Installation
1
Add the Helm repository
helm repo add infisical-helm-charts 'https://dl.cloudsmith.io/public/infisical/helm-charts/helm/charts/'
helm repo update
2
Install the chart
- Token Auth
- AWS Auth
- Kubernetes Auth
helm install infisical-gateway infisical-helm-charts/infisical-gateway \
--namespace infisical-gateway \
--create-namespace \
--set gateway.name=<gateway-name> \
--set gateway.enrollment.method=token \
--set gateway.enrollment.token.value=<enrollment-token> \
--set gateway.domain=https://app.infisical.com
The enrollment token is single-use and expires in 1 hour. Persistent storage (enabled by default) is required so credentials survive pod restarts.
helm install infisical-gateway infisical-helm-charts/infisical-gateway \
--namespace infisical-gateway \
--create-namespace \
--set gateway.name=<gateway-name> \
--set gateway.enrollment.method=aws \
--set gateway.enrollment.aws.gatewayId=<gateway-id> \
--set gateway.domain=https://app.infisical.com \
--set serviceAccount.annotations."eks\.amazonaws\.com/role-arn"=arn:aws:iam::<account-id>:role/<role-name>
helm install infisical-gateway infisical-helm-charts/infisical-gateway \
--namespace infisical-gateway \
--create-namespace \
--set gateway.name=<gateway-name> \
--set gateway.enrollment.method=kubernetes \
--set gateway.enrollment.kubernetes.gatewayId=<gateway-id> \
--set gateway.domain=https://app.infisical.com
system:auth-delegator ClusterRole by default, which is what lets that token be reviewed.The release namespace and service account name must match the allowlists configured on the
gateway in Infisical. With the command above those are
infisical-gateway and
infisical-gateway. See Gateway Deployment
for the full configuration.3
Verify the deployment
kubectl get pods -n infisical-gateway
Uninstall
helm uninstall infisical-gateway --namespace infisical-gateway
Configuration reference
| Parameter | Default | Description |
|---|---|---|
gateway.name | "" | Name of the gateway as created in the Infisical UI. |
gateway.domain | "" | Infisical instance URL (e.g., https://app.infisical.com). |
gateway.enrollment.method | "" | Enrollment method: token, aws, or kubernetes. |
gateway.enrollment.token.value | "" | Inline enrollment token. Mutually exclusive with existingSecretRef. |
gateway.enrollment.token.existingSecretRef | "" | Kubernetes secret containing the enrollment token. |
gateway.enrollment.token.secretKey | "enrollment-token" | Key in the secret that holds the token. |
gateway.enrollment.aws.gatewayId | "" | Gateway ID from the Infisical UI. Required for AWS auth. |
gateway.enrollment.kubernetes.gatewayId | "" | Gateway ID from the Infisical UI. Required for Kubernetes auth. |
gateway.enrollment.kubernetes.serviceAccountTokenPath | "" | Override the projected service account token path. Defaults to /var/run/secrets/kubernetes.io/serviceaccount/token. |
gateway.enrollment.kubernetes.externalTokenReview | false | Set true when TokenReview permission comes from outside this chart, either a token reviewer JWT configured in Infisical or a binding you manage. Required to install with serviceAccount.createAsAuthDelegator disabled. |
gateway.enrollment.credentialsSecretRef | "" | Kubernetes secret with credentials injected as env vars. |
gateway.relayName | "" | Specific relay to connect to. Empty for automatic selection. |
persistence.enabled | true | Enable persistent storage. Required for token auth, optional for AWS and Kubernetes auth. |
persistence.storageClass | "" | Storage class for the PVC. |
persistence.size | 5Gi | PVC size. |
persistence.existingClaim | "" | Use an existing PVC. |
image.repository | infisical/cli | Container image. |
image.tag | "0.43.123" | Image tag. |
resources.requests.cpu | 100m | CPU request. |
resources.requests.memory | 128Mi | Memory request. |
resources.limits.cpu | 500m | CPU limit. |
resources.limits.memory | 128Mi | Memory limit. |
serviceAccount.create | true | Create a service account. |
serviceAccount.annotations | {} | Service account annotations (e.g., IRSA role ARN). |
nodeSelector | {} | Node selector. |
tolerations | {} | Pod tolerations. |
affinity | {} | Pod affinity rules. |
extraEnv | [] | Extra environment variables for the gateway container. |
extraEnvFrom | [] | Load environment variables from Secrets or ConfigMaps. |
extraArgs | [] | Extra arguments appended to the gateway container command. |
extraObjects | [] | Extra Kubernetes manifests to deploy with this chart. |
Default Helm values
image:
repository: infisical/cli
tag: "0.43.123"
