feat(iam): own the ZITADEL core objects in GitOps

The chart declares its ServiceAccount, ConfigMap, Role and RoleBinding as pre-install/pre-upgrade Helm hooks with hook-delete-policy before-hook-creation. ArgoCD maps those to PreSync and prunes them when a sync ends, so every sync deleted the ServiceAccount and ConfigMap the ZITADEL Deployment mounts. New pods failed with `serviceaccount "zitadel" not found`, leaving the IdP one restart from an outage. Add a zatadel-core Application owning hook-free copies, keeping them as ordinary desired state that survives every sync. Prune is off for this path: deleting a ServiceAccount here would recreate the outage. The ConfigMap also carries the notification settings, pointing DefaultInstance.SMTPConfiguration at the smtp-gotify relay, with SMTPSenderAddressMatchesInstanceDomain false because the sender [email protected] differs from the instance domain zatadel.riotpiao.com. Drop the envVarsSecret approach: ZITADEL created no SMTP provider from those env vars (no instance.smtp.config.added event).
2026-10-26 23:54:57 -07:00
parent 9c3b2bfbbe
commit 7f29d640fd
6 changed files with 173 additions and 39 deletions
@@ -145,19 +145,9 @@ setupJob:
 replicaCount: 2
 revisionHistoryLimit: 3

-# Notification delivery. ZITADEL sends verification codes and password resets
-# by SMTP only, and this cluster has no mail path, so every user sits at
-# verified_email = empty and cannot finish a first login.
-#
-# The settings go in through envVarsSecret rather than configmapConfig on
-# purpose: changing configmapConfig makes ArgoCD stop managing the rendered
-# `zitadel-config-yaml` ConfigMap, which the Deployment still mounts, so the
-# next pod restart fails. An envFrom secret overrides the same keys with no
-# effect on that ConfigMap.
-#
-# Target is the in-cluster smtp-gotify relay, which forwards to Gotify so the
-# codes arrive on the phone.
-envVarsSecret: zitadel-smtp-env
+# Notification delivery lives in the ConfigMap owned by the zitadel-core app
+# (k8s/infra/zitadel-core/). Env overrides here produced no SMTP provider, and
+# editing configmapConfig made ArgoCD drop the rendered ConfigMap.

 # Best practice: a PDB guarantees at least one API pod stays available during
 # voluntary disruptions (node drain, rolling upgrade). Without it a drain can