19 changed files with 7 additions and 751 deletions
--- a/apps/django/d8-ugmk-prod/backend.yaml
+++ b/apps/django/d8-ugmk-prod/backend.yaml
@ -8,9 +8,6 @@ spec:
  values:
    services:
      backend:
-        deployment:
-          replicaCount:
-            _default: 2
        envs:
          - name: ALLOWED_HOSTS
            value:
--- a/apps/eav/wb/django-configmap.yaml
+++ b/apps/eav/wb/django-configmap.yaml
@ -18,7 +18,7 @@ data:

    # DEBUG SETTINGS START
    # ---------------------------------------------------------------------------------------------------------------------
-    DEBUG = False
+    DEBUG = True
    ALLOWED_HOSTS = ['*']
    # ---------------------------------------------------------------------------------------------------------------------
    # DEBUG SETTINGS END
--- a/apps/flows/d8-ugmk-prod/backend.yaml
+++ b/apps/flows/d8-ugmk-prod/backend.yaml
@ -9,8 +9,6 @@ spec:
    services:
      backend:
        deployment:
-          replicaCount:
-            _default: 2
          args:
            _default:
              - |
--- a/apps/workspaces/base/frontend.yaml
+++ b/apps/workspaces/base/frontend.yaml
@ -29,7 +29,7 @@ spec:
        enabled: true
        image:
          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/workspaces-v2-frontend:contour_2da2a00e
+            _default: cr.yandex/crp3ccidau046kdj8g9q/workspaces-v2-frontend:contour_1b5d64e4
          pullPolicy:
            _default: IfNotPresent
        deployment:
--- a/apps/workspaces/ugok/frontend.yaml
+++ b/apps/workspaces/ugok/frontend.yaml
@ -36,7 +36,7 @@ spec:

        image:
          name:
-            _default: 10.4.10.187:80/library/workspaces-v2-frontend:contour_1b5d64e4
+            _default: 10.4.10.187:80/library/workspaces-v2-frontend:contour_07373a45
          pullPolicy:
            _default: IfNotPresent

--- a/clusters/stand/00-vault/kustomization.yaml
+++ b/clusters/stand/00-vault/kustomization.yaml
@ -1,5 +1,4 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - ./helm-repositories.yaml
  - ../../../infrastructure/vault/contour-template
--- a/clusters/stand/30-platform/kustomization.yaml
+++ b/clusters/stand/30-platform/kustomization.yaml
@ -1,5 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../../../infrastructure/zitadel/contour-template
-  - ../../../infrastructure/camunda/contour-template
--- a/clusters/stand/40-routing/kustomization.yaml
+++ b/clusters/stand/40-routing/kustomization.yaml
@ -1,4 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../../../infrastructure/istio-config/contour-template
--- a/clusters/stand/00-vault/helm-repositories.yaml
+++ b/clusters/stand/00-vault/helm-repositories.yaml
@ -7,8 +7,6 @@ metadata:
 spec:
  type: oci
  interval: 10m0s
-  url: ${CHART_REPO:=oci://cr.yandex/crp3ccidau046kdj8g9q/charts}
+  url: oci://cr.yandex/crp3ccidau046kdj8g9q/charts
  secretRef:
-    name: ${CHART_REPO_SECRET:=yc-cr-auth}
-  certSecretRef:
-    name: chart-repo-ca
+    name: yc-cr-auth
--- a/clusters/stand/kustomization.yaml
+++ b/clusters/stand/kustomization.yaml
@ -2,4 +2,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ./flux-system
+  - ./helm-repositories.yaml
  - ./layers.yaml
--- a/clusters/stand/layers.yaml
+++ b/clusters/stand/layers.yaml
@ -53,41 +53,3 @@ spec:
    substituteFrom:
      - kind: ConfigMap
        name: contour-vars
---
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: 30-platform
-  namespace: flux-system
-spec:
-  interval: 10m0s
-  timeout: 35m0s
-  path: ./clusters/stand/30-platform
-  prune: true
-  wait: true
-  sourceRef:
-    kind: GitRepository
-    name: flux-system
-  postBuild:
-    substituteFrom:
-      - kind: ConfigMap
-        name: contour-vars
---
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: 40-routing
-  namespace: flux-system
-spec:
-  interval: 10m0s
-  timeout: 10m0s
-  path: ./clusters/stand/40-routing
-  prune: true
-  wait: true
-  sourceRef:
-    kind: GitRepository
-    name: flux-system
-  postBuild:
-    substituteFrom:
-      - kind: ConfigMap
-        name: contour-vars
--- a/infrastructure/camunda/contour-template/camunda.yaml
+++ b/infrastructure/camunda/contour-template/camunda.yaml
@ -1,354 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: camunda
-  namespace: camunda
-spec:
-  dependsOn: []
-  interval: 5m
-  timeout: 30m
-  waitStrategy:
-    name: legacy
-  postRenderers:
-    - kustomize:
-        patches:
-          - target:
-              group: apps
-              version: v1
-              kind: Deployment
-            patch: |-
-              - op: add
