From 2c81ab03a75433b3442c65275f34a0c5f04cc865 Mon Sep 17 00:00:00 2001 From: chemavx Date: Thu, 18 Jun 2026 15:42:14 +0000 Subject: [PATCH] Add Infisical Kubernetes operator (secrets-operator v0.11.1) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Phase 2 Step 1: controller-only, dedicated infisical-operator namespace, hostAPI -> self-hosted instance, cluster-scoped, ServerSideApply for CRDs. No InfisicalSecret CRs yet — operator sits idle until later UI config. Co-Authored-By: Claude Opus 4.8 --- argocd/application-infisical-operator.yaml | 35 ++++++++++++++++++++++ 1 file changed, 35 insertions(+) create mode 100644 argocd/application-infisical-operator.yaml diff --git a/argocd/application-infisical-operator.yaml b/argocd/application-infisical-operator.yaml new file mode 100644 index 0000000..4bd9700 --- /dev/null +++ b/argocd/application-infisical-operator.yaml @@ -0,0 +1,35 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: infisical-operator + namespace: argocd +spec: + destination: + namespace: infisical-operator + server: https://kubernetes.default.svc + project: default + # Single-source Helm: remote chart + inline values. (Multi-source $values ref + # caused the platform app to prune its own Application object on first sync.) + source: + repoURL: https://dl.cloudsmith.io/public/infisical/helm-charts/helm/charts/ + chart: secrets-operator + targetRevision: v0.11.1 + helm: + valuesObject: + # Self-hosted API as the global default (chart default is Infisical Cloud). + hostAPI: https://infisical.chemavx.xyz/api + installCRDs: true + scopedRBAC: false # cluster-scoped: watch all namespaces + scopedNamespaces: [] + controllerManager: + replicas: 1 + telemetry: + serviceMonitor: + enabled: false # no Prometheus-Operator ServiceMonitor CRD in cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - ServerSideApply=true # large CRD schemas exceed client-side annotation limit