Skip to content

chore: retire the self-hosted zitadel - #1702

Merged
zackpollard merged 1 commit into
mainfrom
chore/retire-self-hosted-zitadel
Jul 28, 2026
Merged

chore: retire the self-hosted zitadel#1702
zackpollard merged 1 commit into
mainfrom
chore/retire-self-hosted-zitadel

Conversation

@zackpollard

@zackpollard zackpollard commented Jun 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

1. Destroy the self-hosted resources — while the instance is still running

The instance must be reachable so the provider can delete its org/projects/users; this also removes the ZITADEL_OAUTH_CLIENT_ID/SECRET_* 1Password items.

git checkout main && git pull 
cd tf/deployment/modules/shared/zitadel/self-hosted
mise run tg run -- destroy

2. Merge this PR

Flux prunes the in-cluster instance (helmrelease, CNPG database, secrets, admin-sa pushsecret); the tf module is removed.

3. Manual cleanup (not tf-managed)

  • Delete the leftover 1Password items the destroy doesn't own: the zitadel masterkey and the admin-sa pushsecret item.
  • DNS for zitadel.internal.immich.cloud is ingress/external-dns-managed, so it's removed with the app — nothing to do.

@github-actions

github-actions Bot commented Jun 18, 2026

Copy link
Copy Markdown 
--- kubernetes/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/zitadel-secrets

+++ kubernetes/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/zitadel-secrets

@@ -1,26 +0,0 @@

----
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  labels:
-    kustomize.toolkit.fluxcd.io/name: cluster-apps
-    kustomize.toolkit.fluxcd.io/namespace: flux-system
-  name: zitadel-secrets
-  namespace: flux-system
-spec:
-  commonMetadata:
-    labels:
-      app.kubernetes.io/name: zitadel-secrets
-  dependsOn:
-  - name: external-secrets-stores
-  interval: 30m
-  path: ./kubernetes/apps/authentication/zitadel/secrets
-  prune: true
-  retryInterval: 1m
-  sourceRef:
-    kind: GitRepository
-    name: immich-kubernetes
-  targetNamespace: authentication
-  timeout: 5m
-  wait: true
-
--- kubernetes/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/zitadel-database

+++ kubernetes/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/zitadel-database

@@ -1,26 +0,0 @@

----
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  labels:
-    kustomize.toolkit.fluxcd.io/name: cluster-apps
-    kustomize.toolkit.fluxcd.io/namespace: flux-system
-  name: zitadel-database
-  namespace: flux-system
-spec:
-  commonMetadata:
-    labels:
-      app.kubernetes.io/name: zitadel-database
-  dependsOn:
-  - name: database-cloudnative-pg
-  interval: 30m
-  path: ./kubernetes/apps/authentication/zitadel/database
-  prune: true
-  retryInterval: 1m
-  sourceRef:
-    kind: GitRepository
-    name: immich-kubernetes
-  targetNamespace: authentication
-  timeout: 5m
-  wait: true
-
--- kubernetes/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/zitadel

+++ kubernetes/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/zitadel

@@ -1,27 +0,0 @@

----
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  labels:
-    kustomize.toolkit.fluxcd.io/name: cluster-apps
-    kustomize.toolkit.fluxcd.io/namespace: flux-system
-  name: zitadel
-  namespace: flux-system
-spec:
-  commonMetadata:
-    labels:
-      app.kubernetes.io/name: zitadel
-  dependsOn:
-  - name: zitadel-secrets
-  - name: zitadel-database
-  interval: 30m
-  path: ./kubernetes/apps/authentication/zitadel/app
-  prune: true
-  retryInterval: 1m
-  sourceRef:
-    kind: GitRepository
-    name: immich-kubernetes
-  targetNamespace: authentication
-  timeout: 5m
-  wait: true
-
--- kubernetes/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/zitadel-pushsecret

+++ kubernetes/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/zitadel-pushsecret

@@ -1,26 +0,0 @@

----
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  labels:
-    kustomize.toolkit.fluxcd.io/name: cluster-apps
-    kustomize.toolkit.fluxcd.io/namespace: flux-system
-  name: zitadel-pushsecret
-  namespace: flux-system
-spec:
-  commonMetadata:
-    labels:
-      app.kubernetes.io/name: zitadel-pushsecret
-  dependsOn:
-  - name: zitadel
-  interval: 30m
-  path: ./kubernetes/apps/authentication/zitadel/pushsecret
-  prune: true
-  retryInterval: 1m
-  sourceRef:
-    kind: GitRepository
-    name: immich-kubernetes
-  targetNamespace: authentication
-  timeout: 5m
-  wait: true
-
--- kubernetes/apps/authentication/zitadel/database Kustomization: flux-system/zitadel-database Cluster: authentication/zitadel-db

