riotpiao-poimen/homelab
2
0
Fork 0
Code Issues 23 Pull Requests Actions Packages Projects 1 Releases Wiki Activity

fix(iam): own the Zitadel login keypair through ksops

Browse Source 
The chart generated the login RSA keypair on every render, so
checksum/secret-login-service-key changed each time and both Zitadel
Deployments stayed permanently OutOfSync.

Adopt the live keypair into k8s/argocd/secrets/zitadel-login-service-key.enc.yaml
(SOPS, age recipient from .sops.yaml), list it in the ksops generator, and point
login.loginServiceKeySecretName at it. The chart then stops generating the
keypair and the Deployment checksums become deterministic.
This commit is contained in:
pi
2026-10-25 19:16:18 -07:00
parent 39081222a3
commit be44a576d4
3 changed files with 35 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
k8s/infra/iam/zitadel-values.yaml
+6
View File
@@ -172,6 +172,12 @@ ingress:
login:
enabled: true
# ksops owns this Secret (k8s/argocd/secrets/zitadel-login-service-key.enc.yaml,
# rendered by the sops-secrets Application). Pointing the chart at it stops the
# chart from auto-generating an RSA keypair every render, which changed
# checksum/secret-login-service-key and kept both Deployments permanently
# OutOfSync. The keypair must stay RSA: the login container signs JWTs (RS256).
loginServiceKeySecretName: zitadel-login-service-key
replicaCount: 1
revisionHistoryLimit: 3
ingress: