Kubernetes

• Service Account Token — you provide a static token that the Gateway injects into requests. Simple to set up, but the token is long-lived and stored in Infisical.
• Gateway — the Gateway uses its own pod identity and Kubernetes impersonation to act as a target service account. No tokens are stored in Infisical — you only provide a service account name and namespace.

​

How It Works

​

Service Account Token

​

Gateway (Impersonation)

​

Key Concepts

1. Gateway: An Infisical Gateway deployed in your network that can reach the Kubernetes API server. The Gateway handles secure communication between users and your cluster.
2. Service Account Token: A Kubernetes service account token that grants access to the cluster. This token is stored securely in Infisical and used by the Gateway to authenticate with the Kubernetes API.
3. Impersonation: A Kubernetes feature where one identity (the Gateway) can act on behalf of another (the target service account). The Gateway authenticates as itself and adds Impersonate-User headers. Kubernetes checks if the Gateway has permission to impersonate the target, then applies the target’s RBAC rules.
4. Local Proxy: The Infisical CLI starts a local proxy on your machine that intercepts kubectl commands and routes them securely through the Gateway to your cluster.
5. Session Tracking: All access sessions are logged, including when the session was created, who accessed the cluster, session duration, and when it ended.

​

Session Tracking

• When the session was created
• Who accessed which cluster
• Session duration
• All kubectl commands executed during the session
• When the session ended

​

Prerequisites

1. Infisical Gateway - A Gateway deployed in your network with access to the Kubernetes API server
2. Infisical CLI - The Infisical CLI installed on user machines
3. Depending on your auth method:
   • Service Account Token: A Kubernetes service account with appropriate RBAC permissions and a static token
   • Gateway: The Gateway must be deployed inside the Kubernetes cluster as a pod, with a ClusterRole that allows impersonation of target service accounts

​

Create the PAM Resource

​

Set Up Authentication

apiVersion: v1
kind: ServiceAccount
metadata:
  name: infisical-pam-sa
  namespace: kube-system
---
# Bind the ServiceAccount to the desired ClusterRole
# This example uses cluster-admin - adjust based on your needs
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: infisical-pam-binding
subjects:
  - kind: ServiceAccount
    name: infisical-pam-sa
    namespace: kube-system
roleRef:
  kind: ClusterRole
  name: cluster-admin  # Change this to a more restrictive role as needed
  apiGroup: rbac.authorization.k8s.io
---
# Create a static, non-expiring token for the ServiceAccount
apiVersion: v1
kind: Secret
metadata:
  name: infisical-pam-sa-token
  namespace: kube-system
  annotations:
    kubernetes.io/service-account.name: infisical-pam-sa
type: kubernetes.io/service-account-token

kubectl apply -f sa.yaml

kubectl -n kube-system get secret infisical-pam-sa-token -o jsonpath='{.data.token}' | base64 -d

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: infisical-gateway-impersonator
rules:
  - apiGroups: [""]
    resources: ["serviceaccounts"]
    verbs: ["impersonate"]
    resourceNames:
      - "deploy-bot"       # Add each SA the gateway should be able to impersonate
      - "ci-runner"
  - apiGroups: [""]
    resources: ["groups"]
    verbs: ["impersonate"]
    resourceNames:
      - "system:serviceaccounts"
      - "system:serviceaccounts:default"  # Match the namespace(s) of the target SAs
      - "system:authenticated"
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: infisical-gateway-impersonator-binding
subjects:
  - kind: ServiceAccount
    name: <gateway-pod-service-account>  # The Gateway pod's own service account
    namespace: <gateway-namespace>
roleRef:
  kind: ClusterRole
  name: infisical-gateway-impersonator
  apiGroup: rbac.authorization.k8s.io

kubectl apply -f gateway-impersonation.yaml

apiVersion: v1
kind: ServiceAccount
metadata:
  name: deploy-bot
  namespace: default
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: deploy-bot-binding
subjects:
  - kind: ServiceAccount
    name: deploy-bot
    namespace: default
roleRef:
  kind: ClusterRole
  name: view  # Or whatever permissions this SA should have
  apiGroup: rbac.authorization.k8s.io

​

Create PAM Accounts

​

Access Kubernetes Cluster

kubectl get pods
kubectl get namespaces
kubectl describe deployment my-app

​

FAQ