+++ kubernetes/apps/authentication/zitadel/database Kustomization: flux-system/zitadel-database Cluster: authentication/zitadel-db

@@ -1,16 +0,0 @@

----
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  labels:
-    app.kubernetes.io/name: zitadel-database
-    kustomize.toolkit.fluxcd.io/name: zitadel-database
-    kustomize.toolkit.fluxcd.io/namespace: flux-system
-  name: zitadel-db
-  namespace: authentication
-spec:
-  enableSuperuserAccess: true
-  storage:
-    size: 10Gi
-    storageClass: zfs
-
--- kubernetes/apps/authentication/zitadel/secrets Kustomization: flux-system/zitadel-secrets ExternalSecret: authentication/zitadel-master-key

+++ kubernetes/apps/authentication/zitadel/secrets Kustomization: flux-system/zitadel-secrets ExternalSecret: authentication/zitadel-master-key

@@ -1,20 +0,0 @@

----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  labels:
-    app.kubernetes.io/name: zitadel-secrets
-    kustomize.toolkit.fluxcd.io/name: zitadel-secrets
-    kustomize.toolkit.fluxcd.io/namespace: flux-system
-  name: zitadel-master-key
-  namespace: authentication
-spec:
-  data:
-  - remoteRef:
-      key: AUTH_ZITADEL_MASTER_KEY
-    secretKey: masterkey
-  refreshInterval: 20s
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: 1p-tf
-
--- kubernetes/apps/authentication/zitadel/app Kustomization: flux-system/zitadel HelmRelease: authentication/zitadel

+++ kubernetes/apps/authentication/zitadel/app Kustomization: flux-system/zitadel HelmRelease: authentication/zitadel

@@ -1,101 +0,0 @@

----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  labels:
-    app.kubernetes.io/name: zitadel
-    kustomize.toolkit.fluxcd.io/name: zitadel
-    kustomize.toolkit.fluxcd.io/namespace: flux-system
-  name: zitadel
-  namespace: authentication
-spec:
-  chart:
-    spec:
-      chart: zitadel
-      interval: 5m
-      sourceRef:
-        kind: HelmRepository
-        name: zitadel
-        namespace: flux-system
-      version: 10.0.2
-  interval: 5m
-  values:
-    env:
-    - name: ZITADEL_DATABASE_POSTGRES_HOST
-      valueFrom:
-        secretKeyRef:
-          key: host
-          name: zitadel-db-app
-    - name: ZITADEL_DATABASE_POSTGRES_DATABASE
-      valueFrom:
-        secretKeyRef:
-          key: dbname
-          name: zitadel-db-app
-    - name: ZITADEL_DATABASE_POSTGRES_USER_USERNAME
-      valueFrom:
-        secretKeyRef:
-          key: user
-          name: zitadel-db-app
-    - name: ZITADEL_DATABASE_POSTGRES_USER_PASSWORD
-      valueFrom:
-        secretKeyRef:
-          key: password
-          name: zitadel-db-app
-    - name: ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME
-      valueFrom:
-        secretKeyRef:
-          key: user
-          name: zitadel-db-superuser
-    - name: ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD
-      valueFrom:
-        secretKeyRef:
-          key: password
-          name: zitadel-db-superuser
-    image:
-      repository: ghcr.io/zitadel/zitadel
-      tag: v4.15.0@sha256:cc9fb3b2788dcbd0dff93781a0323bbe491a4cec11e1caefd9a1ed31f7fdc145
-    ingress:
-      annotations:
-        cert-manager.io/cluster-issuer: letsencrypt-production
-        nginx.ingress.kubernetes.io/backend-protocol: GRPC
-        nginx.ingress.kubernetes.io/configuration-snippet: |
-          grpc_set_header Host $host;
-      className: nginx
-      enabled: true
-      hosts:
-      - host: zitadel.internal.immich.cloud
-        paths:
-        - path: /
-          pathType: Prefix
-      tls:
-      - hosts:
-        - zitadel.internal.immich.cloud
-        secretName: zitadel-tls
-    login:
-      enabled: false
-    resources:
-      limits:
-        cpu: 1
-        memory: 2Gi
-      requests:
-        cpu: 500m
-        memory: 512Mi
-    setupJob:
-      machinekeyWriter:
-        image:
-          tag: 1.32.3
-    zitadel:
-      configmapConfig:
-        ExternalDomain: zitadel.internal.immich.cloud
-        FirstInstance:
-          Org:
-            Machine:
-              Machine:
-                Name: Admin
-                Username: zitadel-iac-admin-sa
-              MachineKey:
-                Type: 1
-        TLS:
-          Enabled: false
-      masterkeySecretName: zitadel-master-key
-
--- kubernetes/apps/authentication/zitadel/pushsecret Kustomization: flux-system/zitadel-pushsecret PushSecret: authentication/zitadel-iac-admin-sa

