# DMZ Infisical

DMZ-local Infisical instance for K3s workloads.

- No public Ingress.
- Service type `ClusterIP` only.
- Admin access via SSH/kubectl port-forward when required.
- Initial bootstrap secrets are created directly in Kubernetes and are not committed to Git.
- After bootstrap, rotate/store operational values inside DMZ Infisical.