Gateway
How to access private network resources from Infisical
The Infisical Gateway provides secure access to private resources within your network without needing direct inbound connections to your environment. This method keeps your resources fully protected from external access while enabling Infisical to securely interact with resources like databases. Common use cases include generating dynamic credentials or rotating credentials for private databases.
Note: Gateway is a paid feature. - Infisical Cloud users: Gateway is available under the Enterprise Tier. - Self-Hosted Infisical: Please contact [email protected] to purchase an enterprise license.
How It Works
The Gateway serves as a secure intermediary that facilitates direct communication between the Infisical server and your private network. It’s a lightweight daemon packaged within the Infisical CLI, making it easy to deploy and manage. Once set up, the Gateway establishes a connection with a relay server, ensuring that all communication between Infisical and your Gateway is fully end-to-end encrypted. This setup guarantees that only the platform and your Gateway can decrypt the transmitted information, keeping communication with your resources secure, private and isolated.
Deployment
The Infisical Gateway is seamlessly integrated into the Infisical CLI under the gateway command, making it simple to deploy and manage.
You can install the Gateway in all the same ways you install the Infisical CLI—whether via npm, Docker, or a binary.
For detailed installation instructions, refer to the Infisical CLI Installation instructions.
To function, the Gateway must authenticate with Infisical. This requires a machine identity configured with the appropriate permissions to create and manage a Gateway. Once authenticated, the Gateway establishes a secure connection with Infisical to allow your private resources to be reachable.
Get started
Create a Gateway Identity
- Navigate to Organization Access Control in your Infisical dashboard.
- Create a dedicated machine identity for your Gateway.
- Best Practice: Assign a unique identity to each Gateway for better security and management.
Configure Authentication Method
You’ll need to choose an authentication method to initiate communication with Infisical. View the available machine identity authentication methods here.
Deploy the Gateway
Use the Infisical CLI to deploy the Gateway. You can run it directly or install it as a systemd service for production:
For production deployments on Linux, install the Gateway as a systemd service:
This will install and start the Gateway as a secure systemd service that:
- Runs with restricted privileges:
- Runs as root user (required for secure token management)
- Restricted access to home directories
- Private temporary directory
- Automatically restarts on failure
- Starts on system boot
- Manages token and domain configuration securely in
/etc/infisical/gateway.conf
The install command requires:
- Linux operating system
- Root/sudo privileges
- Systemd
For production deployments on Linux, install the Gateway as a systemd service:
This will install and start the Gateway as a secure systemd service that:
- Runs with restricted privileges:
- Runs as root user (required for secure token management)
- Restricted access to home directories
- Private temporary directory
- Automatically restarts on failure
- Starts on system boot
- Manages token and domain configuration securely in
/etc/infisical/gateway.conf
The install command requires:
- Linux operating system
- Root/sudo privileges
- Systemd
The Gateway can be installed via Helm. Helm is a package manager for Kubernetes that allows you to define, install, and upgrade Kubernetes applications.
For production deployments on Kubernetes, install the Gateway using the Infisical Helm chart:
Install the latest Helm Chart repository
Update the Helm Chart repository
Create a Kubernetes Secret containing gateway environment variables
The gateway supports all identity authentication methods through the use of environment variables.
The environment variables must be set in the infisical-gateway-environment Kubernetes secret.
Supported authentication methods
Universal Auth
Universal Auth
The Universal Auth method is a simple and secure way to authenticate with Infisical. It requires a client ID and a client secret to authenticate with Infisical.
Native Kubernetes
Native Kubernetes
The Native Kubernetes method is used to authenticate with Infisical when running in a Kubernetes environment. It requires a service account token to authenticate with Infisical.
Native Azure
Native Azure
The Native Azure method is used to authenticate with Infisical when running in an Azure environment.
Native GCP ID Token
Native GCP ID Token
The Native GCP ID Token method is used to authenticate with Infisical when running in a GCP environment.
GCP IAM
GCP IAM
The GCP IAM method is used to authenticate with Infisical with a GCP service account key.
Native AWS IAM
Native AWS IAM
The AWS IAM method is used to authenticate with Infisical with an AWS IAM role while running in an AWS environment like EC2, Lambda, etc.
OIDC Auth
OIDC Auth
The OIDC Auth method is used to authenticate with Infisical via identity tokens with OIDC.
JWT Auth
JWT Auth
Token Auth
Token Auth
You can use the INFISICAL_TOKEN environment variable to authenticate with Infisical with a raw machine identity access token.
Other environment variables
INFISICAL_API_URL
INFISICAL_API_URL
The API URL to use for the gateway. By default, INFISICAL_API_URL is set to https://app.infisical.com.
Install the Infisical Gateway Helm Chart
Check the gateway logs
After installing the gateway, you can check the logs to ensure it’s running as expected.
You should see the following output which indicates the gateway is running as expected.
For development or testing, you can run the Gateway directly. Log in with your machine identity and start the Gateway in one command:
Alternatively, if you already have the token, use it directly with the --token flag:
Or set it as an environment variable:
For detailed information about the gateway command and its options, see the gateway command documentation.
Ensure the deployed Gateway has network access to the private resources you intend to connect with Infisical.
Verify Gateway Deployment
To confirm your Gateway is working, check the deployment status by looking for the message “Gateway started successfully” in the Gateway logs. This indicates the Gateway is running properly. Next, verify its registration by opening your Infisical dashboard, navigating to Organization Access Control, and selecting the Gateways tab. Your newly deployed Gateway should appear in the list.