+++ kubernetes/apps/authentication/zitadel/pushsecret Kustomization: flux-system/zitadel-pushsecret PushSecret: authentication/zitadel-iac-admin-sa

@@ -1,23 +0,0 @@

----
-apiVersion: external-secrets.io/v1alpha1
-kind: PushSecret
-metadata:
-  labels:
-    app.kubernetes.io/name: zitadel-pushsecret
-    kustomize.toolkit.fluxcd.io/name: zitadel-pushsecret
-    kustomize.toolkit.fluxcd.io/namespace: flux-system
-  name: zitadel-iac-admin-sa
-  namespace: authentication
-spec:
-  data:
-  - match:
-      remoteRef:
-        remoteKey: PUSHED_ZITADEL_IAC_ADMIN_SA
-      secretKey: zitadel-iac-admin-sa.json
-  secretStoreRefs:
-  - kind: ClusterSecretStore
-    name: 1p-kubernetes
-  selector:
-    secret:
-      name: zitadel-iac-admin-sa
-

@github-actions

github-actions Bot commented Jun 18, 2026

Copy link
Copy Markdown 
--- HelmRelease: authentication/zitadel Service: authentication/zitadel

+++ HelmRelease: authentication/zitadel Service: authentication/zitadel

@@ -1,25 +0,0 @@

----
-apiVersion: v1
-kind: Service
-metadata:
-  name: zitadel
-  namespace: authentication
-  annotations:
-    traefik.ingress.kubernetes.io/service.serversscheme: h2c
-  labels:
-    app.kubernetes.io/name: zitadel
-    app.kubernetes.io/instance: zitadel
-    app.kubernetes.io/managed-by: Helm
-spec:
-  type: ClusterIP
-  ports:
-  - port: 8080
-    targetPort: 8080
-    protocol: TCP
-    name: http2-server
-    appProtocol: kubernetes.io/h2c
-  selector:
-    app.kubernetes.io/name: zitadel
-    app.kubernetes.io/instance: zitadel
-    app.kubernetes.io/component: start
-
--- HelmRelease: authentication/zitadel Deployment: authentication/zitadel

