Skip to content

chore: retire the self-hosted zitadel#1702

Draft
zackpollard wants to merge 1 commit into
mainfrom
chore/retire-self-hosted-zitadel
Draft

chore: retire the self-hosted zitadel#1702
zackpollard wants to merge 1 commit into
mainfrom
chore/retire-self-hosted-zitadel

Conversation

@zackpollard

@zackpollard zackpollard commented Jun 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

1. Destroy the self-hosted resources — while the instance is still running

The instance must be reachable so the provider can delete its org/projects/users; this also removes the ZITADEL_OAUTH_CLIENT_ID/SECRET_* 1Password items.

git checkout main && git pull 
cd tf/deployment/modules/shared/zitadel/self-hosted
mise run tg run -- destroy

2. Merge this PR

Flux prunes the in-cluster instance (helmrelease, CNPG database, secrets, admin-sa pushsecret); the tf module is removed.

3. Manual cleanup (not tf-managed)

  • Delete the leftover 1Password items the destroy doesn't own: the zitadel masterkey and the admin-sa pushsecret item.
  • DNS for zitadel.internal.immich.cloud is ingress/external-dns-managed, so it's removed with the app — nothing to do.

@zackpollard
chore: retire the self-hosted zitadel
0e0c4e8 
remove the in-cluster zitadel instance (helmrelease, cnpg database, secrets,
admin-sa pushsecret) and the terraform module that configured it. all app
consumers have moved to the cloud zitadel at auth.internal.futo.org.

the module's resources must be destroyed with `terragrunt destroy` BEFORE this
merges, while the instance is still reachable, so the ZITADEL_OAUTH_CLIENT_ID/
SECRET_* 1password items and the zitadel org/projects/users are cleaned up
rather than orphaned. see the PR description for the full teardown sequence.
@github-actions

github-actions Bot commented Jun 18, 2026

Copy link
Copy Markdown 
--- kubernetes/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/zitadel-secrets

+++ kubernetes/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/zitadel-secrets

@@ -1,26 +0,0 @@

----
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  labels:
-    kustomize.toolkit.fluxcd.io/name: cluster-apps
-    kustomize.toolkit.fluxcd.io/namespace: flux-system
-  name: zitadel-secrets
-  namespace: flux-system
-spec:
-  commonMetadata:
-    labels:
-      app.kubernetes.io/name: zitadel-secrets
-  dependsOn:
-  - name: external-secrets-stores
-  interval: 30m
-  path: ./kubernetes/apps/authentication/zitadel/secrets
-  prune: true
-  retryInterval: 1m
-  sourceRef:
-    kind: GitRepository
-    name: immich-kubernetes
-  targetNamespace: authentication
-  timeout: 5m
-  wait: true
-
--- kubernetes/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/zitadel-database

+++ kubernetes/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/zitadel-database

@@ -1,26 +0,0 @@

----
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  labels:
-    kustomize.toolkit.fluxcd.io/name: cluster-apps
-    kustomize.toolkit.fluxcd.io/namespace: flux-system
-  name: zitadel-database
-  namespace: flux-system
-spec:
-  commonMetadata:
-    labels:
-      app.kubernetes.io/name: zitadel-database
-  dependsOn:
-  - name: database-cloudnative-pg
-  interval: 30m
-  path: ./kubernetes/apps/authentication/zitadel/database
-  prune: true
-  retryInterval: 1m
-  sourceRef:
-    kind: GitRepository
-    name: immich-kubernetes
-  targetNamespace: authentication
-  timeout: 5m
-  wait: true
-
--- kubernetes/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/zitadel

+++ kubernetes/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/zitadel

@@ -1,27 +0,0 @@

----
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  labels:
-    kustomize.toolkit.fluxcd.io/name: cluster-apps
-    kustomize.toolkit.fluxcd.io/namespace: flux-system
-  name: zitadel
-  namespace: flux-system
-spec:
-  commonMetadata:
-    labels:
-      app.kubernetes.io/name: zitadel
-  dependsOn:
-  - name: zitadel-secrets
-  - name: zitadel-database
-  interval: 30m
-  path: ./kubernetes/apps/authentication/zitadel/app
-  prune: true
-  retryInterval: 1m
-  sourceRef:
-    kind: GitRepository
-    name: immich-kubernetes
-  targetNamespace: authentication
-  timeout: 5m
-  wait: true
-
--- kubernetes/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/zitadel-pushsecret

