docs(agent-proxy): document machine identity auth methods for start and connect - #7606
Conversation
…nd connect The pages said Universal Auth was the only way both commands could authenticate. Covers --auth-method and the per-method credentials on each subcommand, --token on start, and adds Kubernetes and EC2 deployment tabs. The quickstart stays on Universal Auth with a pointer to the rest. Also records two things the pages never said: that with the ambient methods it is the auth method's own configuration, not possession of a secret, that keeps the proxy identity separate from the agents'; and that jwt-auth and oidc-auth reuse the same JWT at every refresh, so a short-lived one will not survive.
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Workflows to automatically generate PRs for you. |
|
💬 Discussion in Slack: #pr-review-infisical-7606-docs-agent-proxy-document-machine-identity-auth-methods Posted by Review Police — reviews, comments, new commits, and CI failures will stream into this channel. |
|
| Filename | Overview |
|---|---|
| docs/cli/commands/agent-proxy.mdx | Adds comprehensive start and connect authentication reference material; no concrete defect was established from repository-local contracts. |
| docs/documentation/platform/agent-proxy/quickstart/standalone-proxy.mdx | Adds an alternative-authentication cross-reference, but its anchor lands above the section containing the promised method guidance. |
| docs/documentation/platform/agent-proxy/standalone-agent-proxy.mdx | Expands configuration and deployment guidance with Kubernetes and EC2 examples and explicit cloud-auth isolation warnings. |
Reviews (1): Last reviewed commit: "docs(agent-proxy): document machine iden..." | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 392e8909b3
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
The isolation note named only the AWS and Kubernetes fields while the deployment tabs recommend Azure and GCP too, which have the same guards and enforce them only when set. Lists all four as a table instead. The quickstart's auth methods link pointed at Agent authentication; the list of methods is under The two commands.
1 participant
Context
Docs for Infisical/cli#357, which lets
agent-proxy startandagent-proxy connectauthenticate with any machine identity auth method, not just Universal Auth.The pages said Universal Auth was the only option in several places, so all of those are updated. The quickstart still uses Universal Auth, since it works on any host and is the simplest way to start, with a pointer to the other methods.
What changed, page by page
docs/cli/commands/agent-proxy.mdx--auth-method,--machine-identity-id,--organization-slugand the per-method credential flags, on bothstartandconnect--tokenonstart, and a note that it takes precedence over--auth-methodconnectsection now says the credentials are scrubbed from the agent's environment whichever method they belong to, and that the agent's token is frozen at launchdocs/documentation/platform/agent-proxy/standalone-agent-proxy.mdxdocs/documentation/platform/agent-proxy/quickstart/standalone-proxy.mdxTwo things the pages did not say before, and now do:
kubernetes,aws-iam,azureandgcp-id-tokenthere is no secret keeping the proxy identity separate from the agent identities, and the machine identity id is not a secret either. What keeps them separate is the auth method's own configuration. So the deployment section now says to scope Allowed Principal ARNs or Allowed Namespaces to the proxy host only. If you leave them empty, any host in the same account or cluster, including agent hosts, can authenticate as the proxy and read every secret it can read.jwt-authoroidc-authwith a short-lived JWT.Screenshots
Steps to verify the change
Type
Checklist
type(scope): short description(scope is optional, e.g.,fix: prevent crash on syncorfix(api): handle null response).