+++ HelmRelease: authentication/zitadel Deployment: authentication/zitadel

@@ -1,146 +0,0 @@

----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: zitadel
-  namespace: authentication
-  labels:
-    app.kubernetes.io/name: zitadel
-    app.kubernetes.io/instance: zitadel
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/component: start
-spec:
-  revisionHistoryLimit: 10
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: zitadel
-      app.kubernetes.io/instance: zitadel
-      app.kubernetes.io/component: start
-  template:
-    metadata:
-      annotations:
-        checksum/configmap: 1e4c8b5d1e226e433a596a7bb070295d0341480a08bfd8d59b830756aa73c2b2
-        checksum/secret-db-ssl-ca-crt: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
-        checksum/secret-zitadel-secrets: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
-      labels:
-        app.kubernetes.io/name: zitadel
-        app.kubernetes.io/instance: zitadel
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/component: start
-    spec:
-      serviceAccountName: zitadel
-      securityContext:
-        fsGroup: 1000
-        runAsNonRoot: true
-        runAsUser: 1000
-      enableServiceLinks: false
-      containers:
-      - name: zitadel
-        securityContext:
-          privileged: false
-          readOnlyRootFilesystem: true
-          runAsNonRoot: true
-          runAsUser: 1000
-        image: ghcr.io/zitadel/zitadel:v4.15.0@sha256:cc9fb3b2788dcbd0dff93781a0323bbe491a4cec11e1caefd9a1ed31f7fdc145
-        imagePullPolicy: IfNotPresent
-        args:
-        - start
-        - --config
-        - /config/zitadel-config-yaml
-        - --masterkeyFromEnv
-        env:
-        - name: POD_IP
-          valueFrom:
-            fieldRef:
-              apiVersion: v1
-              fieldPath: status.podIP
-        - name: ZITADEL_MASTERKEY
-          valueFrom:
-            secretKeyRef:
-              name: zitadel-master-key
-              key: masterkey
-        - name: ZITADEL_DATABASE_POSTGRES_AWAITINITIALCONN
-          value: 5m
-        - name: ZITADEL_DATABASE_POSTGRES_HOST
-          valueFrom:
-            secretKeyRef:
-              key: host
-              name: zitadel-db-app
-        - name: ZITADEL_DATABASE_POSTGRES_DATABASE
-          valueFrom:
-            secretKeyRef:
-              key: dbname
-              name: zitadel-db-app
-        - name: ZITADEL_DATABASE_POSTGRES_USER_USERNAME
-          valueFrom:
-            secretKeyRef:
-              key: user
-              name: zitadel-db-app
-        - name: ZITADEL_DATABASE_POSTGRES_USER_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              key: password
-              name: zitadel-db-app
-        - name: ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME
-          valueFrom:
-            secretKeyRef:
-              key: user
-              name: zitadel-db-superuser
-        - name: ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              key: password
-              name: zitadel-db-superuser
-        ports:
-        - containerPort: 8080
-          name: http2-server
-          protocol: TCP
-        livenessProbe:
-          httpGet:
-            path: /debug/healthz
-            port: http2-server
-            httpHeaders:
-            - name: Host
-              value: zitadel.internal.immich.cloud
-            scheme: HTTP
-          initialDelaySeconds: 0
-          periodSeconds: 5
-          failureThreshold: 3
-        readinessProbe:
-          httpGet:
-            path: /debug/ready
-            port: http2-server
-            httpHeaders:
-            - name: Host
-              value: zitadel.internal.immich.cloud
-            scheme: HTTP
-          initialDelaySeconds: 0
-          periodSeconds: 5
-          failureThreshold: 3
-        startupProbe:
-          httpGet:
-            path: /debug/ready
-            port: http2-server
-            httpHeaders:
-            - name: Host
-              value: zitadel.internal.immich.cloud
-            scheme: HTTP
-          periodSeconds: 1
-          failureThreshold: 30
-        volumeMounts:
-        - name: zitadel-config-yaml
-          mountPath: /config
-          readOnly: true
-        resources:
-          limits:
-            cpu: 1
-            memory: 2Gi
-          requests:
-            cpu: 500m
-            memory: 512Mi
-      volumes:
-      - name: zitadel-config-yaml
-        configMap:
-          name: zitadel-config-yaml
-
--- HelmRelease: authentication/zitadel Ingress: authentication/zitadel

+++ HelmRelease: authentication/zitadel Ingress: authentication/zitadel

@@ -1,33 +0,0 @@

----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: zitadel
-  namespace: authentication
-  labels:
-    app.kubernetes.io/name: zitadel
-    app.kubernetes.io/instance: zitadel
-    app.kubernetes.io/managed-by: Helm
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-production
-    nginx.ingress.kubernetes.io/backend-protocol: GRPC
-    nginx.ingress.kubernetes.io/configuration-snippet: |
-      grpc_set_header Host $host;
-spec:
-  ingressClassName: nginx
-  tls:
-  - hosts:
-    - zitadel.internal.immich.cloud
-    secretName: zitadel-tls
-  rules:
-  - host: zitadel.internal.immich.cloud
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: zitadel
-            port:
-              number: 8080
-
--- HelmRelease: authentication/zitadel ServiceAccount: authentication/zitadel

+++ HelmRelease: authentication/zitadel ServiceAccount: authentication/zitadel

@@ -1,15 +0,0 @@

----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: zitadel
-  namespace: authentication
-  labels:
-    app.kubernetes.io/name: zitadel
-    app.kubernetes.io/instance: zitadel
-    app.kubernetes.io/managed-by: Helm
-  annotations:
-    helm.sh/hook: pre-install,pre-upgrade
-    helm.sh/hook-delete-policy: before-hook-creation
-    helm.sh/hook-weight: '0'
-
--- HelmRelease: authentication/zitadel ConfigMap: authentication/zitadel-config-yaml

+++ HelmRelease: authentication/zitadel ConfigMap: authentication/zitadel-config-yaml

