Kubernetes via Helm Chart

Create a values.yaml file. This will be used to configure settings for the Infisical Helm chart. To explore all configurable properties for your values file, visit this page.

By default, the Infisical version set in your helm chart will likely be outdated. Choose the latest Infisical docker image tag from here.

infisical:
  image:
    repository: infisical/infisical
    tag: "v0.46.2-postgres" #<-- update
    pullPolicy: IfNotPresent

To deploy this Helm chart, a Kubernetes secret named infisical-secrets must be present in the same namespace where the chart is being deployed.

For a minimal installation of Infisical, you need to configure ENCRYPTION_KEY, AUTH_SECRET, DB_CONNECTION_URI, and REDIS_URL. Learn more about configuration settings.

• Proof of concept deployment
• Production deployment

apiVersion: v1
kind: Secret
metadata:
  name: infisical-secrets
type: Opaque
stringData:
  AUTH_SECRET: <>
  ENCRYPTION_KEY: <>

Infisical relies a relational database, which means that database schemas need to be migrated before the instance can become operational.

To automate this process, the chart includes a option named infisical.autoDatabaseSchemaMigration. When this option is enabled, a deployment/upgrade will only occur after a successful schema migration.

By default, this chart uses Nginx as its Ingress controller to direct traffic to Infisical services.

ingress:
  nginx:
    enabled: true 

Once you are done configuring your values.yaml file, run the command below.

helm upgrade --install infisical infisical-helm-charts/infisical-standalone --values /path/to/values.yaml

nameOverride: "infisical"
fullnameOverride: "infisical"

infisical:
  enabled: true
  name: infisical
  autoDatabaseSchemaMigration: true
  fullnameOverride: ""
  podAnnotations: {}
  deploymentAnnotations: {}
  replicaCount: 6

  image:
    repository: infisical/infisical
    tag: "v0.46.2-postgres"
    pullPolicy: IfNotPresent

  affinity: {}
  kubeSecretRef: "infisical-secrets"
  service:
    annotations: {}
    type: ClusterIP
    nodePort: ""

  resources:
    limits:
      memory: 210Mi
    requests:
      cpu: 200m

ingress:
  enabled: true
  hostName: ""
  ingressClassName: nginx
  nginx:
    enabled: true
  annotations: {}
  tls: []

postgresql:
  enabled: true
  name: "postgresql"
  fullnameOverride: "postgresql"
  auth:
    username: infisical
    password: root
    database: infisicalDB

redis:
  enabled: true
  name: "redis"
  fullnameOverride: "redis"
  cluster:
    enabled: false
  usePassword: true
  auth:
    password: "mysecretpassword"
  architecture: standalone

After deployment, please wait for 2-5 minutes for all pods to reach a running state. Once a significant number of pods are operational, access the IP address revealed through Ingress by your load balancer. You can find the IP address/hostname by executing the command kubectl get ingress.

To upgrade your instance of Infisical simply update the docker image tag in your Halm values and rerun the command below.

helm upgrade --install infisical infisical-helm-charts/infisical-standalone --values /path/to/values.yaml