LoginSign Up
← Back to all sparks
I

Infisical

INFRA · APIS
Velocity5.0

Open-source secret management platform for developers

infisical.com ↗

A credential platform assembled two or three pull requests at a time, never a headline

pkipamkmipsecret-rotationui-migration
◆Current state
Infisical is assembling a credential platform rather than a secrets store, with PKI, PAM, KMIP and secret rotation advancing in parallel. No release carries a headline; each version lands two or three pull requests per pillar. The newest, v0.162.21, brings PAM access control improvements, expanded certificate-manager telemetry and a migration of project service tokens onto the v3 UI — the same pattern as the release before it, which added KMIP auto-renewal and removed the legacy environment dashboard.
◆Where it's heading
PKI is furthest along and PAM is the fastest-moving: it has picked up machine identities, Redis as an account type, and now finer access control, following the same absorb-the-identity-model path secrets took. Running underneath everything is the v3 UI migration, which has been consuming one settings surface per release — the environment dashboard, then service tokens. Read as a whole, the changelog describes a product deliberately refusing to announce itself.
◆Prediction
Expect the v3 migration to finish sweeping the remaining project settings surfaces and PAM to keep collecting account types the way PKI collected sync destinations; the expanding certificate-manager telemetry suggests that pillar is being measured before it is expanded.

◆Recent moves

  1. 1d ago

    PAM access control improvements; service tokens migrate to v3

    A routine release in this changelog's idiom: access control improvements in PAM, expanded PostHog coverage for the certificate manager, project service tokens moved onto the v3 UI, and cloud discovery jobs limited. The service-token migration continues the settings-surface-per-release pace of the v3 rewrite, and the telemetry work suggests certificate manager usage is being measured before it is built on.

    View source ↗
  2. 2d ago

    KMIP certificates renew themselves; legacy environment dashboard removed

    KMIP auto-renewal is the PKI thread's next step: certificates issued through the KMIP path no longer need an operator to rotate them. The rest is consolidation — the legacy environment dashboard is gone, the secret validation API contract changed, and folder creation moved its lock into Redis.

    View source ↗
  3. 8d ago

    Machine identities gain PAM access

    A short release whose one substantive line extends PAM to machine identities, letting non-human principals hold privileged access records rather than only human users. It fits the pattern of PAM absorbing the identity model Infisical already built for secrets.

    View source ↗
  4. 12d ago

    Chef app connection gains gateway support

    Gateway support for the Chef connection means Infisical can reach Chef servers that sit behind a private network boundary. Small in scope, but it is the same self-hosted-reachability work that has been landing connection by connection.

    View source ↗
  5. 12d ago

    PAM adds Redis access; PKI issues from AWS Private CA

    Redis joins PAM as both an account type and a web-access target, and PAM account fields can now be filled from a pasted connection string. The two changes together shorten the path from having a database credential to brokering access to it.

    View source ↗
  6. 15d ago

    Spacelift sync, Cloudflare rotation, cert manager revamp

    A dense release: Spacelift joins the sync destinations, secret rotation covers Cloudflare API tokens and R2 access keys, and the certificate manager UI is rebuilt. Rotation coverage expanding provider by provider is the clearest recurring pattern in this changelog.

    View source ↗