riotpiao-poimen/homelab
2
0
Fork 0
Code Issues 23 Pull Requests Actions Packages Projects 1 Releases Wiki Activity

fix(iam): own the Zitadel login keypair through ksops

Browse Source 
The chart generated the login RSA keypair on every render, so
checksum/secret-login-service-key changed each time and both Zitadel
Deployments stayed permanently OutOfSync.

Adopt the live keypair into k8s/argocd/secrets/zitadel-login-service-key.enc.yaml
(SOPS, age recipient from .sops.yaml), list it in the ksops generator, and point
login.loginServiceKeySecretName at it. The chart then stops generating the
keypair and the Deployment checksums become deterministic.
This commit is contained in:
pi
2026-10-25 19:16:18 -07:00
parent 39081222a3
commit be44a576d4
3 changed files with 35 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
k8s/argocd/secrets/secret-generator.yaml
+5
View File
@@ -38,3 +38,8 @@ files:
- pi-sandbox-secrets.enc.yaml
- etcd-defrag-creds.enc.yaml
- zitadel-masterkey.enc.yaml
# Login UI RSA keypair, adopted from the chart-generated Secret so ArgoCD
# owns it. Without this, the chart re-generates the keypair on every render,
# which changes checksum/secret-login-service-key and leaves both Zitadel
# Deployments permanently OutOfSync.
- zitadel-login-service-key.enc.yaml