🔐 技術調査 - Infisical

Root Encryption Key - 256-bit AES
  └─ オペレーターが環境変数で提供。HSM連携も可能
     └─ Internal KMS Root Key - 256-bit AES
          └─ インスタンス初回起動時に自動生成、DBに暗号化保存
               ├─ Organization Data Key - 256-bit AES
               │    └─ SSO設定・Machine Identity・SCIM設定を保護
               └─ Project Data Key - 256-bit AES
                    └─ シークレット・証明書・APIキーを保護

# 1. 設定ファイルを取得
curl -o docker-compose.prod.yml \
  https://raw.githubusercontent.com/Infisical/infisical/main/docker-compose.prod.yml
curl -o .env \
  https://raw.githubusercontent.com/Infisical/infisical/main/.env.example

# 2. 暗号化キーを生成して .env に設定
export ENCRYPTION_KEY=$(openssl rand -base64 32)
export AUTH_SECRET=$(openssl rand -base64 32)
export DB_PASSWORD=$(openssl rand -base64 32)

# 3. サービス起動
docker compose -f docker-compose.prod.yml up -d

# 4. 起動確認
curl -s http://localhost:80/api/status

version: '3.9'

services:
  backend:
    image: infisical/infisical:latest
    ports:
      - "80:8080"
    depends_on: [postgres, redis]
    environment:
      - NODE_ENV=production
      - ENCRYPTION_KEY=${ENCRYPTION_KEY}
      - AUTH_SECRET=${AUTH_SECRET}
      - DB_CONNECTION_URI=postgres://infisical:${DB_PASSWORD}@postgres:5432/infisical
      - REDIS_URL=redis://redis:6379
      - SITE_URL=https://infisical.yourdomain.com
      - SMTP_HOST=${SMTP_HOST}
      - SMTP_PORT=${SMTP_PORT}
      - SMTP_USERNAME=${SMTP_USERNAME}
      - SMTP_PASSWORD=${SMTP_PASSWORD}

  postgres:
    image: postgres:14-alpine
    environment:
      - POSTGRES_USER=infisical
      - POSTGRES_PASSWORD=${DB_PASSWORD}
      - POSTGRES_DB=infisical

  redis:
    image: redis:7-alpine

# 1. 名前空間を作成
kubectl create namespace infisical

# 2. Helm リポジトリを追加
helm repo add infisical-helm-charts \
  'https://dl.cloudsmith.io/public/infisical/helm-charts/helm/charts/'
helm repo update

# 3. シークレットを作成
kubectl create secret generic infisical-secrets \
  --from-literal=AUTH_SECRET="<auth-secret>" \
  --from-literal=ENCRYPTION_KEY="<encryption-key>" \
  --from-literal=DB_CONNECTION_URI="<db-uri>" \
  --from-literal=REDIS_URL="<redis-url>" \
  --from-literal=SITE_URL="https://infisical.example.com" \
  --namespace infisical

# 4. デプロイ
helm upgrade --install infisical infisical-helm-charts/infisical-standalone \
  --namespace infisical \
  --values values.yaml

infisical:
  image:
    repository: infisical/infisical
    tag: "v0.151.0"
    pullPolicy: IfNotPresent
  replicaCount: 2
  kubeSecretRef: "infisical-secrets"

ingress:
  enabled: true
  hostName: "infisical.example.com"
  ingressClassName: nginx

# macOS
brew install infisical/get-cli/infisical

# Linux (apt)
curl -1sLf 'https://dl.cloudsmith.io/public/infisical/infisical-cli/setup.deb.sh' | sudo bash
sudo apt-get install infisical

# ログイン
infisical login

# プロジェクトに紐付け（.infisical.json を生成）
infisical init

# シークレットをインジェクトしてコマンドを実行
infisical run --env=dev -- npm run dev
infisical run --env=prod -- node server.js

# 複数コマンドをチェーン
infisical run --command "npm install && npm run build && npm start"

# CI/CD 向け（マシンアイデンティティトークン使用）
infisical run --token=$INFISICAL_TOKEN --projectId=<project-id> -- ./deploy.sh

# シークレット変更時にホットリロード
infisical run --watch --watch-interval=30 -- npm run dev

# 特定パスのシークレットを取得
infisical run --path=/backend/api --env=staging -- python app.py

# シークレットを一覧表示
infisical secrets --env=dev

# シークレットを設定
infisical secrets set MY_SECRET=value --env=dev

npm install @infisical/sdk

const { InfisicalSDK } = require("@infisical/sdk");

const client = new InfisicalSDK({
  siteUrl: "https://app.infisical.com"
});

await client.auth().universalAuth.login({
  clientId: "<machine-identity-client-id>",
  clientSecret: "<machine-identity-client-secret>"
});

// シークレットを取得
const secret = await client.secrets().getSecret({
  environment: "dev",
  projectId: "<project-id>",
  secretPath: "/",
  secretName: "DATABASE_URL"
});

console.log(secret.secretValue);

pip install infisicalsdk

from infisical_sdk import InfisicalSDKClient

client = InfisicalSDKClient(host="https://app.infisical.com")
client.auth.universal_auth.login(
    client_id="<machine-identity-client-id>",
    client_secret="<machine-identity-client-secret>"
)

