> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Using the InfisicalConnection CRD

> Learn how to configure the InfisicalConnection CRD to define how the operator connects to your Infisical instance.

## Overview

The **InfisicalConnection** CRD defines how the Infisical Operator connects to your Infisical instance. It holds the instance address and an optional TLS configuration. Once created, it can be referenced by multiple `InfisicalAuth` CRDs so you only need to define connection details once per Infisical instance.

### Prerequisites

* The operator is installed on your Kubernetes cluster.
* Access to an Infisical instance (cloud or self-hosted).

## Example

```yaml infisical-connection.yaml theme={"dark"}
apiVersion: secrets.infisical.com/v1beta1
kind: InfisicalConnection
metadata:
  name: my-infisical-connection
spec:
  address: https://app.infisical.com
  # tls:
  #  caCertificate:
  #   name: secret-containing-ca-certificate
  #   key: ca.crt
  #   namespace: default
```

Apply the resource:

```bash theme={"dark"}
kubectl apply -f infisical-connection.yaml
```

## CRD properties

> [accordion] address
>
> The URL of the Infisical API to connect to.
>
> When `address` isn't defined, the operator connects to the address defined by the Helm value `hostAPI`.
>
> For self-hosted instances, set this to `https://your-self-hosted-instance.com`.

> [accordion] tls
>
> This block defines TLS settings for connecting to the Infisical instance.

> [accordion] tls.caCertificate
>
> A reference to a Kubernetes secret containing a CA certificate for SSL/TLS connections.
>
> * `name`: Name of the Kubernetes secret containing the CA certificate.
> * `namespace`: Namespace of the Kubernetes secret containing the CA certificate.
> * `key`: The key within the secret that holds the CA certificate value.
>
> ```yaml theme={"dark"}
> tls:
>   caCertificate:
>     name: secret-containing-ca-certificate
>     namespace: default
>     key: ca.crt
> ```

## Troubleshooting

You can check the status of your `InfisicalConnection` resource by inspecting its conditions:

```bash theme={"dark"}
kubectl get infisicalconnection my-infisical-connection -o jsonpath='{.status.conditions}' | jq
```

When the connection is healthy, the `secrets.infisical.com/IsReady` condition will have `Status: "True"` and `Reason: "OK"`.

If the connection is unhealthy, `Reason` will be set to `Error` and `Message` will contain details about what went wrong.

The `ObservedGeneration` field indicates which generation of the resource spec the operator has last processed. If `ObservedGeneration` is less than `metadata.generation`, the operator hasn't yet reconciled the latest changes to the resource.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.