Description
Relay-related commands for Infisical that provide identity-aware relay infrastructure for routing encrypted traffic:- Relay: Identity-aware server that routes encrypted traffic (can be instance-wide or organization-specific)
Subcommands & flags
infisical relay start
infisical relay start
Run the Infisical relay component. The relay handles network traffic routing and can operate in different modes.
Flags
--type
--type
The type of relay to run. Must be either ‘instance’ or ‘org’.
instance: Shared relay server that can be used by all organizations on your Infisical instance. Set up by the instance administrator. UsesINFISICAL_RELAY_AUTH_SECRETenvironment variable for authentication, which must be configured by the instance admin.org: Dedicated relay server that individual organizations deploy and manage in their own infrastructure. Provides enhanced security, custom geographic placement, and compliance benefits. Uses standard Infisical authentication methods.
--host
--host
The host (IP address or hostname) of the instance where the relay is deployed. This must be a static public IP or resolvable hostname that gateways can reach.
--name
--name
The name of the relay.
Authentication
Organization Relays (--type=org):
Deploy your own relay server in your infrastructure for enhanced security and reduced latency. Supports all standard Infisical authentication methods documented below.Instance Relays (--type=instance):
Shared relay servers that serve all organizations on your Infisical instance. For Infisical Cloud, these are already running and ready to use. For self-hosted deployments, they’re set up by the instance administrator. Authentication is handled via the INFISICAL_RELAY_AUTH_SECRET environment variable.Authentication Methods
The Infisical CLI supports multiple authentication methods for organization relays. Below are the available authentication methods, with their respective flags.Universal Auth
Universal Auth
The Universal Auth method is a simple and secure way to authenticate with Infisical. It requires a client ID and a client secret to authenticate with Infisical.
Flags
Native Kubernetes
Native Kubernetes
The Native Kubernetes method is used to authenticate with Infisical when running in a Kubernetes environment. It requires a service account token to authenticate with Infisical.
Flags
Native Azure
Native Azure
The Native Azure method is used to authenticate with Infisical when running in an Azure environment.
Flags
Native GCP ID Token
Native GCP ID Token
The Native GCP ID Token method is used to authenticate with Infisical when running in a GCP environment.
Flags
GCP IAM
GCP IAM
Native AWS IAM
Native AWS IAM
The AWS IAM method is used to authenticate with Infisical with an AWS IAM role while running in an AWS environment like EC2, Lambda, etc.
Flags
OIDC Auth
OIDC Auth
JWT Auth
JWT Auth
Token Auth
Token Auth
You can use the
INFISICAL_TOKEN environment variable to authenticate with Infisical with a raw machine identity access token.Flags
Deployment Considerations
When to use Instance Relays (--type=instance):- You want to get started quickly without setting up your own relay infrastructure
- You’re using Infisical Cloud and want to leverage the existing relay infrastructure
- You’re on a self-hosted instance where the admin has already set up shared relays
- You don’t need custom geographic placement of relay servers
- You don’t have specific compliance requirements that require dedicated infrastructure
- You want to minimize operational overhead by using shared infrastructure
--type=org):- You need lower latency by deploying relay servers closer to your resources
- You have security requirements that mandate running infrastructure in your own environment
- You have compliance requirements such as data sovereignty or air-gapped environments
- You need custom network policies or specific networking configurations
- You have high-scale performance requirements that shared infrastructure can’t meet
- You want full control over your relay infrastructure and its configuration