Using the InfisicalSecret CRD

resyncInterval: 60s # 60 seconds
resyncInterval: 5m # 5 minutes
resyncInterval: 2h # 2 hours
resyncInterval: 3d # 3 days
resyncInterval: 4w # 4 weeks

apiVersion: secrets.infisical.com/v1alpha1
kind: InfisicalSecret
metadata:
  name: infisicalsecret-sample-crd
spec:
  authentication:
      universalAuth:
          secretsScope:
              # either projectSlug or projectId is required
              projectSlug: <project-slug> # <-- project slug
              projectId: <project-id> # <-- project id

              secretName: <secret-name> # OPTIONAL: If you want to fetch a single Infisical secret, you can specify the secret name here. If not specified, all secrets in the specified scope will be fetched.
              envSlug: <env-slug> # "dev", "staging", "prod", etc..
              secretsPath: "<secrets-path>" # Root is "/"
          credentialsRef:
              secretName: universal-auth-credentials # <-- name of the Kubernetes secret that stores our machine identity credentials
              secretNamespace: default # <-- namespace of the Kubernetes secret that stores our machine identity credentials
  ...

apiVersion: secrets.infisical.com/v1alpha1
kind: InfisicalSecret
metadata:
  name: infisicalsecret-sample-crd
spec:
  authentication:
    ldapAuth:
      secretsScope:
        projectSlug: <project-slug> # <-- project slug
        envSlug: <env-slug> # "dev", "staging", "prod", etc..
        secretsPath: "<secrets-path>" # Root is "/"
        secretName: <secret-name> # OPTIONAL: If you want to fetch a single Infisical secret, you can specify the secret name here. If not specified, all secrets in the specified scope will be fetched.
      identityId: <machine-identity-id>
      credentialsRef:
        secretName: ldap-auth-credentials # <-- name of the Kubernetes secret that stores our machine identity credentials
        secretNamespace: default # <-- namespace of the Kubernetes secret that stores our machine identity credentials

kubectl create secret generic service-token --from-literal=infisicalToken="<your-service-token-here>"

apiVersion: secrets.infisical.com/v1alpha1
kind: InfisicalSecret
metadata:
  name: infisicalsecret-sample-crd
spec:
  authentication:
    serviceToken:
      serviceTokenSecretReference:
        secretName: service-token # <-- name of the Kubernetes secret that stores our service token
        secretNamespace: option # <-- namespace of the Kubernetes secret that stores our service token
      secretsScope:
        envSlug: <env-slug> # "dev", "staging", "prod", etc..
        secretsPath: <secrets-path> # Root is "/"
  ...

type TemplateSecret struct {
    Value      string `json:"value"`
    SecretPath string `json:"secretPath"`
}

managedKubeSecretReferences:
  - secretName: managed-secret
    secretNamespace: default
    template:
      includeAllSecrets: true
      data:
        # Create new secret key that doesn't exist in your Infisical project using values of other secrets
        NEW_KEY: "{{ .DB_PASSWORD.Value }}"
        # Override an existing secret key in Infisical project with a new value using values of other secrets
        API_URL: "https://api.{{.COMPANY_NAME.Value}}.{{.REGION.Value}}.com"

DB_PASSWORD = "secret123"
COMPANY_NAME = "acme"
REGION = "us-east-1"
API_URL = "old-url"  # This will be overridden

# Original secrets (from includeAllSecrets: true)
DB_PASSWORD = "secret123"
COMPANY_NAME = "acme"
REGION = "us-east-1"

# New and overridden templated secrets
NEW_KEY = "secret123"                       # New secret created from template
API_URL = "https://api.acme.us-east-1.com" # Existing secret overridden by template

type TemplateSecret struct {
    Value      string `json:"value"`
    SecretPath string `json:"secretPath"`
}

managedKubeConfigMapReferences:
  - configMapName: managed-configmap
    configMapNamespace: default
    template:
      includeAllSecrets: true
      data:
        # Create new key that doesn't exist in your Infisical project using values of other secrets
        SITE_URL: "{{ .SITE_URL.Value }}"
        # Override an existing key in Infisical project with a new value using values of other secrets
        API_URL: "https://api.{{.SITE_URL.Value}}.{{.REGION.Value}}.com"

SITE_URL = "https://example.com"
REGION = "us-east-1"
API_URL = "old-url"  # This will be overridden

# Original config map data (from includeAllSecrets: true)
SITE_URL = "https://example.com"
REGION = "us-east-1"

# New and overridden config map data
SITE_URL = "https://example.com"
API_URL = "https://api.example.com.us-east-1.com" # Existing secret overridden by template

  envFrom:
    - secretRef:
        name: managed-secret # managed secret name
  ```

  Example usage in a deployment
  ```yaml
  apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
  labels:
    app: nginx
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:1.14.2
        envFrom:
        - secretRef:
            name: managed-secret # <- name of managed secret
        ports:
        - containerPort: 80

env:
  - name: SECRET_NAME # The environment variable's name which is made available in the container
    valueFrom:
      secretKeyRef:
        name: managed-secret # managed secret name
        key: SOME_SECRET_KEY # The name of the key which exists in the managed secret

