Skip to content

Commit 949b8d0

Browse files
mridangmridang
authored
feat: drop CockroachDB support from chart templates (#587)
1 parent c3d68ad commit 949b8d0

9 files changed

Lines changed: 25 additions & 54 deletions

File tree

‎charts/zitadel/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ name: zitadel
33
description: A Helm chart for ZITADEL
44
type: application
55
appVersion: v4.13.0
6-
version: 9.31.0
6+
version: 9.32.0
77
kubeVersion: '>= 1.30.0-0'
88
home: https://zitadel.com
99
sources:

‎charts/zitadel/README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
# Zitadel
44

5-
![Version: 9.31.0](https://img.shields.io/badge/Version-9.31.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v4.13.0](https://img.shields.io/badge/AppVersion-v4.13.0-informational?style=flat-square)
5+
![Version: 9.32.0](https://img.shields.io/badge/Version-9.32.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v4.13.0](https://img.shields.io/badge/AppVersion-v4.13.0-informational?style=flat-square)
66

77
## A Better Identity and Access Management Solution
88

@@ -402,7 +402,7 @@ Kubernetes: `>= 1.30.0-0`
402402
| zitadel.configSecretName | string | `nil` | Name of an existing Kubernetes Secret containing ZITADEL configuration. Use this when you want to manage ZITADEL configuration externally (e.g., via External Secrets Operator, Sealed Secrets, or GitOps). The secret should contain YAML configuration in the same format as configmapConfig. |
403403
| zitadel.configmapConfig | object | `{"Database":{"Postgres":{"Host":"","Port":5432}},"ExternalDomain":"","ExternalSecure":true,"FirstInstance":{"LoginClientPatPath":null,"MachineKeyPath":null,"Org":{"LoginClient":{"Machine":{"Name":"Automatically Initialized IAM Login Client","Username":"login-client"},"Pat":{"ExpirationDate":"2029-01-01T00:00:00Z"}},"Machine":{"Machine":{"Name":"Automatically Initialized IAM Admin","Username":"iam-admin"},"MachineKey":{"ExpirationDate":"2029-01-01T00:00:00Z","Type":1},"Pat":{"ExpirationDate":"2029-01-01T00:00:00Z"}},"Skip":null},"PatPath":null,"Skip":false},"Machine":{"Identification":{"Hostname":{"Enabled":true},"Webhook":{"Enabled":false}}},"TLS":{"Enabled":false}}` | ZITADEL runtime configuration written to a Kubernetes ConfigMap. These values are passed directly to the ZITADEL binary and control its behavior. For the complete list of available configuration options, see: https://github.com/zitadel/zitadel/blob/main/cmd/defaults.yaml |
404404
| zitadel.dbSslAdminCrtSecret | string | `""` | Name of a Kubernetes Secret containing the admin user's client certificate for mutual TLS (mTLS) authentication to the database. The secret must contain keys "tls.crt" (certificate) and "tls.key" (private key). Used by the init job for database setup operations that require elevated privileges. |
405-
| zitadel.dbSslCaCrt | string | `""` | PEM-encoded CA certificate for verifying the database server's TLS certificate. Use this when your PostgreSQL/CockroachDB server uses a self-signed certificate or a certificate signed by a private CA. The certificate is stored in a Kubernetes Secret and mounted into ZITADEL pods at /db-ssl-ca-crt/ca.crt. Either provide the certificate inline here, or reference an existing secret using dbSslCaCrtSecret instead. |
405+
| zitadel.dbSslCaCrt | string | `""` | PEM-encoded CA certificate for verifying the database server's TLS certificate. Use this when your PostgreSQL server uses a self-signed certificate or a certificate signed by a private CA. The certificate is stored in a Kubernetes Secret and mounted into ZITADEL pods at /db-ssl-ca-crt/ca.crt. Either provide the certificate inline here, or reference an existing secret using dbSslCaCrtSecret instead. |
406406
| zitadel.dbSslCaCrtAnnotations | map[string]string | `{"helm.sh/hook":"pre-install,pre-upgrade","helm.sh/hook-delete-policy":"before-hook-creation","helm.sh/hook-weight":"0"}` | Annotations for the dbSslCaCrt Secret when created from the inline certificate. The default Helm hooks ensure the secret exists before pods start. |
407407
| zitadel.dbSslCaCrtSecret | string | `""` | Name of an existing Kubernetes Secret containing the database CA certificate at key "ca.crt". Use this instead of dbSslCaCrt when the certificate is managed externally (e.g., by cert-manager or an operator). The secret must exist in the same namespace as the ZITADEL release. |
408408
| zitadel.dbSslUserCrtSecret | string | `""` | Name of a Kubernetes Secret containing the application user's client certificate for mutual TLS (mTLS) authentication to the database. The secret must contain keys "tls.crt" (certificate) and "tls.key" (private key). Used by the main ZITADEL deployment and setup job for normal database operations. |