pullPolicy: IfNotPresent
# Machine identity flow: name of the K8s Secret containing env vars like INFISICAL_AUTH_METHOD, etc.
# Only used when gateway.enrollment.method is unset.
secret:
name: "infisical-gateway-environment"
gateway:
# Name of the gateway created in the Infisical UI. Required when enrollment.method is set.
name: ""
# Infisical instance URL (e.g. https://app.infisical.com). Required when enrollment.method is set.
domain: ""
enrollment:
# Enrollment method: "token", "aws", or "kubernetes".
# Leave empty to use the legacy machine identity flow (env vars from secret.name).
method: ""
# Token enrollment settings (method=token)
token:
# Inline enrollment token value. Mutually exclusive with existingSecretRef.
value: ""
# Name of an existing K8s Secret containing the enrollment token.
existingSecretRef: ""
# Key within the secret that holds the enrollment token.
secretKey: "enrollment-token"
# AWS enrollment settings (method=aws)
aws:
# Required when method=aws. Gateway ID from the Infisical UI.
gatewayId: ""
# Kubernetes enrollment settings (method=kubernetes).
kubernetes:
# Required when method=kubernetes. Gateway ID from the Infisical UI.
gatewayId: ""
# Path to the projected service account token. Only override for a non-default mount.
serviceAccountTokenPath: ""
# Set true only if TokenReview permission comes from somewhere other than this chart: a token
# reviewer JWT configured on the gateway in Infisical, or a binding you manage yourself.
# Required to install with serviceAccount.createAsAuthDelegator disabled.
externalTokenReview: false
# Name of a K8s Secret whose key-value pairs are injected as env vars.
# Use this to provide credentials for the enrollment method (e.g. AWS keys, GCP credentials).
# Not needed when credentials are provided via workload identity (IRSA, GCP Workload Identity, etc.).
credentialsSecretRef: ""
# Specific relay to connect to. Leave empty for automatic selection.
relayName: ""
pamSessionRecordingsDirectory: /var/lib/infisical/session_recordings
# Persistent storage for the gateway (credentials and session recordings).
# Required when enrollment.method=token so credentials survive pod restarts.
# Optional when enrollment.method=aws or enrollment.method=kubernetes, since both re-authenticate
# on every start.
# For legacy machine-identity installs (no enrollment.method), persistence only takes effect
# when existingClaim is provided.
persistence:
enabled: true
storageClass: ""
size: 5Gi
accessModes:
- ReadWriteOnce
existingClaim: ""
resources:
limits:
cpu: 500m
memory: 128Mi
requests:
cpu: 100m
memory: 128Mi
imagePullSecrets: []
nameOverride: ""
fullnameOverride: ""
serviceAccount:
create: true
automount: true
createAsAuthDelegator: true
annotations: {}
name: ""
podAnnotations: {}
podLabels: {}
podSecurityContext:
runAsNonRoot: true
fsGroup: 1000
securityContext:
runAsNonRoot: true
runAsUser: 1000
affinity: {}
tolerations: {}
nodeSelector: {}
service:
type: ClusterIP
port: 80
ingress:
enabled: false
# Extra environment variables for the gateway container
extraEnv: []
# - name: LOG_LEVEL
# value: debug
# - name: MY_SECRET
# valueFrom:
# secretKeyRef:
# name: my-secret
# key: my-key
# Load environment variables from Secrets or ConfigMaps
extraEnvFrom: []
# - secretRef:
# name: my-secret
# - configMapRef:
# name: my-configmap
# Extra arguments appended to the gateway container command
extraArgs: []
# - --log-level=debug
# Extra Kubernetes manifests to deploy with this chart
extraObjects: []