chemavxandClaude Opus 4.8
e548a06ebc
Deploy infisical-standalone 1.9.0 (Infisical v0.158.0) in a dedicated 'infisical' namespace via a multi-source ArgoCD app (chart + values). Bundled Postgres (dedicated local-path PVC, 8Gi) + Redis. Ingress via Traefik + cert-manager (letsencrypt-prod) at infisical.chemavx.xyz. Crown-jewel secrets (ENCRYPTION_KEY, AUTH_SECRET, SITE_URL) are injected out-of-band via the 'infisical-secrets' Secret (kubectl, IgnoreExtraneous), NOT in git. Postgres/Redis passwords guard ClusterIP-only in-cluster services holding ciphertext; acceptable in values per design review. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
57 lines
1.5 KiB
YAML
57 lines
1.5 KiB
YAML
# Infisical platform (Phase 1) — chart: infisical-standalone 1.9.0 (Infisical v0.158.0)
|
|
# Crown-jewel secrets (ENCRYPTION_KEY, AUTH_SECRET, SITE_URL) are NOT here — they live
|
|
# in the out-of-band 'infisical-secrets' Secret (kubectl, IgnoreExtraneous).
|
|
# Postgres/Redis passwords below guard ClusterIP-only services in the isolated infisical
|
|
# namespace; the DB stores only ciphertext (useless without ENCRYPTION_KEY).
|
|
infisical:
|
|
enabled: true
|
|
replicaCount: 1
|
|
kubeSecretRef: infisical-secrets
|
|
autoBootstrap:
|
|
enabled: false
|
|
image:
|
|
tag: "v0.158.0"
|
|
pullPolicy: IfNotPresent
|
|
resources:
|
|
limits:
|
|
memory: 1000Mi
|
|
requests:
|
|
cpu: 350m
|
|
|
|
ingress:
|
|
enabled: true
|
|
nginx:
|
|
enabled: false
|
|
ingressClassName: traefik
|
|
hostName: infisical.chemavx.xyz
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
|
tls:
|
|
- secretName: infisical-tls
|
|
hosts:
|
|
- infisical.chemavx.xyz
|
|
|
|
postgresql:
|
|
enabled: true
|
|
name: postgresql
|
|
fullnameOverride: postgresql
|
|
auth:
|
|
username: infisical
|
|
password: "eeb3d0ec1a98f8582253e74b8f22f7ad9f4b56eaf94679aa"
|
|
database: infisicalDB
|
|
primary:
|
|
persistence:
|
|
enabled: true
|
|
storageClass: local-path
|
|
size: 8Gi
|
|
|
|
redis:
|
|
enabled: true
|
|
name: redis
|
|
fullnameOverride: redis
|
|
architecture: standalone
|
|
usePassword: true
|
|
auth:
|
|
password: "b10e20323896054ddacbafffa6b3d71b350c826e6ce3e06f"
|