‎charts/zitadel/templates/_helpers.tpl‎

Lines changed: 0 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -255,31 +255,6 @@ Prefers login.securityContext; falls back to the chart-wide securityContext.
255255
{{- end }}
256256
{{- end }}
257257

258-
{{/*
259-
Returns the database config from the secretConfig or else from the configmapConfig
260-
*/}}
261-
{{- define "zitadel.dbconfig.json" -}}
262-
{{- if (((.Values.zitadel).secretConfig).Database) -}}
263-
{{- .Values.zitadel.secretConfig.Database | toJson -}}
264-
{{- else if (((.Values.zitadel).configmapConfig).Database) -}}
265-
{{- .Values.zitadel.configmapConfig.Database | toJson -}}
266-
{{- else -}}
267-
{{- dict | toJson -}}
268-
{{- end -}}
269-
{{- end -}}
270-
271-
{{/*
272-
Returns a dict with the databases key in the yaml and the environment variable part, either COCKROACH or POSTGRES, in uppercase letters.
273-
*/}}
274-
{{- define "zitadel.dbkey.json" -}}
275-
{{- range $i, $key := (include "zitadel.dbconfig.json" . | fromJson | keys ) -}}
276-
{{- if or (eq (lower $key) "postgres" ) (eq (lower $key) "pg" ) -}}
277-
{"key": "{{ $key }}", "env": "POSTGRES" }
278-
{{- else if or (eq (lower $key) "cockroach" ) (eq (lower $key) "crdb" ) -}}
279-
{"key": "{{ $key }}", "env": "COCKROACH" }
280-
{{- end -}}
281-
{{- end -}}
282-
{{- end -}}
283258

284259
{{- define "zitadel.containerPort" -}}
285260
8080

‎charts/zitadel/templates/debug_replicaset.yaml‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -62,15 +62,14 @@ spec:
6262
key: masterkey
6363
- name: ZITADEL_FIRSTINSTANCE_MACHINEKEYPATH
6464
value: "/machinekey/sa.json"
65-
{{- $dbEnv := get (include "zitadel.dbkey.json" . | fromJson) "env" }}
6665
{{- if (or .Values.zitadel.dbSslCaCrt .Values.zitadel.dbSslCaCrtSecret) }}
67-
- name: ZITADEL_DATABASE_{{ $dbEnv }}_USER_SSL_ROOTCERT
66+
- name: ZITADEL_DATABASE_POSTGRES_USER_SSL_ROOTCERT
6867
value: /db-ssl-ca-crt/ca.crt
6968
{{- end }}
7069
{{- if .Values.zitadel.dbSslUserCrtSecret }}
71-
- name: ZITADEL_DATABASE_{{ $dbEnv }}_USER_SSL_CERT
70+
- name: ZITADEL_DATABASE_POSTGRES_USER_SSL_CERT
7271
value: /db-ssl-user-crt/tls.crt
73-
- name: ZITADEL_DATABASE_{{ $dbEnv }}_USER_SSL_KEY
72+
- name: ZITADEL_DATABASE_POSTGRES_USER_SSL_KEY
7473
value: /db-ssl-user-crt/tls.key
7574
{{- end}}
7675
{{- with .Values.env }}

