Doppler-like secrets structure

[artyom-p]

Hi, is it possible to have a base secret that can be then overridden by multiple child branches like in Doppler?

We have a multi-tenant application that requires the same set of keys for every tenant, some values are different some are not.
In Doppler, we can define a base with some standard key/values and for tenants that required different settings, we can override the base with a child key/values, that simplifies secret management a lot and also makes the overview much easier to understand.

Is something like that planned or already exists in Infisical?

[dangtony98]

Hey @artyom-p!

You can achieve this behavior with folders or path-based secret storage — you can read about it here; here are the Infisical docs for it.

Essentially, for each tenant, you can create a folder with the tenant's id; you can then store the keys for that tenant in that folder. When you do need the keys for a particular tenant, you can query for that folder or whatever path you chose to store the secrets in.

It'd be up to you to define the folder hierarchy in whatever way best fits your use-case.

[maidul98]

You can create a base set of secrets and override them with the help of folders and import feature mentioned here https://infisical.com/docs/documentation/platform/secret-reference#import-entire-folders

[artyom-p]

Hmm, that doesn't work...

tenants/
tenant1/
tenant2/
tenant3/

As our applications are multitenant they need to know about all the tenants and their settings. I expect the following behavior:

token path: /tenants
fetching all items by path /tenants returns all the tenants secrets.

Actual behavior - it returns empty array.

Seems like it works only with actual secrets, not folders.

[maidul98]

are you trying to place the base secrets in the /tenants folder and then trying to import them into /tenant1 /tenant2, etc?

[artyom-p]

We plan to do that, but in a current test case /tenants folder contains only folders, and then /tenantX containst actual keys

[artyom-p]

just for a reference, now we have yaml configs in the format:

tenants:
   tenant1:
      section1:
      section2:
      sectionN:
   tenant2:
      section1:

[maidul98]

I think it may be more easier if we chat for a bit to see how we can structure your secrets. You can sign up on my calendar for support https://calendly.com/maidull/30min?month=2023-08