Helm Improvements: While trying to deploy a HA Infisical on Kubernetes with a

cloudnative-pg

postgres instance with TLS/SSL, there is a limitation I wanted to address with the “secret zero” & injecting custom CA for TLS verification. Currently you have to define the

DATABASE_CONNECTION_URI

and

REDIS_URL

as a string, which can be insecure, but you can turn the string into a secret, and pass the url as a secret. However, when you have to rotate your secrets, you will need also need to update the URI, and you don’t want the URI to hold your password, which can be easily decoded. I wanted to make this process more seamless, so the downtime between the secrets rotating and the connection between Infisical & DB updating is just 2 steps, rotate secret and then restart the deployment. To address this, I’ve opened a PR to improve the helm templating language to dynamically create URI based on configs provided, which works really well for me to be able to deploy Infisical in my K8s environment: https://github.com/Infisical/infisical/pull/3413 I would love some feedback from the team on the PR, if there is any room for improvement and I would love for this PR to be integrated so I can peacefully pull the chart to make upgrades haha. Some next step improvements from this PR would be to implement automating the

DB_READ_REPLICAS=[{"DB_CONNECTION_URI":""}]

based on a list of configs for read replicas.