‎charts/zitadel/templates/deployment_zitadel.yaml‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -83,18 +83,17 @@ spec:
8383
secretKeyRef:
8484
name: {{ include "zitadel.masterkeySecretName" . }}
8585
key: masterkey
86-
{{- $dbEnv := get (include "zitadel.dbkey.json" . | fromJson) "env" }}
8786
{{- if (or .Values.zitadel.dbSslCaCrt .Values.zitadel.dbSslCaCrtSecret) }}
88-
- name: ZITADEL_DATABASE_{{ $dbEnv }}_USER_SSL_ROOTCERT
87+
- name: ZITADEL_DATABASE_POSTGRES_USER_SSL_ROOTCERT
8988
value: /db-ssl-ca-crt/ca.crt
9089
{{- end }}
9190
{{- if .Values.zitadel.dbSslUserCrtSecret }}
92-
- name: ZITADEL_DATABASE_{{ $dbEnv }}_USER_SSL_CERT
91+
- name: ZITADEL_DATABASE_POSTGRES_USER_SSL_CERT
9392
value: /db-ssl-user-crt/tls.crt
94-
- name: ZITADEL_DATABASE_{{ $dbEnv }}_USER_SSL_KEY
93+
- name: ZITADEL_DATABASE_POSTGRES_USER_SSL_KEY
9594
value: /db-ssl-user-crt/tls.key
9695
{{- end }}
97-
- name: ZITADEL_DATABASE_{{ $dbEnv }}_AWAITINITIALCONN
96+
- name: ZITADEL_DATABASE_POSTGRES_AWAITINITIALCONN
9897
value: "5m"
9998
{{- if .Values.zitadel.serverSslCrtSecret }}
10099
- name: ZITADEL_TLS_CERTPATH

‎charts/zitadel/templates/job_init.yaml‎

Lines changed: 7 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -80,26 +80,25 @@ spec:
8080
fieldRef:
8181
apiVersion: v1
8282
fieldPath: status.podIP
83-
{{- $dbEnv := get (include "zitadel.dbkey.json" . | fromJson) "env" }}
8483
{{- if (or .Values.zitadel.dbSslCaCrt .Values.zitadel.dbSslCaCrtSecret) }}
85-
- name: ZITADEL_DATABASE_{{ $dbEnv }}_USER_SSL_ROOTCERT
84+
- name: ZITADEL_DATABASE_POSTGRES_USER_SSL_ROOTCERT
8685
value: /db-ssl-ca-crt/ca.crt
87-
- name: ZITADEL_DATABASE_{{ $dbEnv }}_ADMIN_SSL_ROOTCERT
86+
- name: ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_ROOTCERT
8887
value: /db-ssl-ca-crt/ca.crt
8988
{{- end}}
9089
{{- if .Values.zitadel.dbSslAdminCrtSecret }}
91-
- name: ZITADEL_DATABASE_{{ $dbEnv }}_ADMIN_SSL_CERT
90+
- name: ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_CERT
9291
value: /db-ssl-admin-crt/tls.crt
93-
- name: ZITADEL_DATABASE_{{ $dbEnv }}_ADMIN_SSL_KEY
92+
- name: ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_KEY
9493
value: /db-ssl-admin-crt/tls.key
9594
{{- end}}
9695
{{- if .Values.zitadel.dbSslUserCrtSecret }}
97-
- name: ZITADEL_DATABASE_{{ $dbEnv }}_USER_SSL_CERT
96+
- name: ZITADEL_DATABASE_POSTGRES_USER_SSL_CERT
9897
value: /db-ssl-user-crt/tls.crt
99-
- name: ZITADEL_DATABASE_{{ $dbEnv }}_USER_SSL_KEY
98+
- name: ZITADEL_DATABASE_POSTGRES_USER_SSL_KEY
10099
value: /db-ssl-user-crt/tls.key
101100
{{- end}}
102-
- name: ZITADEL_DATABASE_{{ $dbEnv }}_AWAITINITIALCONN
101+
- name: ZITADEL_DATABASE_POSTGRES_AWAITINITIALCONN
103102
value: "5m"
104103
{{- with .Values.env }}
105104
{{- toYaml . | nindent 12 }}

