/api"`	Infisical API URL.
`installCRDs`	`true`	Install CRD definitions. Set to `false` for secondary namespace-scoped installations.
`scopedNamespaces`	`[]`	Namespaces to watch. Empty means all namespaces.
`scopedRBAC`	`false`	Create namespaced Role/RoleBinding instead of cluster-wide.
`controllerManager.replicas`	`1`	Number of operator replicas.
`controllerManager.manager.image.repository`	`infisical/kubernetes-operator`	Container image.
`controllerManager.manager.image.tag`	`v0.11.2`	Image tag.
`controllerManager.manager.resources.requests.cpu`	`10m`	CPU request.
`controllerManager.manager.resources.requests.memory`	`64Mi`	Memory request.
`controllerManager.manager.resources.limits.cpu`	`500m`	CPU limit.
`controllerManager.manager.resources.limits.memory`	`128Mi`	Memory limit.
`controllerManager.serviceAccount.create`	`true`	Create a service account.
`controllerManager.serviceAccount.name`	`""`	Service account name override.
`controllerManager.serviceAccount.annotations`	`{}`	Service account annotations.
`controllerManager.nodeSelector`	`{}`	Node selector.
`controllerManager.tolerations`	`[]`	Pod tolerations.
`controllerManager.affinity`	`{}`	Pod affinity rules.
`controllerManager.manager.extraEnv`	`[]`	Extra environment variables.
`controllerManager.manager.extraVolumeMounts`	`[]`	Extra volume mounts.
`controllerManager.extraVolumes`	`[]`	Extra volumes.
`imagePullSecrets`	`[]`	Image pull secrets for private registries.
`telemetry.serviceMonitor.enabled`	`false`	Enable Prometheus ServiceMonitor.

Default Helm Values

yaml

# -- The Infisical API host URL. This is the default host used when no hostAPI is set on the CRD or global ConfigMap.
hostAPI: "https://app.infisical.com/api"

logger:
  # -- The output of the logs. Can be "stdout" or "stderr". Defaults to "stderr".
  writer: "stderr"

controllerManager:
  serviceAccount:
    create: true
    name: ""
    annotations: {}
  nodeSelector: {}
  tolerations: []
  affinity: {}
  topologySpreadConstraints: []
  # -- Extra volumes to add to the pod
  extraVolumes: []
  # -- Extra init containers to add to the pod
  extraInitContainers: []
  manager:
    args:
    - --metrics-bind-address=:8443
    - --leader-elect
    - --health-probe-bind-address=:8081
    containerSecurityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
        - ALL
      readOnlyRootFilesystem: true
    image:
      repository: infisical/kubernetes-operator
      tag: v0.11.2
    resources:
      limits:
        cpu: 500m
        memory: 128Mi
      requests:
        cpu: 10m
        memory: 64Mi
    # -- Extra environment variables to add to the manager container
    extraEnv: []
    # -- Extra volume mounts to add to the manager container
    extraVolumeMounts: []
  podSecurityContext:
    runAsNonRoot: true
    seccompProfile:
      type: RuntimeDefault
  replicas: 1
kubernetesClusterDomain: cluster.local

# DEPRECATED: Use scopedNamespaces instead. This field will be removed in a future version.
# If both scopedNamespace and scopedNamespaces are set, scopedNamespaces takes precedence.
scopedNamespace: ""

# List of namespaces to watch. If empty, the operator watches all namespaces (cluster-scoped).
# When scopedRBAC is true, a Role and RoleBinding will be created in each namespace.
# Example:
#   scopedNamespaces:
#     - team-a-namespace
#     - team-b-namespace
scopedNamespaces: []

scopedRBAC: false
installCRDs: true
imagePullSecrets: []

metricsService:
  ports:
    - name: https
      port: 8443
      protocol: TCP
      targetPort: 8443
  type: ClusterIP

telemetry:
  serviceMonitor:
    enabled: false

    selectors: {}
    scheme: https
    port: https
    path: /metrics
    bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
    interval: 30s
    scrapeTimeout: 10s