InfisicalStaticSecret ignores custom CA configured in InfisicalConnection #7812

Product

Secret Manager

Describe the bug

When using a self-hosted Infisical deployment secured by a private/internal CA hierarchy, the operator successfully validates connectivity and authentication but fails to reconcile InfisicalStaticSecret resources with a TLS trust error.

The configured InfisicalConnection references a CA bundle via:

spec:
  tls:
    caCertificate:
      name: infisical-ca
      namespace: <namespace>
      key: ca.crt

The connection becomes healthy:

InfisicalConnection   Ready=True

and authentication succeeds:

InfisicalAuth         Ready=True

Operator logs show successful Kubernetes authentication and credential caching:

successful authentication with "kubernetes"
Reusing cached authentication

However, InfisicalStaticSecret reconciliation fails:

InfisicalStaticSecret Synced=False

with the following error:

failed to fetch secrets:
unable to fetch all secret sources:
failed to list secrets:

tls: failed to verify certificate:
x509: certificate signed by unknown authority

Why This Appears Unexpected

The CA bundle configured in the InfisicalConnection has been independently validated.

Using the exact CA bundle stored in the Kubernetes Secret:

curl --cacert ca.pem https://<infisical-host>/api/status

returns:

SSL certificate verify ok
HTTP/2 200

and the exact API endpoint used by the operator also validates successfully:

curl --cacert ca.pem \
  "https://<infisical-host>/api/v4/secrets?..."

returns:

SSL certificate verify ok
HTTP/2 401 Unauthorized

The 401 Unauthorized response is expected because no authentication token was supplied. The important observation is that TLS verification succeeds successfully using the same CA bundle referenced by InfisicalConnection.

Expected Behaviour

The CA certificate configured on the InfisicalConnection should be used

To Reproduce

1. Deploy a self-hosted Infisical instance using a certificate issued by a private/internal certificate authority.

2. Create a Kubernetes Secret that contains the CA certificate chain used to validate the Infisical endpoint.

apiVersion: v1
kind: Secret
metadata:
  name: infisical-ca
  namespace: <namespace>
type: Opaque
stringData:
  ca.crt: |
    -----BEGIN CERTIFICATE-----
    ...
    -----END CERTIFICATE-----

3. Create an InfisicalConnection referencing the CA certificate.

apiVersion: secrets.infisical.com/v1beta1
kind: InfisicalConnection
metadata:
  name: self-hosted-infisical
spec:
  address: https://<infisical-host>

  tls:
    caCertificate:
      name: infisical-ca
      namespace: <namespace>
      key: ca.crt

4. Verify that the connection becomes healthy.

kubectl get infisicalconnection

Expected:

READY=True

5. Create an InfisicalAuth using Kubernetes authentication.

apiVersion: secrets.infisical.com/v1beta1
kind: InfisicalAuth
...

6. Verify that authentication becomes healthy.

kubectl get infisicalauth

Expected:

READY=True

7. Create an InfisicalStaticSecret referencing the authentication resource.

apiVersion: secrets.infisical.com/v1beta1
kind: InfisicalStaticSecret
...

8. Observe the InfisicalStaticSecret status and operator logs.

kubectl describe infisicalstaticsecret <name>
kubectl logs -n infisical-operator deployment/<operator-deployment>

Actual Result

InfisicalStaticSecret reconciliation fails with:

failed to fetch secrets:
unable to fetch all secret sources:
failed to list secrets:

tls: failed to verify certificate:
x509: certificate signed by unknown authority

Additional Validation

The same CA bundle referenced by the InfisicalConnection successfully validates the Infisical endpoint:

curl --cacert ca.pem https://<infisical-host>/api/status

Result:

SSL certificate verify ok
HTTP/2 200

The same CA bundle also successfully validates the exact secrets API endpoint used by the operator:

curl --cacert ca.pem \
  "https://<infisical-host>/api/v4/secrets?environment=<env>&projectId=<id>&recursive=false&secretPath=<path>"

Result:

SSL certificate verify ok
HTTP/2 401 Unauthorized

The 401 Unauthorized response is expected

Expected behavior

When an InfisicalConnection is configured with a valid CA bundle using:

spec:
  tls:
    caCertificate:
      name: infisical-ca
      namespace: <namespace>
      key: ca.crt

all operator communication with the Infisical API should use that CA bundle consistently.

If InfisicalConnection reports:

Ready=True

and InfisicalAuth reports:

Ready=True

then InfisicalStaticSecret reconciliation should be able to establish a trusted TLS connection to the Infisical API using the same CA bundle.

For private PKI deployments, the following workflow should succeed:

InfisicalConnection   Ready=True
InfisicalAuth         Ready=True
InfisicalStaticSecret Synced=True

and the target Kubernetes Secret should be created or updated successfully.

A CA bundle that successfully validates:

• /api/status
• /api/v4/secrets

outside of the operator should also be sufficient for secret synchronization within the operator.

The operator should not return:

x509: certificate signed by unknown authority

when the configured CA bundle is capable of successfully validating the certificate chain presented by the Infisical endpoint.

Screenshots

No response

Deployment Type

Self-hosted

Additional context

No response