+++ kubernetes/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/zitadel-pushsecret

@@ -1,26 +0,0 @@

----
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  labels:
-    kustomize.toolkit.fluxcd.io/name: cluster-apps
-    kustomize.toolkit.fluxcd.io/namespace: flux-system
-  name: zitadel-pushsecret
-  namespace: flux-system
-spec:
-  commonMetadata:
-    labels:
-      app.kubernetes.io/name: zitadel-pushsecret
-  dependsOn:
-  - name: zitadel
-  interval: 30m
-  path: ./kubernetes/apps/authentication/zitadel/pushsecret
-  prune: true
-  retryInterval: 1m
-  sourceRef:
-    kind: GitRepository
-    name: immich-kubernetes
-  targetNamespace: authentication
-  timeout: 5m
-  wait: true
-
--- kubernetes/apps/authentication/zitadel/database Kustomization: flux-system/zitadel-database Cluster: authentication/zitadel-db

+++ kubernetes/apps/authentication/zitadel/database Kustomization: flux-system/zitadel-database Cluster: authentication/zitadel-db

@@ -1,16 +0,0 @@

----
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  labels:
-    app.kubernetes.io/name: zitadel-database
-    kustomize.toolkit.fluxcd.io/name: zitadel-database
-    kustomize.toolkit.fluxcd.io/namespace: flux-system
-  name: zitadel-db
-  namespace: authentication
-spec:
-  enableSuperuserAccess: true
-  storage:
-    size: 10Gi
-    storageClass: zfs
-
--- kubernetes/apps/authentication/zitadel/secrets Kustomization: flux-system/zitadel-secrets ExternalSecret: authentication/zitadel-master-key

+++ kubernetes/apps/authentication/zitadel/secrets Kustomization: flux-system/zitadel-secrets ExternalSecret: authentication/zitadel-master-key

@@ -1,20 +0,0 @@

----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  labels:
-    app.kubernetes.io/name: zitadel-secrets
-    kustomize.toolkit.fluxcd.io/name: zitadel-secrets
-    kustomize.toolkit.fluxcd.io/namespace: flux-system
-  name: zitadel-master-key
-  namespace: authentication
-spec:
-  data:
-  - remoteRef:
-      key: AUTH_ZITADEL_MASTER_KEY
-    secretKey: masterkey
-  refreshInterval: 20s
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: 1p-tf
-
--- kubernetes/apps/authentication/zitadel/app Kustomization: flux-system/zitadel HelmRelease: authentication/zitadel

+++ kubernetes/apps/authentication/zitadel/app Kustomization: flux-system/zitadel HelmRelease: authentication/zitadel

