helm-external-secrets/docs/snippets/infisical-generic-secret-store.yaml

apiVersion: external-secrets.io/v1
kind: SecretStore
metadata:
  name: infisical
spec:
  provider:
    infisical:
      # Optional. Base URL of your Infisical instance (without the /api suffix
      # -- the operator appends it automatically). Omit to use Infisical Cloud.
      # For self-hosted instances use your instance URL, e.g. https://infisical.example.com
      hostAPI: https://app.infisical.com

      # Optional: PEM-encoded CA bundle for self-hosted instances with private CAs.
      # caBundle: "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0t..."

      # Optional: Reference to Secret or ConfigMap containing CA certificate.
      # Mutually exclusive with caBundle.
      # caProvider:
      #   type: Secret  # or ConfigMap
      #   name: infisical-ca
      #   key: ca.crt
      #   # namespace is required for ClusterSecretStore
      #   # namespace: external-secrets

      auth:
        universalAuthCredentials:
          clientId:
            key: clientId
            name: universal-auth-credentials
          clientSecret:
            key: clientSecret
            name: universal-auth-credentials
      secretsScope:
        projectSlug: first-project-fujo
        # "dev", "staging", "prod", etc.
        environmentSlug: dev
        # Optional (default: `/`).
        #
        # Secrets will only be retrieved from this path for `data` and `dataFrom` rules. When a
        # `data` `remoteRef` uses a path (e.g. `/foo/bar`), that reference will use an absolute
        # reference and disregard this default.
        #
        # If you need to prevent access to secrets outside of this path, rely on instead setting
        # Access Controls in Infisical.
        secretsPath: /
        # Optional (default: false).
        #
        # When recursive is enabled, secrets retrieved using `dataFrom` patterns will fetch all secrets recursive.
        recursive: false
        # optional
        expandSecretReferences: false # Default is true