@@ -1,42 +0,0 @@

----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: zitadel-config-yaml
-  namespace: authentication
-  annotations:
-    helm.sh/hook: pre-install,pre-upgrade
-    helm.sh/hook-delete-policy: before-hook-creation
-    helm.sh/hook-weight: '0'
-  labels:
-    app.kubernetes.io/name: zitadel
-    app.kubernetes.io/instance: zitadel
-    app.kubernetes.io/managed-by: Helm
-data:
-  zitadel-config-yaml: |-
-    ExternalDomain: zitadel.internal.immich.cloud
-    ExternalSecure: true
-    FirstInstance:
-      MachineKeyPath: null
-      Org:
-        Machine:
-          Machine:
-            Name: Admin
-            Username: zitadel-iac-admin-sa
-          MachineKey:
-            ExpirationDate: "2029-01-01T00:00:00Z"
-            Type: 1
-          Pat:
-            ExpirationDate: "2029-01-01T00:00:00Z"
-        Skip: null
-      PatPath: null
-      Skip: false
-    Machine:
-      Identification:
-        Hostname:
-          Enabled: true
-        Webhook:
-          Enabled: false
-    TLS:
-      Enabled: false
-
--- HelmRelease: authentication/zitadel Role: authentication/zitadel

+++ HelmRelease: authentication/zitadel Role: authentication/zitadel

@@ -1,32 +0,0 @@

----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: zitadel
-  namespace: authentication
-  labels:
-    app.kubernetes.io/name: zitadel
-    app.kubernetes.io/instance: zitadel
-    app.kubernetes.io/managed-by: Helm
-  annotations:
-    helm.sh/hook: pre-install,pre-upgrade
-    helm.sh/hook-delete-policy: before-hook-creation
-    helm.sh/hook-weight: '0'
-rules:
-- apiGroups:
-  - ''
-  resources:
-  - secrets
-  verbs:
-  - get
-  - create
-  - patch
-  - list
-  - delete
-- apiGroups:
-  - ''
-  resources:
-  - pods
-  verbs:
-  - get
-
--- HelmRelease: authentication/zitadel RoleBinding: authentication/zitadel

+++ HelmRelease: authentication/zitadel RoleBinding: authentication/zitadel

@@ -1,22 +0,0 @@

----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: zitadel
-  namespace: authentication
-  labels:
-    app.kubernetes.io/name: zitadel
-    app.kubernetes.io/instance: zitadel
-    app.kubernetes.io/managed-by: Helm
-  annotations:
-    helm.sh/hook: pre-install,pre-upgrade
-    helm.sh/hook-delete-policy: before-hook-creation
-    helm.sh/hook-weight: '0'
-subjects:
-- kind: ServiceAccount
-  name: zitadel
-roleRef:
-  kind: Role
-  name: zitadel
-  apiGroup: rbac.authorization.k8s.io
-
--- HelmRelease: authentication/zitadel Job: authentication/zitadel-cleanup

+++ HelmRelease: authentication/zitadel Job: authentication/zitadel-cleanup

@@ -1,53 +0,0 @@

----
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: zitadel-cleanup
-  namespace: authentication
-  labels:
-    app.kubernetes.io/name: zitadel
-    app.kubernetes.io/instance: zitadel
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/component: cleanup
-  annotations:
-    helm.sh/hook: post-delete
-    helm.sh/hook-delete-policy: hook-succeeded
-    helm.sh/hook-weight: '-1'
-spec:
-  backoffLimit: 3
-  activeDeadlineSeconds: 60
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: zitadel
-        app.kubernetes.io/instance: zitadel
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/component: cleanup
-    spec:
-      serviceAccountName: zitadel
-      securityContext:
-        fsGroup: 1000
-        runAsNonRoot: true
-        runAsUser: 1000
-      enableServiceLinks: false
-      restartPolicy: Never
-      containers:
-      - name: zitadel-cleanup
-        securityContext:
-          privileged: false
-          readOnlyRootFilesystem: true
-          runAsNonRoot: true
-          runAsUser: 1000
-        image: docker.io/alpine/k8s:1.35.0
-        imagePullPolicy: IfNotPresent
-        command:
-        - sh
-        - -c
-        - |
-          echo "Cleaning up secrets created by zitadel-setup..."
-          kubectl --namespace=authentication delete secret \
-            --selector='app.kubernetes.io/managed-by=Zitadel,app.kubernetes.io/instance=zitadel' \
-            --ignore-not-found=true
-          echo "Cleanup completed"
-        resources: {}
-
--- HelmRelease: authentication/zitadel Job: authentication/zitadel-init