@@ -1,101 +0,0 @@

----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  labels:
-    app.kubernetes.io/name: zitadel
-    kustomize.toolkit.fluxcd.io/name: zitadel
-    kustomize.toolkit.fluxcd.io/namespace: flux-system
-  name: zitadel
-  namespace: authentication
-spec:
-  chart:
-    spec:
-      chart: zitadel
-      interval: 5m
-      sourceRef:
-        kind: HelmRepository
-        name: zitadel
-        namespace: flux-system
-      version: 10.0.2
-  interval: 5m
-  values:
-    env:
-    - name: ZITADEL_DATABASE_POSTGRES_HOST
-      valueFrom:
-        secretKeyRef:
-          key: host
-          name: zitadel-db-app
-    - name: ZITADEL_DATABASE_POSTGRES_DATABASE
-      valueFrom:
-        secretKeyRef:
-          key: dbname
-          name: zitadel-db-app
-    - name: ZITADEL_DATABASE_POSTGRES_USER_USERNAME
-      valueFrom:
-        secretKeyRef:
-          key: user
-          name: zitadel-db-app
-    - name: ZITADEL_DATABASE_POSTGRES_USER_PASSWORD
-      valueFrom:
-        secretKeyRef:
-          key: password
-          name: zitadel-db-app
-    - name: ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME
-      valueFrom:
-        secretKeyRef:
-          key: user
-          name: zitadel-db-superuser
-    - name: ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD
-      valueFrom:
-        secretKeyRef:
-          key: password
-          name: zitadel-db-superuser
-    image:
-      repository: ghcr.io/zitadel/zitadel
-      tag: v4.15.0@sha256:cc9fb3b2788dcbd0dff93781a0323bbe491a4cec11e1caefd9a1ed31f7fdc145
-    ingress:
-      annotations:
-        cert-manager.io/cluster-issuer: letsencrypt-production
-        nginx.ingress.kubernetes.io/backend-protocol: GRPC
-        nginx.ingress.kubernetes.io/configuration-snippet: |
-          grpc_set_header Host $host;
-      className: nginx
-      enabled: true
-      hosts:
-      - host: zitadel.internal.immich.cloud
-        paths:
-        - path: /
-          pathType: Prefix
-      tls:
-      - hosts:
-        - zitadel.internal.immich.cloud
-        secretName: zitadel-tls
-    login:
-      enabled: false
-    resources:
-      limits:
-        cpu: 1
-        memory: 2Gi
-      requests:
-        cpu: 500m
-        memory: 512Mi
-    setupJob:
-      machinekeyWriter:
-        image:
-          tag: 1.32.3
-    zitadel:
-      configmapConfig:
-        ExternalDomain: zitadel.internal.immich.cloud
-        FirstInstance:
-          Org:
-            Machine:
-              Machine:
-                Name: Admin
-                Username: zitadel-iac-admin-sa
-              MachineKey:
-                Type: 1
-        TLS:
-          Enabled: false
-      masterkeySecretName: zitadel-master-key
-
--- kubernetes/apps/authentication/zitadel/pushsecret Kustomization: flux-system/zitadel-pushsecret PushSecret: authentication/zitadel-iac-admin-sa

+++ kubernetes/apps/authentication/zitadel/pushsecret Kustomization: flux-system/zitadel-pushsecret PushSecret: authentication/zitadel-iac-admin-sa

@@ -1,23 +0,0 @@

----
-apiVersion: external-secrets.io/v1alpha1
-kind: PushSecret
-metadata:
-  labels:
-    app.kubernetes.io/name: zitadel-pushsecret
-    kustomize.toolkit.fluxcd.io/name: zitadel-pushsecret
-    kustomize.toolkit.fluxcd.io/namespace: flux-system
-  name: zitadel-iac-admin-sa
-  namespace: authentication
-spec:
-  data:
-  - match:
-      remoteRef:
-        remoteKey: PUSHED_ZITADEL_IAC_ADMIN_SA
-      secretKey: zitadel-iac-admin-sa.json
-  secretStoreRefs:
-  - kind: ClusterSecretStore
-    name: 1p-kubernetes
-  selector:
-    secret:
-      name: zitadel-iac-admin-sa
-

@github-actions

github-actions Bot commented Jun 18, 2026

Copy link
Copy Markdown 
--- HelmRelease: authentication/zitadel Service: authentication/zitadel

+++ HelmRelease: authentication/zitadel Service: authentication/zitadel

@@ -1,25 +0,0 @@

----
-apiVersion: v1
-kind: Service
-metadata:
-  name: zitadel
-  namespace: authentication
-  annotations:
-    traefik.ingress.kubernetes.io/service.serversscheme: h2c
-  labels:
-    app.kubernetes.io/name: zitadel
-    app.kubernetes.io/instance: zitadel
-    app.kubernetes.io/managed-by: Helm
-spec:
-  type: ClusterIP
-  ports:
-  - port: 8080
-    targetPort: 8080
-    protocol: TCP
-    name: http2-server
-    appProtocol: kubernetes.io/h2c
-  selector:
-    app.kubernetes.io/name: zitadel
-    app.kubernetes.io/instance: zitadel
-    app.kubernetes.io/component: start
-
--- HelmRelease: authentication/zitadel Deployment: authentication/zitadel

