Multi-Path Secret Injection

[slothyrulez]

Feature description

Add the ability to inject secrets from multiple paths in a single infisical run command.

Proposed usage:

infisical run --path="/" --path="/common" --path="/app1" -- npm run dev

This would allow secrets to be loaded from multiple paths. The system can use a precedence system based on the ordering of the --path arguments, where earlier paths override later ones for colliding keys. For example, if the same key exists in /common and /app1, the value
from /common would be used since it appears before in the command, (or the other side).

Why would it be useful?

With monorepo applications, this feature becomes essential for organizing secrets and sharing common ones across multiple applications.

Benefits:

• Avoid duplication: Define shared secrets once in a common path instead of duplicating them across application-specific paths
• Better organization: Create a clear hierarchical structure (e.g., /common for shared secrets, /app1, /app2 for app-specific ones)
• Easier maintenance: Update common secrets in one place rather than across multiple paths
• Reduced errors: Eliminate manual duplication that leads to inconsistencies
• Scalability: Manage secrets efficiently as the number of applications and environments grows
• Flexible overrides: Application-specific paths can override common values when needed, thanks to the precedence system

Additional context

We have a common monorepo application that holds various applications (app1, app2, app3,...). These apps share around 75% of secrets. We have almost 20 environments, each one with /app1, /app2, and /app3 folders.

Current problem: We must duplicate ~75% of our secrets across 3 applications x environments. Any change to a shared secret requires updating it in a lot of places.

Desired structure:
/ # Common shared secrets (DATABASE_URL, REDIS_URL, etc.)
/app1 # App1-specific overrides and unique secrets
/app2 # App2-specific overrides and unique secrets
/app3 # App3-specific overrides and unique secrets

Desired usage:

  infisical run --path="/" --path="/common" --path="/app1" -- npm run start:app1
  infisical run --path="/" --path="app2"  -- npm run start:app2
...

Precedence example:
If DATABASE_URL exists in both / and /app2, the value from / will be used since it's specified before, allowing for environment-specific overrides while maintaining shared defaults.

[nagxsan]

Can I please work on this issue?

[slothyrulez]

@nagxsan if you know how to implement it, why not?

[nagxsan]

Thanks will try this and let you know the update

[kyzyl]

For simplicity when using the CLI, I would like this feature as well. Path could be passed as a list, or allow glob matching paths like you can do in the policies. However there are two workarounds I've found:

1. Where possible, use one of the SDKs rather than the CLI. You can do things like recursive fetches for filter on tags. But this is not always possible.
2. Create a folder and use that as a "view". So if you have app1 that needs secrets from / and /common, create a folder /app1 containing all the secrets needed, with values referencing to ${dev.<secret>} or ${dev.common.<secret>}. Then app1 will run with infisical run --path="/app1" -- <cmd> and any updates to the secret values will propagate across 'views' (apps) and environments automatically.

[akhilmhdh]

You can also use the secret import feature to pull secrets from a shared folder.

Another workaround is to use export with template. Just remember to load it in memory after exporting. The SDK is also a good option.

Regarding the issue with multiple paths in the run command, I understand that it works for one scenario, but what about when you have multiple environments? Developers often use environments as a common place to store things. I believe that having a single path and environment provides the most flexibility vs complexity trade off in here, allowing you to easily chain your commands together.

Moving this to a feature request discussion, as this is not an issue from Infisical cli. Feel free to up vote if you feel this is a really required addition.

[slothyrulez]

allowing you to easily chain your commands together

Interensting, so somethig like:

infisical run --path="/" -- infisical run --path="/common" -- infisical run --path="/app1" -- npm run start:app1

will be equivalent to:

infisical run --path="/" --path="/common" --path="/app1" -- npm run start:app1

Is it true? is it valid?(probably the order should be inverted so latest path keys, overwrite early equal ones)
If thats the case, then just document it, will be the solution!

[1hachem]

Here is a script that I created with infisical node sdk that would allow for mutli-path run

https://gist.github.com/1hachem/9b1d387f007805a6bd5133c779d0fbe9

[akhilmhdh]

This is now supported in v0.43.82 🔥

[1hachem]

noiice!