# シークレットを一覧取得
secrets = client.secrets.list_secrets(
    project_id="<project-id>",
    environment_slug="dev",
    secret_path="/"
)

# 特定のシークレットを取得
secret = client.secrets.get_secret_by_name(
    secret_name="DATABASE_URL",
    project_id="<project-id>",
    environment_slug="dev",
    secret_path="/"
)

print(secret.secret_value)

helm repo add infisical-helm-charts \
  'https://dl.cloudsmith.io/public/infisical/helm-charts/helm/charts/'
helm repo update

# クラスター全体にインストール
helm install --generate-name infisical-helm-charts/secrets-operator

# 特定の名前空間にスコープを限定
helm install operator-namespaced infisical-helm-charts/secrets-operator \
  --namespace target-namespace \
  --set scopedNamespaces=target-namespace \
  --set scopedRBAC=true

apiVersion: secrets.infisical.com/v1alpha1
kind: InfisicalSecret
metadata:
  name: my-infisical-secret
  namespace: default
spec:
  hostAPI: https://app.infisical.com/api
  resyncInterval: 60
  authentication:
    universalAuth:
      secretsScope:
        projectSlug: "my-project"
        envSlug: "prod"
        secretsPath: "/"
      credentialsRef:
        secretName: universal-auth-credentials
        secretNamespace: default
  managedSecretReference:
    secretName: my-k8s-secret
    secretNamespace: default

infisical:
  address: "https://app.infisical.com"

auth:
  type: "universal-auth"
  config:
    client-id: "./client-id"
    client-secret: "./client-secret"

sinks:
  - type: "file"
    config:
      path: "/tmp/infisical-token"

templates:
  - source-path: ./secret.template
    destination-path: /app/.env
    config:
      polling-interval: 60s
      execute:
        command: ./reload-app.sh
        timeout: 30

{{- with secret "my-project" "prod" "/" }}
DATABASE_URL={{ .DB_URL }}
API_KEY={{ .API_KEY }}
{{- end }}

infisical agent --config agent-config.yaml

name: Deploy

on:
  push:
    branches: [main]

permissions:
  id-token: write
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: Infisical/secrets-action@v1.0.9
        with:
          method: "oidc"
          identity-id: "your-identity-id"
          project-slug: "your-project-slug"
          env-slug: "prod"

      - name: Use secrets
        run: |
          echo "$DATABASE_URL"

curl -X POST "https://app.infisical.com/api/v1/cert-manager/ca/internal" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "projectSlug": "<your-project-slug>",
    "type": "root",
    "commonName": "My Root CA"
  }'

# Intermediate CA を作成
curl -X POST "https://app.infisical.com/api/v1/cert-manager/ca/internal" \
  -d '{"projectSlug": "<slug>", "type": "intermediate", "commonName": "My Intermediate CA"}'

# Root CA で CSR に署名
curl -X POST "https://app.infisical.com/api/v1/cert-manager/ca/internal/<root-ca-id>/sign-intermediate" \
  -d '{"csr": "<csr>", "notAfter": "2029-06-12"}'

curl -X POST "https://app.infisical.com/api/v1/cert-manager/certificates/<cert-id>/revoke" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -d '{"revocationReason": "UNSPECIFIED"}'

# サーバー側: ホスト登録
infisical ssh add-host \
  --projectId=<project-id> \
  --hostname=<hostname> \
  --write-user-ca-to-file \
  --write-host-cert-to-file \
  --configure-sshd

# クライアント側: SSH 接続
infisical ssh connect \
  --hostname=<host> \
  --login-user=<user>

import { InfisicalSDK, DynamicSecretProviders } from "@infisical/sdk";

const client = new InfisicalSDK();
await client.auth().universalAuth.login({
  clientId: "CLIENT_ID",
  clientSecret: "CLIENT_SECRET"
});

const dynamicSecret = await client.dynamicSecrets().create({
  provider: {
    type: DynamicSecretProviders.Redis,
    inputs: {
      host: "<redis-host>",
      port: 6479,
      username: "<redis-username>",
      password: "<redis-password>",
      creationStatement: "ACL SETUSER {{username}} on >{{password}} ~* &* +@all",
      revocationStatement: "ACL DELUSER {{username}}"
    }
  },
  defaultTTL: "1h",
  maxTTL: "24h",
  name: "redis-dynamic-secret",
  projectSlug: "my-project",
  environmentSlug: "dev"
});

from infisical_sdk import DynamicSecretProviders

dynamic_secret = client.dynamic_secrets.create(
    name="postgres-dev",
    provider_type=DynamicSecretProviders.SQL_DATABASE,
    inputs={
        "client": "postgres",
        "host": "localhost",
        "port": 5432,
        "database": "mydb",
        "username": "admin",
        "password": "admin-password",
        "creationStatement": "CREATE USER \"{{username}}\" WITH PASSWORD '{{password}}';",
        "revocationStatement": "DROP USER \"{{username}}\";"
    },
    default_ttl="1h",
    max_ttl="24h",
    project_slug="my-project",
    environment_slug="dev",
    path="/"
)

