The Infisical Kubernetes Operator: Sync Secrets into Your Cluster
Most teams already have a way to get secrets into Kubernetes. This video is about the first-party Infisical Kubernetes Operator: what it is, how it works, and how to deploy it, aimed at platform engineers who are already running something like External Secrets Operator or Vault. We focus on the sync-in flow, where Infisical is the source of truth and the operator keeps your secrets available as native Kubernetes Secrets, updated automatically after rotations. You'll see the three resources the operator is built around (InfisicalConnection, InfisicalAuth, and InfisicalStaticSecret), a Helm install, AWS IAM authentication on EKS, secret rotation with built-in auto-reload, and where this lands if you're coming from ESO or Vault. Pushing secrets back to Infisical and dynamic secrets each get their own video. Chapters: 00:00 - Overview of the Infisical Kubernetes Operator 00:24 - The Three Core Resources (Connection, Auth, Secret) 00:45 - How the Operator Works at Runtime 00:58 - Comparison to External Secrets Operator (ESO) 01:20 - Capabilities: Sync, Push, and Dynamic Secrets 01:35 - Installation with Helm 02:01 - Step 1: Defining the InfisicalConnection 02:20 - Step 2: Defining the InfisicalAuth (AWS IAM Example) 03:06 - Step 3: Defining the InfisicalStaticSecret 03:31 - Templating and Formatting Secret Output 04:03 - Consuming Secrets in a Deployment 04:11 - Automatic Rotation and Reloading (Auto-reload) 04:55 - Why use the First-Party Operator vs. ESO? 05:21 - Migrating from HashiCorp Vault 05:38 - Security, Scoping, and Observability 06:03 - Summary and Next Steps Resources: Kubernetes Operator overview and install: https://infisical.com/docs/integrations/platforms/kubernetes/overview InfisicalConnection: https://infisical.com/docs/integrations/platforms/kubernetes/infisical-connection-crd InfisicalAuth: https://infisical.com/docs/integrations/platforms/kubernetes/infisical-auth-crd InfisicalStaticSecret: https://infisical.com/docs/integrations/platforms/kubernetes/infisical-static-secret-crd Migrating from Vault to Infisical: https://infisical.com/docs/documentation/platform/external-migrations/vault Mounting secrets as files (CSI driver): https://infisical.com/docs/integrations/platforms/kubernetes-csi Agent injector: https://infisical.com/docs/integrations/platforms/kubernetes-injector Follow Infisical: Website: https://infisical.com LinkedIn: https://www.linkedin.com/company/infisical GitHub: https://github.com/Infisical Twitter / X: https://x.com/infisical Slack: https://infisical.com/slack