fix(iam): merge into the consumer Secret, and retry with a backoff

Two defects that a real rotation exposed: merge writeSecret replaced the whole Secret map, so every key a consumer keeps beside the credential disappeared. paperless lost SOCIALACCOUNT_PROVIDERS_JSON and immich lost config.json; both pods then failed to start while the rotation reported success. backoff a Failed attempt returned 0, so the controller retried in a tight loop. It now waits two minutes and then retries. All eight objects carry both identifiers ZITADEL needs: the app resource id for the secret endpoint and the client id for introspection. Result: seven rotations reach Succeeded with every consumer ready (grafana, comfyui, argocd, forgejo, paperless, immich, minio). api-gw stays suspended because no workload exists for it.
2026-10-27 19:59:23 -07:00
parent e800e2cf1c
commit c5058dadc6
6 changed files with 68 additions and 10 deletions
@@ -60,6 +60,7 @@ spec:
                  properties:
                    zitadelProjectID: {type: string}
                    zitadelAppID: {type: string}
+                    zitadelClientID: {type: string}
                    machineUserID: {type: string}
                    secretName: {type: string}
                    secretNamespace: {type: string}