feat: Add full configuration

manifests/configmap.yaml

@@ -4,19 +4,7 @@ metadata:
   name: zitadel-config
   namespace: zitadel
 data:
-  first-step.yaml: |
-    FirstInstance:
-      InstanceName: ZITADEL
-      Org:
-        Name: 'Halis'
-        Human:
-          # use the loginname root@zitadel.localhost
-          Username: 'admin'
-          Password: 'RootPassword1!'
-          Email:
-            Address: 'admin@zitadel.beta.halia.dev'
-            Verified: true
   config.yaml: |
-    ExternalDomain: zitadel.beta.halia.dev
+    ExternalDomain: zitadel.halis.io
     ExternalSecure: true
     ExternalPort: 443

manifests/database-backup.yaml

@@ -0,0 +1,10 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: ScheduledBackup
+metadata:
+  name: zitadel-db-backup
+  namespace: zitadel
+spec:
+  schedule: "0 0 0 * * *"
+  backupOwnerReference: self
+  cluster:
+    name: zitadel-db

manifests/database.yaml

@@ -5,11 +5,11 @@ metadata:
   namespace: zitadel
 
 spec:
-  instances: 2
+  instances: 3
 
   storage:
     size: 1Gi
-    storageClass: redundant-storage-class
+    storageClass: local-path
 
   bootstrap:
     initdb:
@@ -26,6 +26,24 @@ spec:
     pg_hba:
       - host all all all md5
 
+  backup:
+    barmanObjectStore:
+      destinationPath: "s3://halis/cloudnativepg"
+      endpointURL: https://s3.halia.dev
+      s3Credentials:
+        accessKeyId:
+          name: s3-secret
+          key: AWS_ACCESS_KEY_ID
+        secretAccessKey:
+          name: s3-secret
+          key: AWS_SECRET_ACCESS_KEY
+        region:
+          name: s3-secret
+          key: AWS_REGION
+      wal:
+        compression: gzip
+        maxParallel: 8
+
   resources:
     requests:
       cpu: 100m
@@ -33,3 +51,6 @@ spec:
     limits:
       cpu: 500m
       memory: 500Mi
+
+  monitoring:
+    enablePodMonitor: true

manifests/deployment.yaml

@@ -1,10 +1,3 @@
-# TODO
-#
-# Update var envs
-# Create necessary secrets
-# Explore volume organisation
-# Test multiple replicas configuration
-
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -25,7 +18,13 @@ spec:
             containers:
               - name: zitadel
                 image: ghcr.io/zitadel/zitadel:v2.51.3
-                command: ["/app/zitadel", "start-from-init", "--config", "/tmp/config.yaml", "--steps", "/tmp/first-step.yaml", "--masterkey", "'MasterkeyNeedsToHave32Characte'", "--tlsMode", "external"]
+                command: [
+                  "/app/zitadel", "start-from-init", 
+                  "--config", "/tmp/config.yaml", 
+                  "--steps", "/tmp/first-step.yaml", 
+                  "--masterkeyFromEnv", 
+                  "--tlsMode", "external"
+                ]
                 ports:
                   - containerPort: 8080
                 env:
@@ -62,15 +61,25 @@ spec:
                   - name: ZITADEL_EXTERNALSECURE
                     value: "true"
                   - name: ZITADEL_EXTERNALDOMAIN
-                    value: "zitadel.beta.halia.dev"
+                    value: "zitadel.halis.io"
+                  - name: ZITADEL_MASTERKEY
+                    valueFrom:
+                      secretKeyRef:
+                        name: zitadel-masterkey
+                        key: masterkey
+                  - name: ZITADEL_SYSTEMDEFAULTS_PASSWORDHASHER_HASHER_COST
+                    value: "12"
                 volumeMounts:
                   - mountPath: "/tmp/config.yaml"
                     name: zitadel-config
                     subPath: config.yaml
                   - mountPath: "/tmp/first-step.yaml"
-                    name: zitadel-config
+                    name: zitadel-secret-config
                     subPath: first-step.yaml
             volumes:
               - name: zitadel-config
                 configMap:
                   name: zitadel-config
+              - name: zitadel-secret-config
+                secret:
+                  secretName: zitadel-secret-config

manifests/ingress.yaml

@@ -1,19 +1,26 @@
-apiVersion: traefik.containo.us/v1alpha1
-kind: IngressRoute
+apiVersion: networking.k8s.io/v1
+kind: Ingress
 metadata:
-    name: zitadel-ingress
-    namespace: zitadel
-    annotations:
-      kubernetes.io/ingress.class: "traefik"
-      traefik.ingress.kubernetes.io/preserve-host-header: "true"
+  name: zitadel-ingress
+  namespace: zitadel
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-production
+    kubernetes.io/ingress.class: nginx-external
+    acme.cert-manager.io/http01-edit-in-place: "true"
 spec:
-  entryPoints:
-    - websecure
-  routes:
-    - kind: Rule
-      match: Host(`zitadel.beta.halia.dev`)
-      services:
-        - name: zitadel-svc
-          namespace: zitadel
-          port: 80
-          passHostHeader: true
+  tls:
+  - hosts:
+    - zitadel.halis.io
+    secretName: zitadel-halis-io-tls
+  ingressClassName: nginx-external
+  rules:
+  - host: zitadel.halis.io
+    http:
+      paths:
+        - path: /
+          pathType: Prefix
+          backend:
+            service:
+              name: zitadel-svc
+              port:
+                number: 80

manifests/kustomization.yaml

@@ -1,13 +1,12 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
-namespace: zitadel
-
 resources:
   - namespace.yaml
+  - secrets.yaml
   - service.yaml
   - ingress.yaml
   - database.yaml
+  - database-backup.yaml
   - configmap.yaml
   - deployment.yaml
-

manifests/secrets.yaml

@@ -0,0 +1,24 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: zitadel-secrets
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  source:
+    repoURL: https://git.halis.io/athens-school/k3s-secrets.git
+    targetRevision: prod-migration
+    path: zitadel
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=false
+      - ApplyOutOfSyncOnly=true
+      - PruneLast=true
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: zitadel