--- HelmRelease: authentication/zitadel Deployment: authentication/zitadel

+++ HelmRelease: authentication/zitadel Deployment: authentication/zitadel

@@ -17,13 +17,13 @@

       app.kubernetes.io/name: zitadel
       app.kubernetes.io/instance: zitadel
       app.kubernetes.io/component: start
   template:
     metadata:
       annotations:
-        checksum/configmap: 63845b56b6c7afb776f40f0061e328693b7eddfb033ba32305060f8960c9a96c
+        checksum/configmap: 13eac07e4b37888f39881874790a85be8fbe31919f552fa02535e32009dcfcad
         checksum/secret-db-ssl-ca-crt: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
         checksum/secret-zitadel-secrets: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
       labels:
         app.kubernetes.io/name: zitadel
         app.kubernetes.io/instance: zitadel
         app.kubernetes.io/managed-by: Helm
--- HelmRelease: authentication/zitadel ConfigMap: authentication/zitadel-config-yaml

+++ HelmRelease: authentication/zitadel ConfigMap: authentication/zitadel-config-yaml

@@ -14,21 +14,14 @@

     app.kubernetes.io/managed-by: Helm
 data:
   zitadel-config-yaml: |-
     ExternalDomain: zitadel.internal.immich.cloud
     ExternalSecure: true
     FirstInstance:
-      LoginClientPatPath: null
       MachineKeyPath: null
       Org:
-        LoginClient:
-          Machine:
-            Name: Automatically Initialized IAM Login Client
-            Username: login-client
-          Pat:
-            ExpirationDate: "2029-01-01T00:00:00Z"
         Machine:
           Machine:
             Name: Admin
             Username: zitadel-iac-admin-sa
           MachineKey:
             ExpirationDate: "2029-01-01T00:00:00Z"
--- HelmRelease: authentication/zitadel Job: authentication/zitadel-setup

+++ HelmRelease: authentication/zitadel Job: authentication/zitadel-setup

@@ -60,14 +60,12 @@

               name: zitadel-master-key
               key: masterkey
         - name: ZITADEL_FIRSTINSTANCE_MACHINEKEYPATH
           value: /machinekey/sa.json
         - name: ZITADEL_FIRSTINSTANCE_PATPATH
           value: /machinekey/pat
-        - name: ZITADEL_FIRSTINSTANCE_LOGINCLIENTPATPATH
-          value: /login-client/pat
         - name: ZITADEL_DATABASE_POSTGRES_AWAITINITIALCONN
           value: 5m
         - name: ZITADEL_DATABASE_POSTGRES_HOST
           valueFrom:
             secretKeyRef:
               key: host
@@ -100,14 +98,12 @@

         volumeMounts:
         - name: zitadel-config-yaml
           mountPath: /config
           readOnly: true
         - name: machinekey
           mountPath: /machinekey
-        - name: login-client
-          mountPath: /login-client
         resources: {}
       - name: zitadel-machinekey
         securityContext:
           privileged: false
           readOnlyRootFilesystem: true
           runAsNonRoot: true
@@ -185,57 +181,14 @@

               fieldPath: metadata.name
         volumeMounts:
         - name: machinekey
           mountPath: /machinekey
           readOnly: true
         resources: {}
-      - name: zitadel-login-client-pat
-        securityContext:
-          privileged: false
-          readOnlyRootFilesystem: true
-          runAsNonRoot: true
-          runAsUser: 1000
-        image: docker.io/alpine/k8s:1.35.0
-        imagePullPolicy: IfNotPresent
-        command:
-        - sh
-        - -c
-        - |
-          until [ -n "$(kubectl --namespace=authentication get pod ${POD_NAME} --output=jsonpath="{.status.containerStatuses[?(@.name=='zitadel-setup')].state.terminated}")" ]; do
-            echo 'waiting for zitadel-setup container to terminate';
-            sleep 5;
-          done &&
-          echo 'zitadel-setup container terminated' &&
-          if [ -f /login-client/pat ]; then
-            kubectl --namespace=authentication create secret generic login-client \
-              --from-file=pat=/login-client/pat \
-              --dry-run=client --output=yaml | \
-            kubectl annotate --local --filename=- \
-              helm.sh/resource-policy=keep \
-              --output=yaml | \
-            kubectl label --local --filename=- \
-              app.kubernetes.io/managed-by=Zitadel \
-              app.kubernetes.io/name=zitadel \
-              app.kubernetes.io/instance=zitadel \
-              --output=yaml | \
-            kubectl apply --filename=-;
-          fi;
-        env:
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        volumeMounts:
-        - name: login-client
-          mountPath: /login-client
-          readOnly: true
-        resources: {}
       volumes:
       - name: zitadel-config-yaml
         configMap:
           name: zitadel-config-yaml
           defaultMode: 288
       - name: machinekey
         emptyDir: {}
-      - name: login-client
-        emptyDir: {}
 

--- kubernetes/apps/authentication/zitadel/app Kustomization: flux-system/zitadel HelmRelease: authentication/zitadel

+++ kubernetes/apps/authentication/zitadel/app Kustomization: flux-system/zitadel HelmRelease: authentication/zitadel

@@ -14,13 +14,13 @@

       chart: zitadel
       interval: 5m
       sourceRef:
         kind: HelmRepository
         name: zitadel
         namespace: flux-system
-      version: 9.34.1
+      version: 10.0.1
   interval: 5m
   values:
     env:
     - name: ZITADEL_DATABASE_POSTGRES_HOST
       valueFrom:
         secretKeyRef: