Skip to main content

component-external-secret

Wires the project namespace to Infisical (via the External Secrets Operator). Produces a SecretStore pointing at eu.infisical.com and an ExternalSecret that materializes every secret it finds in the project's scope into a Kubernetes Secret.

The resulting Secret is what every other workload reads via envFrom: secretRef: { name: <global.secretName> }.

Enable it​

enabled: true is the default. It auto-skips itself if global.projectSlug or global.environmentSlug is empty (so a half-configured chart doesn't try to spin one up).

Defaults​

secretStore:
  name: infisical-secret-store
  hostAPI: https://eu.infisical.com
  universalAuthSecretRef:
    name: universal-auth-credentials      # cluster-wide credentials in the namespace
    clientIdKey: clientId
    clientSecretKey: clientSecret
  secretsPath: /
externalSecret:
  refreshInterval: 1h
  creationPolicy: Owner
  findRegexp: ".*"

findRegexp: ".*" pulls every secret in the project's Infisical scope (projectSlug + environmentSlug). Tune findRegexp if you want a subset.

Refresh on deploy​

The ExternalSecret carries a force-sync annotation populated from global.image.tag. ESO refetches Infisical whenever that annotation value changes, so every image bump (i.e. every deploy) pulls the latest secret state in addition to the refreshInterval poll. Combined with Reloader, pods then restart with the new env. Set refreshInterval longer if you want to lean entirely on deploy-time refresh and reduce Infisical API traffic.

Per-environment scope​

Scope in Infisical is (projectSlug, environmentSlug). The component passes these straight from global.*, so the matching project/env must exist in Infisical first.