Using the InfisicalSecret CRD

apiVersion: secrets.infisical.com/v1alpha1
kind: InfisicalSecret
metadata:
  name: infisicalsecret-sample-crd
spec:
  authentication:
      universalAuth:
          secretsScope:
              projectSlug: <project-slug> # <-- project slug
              envSlug: <env-slug> # "dev", "staging", "prod", etc..
              secretsPath: "<secrets-path>" # Root is "/"
          credentialsRef:
              secretName: universal-auth-credentials # <-- name of the Kubernetes secret that stores our machine identity credentials
              secretNamespace: default # <-- namespace of the Kubernetes secret that stores our machine identity credentials
  ...

apiVersion: secrets.infisical.com/v1alpha1
kind: InfisicalSecret
metadata:
  name: infisicalsecret-sample-crd
spec:
  authentication:
      kubernetesAuth:
          identityId: <machine-identity-id>
          serviceAccountRef:
            name: <service-account-name>
            namespace: <service-account-namespace>

          # secretsScope is identical to the secrets scope in the universalAuth field in this sample.
          secretsScope:
              projectSlug: your-project-slug
              envSlug: prod
              secretsPath: "/path"
              recursive: true
  ...

apiVersion: secrets.infisical.com/v1alpha1
kind: InfisicalSecret
metadata:
  name: infisicalsecret-sample-crd
spec:
  authentication:
      awsIamAuth:
          identityId: <your-machine-identity-id>

          # secretsScope is identical to the secrets scope in the universalAuth field in this sample.
          secretsScope:
              projectSlug: your-project-slug
              envSlug: prod
              secretsPath: "/path"
              recursive: true
  ...

apiVersion: secrets.infisical.com/v1alpha1
kind: InfisicalSecret
metadata:
  name: infisicalsecret-sample-crd
spec:
  authentication:
      azureAuth:
          identityId: <your-machine-identity-id>

          # secretsScope is identical to the secrets scope in the universalAuth field in this sample.
          secretsScope:
              projectSlug: your-project-slug
              envSlug: prod
              secretsPath: "/path"
              recursive: true
  ...

apiVersion: secrets.infisical.com/v1alpha1
kind: InfisicalSecret
metadata:
  name: infisicalsecret-sample-crd
spec:
  authentication:
      gcpIdTokenAuth:
          identityId: <your-machine-identity-id>

          # secretsScope is identical to the secrets scope in the universalAuth field in this sample.
          secretsScope:
              projectSlug: your-project-slug
              envSlug: prod
              secretsPath: "/path"
              recursive: true
  ...

apiVersion: secrets.infisical.com/v1alpha1
kind: InfisicalSecret
metadata:
  name: infisicalsecret-sample-crd
spec:
  authentication:
      gcpIamAuth:
          identityId: <your-machine-identity-id>
          serviceAccountKeyFilePath: "/path/to-service-account-key-file-path.json"

          # secretsScope is identical to the secrets scope in the universalAuth field in this sample.
          secretsScope:
              projectSlug: your-project-slug
              envSlug: prod
              secretsPath: "/path"
              recursive: true
  ...

kubectl create secret generic service-token --from-literal=infisicalToken="<your-service-token-here>"

apiVersion: secrets.infisical.com/v1alpha1
kind: InfisicalSecret
metadata:
  name: infisicalsecret-sample-crd
spec:
  authentication:
    serviceToken:
      serviceTokenSecretReference:
        secretName: service-token # <-- name of the Kubernetes secret that stores our service token
        secretNamespace: option # <-- namespace of the Kubernetes secret that stores our service token
      secretsScope:
        envSlug: <env-slug> # "dev", "staging", "prod", etc..
        secretsPath: <secrets-path> # Root is "/"
  ...

type TemplateSecret struct {
    Value      string `json:"value"`
    SecretPath string `json:"secretPath"`
}

managedKubeSecretReferences:
  - secretName: managed-secret
    secretNamespace: default
    template:
      includeAllSecrets: true
      data:
        # Create new secret key that doesn't exist in your Infisical project using values of other secrets
        NEW_KEY: "{{ .DB_PASSWORD.Value }}"
        # Override an existing secret key in Infisical project with a new value using values of other secrets
        API_URL: "https://api.{{.COMPANY_NAME.Value}}.{{.REGION.Value}}.com"

DB_PASSWORD = "secret123"
COMPANY_NAME = "acme"
REGION = "us-east-1"
API_URL = "old-url"  # This will be overridden

# Original secrets (from includeAllSecrets: true)
DB_PASSWORD = "secret123"
COMPANY_NAME = "acme"
REGION = "us-east-1"

# New and overridden templated secrets
NEW_KEY = "secret123"                       # New secret created from template
API_URL = "https://api.acme.us-east-1.com" # Existing secret overridden by template

  envFrom:
    - secretRef:
        name: managed-secret # managed secret name
  ```

  Example usage in a deployment
  ```yaml
  apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
  labels:
    app: nginx
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:1.14.2
        envFrom:
        - secretRef:
            name: managed-secret # <- name of managed secret
        ports:
        - containerPort: 80

env:
  - name: SECRET_NAME # The environment variable's name which is made available in the container
    valueFrom:
      secretKeyRef:
        name: managed-secret # managed secret name
        key: SOME_SECRET_KEY # The name of the key which  exists in the managed secret

apiVersion: apps/v1
kind: Deployment
metadata:
name: nginx-deployment
labels:
app: nginx
spec:
replicas: 1
selector:
matchLabels:
app: nginx
template:
metadata:
labels:
app: nginx
spec:
containers: - name: nginx
image: nginx:1.14.2
env: - name: STRIPE_API_SECRET
valueFrom:
secretKeyRef:
name: managed-secret # <- name of managed secret
key: STRIPE_API_SECRET
ports: - containerPort: 80

volumes:
  - name: secrets-volume-name # The name of the volume under which secrets will be stored
    secret:
      secretName: managed-secret # managed secret name

volumeMounts:
  - name: secrets-volume-name
    mountPath: /etc/secrets
    readOnly: true

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
  labels:
    app: nginx
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
        - name: nginx
          image: nginx:1.14.2
          volumeMounts:
            - name: secrets-volume-name
              mountPath: /etc/secrets
              readOnly: true
          ports:
            - containerPort: 80
      volumes:
        - name: secrets-volume-name
          secret:
            secretName: managed-secret # <- managed secrets

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
  labels:
    app: nginx
  annotations: 
    secrets.infisical.com/auto-reload: "true" # <- redeployment annotation
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:1.14.2
        envFrom:
        - secretRef:
            name: managed-secret
        ports:
        - containerPort: 80

apiVersion: secrets.infisical.com/v1alpha1
kind: InfisicalSecret
metadata:
  name: infisicalsecret-sample
  labels:
    label-to-be-passed-to-managed-secret: sample-value
  annotations:
    example.com/annotation-to-be-passed-to-managed-secret: "sample-value"
spec:
  ..
  authentication:
    ...
  managedKubeSecretReferences:
    ...

apiVersion: v1
data: ...
kind: Secret
metadata:
  annotations:
    example.com/annotation-to-be-passed-to-managed-secret: sample-value
    secrets.infisical.com/version: W/"3f1-ZyOSsrCLGSkAhhCkY2USPu2ivRw"
  labels:
    label-to-be-passed-to-managed-secret: sample-value
  name: managed-token
  namespace: default
type: Opaque