iac/infrastructure/zitadel/contour-template/zitadel.yaml

apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: zitadel
  namespace: zitadel
spec:
  interval: 5m
  timeout: 10m
  dependsOn:
    - name: postgresql
      namespace: postgresql
  postRenderers:
    - kustomize:
        patches:
          - target:
              group: apps
              version: v1
              kind: Deployment
              name: zitadel-idp-contour
            patch: |-
              - op: add
                path: /spec/template/spec/nodeSelector
                value:
                  dedicated: generic
              - op: add
                path: /spec/template/spec/tolerations
                value: []
              - op: replace
                path: /spec/template/metadata/annotations/vault.hashicorp.com~1agent-inject-template-zitadel-vault-config.yaml
                value: |-
                  {{- with secret "secrets/data/zitadel/postgresql" -}}
                  Database:
                    postgres:
                      User:
                        Password: |-
                          {{ index .Data.data "password" }}
                      Admin:
                        Password: |-
                          {{ index .Data.data "password" }}
                  FirstInstance:
                    Org:
                      Human:
                        Password: |-
                          {{ index .Data.data "humanPassword" }}
                  {{- end -}}              
          - target:
              group: batch
              version: v1
              kind: Job
              name: zitadel-idp-contour-init
            patch: |-
              - op: add
                path: /spec/template/spec/nodeSelector
                value:
                  dedicated: generic
              - op: add
                path: /spec/template/spec/tolerations
                value: []
              - op: replace
                path: /spec/template/metadata/annotations/vault.hashicorp.com~1agent-inject-template-zitadel-vault-config.yaml
                value: |-
                  {{- with secret "secrets/data/zitadel/postgresql" -}}
                  Database:
                    postgres:
                      User:
                        Password: |-
                          {{ index .Data.data "password" }}
                      Admin:
                        Password: |-
                          {{ index .Data.data "password" }}
                  FirstInstance:
                    Org:
                      Human:
                        Password: |-
                          {{ index .Data.data "humanPassword" }}
                  {{- end -}}              
          - target:
              group: batch
              version: v1
              kind: Job
              name: zitadel-idp-contour-setup
            patch: |-
              - op: add
                path: /spec/template/spec/nodeSelector
                value:
                  dedicated: generic
              - op: add
                path: /spec/template/spec/tolerations
                value: []
              - op: replace
                path: /spec/template/metadata/annotations/vault.hashicorp.com~1agent-inject-template-zitadel-vault-config.yaml
                value: |-
                  {{- with secret "secrets/data/zitadel/postgresql" -}}
                  Database:
                    postgres:
                      User:
                        Password: |-
                          {{ index .Data.data "password" }}
                      Admin:
                        Password: |-
                          {{ index .Data.data "password" }}
                  FirstInstance:
                    Org:
                      Human:
                        Password: |-
                          {{ index .Data.data "humanPassword" }}
                  {{- end -}}              
  values:
    zitadel:
      configmapConfig:
        ExternalDomain: ${HOST_LOGIN}
        ExternalSecure: true
        # IAM_OWNER service user for sarexctl phase zitadel-setup; the chart stores its key
        # in secret zitadel/sarex-installer. Created only on the first instance setup.
        FirstInstance:
          Org:
            Machine:
              Machine:
                Username: sarex-installer
                Name: sarexctl
              MachineKey:
                ExpirationDate: "2099-01-01T00:00:00Z"
                Type: 1
      debug:
        enabled: false
    postgresqlSecret:
      create: false
      vault:
        enabled: true
        role: zitadel
        authPath: auth/kubernetes
        secretPath: secrets/data/zitadel/postgresql
        secretKey: password
        kvVersion: 2
        fileName: zitadel-vault-config.yaml
    serviceAccount:
      create: true
      name: zitadel-idp-contour
    replicaCount: 1
    pdb:
      enabled: false
    env:
      - name: ZITADEL_DEFAULTINSTANCE_FEATURES_LOGINV2_REQUIRED
        value: "false"
      - name: ZITADEL_SYSTEMDEFAULTS_PASSWORDHASHER_VERIFIERS
        value: "bcrypt,pbkdf2"
      - name: ZITADEL_MACHINE_IDENTIFICATION_HOSTNAME_ENABLED
        value: "true"
      - name: ZITADEL_DATABASE_POSTGRES_HOST
        value: "postgresql.postgresql.svc.cluster.local"
      - name: ZITADEL_DATABASE_POSTGRES_PORT
        value: "5432"
      - name: ZITADEL_DATABASE_POSTGRES_USER_USERNAME
        value: "zitadel"
      - name: ZITADEL_DATABASE_POSTGRES_ADMIN_EXISTINGDATABASE
        value: "zitadel"
      - name: ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME
        value: "zitadel"
      - name: ZITADEL_DATABASE_POSTGRES_DATABASE
        value: "zitadel"
      - name: ZITADEL_DATABASE_POSTGRES_USER_SSL_MODE
        value: "disable"
      - name: ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_MODE
        value: "disable"
      - name: ZITADEL_DEFAULTINSTANCE_ORG_HUMAN_USERNAME
        value: "zitadel-admin"
      - name: ZITADEL_DEFAULTINSTANCE_ORG_NAME
        value: "Sarex"