+++ HelmRelease: authentication/zitadel Deployment: authentication/zitadel

@@ -1,146 +0,0 @@

----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: zitadel
-  namespace: authentication
-  labels:
-    app.kubernetes.io/name: zitadel
-    app.kubernetes.io/instance: zitadel
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/component: start
-spec:
-  revisionHistoryLimit: 10
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: zitadel
-      app.kubernetes.io/instance: zitadel
-      app.kubernetes.io/component: start
-  template:
-    metadata:
-      annotations:
-        checksum/configmap: 1e4c8b5d1e226e433a596a7bb070295d0341480a08bfd8d59b830756aa73c2b2
-        checksum/secret-db-ssl-ca-crt: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
-        checksum/secret-zitadel-secrets: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
-      labels:
-        app.kubernetes.io/name: zitadel
-        app.kubernetes.io/instance: zitadel
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/component: start
-    spec:
-      serviceAccountName: zitadel
-      securityContext:
-        fsGroup: 1000
-        runAsNonRoot: true
-        runAsUser: 1000
-      enableServiceLinks: false
-      containers:
-      - name: zitadel
-        securityContext:
-          privileged: false
-          readOnlyRootFilesystem: true
-          runAsNonRoot: true
-          runAsUser: 1000
-        image: ghcr.io/zitadel/zitadel:v4.15.0@sha256:cc9fb3b2788dcbd0dff93781a0323bbe491a4cec11e1caefd9a1ed31f7fdc145
-        imagePullPolicy: IfNotPresent
-        args:
-        - start
-        - --config
-        - /config/zitadel-config-yaml
-        - --masterkeyFromEnv
-        env:
-        - name: POD_IP
-          valueFrom:
-            fieldRef:
-              apiVersion: v1
-              fieldPath: status.podIP
-        - name: ZITADEL_MASTERKEY
-          valueFrom:
-            secretKeyRef:
-              name: zitadel-master-key
-              key: masterkey
-        - name: ZITADEL_DATABASE_POSTGRES_AWAITINITIALCONN
-          value: 5m
-        - name: ZITADEL_DATABASE_POSTGRES_HOST
-          valueFrom:
-            secretKeyRef:
-              key: host
-              name: zitadel-db-app
-        - name: ZITADEL_DATABASE_POSTGRES_DATABASE
-          valueFrom:
-            secretKeyRef:
-              key: dbname
-              name: zitadel-db-app
-        - name: ZITADEL_DATABASE_POSTGRES_USER_USERNAME
-          valueFrom:
-            secretKeyRef:
-              key: user
-              name: zitadel-db-app
-        - name: ZITADEL_DATABASE_POSTGRES_USER_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              key: password
-              name: zitadel-db-app
-        - name: ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME
-          valueFrom:
-            secretKeyRef:
-              key: user
-              name: zitadel-db-superuser
-        - name: ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              key: password
-              name: zitadel-db-superuser
-        ports:
-        - containerPort: 8080
-          name: http2-server
-          protocol: TCP
-        livenessProbe:
-          httpGet:
-            path: /debug/healthz
-            port: http2-server
-            httpHeaders:
-            - name: Host
-              value: zitadel.internal.immich.cloud
-            scheme: HTTP
-          initialDelaySeconds: 0
-          periodSeconds: 5
-          failureThreshold: 3
-        readinessProbe:
-          httpGet:
-            path: /debug/ready
-            port: http2-server
-            httpHeaders:
-            - name: Host
-              value: zitadel.internal.immich.cloud
-            scheme: HTTP
-          initialDelaySeconds: 0
-          periodSeconds: 5
-          failureThreshold: 3
-        startupProbe:
-          httpGet:
-            path: /debug/ready
-            port: http2-server
-            httpHeaders:
-            - name: Host
-              value: zitadel.internal.immich.cloud
-            scheme: HTTP
-          periodSeconds: 1
-          failureThreshold: 30
-        volumeMounts:
-        - name: zitadel-config-yaml
-          mountPath: /config
-          readOnly: true
-        resources:
-          limits:
-            cpu: 1
-            memory: 2Gi
-          requests:
-            cpu: 500m
-            memory: 512Mi
-      volumes:
-      - name: zitadel-config-yaml
-        configMap:
-          name: zitadel-config-yaml
-
--- HelmRelease: authentication/zitadel Ingress: authentication/zitadel