+++ HelmRelease: authentication/zitadel Job: authentication/zitadel-init

@@ -1,95 +0,0 @@

----
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: zitadel-init
-  namespace: authentication
-  labels:
-    app.kubernetes.io/name: zitadel
-    app.kubernetes.io/instance: zitadel
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/component: init
-  annotations:
-    helm.sh/hook: pre-install,pre-upgrade
-    helm.sh/hook-delete-policy: before-hook-creation
-    helm.sh/hook-weight: '1'
-spec:
-  backoffLimit: 5
-  activeDeadlineSeconds: 300
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: zitadel
-        app.kubernetes.io/instance: zitadel
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/component: init
-    spec:
-      serviceAccountName: zitadel
-      securityContext:
-        fsGroup: 1000
-        runAsNonRoot: true
-        runAsUser: 1000
-      enableServiceLinks: false
-      restartPolicy: Never
-      containers:
-      - name: zitadel-init
-        securityContext:
-          privileged: false
-          readOnlyRootFilesystem: true
-          runAsNonRoot: true
-          runAsUser: 1000
-        image: ghcr.io/zitadel/zitadel:v4.15.0@sha256:cc9fb3b2788dcbd0dff93781a0323bbe491a4cec11e1caefd9a1ed31f7fdc145
-        imagePullPolicy: IfNotPresent
-        args:
-        - init
-        - --config
-        - /config/zitadel-config-yaml
-        env:
-        - name: POD_IP
-          valueFrom:
-            fieldRef:
-              apiVersion: v1
-              fieldPath: status.podIP
-        - name: ZITADEL_DATABASE_POSTGRES_AWAITINITIALCONN
-          value: 5m
-        - name: ZITADEL_DATABASE_POSTGRES_HOST
-          valueFrom:
-            secretKeyRef:
-              key: host
-              name: zitadel-db-app
-        - name: ZITADEL_DATABASE_POSTGRES_DATABASE
-          valueFrom:
-            secretKeyRef:
-              key: dbname
-              name: zitadel-db-app
-        - name: ZITADEL_DATABASE_POSTGRES_USER_USERNAME
-          valueFrom:
-            secretKeyRef:
-              key: user
-              name: zitadel-db-app
-        - name: ZITADEL_DATABASE_POSTGRES_USER_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              key: password
-              name: zitadel-db-app
-        - name: ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME
-          valueFrom:
-            secretKeyRef:
-              key: user
-              name: zitadel-db-superuser
-        - name: ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              key: password
-              name: zitadel-db-superuser
-        volumeMounts:
-        - name: zitadel-config-yaml
-          mountPath: /config
-          readOnly: true
-        resources: {}
-      volumes:
-      - name: zitadel-config-yaml
-        configMap:
-          name: zitadel-config-yaml
-          defaultMode: 288
-
--- HelmRelease: authentication/zitadel Job: authentication/zitadel-setup

