devtools/kubernetes/apps/authentication/zitadel/app/helmrelease.yaml

---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: zitadel
  namespace: authentication
spec:
  interval: 5m
  chart:
    spec:
      chart: zitadel
      version: 10.0.4
      sourceRef:
        kind: HelmRepository
        name: zitadel
        namespace: flux-system
      interval: 5m
  values:
    image:
      repository: ghcr.io/zitadel/zitadel
      tag: v4.16.1@sha256:fea7ea2e4648d2dfe6a22a446252f084e4a370d8caedf08d3af4632cf517d4ef
    setupJob:
      machinekeyWriter:
        image:
          tag: 1.32.3
    zitadel:
      configmapConfig:
        FirstInstance:
          Org:
            Machine:
              Machine:
                Username: zitadel-iac-admin-sa
                Name: Admin
              MachineKey:
                Type: 1
        ExternalDomain: zitadel.internal.immich.cloud
        TLS:
          Enabled: false # TLS is terminated at the ingress
      masterkeySecretName: zitadel-master-key
    login:
      enabled: false
    env:
      - name: ZITADEL_DATABASE_POSTGRES_HOST
        valueFrom:
          secretKeyRef:
            name: zitadel-db-app
            key: host
      - name: ZITADEL_DATABASE_POSTGRES_DATABASE
        valueFrom:
          secretKeyRef:
            name: zitadel-db-app
            key: dbname
      - name: ZITADEL_DATABASE_POSTGRES_USER_USERNAME
        valueFrom:
          secretKeyRef:
            name: zitadel-db-app
            key: user
      - name: ZITADEL_DATABASE_POSTGRES_USER_PASSWORD
        valueFrom:
          secretKeyRef:
            name: zitadel-db-app
            key: password
      - name: ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME
        valueFrom:
          secretKeyRef:
            name: zitadel-db-superuser
            key: user
      - name: ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD
        valueFrom:
          secretKeyRef:
            name: zitadel-db-superuser
            key: password

    ingress:
      enabled: true
      className: nginx
      annotations:
        cert-manager.io/cluster-issuer: letsencrypt-production
        nginx.ingress.kubernetes.io/backend-protocol: "GRPC"
        nginx.ingress.kubernetes.io/configuration-snippet: |
          grpc_set_header Host $host;
      hosts:
        - host: &host zitadel.internal.immich.cloud
          paths:
            - path: /
              pathType: Prefix
      tls:
        - hosts:
            - *host
          secretName: zitadel-tls
    resources:
      limits:
        cpu: 1
        memory: 2Gi
      requests:
        cpu: 500m
        memory: 512Mi