+++ HelmRelease: authentication/zitadel Ingress: authentication/zitadel

@@ -1,33 +0,0 @@

----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: zitadel
-  namespace: authentication
-  labels:
-    app.kubernetes.io/name: zitadel
-    app.kubernetes.io/instance: zitadel
-    app.kubernetes.io/managed-by: Helm
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-production
-    nginx.ingress.kubernetes.io/backend-protocol: GRPC
-    nginx.ingress.kubernetes.io/configuration-snippet: |
-      grpc_set_header Host $host;
-spec:
-  ingressClassName: nginx
-  tls:
-  - hosts:
-    - zitadel.internal.immich.cloud
-    secretName: zitadel-tls
-  rules:
-  - host: zitadel.internal.immich.cloud
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: zitadel
-            port:
-              number: 8080
-
--- HelmRelease: authentication/zitadel ServiceAccount: authentication/zitadel

+++ HelmRelease: authentication/zitadel ServiceAccount: authentication/zitadel

@@ -1,15 +0,0 @@

----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: zitadel
-  namespace: authentication
-  labels:
-    app.kubernetes.io/name: zitadel
-    app.kubernetes.io/instance: zitadel
-    app.kubernetes.io/managed-by: Helm
-  annotations:
-    helm.sh/hook: pre-install,pre-upgrade
-    helm.sh/hook-delete-policy: before-hook-creation
-    helm.sh/hook-weight: '0'
-
--- HelmRelease: authentication/zitadel ConfigMap: authentication/zitadel-config-yaml

+++ HelmRelease: authentication/zitadel ConfigMap: authentication/zitadel-config-yaml

@@ -1,42 +0,0 @@

----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: zitadel-config-yaml
-  namespace: authentication
-  annotations:
-    helm.sh/hook: pre-install,pre-upgrade
-    helm.sh/hook-delete-policy: before-hook-creation
-    helm.sh/hook-weight: '0'
-  labels:
-    app.kubernetes.io/name: zitadel
-    app.kubernetes.io/instance: zitadel
-    app.kubernetes.io/managed-by: Helm
-data:
-  zitadel-config-yaml: |-
-    ExternalDomain: zitadel.internal.immich.cloud
-    ExternalSecure: true
-    FirstInstance:
-      MachineKeyPath: null
-      Org:
-        Machine:
-          Machine:
-            Name: Admin
-            Username: zitadel-iac-admin-sa
-          MachineKey:
-            ExpirationDate: "2029-01-01T00:00:00Z"
-            Type: 1
-          Pat:
-            ExpirationDate: "2029-01-01T00:00:00Z"
-        Skip: null
-      PatPath: null
-      Skip: false
-    Machine:
-      Identification:
-        Hostname:
-          Enabled: true
-        Webhook:
-          Enabled: false
-    TLS:
-      Enabled: false
-
--- HelmRelease: authentication/zitadel Role: authentication/zitadel

+++ HelmRelease: authentication/zitadel Role: authentication/zitadel

@@ -1,32 +0,0 @@

----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: zitadel
-  namespace: authentication
-  labels:
-    app.kubernetes.io/name: zitadel
-    app.kubernetes.io/instance: zitadel
-    app.kubernetes.io/managed-by: Helm
-  annotations:
-    helm.sh/hook: pre-install,pre-upgrade
-    helm.sh/hook-delete-policy: before-hook-creation
-    helm.sh/hook-weight: '0'
-rules:
-- apiGroups:
-  - ''
-  resources:
-  - secrets
-  verbs:
-  - get
-  - create
-  - patch
-  - list
-  - delete
-- apiGroups:
-  - ''
-  resources:
-  - pods
-  verbs:
-  - get
-
--- HelmRelease: authentication/zitadel RoleBinding: authentication/zitadel