-                path: /spec/template/spec/nodeSelector
-                value:
-                  dedicated: processing
-              - op: add
-                path: /spec/template/spec/tolerations
-                value:
-                  - key: dedicated
-                    operator: Equal
-                    value: processing
-                    effect: NoSchedule
-          - target:
-              group: apps
-              version: v1
-              kind: StatefulSet
-            patch: |-
-              - op: add
-                path: /spec/template/spec/nodeSelector
-                value:
-                  dedicated: processing
-              - op: add
-                path: /spec/template/spec/tolerations
-                value:
-                  - key: dedicated
-                    operator: Equal
-                    value: processing
-                    effect: NoSchedule
-          - target:
-              group: batch
-              version: v1
-              kind: Job
-            patch: |-
-              - op: add
-                path: /spec/template/spec/nodeSelector
-                value:
-                  dedicated: processing
-              - op: add
-                path: /spec/template/spec/tolerations
-                value:
-                  - key: dedicated
-                    operator: Equal
-                    value: processing
-                    effect: NoSchedule
-          - target:
-              group: apps
-              version: v1
-              kind: Deployment
-              name: camunda-connectors
-            patch: |-
-              - op: add
-                path: /spec/template/spec/nodeSelector
-                value:
-                  dedicated: processing
-              - op: add
-                path: /spec/template/spec/tolerations
-                value:
-                  - key: dedicated
-                    operator: Equal
-                    value: processing
-                    effect: NoSchedule
-          - target:
-              group: apps
-              version: v1
-              kind: Deployment
-              name: camunda-identity
-            patch: |-
-              - op: add
-                path: /spec/template/spec/nodeSelector
-                value:
-                  dedicated: processing
-              - op: add
-                path: /spec/template/spec/tolerations
-                value:
-                  - key: dedicated
-                    operator: Equal
-                    value: processing
-                    effect: NoSchedule
-          - target:
-              group: apps
-              version: v1
-              kind: Deployment
-              name: camunda-operate
-            patch: |-
-              - op: add
-                path: /spec/template/spec/nodeSelector
-                value:
-                  dedicated: processing
-              - op: add
-                path: /spec/template/spec/tolerations
-                value:
-                  - key: dedicated
-                    operator: Equal
-                    value: processing
-                    effect: NoSchedule
-          - target:
-              group: apps
-              version: v1
-              kind: Deployment
-              name: camunda-optimize
-            patch: |-
-              - op: add
-                path: /spec/template/spec/nodeSelector
-                value:
-                  dedicated: processing
-              - op: add
-                path: /spec/template/spec/tolerations
-                value:
-                  - key: dedicated
-                    operator: Equal
-                    value: processing
-                    effect: NoSchedule
-          - target:
-              group: apps
-              version: v1
-              kind: Deployment
-              name: camunda-tasklist
-            patch: |-
-              - op: add
-                path: /spec/template/spec/nodeSelector
-                value:
-                  dedicated: processing
-              - op: add
-                path: /spec/template/spec/tolerations
-                value:
-                  - key: dedicated
-                    operator: Equal
-                    value: processing
-                    effect: NoSchedule
-          - target:
-              group: apps
-              version: v1
-              kind: Deployment
-              name: camunda-zeebe-gateway
-            patch: |-
-              - op: add
-                path: /spec/template/spec/nodeSelector
-                value:
-                  dedicated: processing
