Kubernetes

The Infisical Kubernetes dynamic secret allows you to generate short-lived service account tokens on demand.

​

Overview

The Kubernetes dynamic secret feature enables you to generate short-lived service account tokens for your Kubernetes clusters. This is particularly useful for:

• Secure Access Management: Instead of using long-lived service account tokens, you can generate short-lived tokens that automatically expire, reducing the risk of token exposure.
• Temporary Access: Generate tokens with specific TTLs (Time To Live) for temporary access to your Kubernetes clusters.
• Audit Trail: Each token generation is tracked, providing better visibility into who accessed your cluster and when.
• Integration with Private Clusters: Seamlessly work with private Kubernetes clusters using Infisical’s Gateway feature.

This feature is ideal for scenarios where you need to:

• Provide temporary access to developers or CI/CD pipelines
• Rotate service account tokens frequently
• Maintain a secure audit trail of cluster access
• Manage access to multiple Kubernetes clusters

​

Prerequisites

• A Kubernetes cluster with a service account
• Cluster access token with permissions to create service account tokens
• (Optional) Gateway for private cluster access

​

RBAC Configuration

Before you can start generating dynamic service account tokens, you’ll need to configure the appropriate permissions in your Kubernetes cluster. This involves setting up Role-Based Access Control (RBAC) to allow the creation and management of service account tokens.

The RBAC configuration serves a crucial security purpose: it creates a dedicated service account with minimal permissions that can only create and manage service account tokens. This follows the principle of least privilege, ensuring that the token generation process is secure and controlled.

The following RBAC configuration creates the necessary permissions for generating service account tokens:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: tokenrequest
rules:
  - apiGroups: [""]
    resources:
      - "serviceaccounts/token"
      - "serviceaccounts"
    verbs:
      - "create"
      - "get"
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: tokenrequest
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: tokenrequest
subjects:
  - kind: ServiceAccount
    name: infisical-token-requester
    namespace: default

kubectl apply -f rbac.yaml

This configuration:

1. Creates a ClusterRole named tokenrequest that allows:
   • Creating and getting service account tokens
   • Getting service account information
2. Creates a ClusterRoleBinding that binds the role to a service account named infisical-token-requester in the default namespace

You can customize the service account name and namespace according to your needs.

​

Obtaining the Cluster Token

After setting up the RBAC configuration, you need to obtain a token for the service account that will be used to create dynamic secrets. Here’s how to get the token:

1. Create a service account in your Kubernetes cluster that will be used to create service account tokens:

apiVersion: v1
kind: ServiceAccount
metadata:
  name: infisical-token-requester
  namespace: default

kubectl apply -f infisical-service-account.yaml

2. Create a long-lived service account token using this configuration file:

apiVersion: v1
kind: Secret
type: kubernetes.io/service-account-token
metadata:
  name: infisical-token-requester-token
  annotations:
    kubernetes.io/service-account.name: "infisical-token-requester"

kubectl apply -f service-account-token.yaml

3. Link the secret to the service account:

kubectl patch serviceaccount infisical-token-requester -p '{"secrets": [{"name": "infisical-token-requester-token"}]}' -n default

4. Retrieve the token:

kubectl get secret infisical-token-requester-token -n default -o=jsonpath='{.data.token}' | base64 --decode

This token will be used as the “Cluster Token” in the dynamic secret configuration.

​

Obtaining the Cluster URL

The cluster URL is the address of your Kubernetes API server. The simplest way to find it is to use the kubectl cluster-info command:

kubectl cluster-info

This command works for all Kubernetes environments (managed services like GKE, EKS, AKS, or self-hosted clusters) and will show you the Kubernetes control plane address, which is your cluster URL.

​

Set up Dynamic Secrets with Kubernetes

​

Audit or Revoke Leases

Once you have created one or more leases, you will be able to access them by clicking on the respective dynamic secret item on the dashboard. This will allow you to see the lease details and delete the lease ahead of its expiration time.