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
  labels:
    app: nginx
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
        - name: nginx
          image: nginx:1.14.2
          env:
            - name: STRIPE_API_SECRET
              valueFrom:
                secretKeyRef:
                  name: managed-secret # <- name of managed secret
                  key: STRIPE_API_SECRET
          ports:
            - containerPort: 80

volumes:
  - name: secrets-volume-name # The name of the volume under which secrets will be stored
    secret:
      secretName: managed-secret # managed secret name

volumeMounts:
  - name: secrets-volume-name
    mountPath: /etc/secrets
    readOnly: true

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
  labels:
    app: nginx
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
        - name: nginx
          image: nginx:1.14.2
          volumeMounts:
            - name: secrets-volume-name
              mountPath: /etc/secrets
              readOnly: true
          ports:
            - containerPort: 80
      volumes:
        - name: secrets-volume-name
          secret:
            secretName: managed-secret # <- managed secrets

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
  labels:
    app: nginx
  annotations:
    secrets.infisical.com/auto-reload: "true" # <- redeployment annotation
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:1.14.2
        envFrom:
        - secretRef:
            name: managed-secret
        ports:
        - containerPort: 80

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: log-agent
  labels:
    app: log-agent
  annotations:
    secrets.infisical.com/auto-reload: "true" # <- redeployment annotation
spec:
  selector:
    matchLabels:
      app: log-agent
  template:
    metadata:
      labels:
        app: log-agent
    spec:
      containers:
        - name: log-agent
          image: mycompany/log-agent:latest
          envFrom:
            - secretRef:
                name: managed-secret # <- name of the managed secret
          volumeMounts:
            - name: config-volume
              mountPath: /etc/config
              readOnly: true
      volumes:
        - name: config-volume
          secret:
            secretName: managed-secret

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: db-worker
  labels:
    app: db-worker
  annotations:
    secrets.infisical.com/auto-reload: "true" # <- redeployment annotation
spec:
  selector:
    matchLabels:
      app: db-worker
  serviceName: "db-worker"
  replicas: 2
  template:
    metadata:
      labels:
        app: db-worker
    spec:
      containers:
        - name: db-worker
          image: mycompany/db-worker:stable
          env:
            - name: DATABASE_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: managed-secret
                  key: DB_PASSWORD
          ports:
            - containerPort: 5432

  envFrom:
    - configMapRef:
        name: managed-configmap # managed configmap name
  ```

  Example usage in a deployment
  ```yaml
  apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
  labels:
    app: nginx
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:1.14.2
        envFrom:
        - configMapRef:
            name: managed-configmap # <- name of managed configmap
        ports:
        - containerPort: 80

env:
  - name: CONFIG_NAME # The environment variable's name which is made available in the container
    valueFrom:
      configMapKeyRef:
        name: managed-configmap # managed configmap name
        key: SOME_CONFIG_KEY # The name of the key which exists in the managed configmap

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
  labels:
    app: nginx
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
        - name: nginx
          image: nginx:1.14.2
          env:
            - name: STRIPE_API_SECRET
              valueFrom:
                configMapKeyRef:
                  name: managed-configmap # <- name of managed configmap
                  key: STRIPE_API_SECRET
          ports:
            - containerPort: 80

volumes:
  - name: configmaps-volume-name # The name of the volume under which configmaps will be stored
    configMap:
      name: managed-configmap # managed configmap name

volumeMounts:
  - name: configmaps-volume-name
    mountPath: /etc/config
    readOnly: true

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
  labels:
    app: nginx
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
        - name: nginx
          image: nginx:1.14.2
          volumeMounts:
            - name: configmaps-volume-name
              mountPath: /etc/config
              readOnly: true
          ports:
            - containerPort: 80
      volumes:
        - name: configmaps-volume-name
          configMap:
            name: managed-configmap # <- managed configmap

apiVersion: secrets.infisical.com/v1alpha1
kind: InfisicalSecret
metadata:
  name: infisicalsecret-sample
  labels:
    label-to-be-passed-to-managed-secret: sample-value
  annotations:
    example.com/annotation-to-be-passed-to-managed-secret: "sample-value"
spec:
  authentication:
    # ... auth config ...
  managedKubeSecretReferences:
    - secretName: managed-token
      secretNamespace: default

apiVersion: v1
data: ...
kind: Secret
metadata:
  annotations:
    example.com/annotation-to-be-passed-to-managed-secret: sample-value
    secrets.infisical.com/version: W/"3f1-ZyOSsrCLGSkAhhCkY2USPu2ivRw"
  labels:
    label-to-be-passed-to-managed-secret: sample-value
  name: managed-token
  namespace: default
type: Opaque

apiVersion: secrets.infisical.com/v1alpha1
kind: InfisicalSecret
metadata:
  name: infisicalsecret-with-template-metadata
  labels:
    managed-by: infisical-operator
  annotations:
    example.com/cr-specific: "metadata"
spec:
  authentication:
    # ... auth config ...
  managedKubeSecretReferences:
    - secretName: managed-secret-with-custom-metadata
      secretNamespace: default
      template:
        includeAllSecrets: true
        metadata:
          labels:
            app: my-application
            environment: production
            tier: backend
          annotations:
            secret.example.com/description: "Production database credentials"
            secret.example.com/owner: "platform-team"

apiVersion: v1
data: ...
kind: Secret
metadata:
  annotations:
    secret.example.com/description: "Production database credentials"
    secret.example.com/owner: "platform-team"
  labels:
    app: my-application
    environment: production
    tier: backend
  name: managed-secret-with-custom-metadata
  namespace: default
type: Opaque