feat(gateway): add --enroll-method=kubernetes - #353
Open
bernie-g wants to merge 1 commit into
Open
Conversation
|
💬 Discussion in Slack: #pr-review-cli-353-feat-gateway-add-enroll-method-kubernetes Posted by Review Police — reviews, comments, new commits, and CI failures will stream into this channel. |
11 tasks
Contributor
|
| Filename | Overview |
|---|---|
| packages/cmd/gateway.go | Wires Kubernetes enrollment into gateway startup, token selection, persistence of non-secret state, validation, and systemd rejection. |
| packages/gateway-v2/kubernetes_auth.go | Reads and validates the projected service-account token before exchanging it for a gateway access token. |
| packages/api/api.go | Adds the typed Kubernetes gateway login API operation using the shared HTTP client and error handling. |
| packages/api/model.go | Adds request and response DTOs matching the Kubernetes gateway login exchange. |
| packages/gateway-v2/constants.go | Adds the Kubernetes gateway enrollment-method discriminator. |
Reviews (1): Last reviewed commit: "feat(gateway): add --enroll-method=kuber..." | Re-trigger Greptile
Reads the projected service account token of the pod the gateway runs in and exchanges it for a gateway access token via POST /v3/gateways/login. Infisical verifies the token against the cluster's TokenReview API, so nothing has to be distributed to the cluster. - New LoginGatewayWithKubernetes, with --service-account-token-path to override the default projected token mount. - --enroll-method is now validated, so an unknown value fails with a clear message instead of silently falling through to the machine identity path. - Like AWS auth, no token is written to disk: a fresh one is minted on every start, so only the gateway id and domain are persisted. - Rejected for systemd installs, since in-cluster gateways are not managed by systemd, with a message pointing at the container command instead.
bernie-g
force-pushed
the
bernie/pam-341-add-kubernetes-auth-support-for-gateway-enrollment
branch
from
August 4, 2026 17:54
219198b to
32295a0
Compare
bernie-g
added a commit
to Infisical/infisical
that referenced
this pull request
Aug 4, 2026
Bumps image.tag from 0.43.84 to 0.43.118, and the two places the helm docs mirror it. 0.43.118 does not exist yet: it is the next release after v0.43.117 and needs to be the one that carries Infisical/cli#353, so this has to be confirmed when that release is cut.
carlosmonastyrski
approved these changes
Aug 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description 📣
Adds
--enroll-method=kubernetestoinfisical gateway start. The gateway reads its pod's projected service account token and exchanges it for a gateway access token; Infisical verifies it against the cluster's TokenReview API, so no credential has to be distributed to the cluster. Nothing is written to disk, so a fresh token is minted on every start. Rejected for systemd installs, since in-cluster gateways aren't systemd-managed.Backend side: Infisical/infisical (same branch name). PAM-341.
Type ✨
Tests 🛠️
Ran in a local kind cluster via the Helm chart. Gateway authenticated, connected through a relay, and reported healthy. Also verified re-auth on pod restart, recovery after revoke, and rejection of wrong namespace / wrong service account / non-service-account / malformed tokens.