Installation
1
Add the Helm repository
helm repo add infisical-helm-charts 'https://dl.cloudsmith.io/public/infisical/helm-charts/helm/charts/'
helm repo update
2
Install the chart
- Token Auth
- AWS Auth
- Kubernetes Auth
helm install infisical-gateway infisical-helm-charts/infisical-gateway \
--namespace infisical-gateway \
--create-namespace \
--set gateway.name=<gateway-name> \
--set gateway.enrollment.method=token \
--set gateway.enrollment.token.value=<enrollment-token> \
--set gateway.domain=https://app.infisical.com
The enrollment token is single-use and expires in 1 hour. Persistent storage (enabled by default) is required so credentials survive pod restarts.
helm install infisical-gateway infisical-helm-charts/infisical-gateway \
--namespace infisical-gateway \
--create-namespace \
--set gateway.name=<gateway-name> \
--set gateway.enrollment.method=aws \
--set gateway.enrollment.aws.gatewayId=<gateway-id> \
--set gateway.domain=https://app.infisical.com \
--set serviceAccount.annotations."eks\.amazonaws\.com/role-arn"=arn:aws:iam::<account-id>:role/<role-name>
helm install infisical-gateway infisical-helm-charts/infisical-gateway \
--namespace infisical-gateway \
--create-namespace \
--set gateway.name=<gateway-name> \
--set gateway.enrollment.method=kubernetes \
--set gateway.enrollment.kubernetes.gatewayId=<gateway-id> \
--set gateway.domain=https://app.infisical.com
system:auth-delegator ClusterRole by default, which is what lets that token be reviewed.The release namespace and service account name must match the allowlists configured on the
gateway in Infisical. With the command above those are
infisical-gateway and
infisical-gateway. See Gateway Deployment
for the full configuration.3
Verify the deployment
kubectl get pods -n infisical-gateway
Uninstall
helm uninstall infisical-gateway --namespace infisical-gateway
Configuration reference
| Parameter | Default | Description |
|---|---|---|
gateway.name | "" | Name of the gateway as created in the Infisical UI. |
gateway.domain | "" | Infisical instance URL (e.g., https://app.infisical.com). |
gateway.enrollment.method | "" | Enrollment method: token, aws, or kubernetes. |
gateway.enrollment.token.value | "" | Inline enrollment token. Mutually exclusive with existingSecretRef. |
gateway.enrollment.token.existingSecretRef | "" | Kubernetes secret containing the enrollment token. |
gateway.enrollment.token.secretKey | "enrollment-token" | Key in the secret that holds the token. |
gateway.enrollment.aws.gatewayId | "" | Gateway ID from the Infisical UI. Required for AWS auth. |
gateway.enrollment.kubernetes.gatewayId | "" | Gateway ID from the Infisical UI. Required for Kubernetes auth. |
gateway.enrollment.kubernetes.serviceAccountTokenPath | "" | Override the projected service account token path. Defaults to /var/run/secrets/kubernetes.io/serviceaccount/token. |
gateway.enrollment.kubernetes.externalTokenReview | false | Set true when TokenReview permission comes from outside this chart, either a token reviewer JWT configured in Infisical or a binding you manage. Required to install with serviceAccount.createAsAuthDelegator disabled. |
gateway.enrollment.credentialsSecretRef | "" | Kubernetes secret with credentials injected as env vars. |
gateway.relayName | "" | Specific relay to connect to. Empty for automatic selection. |
gateway.listenAddress | "" | host:port that Infisical dials to reach the gateway, which runs it in direct listen mode. Empty for relay mode. |
persistence.enabled | true | Enable persistent storage. Required for token auth, optional for AWS and Kubernetes auth. |
persistence.storageClass | "" | Storage class for the PVC. |
persistence.size | 5Gi | PVC size. |
persistence.existingClaim | "" | Use an existing PVC. |
image.repository | infisical/cli | Container image. |
image.tag | "0.43.131" | Image tag. |
resources.requests.cpu | 100m | CPU request. |
resources.requests.memory | 128Mi | Memory request. |
resources.limits.cpu | 500m | CPU limit. |
resources.limits.memory | 128Mi | Memory limit. |
serviceAccount.create | true | Create a service account. |
serviceAccount.annotations | {} | Service account annotations (e.g., IRSA role ARN). |
nodeSelector | {} | Node selector. |
tolerations | {} | Pod tolerations. |
affinity | {} | Pod affinity rules. |
extraEnv | [] | Extra environment variables for the gateway container. |
extraEnvFrom | [] | Load environment variables from Secrets or ConfigMaps. |
extraArgs | [] | Extra arguments appended to the gateway container command. |
extraObjects | [] | Extra Kubernetes manifests to deploy with this chart. |
service.type | ClusterIP | Type of the Service created in direct listen mode. |
service.port | "" | Port the Service exposes. Empty means the port from gateway.listenAddress. Set it only to put a different port in front of the gateway. |
Direct listen mode
By default the gateway connects out to a relay. To have Infisical connect to the gateway instead, setgateway.listenAddress to the address Infisical dials.
helm install infisical-gateway infisical-helm-charts/infisical-gateway \
--namespace infisical-gateway \
--create-namespace \
--set gateway.name=<gateway-name> \
--set gateway.listenAddress=infisical-gateway.infisical-gateway.svc.cluster.local:8443 \
--set gateway.enrollment.method=token \
--set gateway.enrollment.token.value=<enrollment-token> \
--set gateway.domain=<your-infisical-domain>
gateway.listenAddress, points the Service at it, and exposes that same port, which keeps all three in step. A host:port value is required, and the chart fails the render if the port is missing. Set service.port only if you want the Service to answer on a different port than the gateway binds, in which case the listen address has to name the Service’s port.