‎charts/zitadel/templates/job_setup.yaml‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -111,18 +111,17 @@ spec:
111111
{{- end }}
112112
- name: ZITADEL_FIRSTINSTANCE_LOGINCLIENTPATPATH
113113
value: "/login-client/pat"
114-
{{- $dbEnv := get (include "zitadel.dbkey.json" . | fromJson) "env" }}
115114
{{- if (or .Values.zitadel.dbSslCaCrt .Values.zitadel.dbSslCaCrtSecret) }}
116-
- name: ZITADEL_DATABASE_{{ $dbEnv }}_USER_SSL_ROOTCERT
115+
- name: ZITADEL_DATABASE_POSTGRES_USER_SSL_ROOTCERT
117116
value: /db-ssl-ca-crt/ca.crt
118117
{{- end }}
119118
{{- if .Values.zitadel.dbSslUserCrtSecret }}
120-
- name: ZITADEL_DATABASE_{{ $dbEnv }}_USER_SSL_CERT
119+
- name: ZITADEL_DATABASE_POSTGRES_USER_SSL_CERT
121120
value: /db-ssl-user-crt/tls.crt
122-
- name: ZITADEL_DATABASE_{{ $dbEnv }}_USER_SSL_KEY
121+
- name: ZITADEL_DATABASE_POSTGRES_USER_SSL_KEY
123122
value: /db-ssl-user-crt/tls.key
124123
{{- end}}
125-
- name: ZITADEL_DATABASE_{{ $dbEnv }}_AWAITINITIALCONN
124+
- name: ZITADEL_DATABASE_POSTGRES_AWAITINITIALCONN
126125
value: "5m"
127126
{{- with .Values.env }}
128127
{{- toYaml . | nindent 12 }}

‎charts/zitadel/values.schema.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1716,7 +1716,7 @@
17161716
"type": "string"
17171717
},
17181718
"dbSslCaCrt": {
1719-
"description": "PEM-encoded CA certificate for verifying the database server's TLS certificate. Use this when your PostgreSQL/CockroachDB server uses a self-signed certificate or a certificate signed by a private CA. The certificate is stored in a Kubernetes Secret and mounted into ZITADEL pods at /db-ssl-ca-crt/ca.crt. Either provide the certificate inline here, or reference an existing secret using dbSslCaCrtSecret instead.",
1719+
"description": "PEM-encoded CA certificate for verifying the database server's TLS certificate. Use this when your PostgreSQL server uses a self-signed certificate or a certificate signed by a private CA. The certificate is stored in a Kubernetes Secret and mounted into ZITADEL pods at /db-ssl-ca-crt/ca.crt. Either provide the certificate inline here, or reference an existing secret using dbSslCaCrtSecret instead.",
17201720
"type": "string"
17211721
},
17221722
"dbSslCaCrtAnnotations": {

‎charts/zitadel/values.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -23,8 +23,8 @@ zitadel:
2323
# Enable HTTPS on ZITADEL's internal server. Requires serverSslCrtSecret or
2424
# selfSignedCert to be configured with valid certificates.
2525
Enabled: false
26-
# Database connection configuration. ZITADEL requires PostgreSQL 14+ or
27-
# CockroachDB 22+ as its backing database.
26+
# Database connection configuration. ZITADEL requires PostgreSQL 14+ as
27+
# its backing database.
2828
Database:
2929
Postgres:
3030
# PostgreSQL server hostname or IP address. Leave empty if providing via
@@ -199,7 +199,7 @@ zitadel:
199199
helm.sh/hook-weight: "0"
200200

201201
# -- PEM-encoded CA certificate for verifying the database server's TLS certificate.
202-
# Use this when your PostgreSQL/CockroachDB server uses a self-signed certificate
202+
# Use this when your PostgreSQL server uses a self-signed certificate
203203
# or a certificate signed by a private CA. The certificate is stored in a
204204
# Kubernetes Secret and mounted into ZITADEL pods at /db-ssl-ca-crt/ca.crt.
205205
# Either provide the certificate inline here, or reference an existing secret

0 commit comments

Comments
 (0)