feat(iam): wire ZITADEL SMTP through envVarsSecret

ZITADEL must send verification codes, and it only speaks SMTP. Route that at the smtp-gotify relay so codes reach Gotify and the phone. The settings go in as a ZITADEL_DEFAULTINSTANCE_SMTPCONFIGURATION_* envFrom secret, not as configmapConfig. Editing configmapConfig makes ArgoCD stop managing the rendered zitadel-config-yaml ConfigMap, which the Deployment still mounts; that twice left the IdP one restart away from failing. Env vars override the same keys and leave that ConfigMap alone. Validated with helm template 10.4.0: envFrom appears on both ZITADEL containers and zitadel-config-yaml still renders.
2026-10-26 23:45:59 -07:00
parent 81e6e9bc03
commit 9c3b2bfbbe
3 changed files with 40 additions and 0 deletions
@@ -36,6 +36,7 @@ files:
    - etcd-defrag-creds.enc.yaml
    - zitadel-masterkey.enc.yaml
    - smtp-gotify-secrets.enc.yaml
+    - zitadel-smtp-secrets.enc.yaml
    # Login UI RSA keypair, adopted from the chart-generated Secret so ArgoCD
    # owns it. Without this, the chart re-generates the keypair on every render,
    # which changes checksum/secret-login-service-key and leaves both Zitadel