+++ HelmRelease: authentication/zitadel Job: authentication/zitadel-setup

@@ -1,194 +0,0 @@

----
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: zitadel-setup
-  namespace: authentication
-  labels:
-    app.kubernetes.io/name: zitadel
-    app.kubernetes.io/instance: zitadel
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/component: setup
-  annotations:
-    helm.sh/hook: pre-install,pre-upgrade
-    helm.sh/hook-delete-policy: before-hook-creation
-    helm.sh/hook-weight: '2'
-spec:
-  backoffLimit: 5
-  activeDeadlineSeconds: 300
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: zitadel
-        app.kubernetes.io/instance: zitadel
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/component: setup
-    spec:
-      serviceAccountName: zitadel
-      securityContext:
-        fsGroup: 1000
-        runAsNonRoot: true
-        runAsUser: 1000
-      enableServiceLinks: false
-      restartPolicy: Never
-      containers:
-      - name: zitadel-setup
-        securityContext:
-          privileged: false
-          readOnlyRootFilesystem: true
-          runAsNonRoot: true
-          runAsUser: 1000
-        image: ghcr.io/zitadel/zitadel:v4.15.0@sha256:cc9fb3b2788dcbd0dff93781a0323bbe491a4cec11e1caefd9a1ed31f7fdc145
-        imagePullPolicy: IfNotPresent
-        args:
-        - setup
-        - --masterkeyFromEnv
-        - --config
-        - /config/zitadel-config-yaml
-        - --steps
-        - /config/zitadel-config-yaml
-        - --init-projections=true
-        env:
-        - name: POD_IP
-          valueFrom:
-            fieldRef:
-              apiVersion: v1
-              fieldPath: status.podIP
-        - name: ZITADEL_MASTERKEY
-          valueFrom:
-            secretKeyRef:
-              name: zitadel-master-key
-              key: masterkey
-        - name: ZITADEL_FIRSTINSTANCE_MACHINEKEYPATH
-          value: /machinekey/sa.json
-        - name: ZITADEL_FIRSTINSTANCE_PATPATH
-          value: /machinekey/pat
-        - name: ZITADEL_DATABASE_POSTGRES_AWAITINITIALCONN
-          value: 5m
-        - name: ZITADEL_DATABASE_POSTGRES_HOST
-          valueFrom:
-            secretKeyRef:
-              key: host
-              name: zitadel-db-app
-        - name: ZITADEL_DATABASE_POSTGRES_DATABASE
-          valueFrom:
-            secretKeyRef:
-              key: dbname
-              name: zitadel-db-app
-        - name: ZITADEL_DATABASE_POSTGRES_USER_USERNAME
-          valueFrom:
-            secretKeyRef:
-              key: user
-              name: zitadel-db-app
-        - name: ZITADEL_DATABASE_POSTGRES_USER_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              key: password
-              name: zitadel-db-app
-        - name: ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME
-          valueFrom:
-            secretKeyRef:
-              key: user
-              name: zitadel-db-superuser
-        - name: ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              key: password
-              name: zitadel-db-superuser
-        volumeMounts:
-        - name: zitadel-config-yaml
-          mountPath: /config
-          readOnly: true
-        - name: machinekey
-          mountPath: /machinekey
-        resources: {}
-      - name: zitadel-machinekey
-        securityContext:
-          privileged: false
-          readOnlyRootFilesystem: true
-          runAsNonRoot: true
-          runAsUser: 1000
-        image: docker.io/alpine/k8s:1.35.0
-        imagePullPolicy: IfNotPresent
-        command:
-        - sh
-        - -c
-        - |
-          until [ -n "$(kubectl --namespace=authentication get pod ${POD_NAME} --output=jsonpath="{.status.containerStatuses[?(@.name=='zitadel-setup')].state.terminated}")" ]; do
-            echo 'waiting for zitadel-setup container to terminate';
-            sleep 5;
-          done &&
-          echo 'zitadel-setup container terminated' &&
-          if [ -f /machinekey/sa.json ]; then
-            kubectl --namespace=authentication create secret generic zitadel-iac-admin-sa \
-              --from-file=zitadel-iac-admin-sa.json=/machinekey/sa.json \
-              --dry-run=client --output=yaml | \
-            kubectl annotate --local --filename=- \
-              helm.sh/resource-policy=keep \
-              --output=yaml | \
-            kubectl label --local --filename=- \
-              app.kubernetes.io/managed-by=Zitadel \
-              app.kubernetes.io/name=zitadel \
-              app.kubernetes.io/instance=zitadel \
-              --output=yaml | \
-            kubectl apply --server-side --field-manager=zitadel-setup --filename=-;
-          fi;
-        env:
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        volumeMounts:
-        - name: machinekey
-          mountPath: /machinekey
-          readOnly: true
-        resources: {}
-      - name: zitadel-machine-pat
-        securityContext:
-          privileged: false
-          readOnlyRootFilesystem: true
-          runAsNonRoot: true
-          runAsUser: 1000
-        image: docker.io/alpine/k8s:1.35.0
-        imagePullPolicy: IfNotPresent
-        command:
-        - sh
-        - -c
-        - |
-          until [ -n "$(kubectl --namespace=authentication get pod "${POD_NAME}" --output=jsonpath="{.status.containerStatuses[?(@.name=='zitadel-setup')].state.terminated}")" ]; do
-            echo 'waiting for zitadel-setup container to terminate';
-            sleep 5;
-          done &&
-          echo 'zitadel-setup container terminated' &&
-          if [ -f /machinekey/pat ]; then
-            kubectl --namespace=authentication create secret generic zitadel-iac-admin-sa-pat \
-              --from-file=pat=/machinekey/pat \
-              --dry-run=client --output=yaml | \
-            kubectl annotate --local --filename=- \
-              helm.sh/resource-policy=keep \
-              --output=yaml | \
-            kubectl label --local --filename=- \
-              app.kubernetes.io/managed-by=Zitadel \
-              app.kubernetes.io/name=zitadel \
-              app.kubernetes.io/instance=zitadel \
-              --output=yaml | \
-            kubectl apply --server-side --field-manager=zitadel-setup --filename=-;
-          fi;
-        env:
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        volumeMounts:
-        - name: machinekey
-          mountPath: /machinekey
-          readOnly: true
-        resources: {}
-      volumes:
-      - name: zitadel-config-yaml
-        configMap:
-          name: zitadel-config-yaml
-          defaultMode: 288
-      - name: machinekey
-        emptyDir: {}
-