-              - op: add
-                path: /spec/template/spec/tolerations
-                value:
-                  - key: dedicated
-                    operator: Equal
-                    value: processing
-                    effect: NoSchedule
-          - target:
-              group: apps
-              version: v1
-              kind: StatefulSet
-              name: camunda-zeebe
-            patch: |-
-              - op: add
-                path: /spec/template/spec/nodeSelector
-                value:
-                  dedicated: processing
-              - op: add
-                path: /spec/template/spec/tolerations
-                value:
-                  - key: dedicated
-                    operator: Equal
-                    value: processing
-                    effect: NoSchedule
-  values:
-    global:
-      vault:
-        enabled: true
-        role: camunda-contour
-        authPath: auth/kubernetes
-        secrets:
-          postgresql:
-            path: secrets/data/camunda/identity-db
-            keys:
-              password: password
-              postgresPassword: password
-      image:
-        pullSecrets:
-          - name: regcred
-      identity:
-        auth:
-          publicIssuerUrl: "https://${HOST_CAMUNDA_KEYCLOAK}/auth/realms/camunda-platform"
-          identity:
-            redirectUrl: "https://${HOST_CAMUNDA_IDENTITY}"
-          operate:
-            redirectUrl: "https://${HOST_CAMUNDA}"
-          tasklist:
-            redirectUrl: "https://${HOST_CAMUNDA_TASKLIST}"
-          optimize:
-            redirectUrl: "https://${HOST_CAMUNDA_OPTIMIZE}"
-    identityPostgresql:
-      enabled: false
-      auth:
-        usePasswordFiles: true
-      primary:
-        automountServiceAccountToken: true
-        persistence:
-          size: 10Gi
-          storageClass: ${STORAGE_CLASS}
-    identityKeycloak:
-      externalDatabase:
-        host: pg-host.storage.svc.cluster.local
-        port: 5432
-        user: bn_keycloak
-        database: bitnami_keycloak
-        password: ""
-        existingSecret: ""
-        existingSecretPasswordKey: password
-      postgresql:
-        enabled: false
-        auth:
-          usePasswordFiles: true
-        primary:
-          automountServiceAccountToken: true
-          persistence:
-            size: 10Gi
-            storageClass: ${STORAGE_CLASS}
-      vaultEnv:
-        enabled: true
-        role: camunda-contour
-        authPath: auth/kubernetes
-        envFiles:
-          KEYCLOAK_ADMIN_PASSWORD:
-            path: secrets/data/camunda/keycloak-admin
-            key: admin-password
-          KEYCLOAK_PASSWORD:
-            path: secrets/data/camunda/keycloak-admin
-            key: admin-password
-          KEYCLOAK_DATABASE_PASSWORD:
-            path: secrets/data/camunda/keycloak-db
-            key: password
-      global:
-        storageClass: ${STORAGE_CLASS}
-      tolerations: []
-    elasticsearch:
-      sysctlImage:
-        registry: cr.yandex
-        repository: crp3ccidau046kdj8g9q/contour/camunda/os-shell
-        tag: 12-debian-12-r32
-        pullSecrets:
-          - regcred
-      master:
-        replicaCount: 1
-        podAntiAffinityPreset: soft
-        persistence:
-          size: 10Gi
-          storageClass: ${STORAGE_CLASS}
-        tolerations: []
-      metrics:
-        enabled: false
-        serviceMonitor:
-          enabled: false
-        prometheusRule:
-          enabled: false
-        tolerations: []
-    camundaCanary:
-      enabled: false
-    prometheusServiceMonitor:
-      enabled: false
-    console:
-      image:
-        pullSecrets:
-          - name: regcred
-      tolerations: []
-    zeebe:
-      clusterSize: "1"
-      partitionCount: "1"
-      replicationFactor: "1"
-      pvcStorageClassName: ${STORAGE_CLASS}
-      image:
-        pullSecrets:
-          - name: regcred
-      tolerations: []
-    zeebeGateway:
-      replicas: 1
-      image:
-        pullSecrets:
-          - name: regcred
-      tolerations: []
-    identity:
-      fullURL: "https://${HOST_CAMUNDA_IDENTITY}"
-      externalDatabase:
-        enabled: true
-        host: pg-host.storage.svc.cluster.local
-        port: 5432
-        username: identity
-        database: identity
-        password: ""
-        existingSecret: ""
-        existingSecretPasswordKey: password
-      image:
-        pullSecrets:
-          - name: regcred
-      tolerations: []
-    operate:
-      image:
-        pullSecrets:
-          - name: regcred
-      serviceAccount:
