Infisical operator syncs root secrets instead of the sub-path in secretsPath

TL;DR

Fix: create a new service token whose path is literally / (self-hosted Infisical has no "grant sub-folder access" checkbox - just type / in the path field), then update the auth Secret (key infisicalToken) the operator reads.

Steps

1. Per the Infisical operator notes: a service token scoped to / ignores the CRD secretsPath and always returns root secrets. Scope the token to / (or /myapp/ for isolation) to make sub-path folders work.

When to use

You are seeing this: Per the Infisical operator notes: a service token scoped to / ignores the CRD secretsPath and always returns root secrets. Use this skill when you run into "Infisical operator syncs root secrets instead of the sub-path in secretsPath".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Edge cases

• Note the operator does not isolate sub-paths from root by default, so scoping the token to /myapp/ keeps one app from inheriting every root secret.

Source: Problem: An InfisicalSecret CRD sets secretsPath to /app-name, but the synced Kubernetes Secret contains the root / secrets instead. Cause: the service token used by the operator is scoped to the path / rather than /. A token scoped to / always returns root secrets no matter what secretsPath the CRD specifies. Fix: create a new service token whose path is literally / (self-hosted Infisical has no "grant sub-folder access" checkbox - just type / in the path field), then update the auth Secret (key infisicalToken) the operator reads. Note the operator does not isolate sub-paths from root by default, so scoping the token to /myapp/ keeps one app from inheriting every root secret.

Verified resolution: Per the Infisical operator notes: a service token scoped to / ignores the CRD secretsPath and always returns root secrets. Scope the token to / (or /myapp/ for isolation) to make sub-path folders work.

Source URL: https://github.com/bnaylor/agent_skills/blob/HEAD/infisical-pro/SKILL.md