+++ HelmRelease: authentication/zitadel RoleBinding: authentication/zitadel

@@ -1,22 +0,0 @@

----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: zitadel
-  namespace: authentication
-  labels:
-    app.kubernetes.io/name: zitadel
-    app.kubernetes.io/instance: zitadel
-    app.kubernetes.io/managed-by: Helm
-  annotations:
-    helm.sh/hook: pre-install,pre-upgrade
-    helm.sh/hook-delete-policy: before-hook-creation
-    helm.sh/hook-weight: '0'
-subjects:
-- kind: ServiceAccount
-  name: zitadel
-roleRef:
-  kind: Role
-  name: zitadel
-  apiGroup: rbac.authorization.k8s.io
-
--- HelmRelease: authentication/zitadel Job: authentication/zitadel-cleanup

+++ HelmRelease: authentication/zitadel Job: authentication/zitadel-cleanup

@@ -1,53 +0,0 @@

----
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: zitadel-cleanup
-  namespace: authentication
-  labels:
-    app.kubernetes.io/name: zitadel
-    app.kubernetes.io/instance: zitadel
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/component: cleanup
-  annotations:
-    helm.sh/hook: post-delete
-    helm.sh/hook-delete-policy: hook-succeeded
-    helm.sh/hook-weight: '-1'
-spec:
-  backoffLimit: 3
-  activeDeadlineSeconds: 60
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: zitadel
-        app.kubernetes.io/instance: zitadel
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/component: cleanup
-    spec:
-      serviceAccountName: zitadel
-      securityContext:
-        fsGroup: 1000
-        runAsNonRoot: true
-        runAsUser: 1000
-      enableServiceLinks: false
-      restartPolicy: Never
-      containers:
-      - name: zitadel-cleanup
-        securityContext:
-          privileged: false
-          readOnlyRootFilesystem: true
-          runAsNonRoot: true
-          runAsUser: 1000
-        image: docker.io/alpine/k8s:1.35.0
-        imagePullPolicy: IfNotPresent
-        command:
-        - sh
-        - -c
-        - |
-          echo "Cleaning up secrets created by zitadel-setup..."
-          kubectl --namespace=authentication delete secret \
-            --selector='app.kubernetes.io/managed-by=Zitadel,app.kubernetes.io/instance=zitadel' \
-            --ignore-not-found=true
-          echo "Cleanup completed"
-        resources: {}
-
--- HelmRelease: authentication/zitadel Job: authentication/zitadel-init