-        automountServiceAccountToken: true
-      tolerations: []
-    tasklist:
-      image:
-        pullSecrets:
-          - name: regcred
-      serviceAccount:
-        automountServiceAccountToken: true
-      tolerations: []
-    optimize:
-      image:
-        pullSecrets:
-          - name: regcred
-      serviceAccount:
-        automountServiceAccountToken: true
-      tolerations: []
-    executionIdentity:
-      image:
-        pullSecrets:
-          - name: regcred
-      tolerations: []
-    webModeler:
-      image:
-        pullSecrets:
-          - name: regcred
-      restapi:
-        tolerations: []
-      webapp:
-        tolerations: []
-      websockets:
-        tolerations: []
-    connectors:
-      image:
-        pullSecrets:
-          - name: regcred
-      serviceAccount:
-        automountServiceAccountToken: true
-      tolerations: []
--- a/infrastructure/camunda/contour-template/kustomization.yaml
+++ b/infrastructure/camunda/contour-template/kustomization.yaml
@ -1,6 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../base
-patches:
-  - path: camunda.yaml
--- a/infrastructure/istio-config/contour-template/istio-config.yaml
+++ b/infrastructure/istio-config/contour-template/istio-config.yaml
@ -1,117 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: istio-config
-  namespace: default
-spec:
-  dependsOn: []
-  interval: 5m
-  timeout: 10m
-  values:
-    global:
-      env: contour
-    environments:
-      contour:
-        istio:
-          gateways:
-            platform:
-              name: platform-gateway
-              namespace: default
-              selector:
-                istio: ingressgateway
-              servers:
-              - hosts:
-                - ${HOST_LOGIN}
-                - ${HOST_CAMUNDA}
-                - ${HOST_CAMUNDA_IDENTITY}
-                - ${HOST_CAMUNDA_KEYCLOAK}
-                - ${HOST_CAMUNDA_OPTIMIZE}
-                - ${HOST_CAMUNDA_TASKLIST}
-                - ${HOST_RABBITMQ}
-                tls:
-                  credentialName: istio-ingress-tls
-          virtualServices:
-            zitadel:
-              name: zitadel-virt-service
-              namespace: default
-              hosts:
-              - ${HOST_LOGIN}
-              gateways:
-              - default/platform-gateway
-              routes:
-              - path:
-                  prefix: /
-                service: zitadel-idp-contour.zitadel.svc.cluster.local
-                port: 8080
-            camunda-operate:
-              name: camunda-operate-virt-service
-              namespace: default
-              hosts:
-              - ${HOST_CAMUNDA}
-              gateways:
-              - default/platform-gateway
-              routes:
-              - path:
-                  prefix: /
-                service: camunda-operate.camunda.svc.cluster.local
-                port: 80
-            camunda-identity:
-              name: camunda-identity-virt-service
-              namespace: default
-              hosts:
-              - ${HOST_CAMUNDA_IDENTITY}
-              gateways:
-              - default/platform-gateway
-              routes:
-              - path:
-                  prefix: /
-                service: camunda-identity.camunda.svc.cluster.local
-                port: 80
-            camunda-keycloak:
-              name: camunda-keycloak-virt-service
-              namespace: default
-              hosts:
-              - ${HOST_CAMUNDA_KEYCLOAK}
-              gateways:
-              - default/platform-gateway
-              routes:
-              - path:
-                  prefix: /
-                service: camunda-keycloak.camunda.svc.cluster.local
-                port: 80
-            camunda-optimize:
-              name: camunda-optimize-virt-service
-              namespace: default
-              hosts:
-              - ${HOST_CAMUNDA_OPTIMIZE}
-              gateways:
-              - default/platform-gateway
-              routes:
-              - path:
-                  prefix: /
-                service: camunda-optimize.camunda.svc.cluster.local
-                port: 80
-            camunda-tasklist:
-              name: camunda-tasklist-virt-service
-              namespace: default
-              hosts:
-              - ${HOST_CAMUNDA_TASKLIST}
-              gateways:
-              - default/platform-gateway
-              routes:
-              - path:
-                  prefix: /
-                service: camunda-tasklist.camunda.svc.cluster.local
-                port: 80
