feat(iam): own the ZITADEL core objects in GitOps

The chart declares its ServiceAccount, ConfigMap, Role and RoleBinding as pre-install/pre-upgrade Helm hooks with hook-delete-policy before-hook-creation. ArgoCD maps those to PreSync and prunes them when a sync ends, so every sync deleted the ServiceAccount and ConfigMap the ZITADEL Deployment mounts. New pods failed with `serviceaccount "zitadel" not found`, leaving the IdP one restart from an outage. Add a zatadel-core Application owning hook-free copies, keeping them as ordinary desired state that survives every sync. Prune is off for this path: deleting a ServiceAccount here would recreate the outage. The ConfigMap also carries the notification settings, pointing DefaultInstance.SMTPConfiguration at the smtp-gotify relay, with SMTPSenderAddressMatchesInstanceDomain false because the sender [email protected] differs from the instance domain zatadel.riotpiao.com. Drop the envVarsSecret approach: ZITADEL created no SMTP provider from those env vars (no instance.smtp.config.added event).
2026-10-26 23:54:57 -07:00
parent 9c3b2bfbbe
commit 7f29d640fd
6 changed files with 173 additions and 39 deletions
@@ -36,7 +36,6 @@ files:
    - etcd-defrag-creds.enc.yaml
    - zitadel-masterkey.enc.yaml
    - smtp-gotify-secrets.enc.yaml
-    - zitadel-smtp-secrets.enc.yaml
    # Login UI RSA keypair, adopted from the chart-generated Secret so ArgoCD
    # owns it. Without this, the chart re-generates the keypair on every render,
    # which changes checksum/secret-login-service-key and leaves both Zitadel