curl http://localhost:8080/api/status

OTEL_TELEMETRY_COLLECTION_ENABLED=true
OTEL_EXPORT_TYPE=prometheus

# リソース使用量の確認
kubectl top pods -n infisical

# スロットリングの確認
kubectl describe pod -n infisical <pod-name>

# 全 Pod のログを追跡
kubectl logs -n infisical -l component=infisical -f

# 特定 Pod のログ
kubectl logs -n infisical <pod-name> -f

# クラッシュ前のログ
kubectl logs -n infisical <pod-name> --previous

# Docker/Linux 環境
pg_dump -U <username> -h <db-host> -d <db-name> > infisical_backup.sql

# Kubernetes 環境
kubectl exec -n infisical postgresql-0 -- \
  pg_dump -U infisical infisicalDB > infisical_backup.sql

psql -U <username> -h <db-host> -d <db-name> < infisical_backup.sql

redis-cli SAVE && cp /data/dump.rdb s3://backup-bucket/redis/dump.rdb

# values.yaml
infisical:
  replicaCount: 4

# 動的スケール
kubectl scale deployment -n infisical infisical --replicas=4

DB_READ_REPLICAS=postgres://replica-host:5432/infisical

# 現行バージョンの確認
cat /opt/infisical-core/version-manifest.txt

# DB・Redis の稼働確認
infisical-ctl status

pg_dump -U <username> -h <db-host> -d <db-name> > infisical_backup_$(date +%Y%m%d).sql

# 1. サービス停止
infisical-ctl stop

# 2. パッケージ更新（Debian/Ubuntu）
sudo apt-get update && sudo apt-get install -y infisical-core

# 3. 再設定
infisical-ctl reconfigure

# 4. サービス起動
infisical-ctl start

# 5. 動作確認
infisical-ctl status
infisical-ctl tail

# 1. DB バックアップ
kubectl exec -n infisical postgresql-0 -- \
  pg_dump -U infisical infisicalDB > backup.sql

# 2. values.yaml のイメージタグを更新後、適用
helm upgrade infisical infisical-helm-charts/infisical-standalone \
  --namespace infisical --values values.yaml

# 3. ロールアウト監視
kubectl rollout status deployment/infisical -n infisical

# Helm
helm rollback infisical -n infisical

# Linux パッケージ（Debian/Ubuntu）
infisical-ctl stop
sudo apt-get install -y infisical-core=<previous-version>
psql -U <username> -h <db-host> -d <db-name> < infisical_backup.sql
infisical-ctl reconfigure

get-secrets / create-secret / delete-secret
login-attempt / failed-login
add-member / remove-member
create-service-token / revoke-service-token

curl -X POST "https://app.infisical.com/api/v1/projects/<projectId>/roles" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -d '{
    "slug": "prod-read-only",
    "name": "Production Read Only",
    "permissions": [
      {
        "subject": "secrets",
        "action": ["describeSecret", "readValue"],
        "conditions": {
          "environment": { "$eq": "production" }
        }
      }
    ]
  }'

{
  "subject": "secrets",
  "action": "readValue",
  "conditions": {
    "environment": { "$eq": "production" },
    "secretPath": { "$glob": "/app/db/*" }
  }
}

AUDIT_LOGS_DB_CONNECTION_URI=postgres://audit-db-host:5432/infisical_audit

openssl rand -hex 16       # 暗号化キー
openssl rand -base64 32    # 認証シークレット

docker run \
  --read-only \
  --tmpfs /tmp:rw,exec,size=1G \
  --cap-drop=ALL \
  --memory=1g \
  --cpus=0.5 \
  infisical/infisical:<specific-version>

securityContext:
  runAsNonRoot: true
  runAsUser: 1000
  readOnlyRootFilesystem: true
  allowPrivilegeEscalation: false

ALLOW_INTERNAL_IP_CONNECTIONS=false
CORS_ALLOWED_ORIGINS=https://app.example.com

DB_CONNECTION_URI=postgres://user:pass@host:5432/db?sslmode=require
REDIS_URL=rediss://user:password@redis:6380

# セルフホスト環境
export INFISICAL_API_URL="https://your-infisical.example.com"

# EU Cloud
export INFISICAL_API_URL="https://eu.infisical.com"

curl -I https://app.infisical.com
openssl s_client -connect <relay-ip>:8443

kubectl logs infisical-csi-provider-7x44t
kubectl logs csi-secrets-store-csi-driver-7h4jp -n kube-system

# CLI のデバッグログ
infisical secrets --log-level debug

# Linux パッケージのリアルタイムログ
infisical-ctl tail

# ヘルスエンドポイントの確認
curl -v http://localhost:8080/api/status

# Kubernetes イベントの確認
kubectl describe pod -n infisical <pod-name>
kubectl get events -n infisical --sort-by='.lastTimestamp'