-            rabbitmq:
-              name: rabbitmq-virt-service
-              namespace: default
-              hosts:
-              - ${HOST_RABBITMQ}
-              gateways:
-              - default/platform-gateway
-              routes:
-              - path:
-                  prefix: /
-                service: rabbitmq.rabbitmq.svc.cluster.local
-                port: 15672
--- a/infrastructure/istio-config/contour-template/kustomization.yaml
+++ b/infrastructure/istio-config/contour-template/kustomization.yaml
@ -1,6 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../base
-patches:
-  - path: istio-config.yaml
--- a/infrastructure/istio-config/vk-infra/istio-config.yaml
+++ b/infrastructure/istio-config/vk-infra/istio-config.yaml
@ -103,17 +103,6 @@ spec:
                renewBefore: 360h0m0s
                privateKey:
                  rotationPolicy: Always
-            goalert-tls:
-              dnsNames:
-                - goalert.infra.sarex.io
-              issuerRef:
-                name: letsencrypt-issuer-istio
-                kind: ClusterIssuer
-              spec:
-                duration: 2160h0m0s
-                renewBefore: 360h0m0s
-                privateKey:
-                  rotationPolicy: Always
        istio:
          gateways:
            vault:
@ -183,17 +172,6 @@ spec:
                  tls:
                    credentialName: wiki-tls
                    mode: SIMPLE
-            goalert:
-              name: goalert-gateway
-              namespace: istio-system
-              selector:
-                istio: ingressgateway
-              servers:
-                - hosts:
-                    - goalert.infra.sarex.io
-                  tls:
-                    credentialName: goalert-tls
-                    mode: SIMPLE
          virtualServices:
            vault-virt-service:
              namespace: istio-system
@ -272,14 +250,3 @@ spec:
                    prefix: /
                  service: outline.outline.svc.cluster.local
                  port: 80
-            goalert-virt-service:
-              namespace: istio-system
-              hosts:
-                - goalert.infra.sarex.io
-              gateways:
-                - istio-system/goalert-gateway
-              routes:
-                - path:
-                    prefix: /
-                  service: goalert.goalert.svc.cluster.local
-                  port: 8081
--- a/infrastructure/kafka/contour-template/kafka.yaml
+++ b/infrastructure/kafka/contour-template/kafka.yaml
@ -47,7 +47,7 @@ spec:
      automountServiceAccountToken: true
    listeners:
      client:
-        protocol: SASL_PLAINTEXT
+        protocol: SASL_SSL
        sslClientAuth: "none"
    provisioning:
      enabled: false
--- a/infrastructure/zitadel/contour-template/kustomization.yaml
+++ b/infrastructure/zitadel/contour-template/kustomization.yaml
@ -1,6 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../base
-patches:
-  - path: zitadel.yaml
--- a/infrastructure/zitadel/contour-template/zitadel.yaml
+++ b/infrastructure/zitadel/contour-template/zitadel.yaml
@ -1,168 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: zitadel
-  namespace: zitadel
-spec:
-  interval: 5m
-  timeout: 10m
-  dependsOn:
-    - name: postgresql
-      namespace: postgresql
-  postRenderers:
-    - kustomize:
-        patches:
-          - target:
-              group: apps
-              version: v1
-              kind: Deployment
-              name: zitadel-idp-contour
-            patch: |-
-              - op: add
-                path: /spec/template/spec/nodeSelector
-                value:
-                  dedicated: generic
-              - op: add
-                path: /spec/template/spec/tolerations
-                value: []
-              - op: replace
-                path: /spec/template/metadata/annotations/vault.hashicorp.com~1agent-inject-template-zitadel-vault-config.yaml
-                value: |-
-                  {{- with secret "secrets/data/zitadel/postgresql" -}}
-                  Database:
-                    postgres:
-                      User:
-                        Password: |-
-                          {{ index .Data.data "password" }}
-                      Admin:
-                        Password: |-
-                          {{ index .Data.data "password" }}
-                  FirstInstance:
-                    Org:
-                      Human:
-                        Password: |-
-                          {{ index .Data.data "humanPassword" }}
-                  {{- end -}}
