zenato
October 4, 2026, 4:50am
1
Hey, Ashwin pointed me here from Slack, so posting my PR here instead.
main ← zenato:feat/secret-sync-portainer
opened 02:26AM - 15 Aug 26 UTC
## Context
Adds Portainer as an app connection and secret sync destination. S… ecrets get synced into a stack's environment variables.
This was requested in #1281 a while back but got closed, the blocker at the time was that Infisical Cloud can't reach a self hosted Portainer instance. Gateways cover that now, and self hosted Infisical can reach it directly anyway.
One thing worth calling out: git-based stacks are updated through the stack's git config endpoint, so syncing doesn't redeploy anything - the new values just apply on the stack's next deployment. File based stacks do redeploy because the Portainer API wants the compose file resubmitted on every update. The stack picker in the wizard shows a hint about which case applies.
## Screenshots
<img width="1568" height="707" alt="portainer-secret-sync-demo" src="https://github.com/user-attachments/assets/3bfc3198-3268-414f-9b1f-abf5687f0f7c" />
## Steps to verify the change
- run a Portainer instance (I tested against portainer-ce 2.44.0) and create an api token under My account -> Access tokens
- create a Portainer app connection with the instance url and the token
- create a Portainer secret sync, pick an environment and a stack, let it sync
- check the stack's env vars in Portainer. for a git stack the running containers should be untouched and the stack's git settings (branch, auto update) preserved
## Type
- [ ] Fix
- [x] Feature
- [ ] Improvement
- [ ] Breaking
- [ ] Docs
- [ ] Chore
## Checklist
- [x] Title follows the [conventional commit](https://www.conventionalcommits.org/en/v1.0.0/#summary) format: `type(scope): short description` (scope is optional, e.g., `fix: prevent crash on sync` or `fix(api): handle null response`).
- [x] Tested locally
- [x] Updated docs (if needed)
- [ ] Updated CLAUDE.md files (if needed)
- [x] Read the [contributing guide](https://infisical.com/docs/contributing/getting-started/overview)
It adds Portainer as an app connection and a secret sync destination. Secrets get written into a stack’s env vars. Someone asked for this back in 2024 (Portainer integration · Issue #1281 · Infisical/infisical · GitHub ) and it got closed because Cloud couldn’t reach a self-hosted Portainer, which gateways cover now.
It’s been open since Aug 15. Rebased it on main again today, fixed the conflicts and moved it over to the new sync payload API. Type check, lint and the docs linter pass locally and the CLA is signed. Also the GitHub workflows on it have never run, they’re all stuck at “action required”, so if someone could approve those that’d be great.
If it helps with testing, Portainer CE runs as a single container and I can write up a quick setup.
Thanks!
Hey Zenato!
Thanks for this! I will flag this to the team and keep you posted.
Thanks,
Jake
Hey @zenato !
I just reviewed your PR and left some comments.
Hey @zenato , this was merged in and deployed to Infisical Cloud. If you’re self-hosting, you can use this image version: v0.166.8
Thank you for your contribution!!
zenato
October 15, 2026, 10:20pm
5
Thanks @Victor_Santos for the detailed review, and thanks @Jake-Infisical for getting this in front of the team. Glad to see it shipped!
1 Like