+++ HelmRelease: authentication/zitadel Job: authentication/zitadel-init

@@ -1,95 +0,0 @@

----
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: zitadel-init
-  namespace: authentication
-  labels:
-    app.kubernetes.io/name: zitadel
-    app.kubernetes.io/instance: zitadel
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/component: init
-  annotations:
-    helm.sh/hook: pre-install,pre-upgrade
-    helm.sh/hook-delete-policy: before-hook-creation
-    helm.sh/hook-weight: '1'
-spec:
-  backoffLimit: 5
-  activeDeadlineSeconds: 300
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: zitadel
-        app.kubernetes.io/instance: zitadel
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/component: init
-    spec:
-      serviceAccountName: zitadel
-      securityContext:
-        fsGroup: 1000
-        runAsNonRoot: true
-        runAsUser: 1000
-      enableServiceLinks: false
-      restartPolicy: Never
-      containers:
-      - name: zitadel-init
-        securityContext:
-          privileged: false
-          readOnlyRootFilesystem: true
-          runAsNonRoot: true
-          runAsUser: 1000
-        image: ghcr.io/zitadel/zitadel:v4.15.0@sha256:cc9fb3b2788dcbd0dff93781a0323bbe491a4cec11e1caefd9a1ed31f7fdc145
-        imagePullPolicy: IfNotPresent
-        args:
-        - init
-        - --config
-        - /config/zitadel-config-yaml
-        env:
-        - name: POD_IP
-          valueFrom:
-            fieldRef:
-              apiVersion: v1
-              fieldPath: status.podIP
-        - name: ZITADEL_DATABASE_POSTGRES_AWAITINITIALCONN
-          value: 5m
-        - name: ZITADEL_DATABASE_POSTGRES_HOST
-          valueFrom:
-            secretKeyRef:
-              key: host
-              name: zitadel-db-app
-        - name: ZITADEL_DATABASE_POSTGRES_DATABASE
-          valueFrom:
-            secretKeyRef:
-              key: dbname
-              name: zitadel-db-app
-        - name: ZITADEL_DATABASE_POSTGRES_USER_USERNAME
-          valueFrom:
-            secretKeyRef:
-              key: user
-              name: zitadel-db-app
-        - name: ZITADEL_DATABASE_POSTGRES_USER_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              key: password
-              name: zitadel-db-app
-        - name: ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME
-          valueFrom:
-            secretKeyRef:
-              key: user
-              name: zitadel-db-superuser
-        - name: ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              key: password
-              name: zitadel-db-superuser
-        volumeMounts:
-        - name: zitadel-config-yaml
-          mountPath: /config
-          readOnly: true
-        resources: {}
-      volumes:
-      - name: zitadel-config-yaml
-        configMap:
-          name: zitadel-config-yaml
-          defaultMode: 288
-
--- HelmRelease: authentication/zitadel Job: authentication/zitadel-setup

+++ HelmRelease: authentication/zitadel Job: authentication/zitadel-setup

@@ -1,194 +0,0 @@

----
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: zitadel-setup
-  namespace: authentication
-  labels:
-    app.kubernetes.io/name: zitadel
-    app.kubernetes.io/instance: zitadel
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/component: setup
-  annotations:
-    helm.sh/hook: pre-install,pre-upgrade
-    helm.sh/hook-delete-policy: before-hook-creation
-    helm.sh/hook-weight: '2'
-spec:
-  backoffLimit: 5
-  activeDeadlineSeconds: 300
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: zitadel
-        app.kubernetes.io/instance: zitadel
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/component: setup
-    spec:
-      serviceAccountName: zitadel
-      securityContext:
-        fsGroup: 1000
-        runAsNonRoot: true
-        runAsUser: 1000
-      enableServiceLinks: false
-      restartPolicy: Never
-      containers:
-      - name: zitadel-setup
-        securityContext:
-          privileged: false
-          readOnlyRootFilesystem: true
-          runAsNonRoot: true
-          runAsUser: 1000
-        image: ghcr.io/zitadel/zitadel:v4.15.0@sha256:cc9fb3b2788dcbd0dff93781a0323bbe491a4cec11e1caefd9a1ed31f7fdc145
-        imagePullPolicy: IfNotPresent
-        args:
-        - setup
-        - --masterkeyFromEnv
-        - --config
-        - /config/zitadel-config-yaml
-        - --steps
-        - /config/zitadel-config-yaml
-        - --init-projections=true
-        env:
-        - name: POD_IP
-          valueFrom:
-            fieldRef:
-              apiVersion: v1
-              fieldPath: status.podIP
-        - name: ZITADEL_MASTERKEY
-          valueFrom:
-            secretKeyRef:
-              name: zitadel-master-key
-              key: masterkey
-        - name: ZITADEL_FIRSTINSTANCE_MACHINEKEYPATH
-          value: /machinekey/sa.json
-        - name: ZITADEL_FIRSTINSTANCE_PATPATH
-          value: /machinekey/pat
-        - name: ZITADEL_DATABASE_POSTGRES_AWAITINITIALCONN
-          value: 5m
-        - name: ZITADEL_DATABASE_POSTGRES_HOST
-          valueFrom:
-            secretKeyRef:
-              key: host
-              name: zitadel-db-app
-        - name: ZITADEL_DATABASE_POSTGRES_DATABASE
-          valueFrom:
-            secretKeyRef:
-              key: dbname
-              name: zitadel-db-app
-        - name: ZITADEL_DATABASE_POSTGRES_USER_USERNAME
-          valueFrom:
-            secretKeyRef:
-              key: user
-              name: zitadel-db-app
-        - name: ZITADEL_DATABASE_POSTGRES_USER_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              key: password
-              name: zitadel-db-app
-        - name: ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME
-          valueFrom:
-            secretKeyRef:
-              key: user
-              name: zitadel-db-superuser
-        - name: ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              key: password
-              name: zitadel-db-superuser
-        volumeMounts:
-        - name: zitadel-config-yaml
-          mountPath: /config
-          readOnly: true
-        - name: machinekey
-          mountPath: /machinekey
-        resources: {}
-      - name: zitadel-machinekey
-        securityContext:
-          privileged: false
-          readOnlyRootFilesystem: true
-          runAsNonRoot: true
-          runAsUser: 1000
-        image: docker.io/alpine/k8s:1.35.0
-        imagePullPolicy: IfNotPresent
-        command:
-        - sh
-        - -c
-        - |
-          until [ -n "$(kubectl --namespace=authentication get pod ${POD_NAME} --output=jsonpath="{.status.containerStatuses[?(@.name=='zitadel-setup')].state.terminated}")" ]; do
-            echo 'waiting for zitadel-setup container to terminate';
-            sleep 5;
-          done &&
-          echo 'zitadel-setup container terminated' &&
-          if [ -f /machinekey/sa.json ]; then
-            kubectl --namespace=authentication create secret generic zitadel-iac-admin-sa \
-              --from-file=zitadel-iac-admin-sa.json=/machinekey/sa.json \
-              --dry-run=client --output=yaml | \
-            kubectl annotate --local --filename=- \
-              helm.sh/resource-policy=keep \
-              --output=yaml | \
-            kubectl label --local --filename=- \
-              app.kubernetes.io/managed-by=Zitadel \
-              app.kubernetes.io/name=zitadel \
-              app.kubernetes.io/instance=zitadel \
-              --output=yaml | \
-            kubectl apply --server-side --field-manager=zitadel-setup --filename=-;
-          fi;
-        env:
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        volumeMounts:
-        - name: machinekey
-          mountPath: /machinekey
-          readOnly: true
-        resources: {}
-      - name: zitadel-machine-pat
-        securityContext:
-          privileged: false
-          readOnlyRootFilesystem: true
-          runAsNonRoot: true
-          runAsUser: 1000
-        image: docker.io/alpine/k8s:1.35.0
-        imagePullPolicy: IfNotPresent
-        command:
-        - sh
-        - -c
-        - |
-          until [ -n "$(kubectl --namespace=authentication get pod "${POD_NAME}" --output=jsonpath="{.status.containerStatuses[?(@.name=='zitadel-setup')].state.terminated}")" ]; do
-            echo 'waiting for zitadel-setup container to terminate';
-            sleep 5;
-          done &&
-          echo 'zitadel-setup container terminated' &&
-          if [ -f /machinekey/pat ]; then
-            kubectl --namespace=authentication create secret generic zitadel-iac-admin-sa-pat \
-              --from-file=pat=/machinekey/pat \
-              --dry-run=client --output=yaml | \
-            kubectl annotate --local --filename=- \
-              helm.sh/resource-policy=keep \
-              --output=yaml | \
-            kubectl label --local --filename=- \
-              app.kubernetes.io/managed-by=Zitadel \
-              app.kubernetes.io/name=zitadel \
-              app.kubernetes.io/instance=zitadel \
-              --output=yaml | \
-            kubectl apply --server-side --field-manager=zitadel-setup --filename=-;
-          fi;
-        env:
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        volumeMounts:
-        - name: machinekey
-          mountPath: /machinekey
-          readOnly: true
-        resources: {}
-      volumes:
-      - name: zitadel-config-yaml
-        configMap:
-          name: zitadel-config-yaml
-          defaultMode: 288
-      - name: machinekey
-        emptyDir: {}
-

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@zackpollard