-          - target:
-              group: batch
-              version: v1
-              kind: Job
-              name: zitadel-idp-contour-init
-            patch: |-
-              - op: add
-                path: /spec/template/spec/nodeSelector
-                value:
-                  dedicated: generic
-              - op: add
-                path: /spec/template/spec/tolerations
-                value: []
-              - op: replace
-                path: /spec/template/metadata/annotations/vault.hashicorp.com~1agent-inject-template-zitadel-vault-config.yaml
-                value: |-
-                  {{- with secret "secrets/data/zitadel/postgresql" -}}
-                  Database:
-                    postgres:
-                      User:
-                        Password: |-
-                          {{ index .Data.data "password" }}
-                      Admin:
-                        Password: |-
-                          {{ index .Data.data "password" }}
-                  FirstInstance:
-                    Org:
-                      Human:
-                        Password: |-
-                          {{ index .Data.data "humanPassword" }}
-                  {{- end -}}
-          - target:
-              group: batch
-              version: v1
-              kind: Job
-              name: zitadel-idp-contour-setup
-            patch: |-
-              - op: add
-                path: /spec/template/spec/nodeSelector
-                value:
-                  dedicated: generic
-              - op: add
-                path: /spec/template/spec/tolerations
-                value: []
-              - op: replace
-                path: /spec/template/metadata/annotations/vault.hashicorp.com~1agent-inject-template-zitadel-vault-config.yaml
-                value: |-
-                  {{- with secret "secrets/data/zitadel/postgresql" -}}
-                  Database:
-                    postgres:
-                      User:
-                        Password: |-
-                          {{ index .Data.data "password" }}
-                      Admin:
-                        Password: |-
-                          {{ index .Data.data "password" }}
-                  FirstInstance:
-                    Org:
-                      Human:
-                        Password: |-
-                          {{ index .Data.data "humanPassword" }}
-                  {{- end -}}
-  values:
-    zitadel:
-      configmapConfig:
-        ExternalDomain: ${HOST_LOGIN}
-        ExternalSecure: true
-        # IAM_OWNER service user for sarexctl phase zitadel-setup; the chart stores its key
-        # in secret zitadel/sarex-installer. Created only on the first instance setup.
-        FirstInstance:
-          Org:
-            Machine:
-              Machine:
-                Username: sarex-installer
-                Name: sarexctl
-              MachineKey:
-                ExpirationDate: "2099-01-01T00:00:00Z"
-                Type: 1
-      debug:
-        enabled: false
-    postgresqlSecret:
-      create: false
-      vault:
-        enabled: true
-        role: zitadel
-        authPath: auth/kubernetes
-        secretPath: secrets/data/zitadel/postgresql
-        secretKey: password
-        kvVersion: 2
-        fileName: zitadel-vault-config.yaml
-    serviceAccount:
-      create: true
-      name: zitadel-idp-contour
-    replicaCount: 1
-    pdb:
-      enabled: false
-    env:
-      - name: ZITADEL_DEFAULTINSTANCE_FEATURES_LOGINV2_REQUIRED
-        value: "false"
-      - name: ZITADEL_SYSTEMDEFAULTS_PASSWORDHASHER_VERIFIERS
-        value: "bcrypt,pbkdf2"
-      - name: ZITADEL_MACHINE_IDENTIFICATION_HOSTNAME_ENABLED
-        value: "true"
-      - name: ZITADEL_DATABASE_POSTGRES_HOST
-        value: "postgresql.postgresql.svc.cluster.local"
-      - name: ZITADEL_DATABASE_POSTGRES_PORT
-        value: "5432"
-      - name: ZITADEL_DATABASE_POSTGRES_USER_USERNAME
-        value: "zitadel"
-      - name: ZITADEL_DATABASE_POSTGRES_ADMIN_EXISTINGDATABASE
-        value: "zitadel"
-      - name: ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME
-        value: "zitadel"
-      - name: ZITADEL_DATABASE_POSTGRES_DATABASE
-        value: "zitadel"
-      - name: ZITADEL_DATABASE_POSTGRES_USER_SSL_MODE
-        value: "disable"
-      - name: ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_MODE
-        value: "disable"
-      - name: ZITADEL_DEFAULTINSTANCE_ORG_HUMAN_USERNAME
-        value: "zitadel-admin"
-      - name: ZITADEL_DEFAULTINSTANCE_ORG_NAME
-        value: "Sarex"