iac/infrastructure/zitadel/sarex-contour/zitadel.yaml

apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: zitadel
  namespace: zitadel
spec:
  interval: 5m
  timeout: 10m
  postRenderers:
    # sarex-contour без выделенных нод — снимаем nodeSelector/tolerations
    # с Deployment и обоих Job'ов (init/setup). Дефолтный vault-agent
    # template не кладёт Admin.Password/FirstInstance.Org.Human.Password —
    # подменяем на свой (по образцу overlay vad), читающий их из
    # secrets/data/zitadel/postgresql (поля password/humanPassword).
    - kustomize:
        patches:
          - target:
              group: apps
              version: v1
              kind: Deployment
              name: zitadel-idp-contour
            patch: |-
              - op: add
                path: /spec/template/spec/nodeSelector
                value: {}
              - op: add
                path: /spec/template/spec/tolerations
                value: []
              - op: replace
                path: /spec/template/metadata/annotations/vault.hashicorp.com~1agent-inject-template-zitadel-vault-config.yaml
                value: |-
                  {{- with secret "secrets/data/zitadel/postgresql" -}}
                  Database:
                    postgres:
                      User:
                        Password: |-
                          {{ index .Data.data "password" }}
                      Admin:
                        Password: |-
                          {{ index .Data.data "password" }}
                  FirstInstance:
                    Org:
                      Human:
                        Password: |-
                          {{ index .Data.data "humanPassword" }}
                  {{- end -}}              
          - target:
              group: batch
              version: v1
              kind: Job
              name: zitadel-idp-contour-init
            patch: |-
              - op: add
                path: /spec/template/spec/nodeSelector
                value: {}
              - op: add
                path: /spec/template/spec/tolerations
                value: []
              - op: replace
                path: /spec/template/metadata/annotations/vault.hashicorp.com~1agent-inject-template-zitadel-vault-config.yaml
                value: |-
                  {{- with secret "secrets/data/zitadel/postgresql" -}}
                  Database:
                    postgres:
                      User:
                        Password: |-
                          {{ index .Data.data "password" }}
                      Admin:
                        Password: |-
                          {{ index .Data.data "password" }}
                  FirstInstance:
                    Org:
                      Human:
                        Password: |-
                          {{ index .Data.data "humanPassword" }}
                  {{- end -}}              
          - target:
              group: batch
              version: v1
              kind: Job
              name: zitadel-idp-contour-setup
            patch: |-
              - op: add
                path: /spec/template/spec/nodeSelector
                value: {}
              - op: add
                path: /spec/template/spec/tolerations
                value: []
              - op: replace
                path: /spec/template/metadata/annotations/vault.hashicorp.com~1agent-inject-template-zitadel-vault-config.yaml
                value: |-
                  {{- with secret "secrets/data/zitadel/postgresql" -}}
                  Database:
                    postgres:
                      User:
                        Password: |-
                          {{ index .Data.data "password" }}
                      Admin:
                        Password: |-
                          {{ index .Data.data "password" }}
                  FirstInstance:
                    Org:
                      Human:
                        Password: |-
                          {{ index .Data.data "humanPassword" }}
                  {{- end -}}              
  values:
    zitadel:
      configmapConfig:
        # placeholder — istio-config/DNS для sarex-contour ещё не заведены,
        # резолвиться прямо сейчас не обязан.
        ExternalDomain: zitadel.sarex-contour.internal
        ExternalSecure: true
      debug:
        enabled: false
    postgresqlSecret:
      create: false
      vault:
        enabled: true
        role: zitadel
        authPath: auth/kubernetes
        secretPath: secrets/data/zitadel/postgresql
        secretKey: password
        kvVersion: 2
        fileName: zitadel-vault-config.yaml
    serviceAccount:
      create: true
      name: zitadel
    replicaCount: 1
    pdb:
      enabled: false
    env:
      - name: ZITADEL_DEFAULTINSTANCE_FEATURES_LOGINV2_REQUIRED
        value: "false"
      - name: ZITADEL_SYSTEMDEFAULTS_PASSWORDHASHER_VERIFIERS
        value: "bcrypt,pbkdf2"
      - name: ZITADEL_MACHINE_IDENTIFICATION_HOSTNAME_ENABLED
        value: "true"
      - name: ZITADEL_DATABASE_POSTGRES_HOST
        value: "111.88.255.180"
      - name: ZITADEL_DATABASE_POSTGRES_PORT
        value: "5432"
      - name: ZITADEL_DATABASE_POSTGRES_USER_USERNAME
        value: "zitadel"
      - name: ZITADEL_DATABASE_POSTGRES_ADMIN_EXISTINGDATABASE
        value: "zitadel"
      - name: ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME
        value: "zitadel"
      - name: ZITADEL_DATABASE_POSTGRES_DATABASE
        value: "zitadel"
      - name: ZITADEL_DATABASE_POSTGRES_USER_SSL_MODE
        value: "disable"
      - name: ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_MODE
        value: "disable"
      - name: ZITADEL_DEFAULTINSTANCE_ORG_HUMAN_USERNAME
        value: "zitadel-admin"
      - name: ZITADEL_DEFAULTINSTANCE_ORG_NAME
        value: "Sarex"