The Service is created only in direct listen mode. A relay-mode gateway accepts no connections and needs none.
The address has to be one Infisical can resolve and reach. An in-cluster Service DNS name works when you self-host Infisical in the same cluster. From outside the cluster, expose the gateway through an Ingress or a LoadBalancer Service and register that address instead.
Direct listen is only available on self-hosted Infisical.
Default Helm values
values.yaml
values.yaml
image:
repository: infisical/cli
tag: "0.43.131"
pullPolicy: IfNotPresent
# Machine identity flow: name of the K8s Secret containing env vars like INFISICAL_AUTH_METHOD, etc.
# Only used when gateway.enrollment.method is unset.
secret:
name: "infisical-gateway-environment"
gateway:
# Name of the gateway created in the Infisical UI. Required when enrollment.method is set.
name: ""
# Infisical instance URL (e.g. https://app.infisical.com). Required when enrollment.method is set.
domain: ""
enrollment:
# Enrollment method: "token", "aws", or "kubernetes".
# Leave empty to use the legacy machine identity flow (env vars from secret.name).
method: ""
# Token enrollment settings (method=token)
token:
# Inline enrollment token value. Mutually exclusive with existingSecretRef.
value: ""
# Name of an existing K8s Secret containing the enrollment token.
existingSecretRef: ""
# Key within the secret that holds the enrollment token.
secretKey: "enrollment-token"
# AWS enrollment settings (method=aws)
aws:
# Required when method=aws. Gateway ID from the Infisical UI.
gatewayId: ""
# Kubernetes enrollment settings (method=kubernetes).
kubernetes:
# Required when method=kubernetes. Gateway ID from the Infisical UI.
gatewayId: ""
# Path to the projected service account token. Only override for a non-default mount.
serviceAccountTokenPath: ""
# Set true only if TokenReview permission comes from somewhere other than this chart: a token
# reviewer JWT configured on the gateway in Infisical, or a binding you manage yourself.
# Required to install with serviceAccount.createAsAuthDelegator disabled.
externalTokenReview: false
# Name of a K8s Secret whose key-value pairs are injected as env vars.
# Use this to provide credentials for the enrollment method (e.g. AWS keys, GCP credentials).
# Not needed when credentials are provided via workload identity (IRSA, GCP Workload Identity, etc.).
credentialsSecretRef: ""
# Specific relay to connect to. Leave empty for automatic selection.
relayName: ""
# Stable host:port advertised by a gateway accepting direct connections.
# Requires an image.tag of 0.43.131 or newer; older images reject the flag and the pod
# crash-loops on startup.
listenAddress: ""
pamSessionRecordingsDirectory: /var/lib/infisical/session_recordings
# Persistent storage for the gateway (credentials and session recordings).
# Required when enrollment.method=token so credentials survive pod restarts.
# Optional when enrollment.method=aws or enrollment.method=kubernetes, since both re-authenticate
# on every start.
# For legacy machine-identity installs (no enrollment.method), persistence only takes effect
# when existingClaim is provided.
persistence:
enabled: true
storageClass: ""
size: 5Gi
accessModes:
- ReadWriteOnce
existingClaim: ""
resources:
limits:
cpu: 500m
memory: 128Mi
requests:
cpu: 100m
memory: 128Mi
imagePullSecrets: []
nameOverride: ""
fullnameOverride: ""
serviceAccount:
create: true
automount: true
createAsAuthDelegator: true
annotations: {}
name: ""
podAnnotations: {}
podLabels: {}
podSecurityContext:
runAsNonRoot: true
fsGroup: 1000
securityContext:
runAsNonRoot: true
runAsUser: 1000
affinity: {}
tolerations: {}
nodeSelector: {}
service:
type: ClusterIP
# Port the Service exposes. Empty means the port from gateway.listenAddress, which is the port
# the platform dials. Only set this to put a different port in front of the gateway.
port: ""
ingress:
enabled: false
# Extra environment variables for the gateway container
extraEnv: []
# - name: LOG_LEVEL
# value: debug
# - name: MY_SECRET
# valueFrom:
# secretKeyRef:
# name: my-secret
# key: my-key
# Load environment variables from Secrets or ConfigMaps
extraEnvFrom: []
# - secretRef:
# name: my-secret
# - configMapRef:
# name: my-configmap
# Extra arguments appended to the gateway container command
extraArgs: []
# - --log-level=debug
# Extra Kubernetes manifests to deploy with this chart
extraObjects: []