@zackpollard
zackpollard force-pushed the chore/retire-self-hosted-zitadel branch from 0e0c4e8 to 4825b90 Compare July 28, 2026 11:21
@zackpollard
chore: retire the self-hosted zitadel
80a68bf 
remove the in-cluster zitadel instance (helmrelease, cnpg database, secrets,
admin-sa pushsecret) and the terraform module that configured it. all app
consumers have moved to the cloud zitadel at auth.internal.futo.org.

the module's resources must be destroyed with `terragrunt destroy` BEFORE this
merges, while the instance is still reachable, so the ZITADEL_OAUTH_CLIENT_ID/
SECRET_* 1password items and the zitadel org/projects/users are cleaned up
rather than orphaned. see the PR description for the full teardown sequence.
@zackpollard
zackpollard force-pushed the chore/retire-self-hosted-zitadel branch from 4825b90 to 80a68bf Compare July 28, 2026 11:24
@github-actions

github-actions Bot commented Jul 28, 2026

Copy link
Copy Markdown 
@@ spec.values.template.spec.containers.dind.image @@
# helm.toolkit.fluxcd.io/v2/HelmRelease/actions-runners/actions-runner-set
! ± value change
- docker:29.6.2-dind@sha256:bfec1f5159c63a81ca6fdedbd81404d2c0e16378ed0feec3bb3fbf3998847659
+ docker:29.6.1-dind@sha256:66d292e5c26bd33a6f6f61cacb880de2186339a524ecba1ce098dbbaceed6515

@@ spec.dependsOn @@
# kustomize.toolkit.fluxcd.io/v1/Kustomization/flux-system/grafana-secrets
! - one list entry removed:
- - name: zitadel

@@ spec.dependsOn @@
# kustomize.toolkit.fluxcd.io/v1/Kustomization/flux-system/grafana-secrets-dev
! - one list entry removed:
- - name: zitadel

@@ spec.dependsOn @@
# kustomize.toolkit.fluxcd.io/v1/Kustomization/flux-system/data-pipeline-grafana-secrets
! - one list entry removed:
- - name: zitadel

@@ spec.dependsOn @@
# kustomize.toolkit.fluxcd.io/v1/Kustomization/flux-system/containerssh-secrets
! - one list entry removed:
- - name: zitadel

@@ spec.dependsOn @@
# kustomize.toolkit.fluxcd.io/v1/Kustomization/flux-system/outline-secrets
! - one list entry removed:
- - name: zitadel

@@ spec.values.controllers.main.containers.main.image.tag @@
# helm.toolkit.fluxcd.io/v2/HelmRelease/monitoring/grafana-image-renderer
! ± value change
- v5.10.3@sha256:7f776ebb20f82b9cd5940238da596da8caf26baf9025c2e0a991d23dd803a0e6
+ v5.10.1@sha256:08cef302c548801a410cec3a1c94046281b01427b1518deb7b665a97814df2f8

@@ spec.values.controllers.outline.containers.app.image.tag @@
# helm.toolkit.fluxcd.io/v2/HelmRelease/tools/outline
! ± value change
- 1.9.2@sha256:32d76719c378931dd65d93945930ca380d8376a0337d98a991fcc12b266f33cf
+ 1.9.1@sha256:9fe2cbdceccea0ffb82cbc8dc6f4c0d4ba1d377454e502d5d2bddececb34d4f1

@@ metadata.annotations.actions.github.com/values-hash @@
# actions.github.com/v1alpha1/AutoscalingRunnerSet/actions-runners/mich
! ± value change
- 204499d1f7f549403f642c5a19fe44359b015725e48b66fffff577ddcdf39e3
+ ff36d5bb08244748fd5609aca72553ad46f36e06b10c5134de80b8ecb1383b8

@@ spec.template.spec.containers.dind.image @@
# actions.github.com/v1alpha1/AutoscalingRunnerSet/actions-runners/mich
! ± value change
- docker:29.6.2-dind@sha256:bfec1f5159c63a81ca6fdedbd81404d2c0e16378ed0feec3bb3fbf3998847659
+ docker:29.6.1-dind@sha256:66d292e5c26bd33a6f6f61cacb880de2186339a524ecba1ce098dbbaceed6515

@@ spec.template.spec.containers.main.image @@
# apps/v1/Deployment/monitoring/grafana-image-renderer
! ± value change
- docker.io/grafana/grafana-image-renderer:v5.10.3@sha256:7f776ebb20f82b9cd5940238da596da8caf26baf9025c2e0a991d23dd803a0e6
+ docker.io/grafana/grafana-image-renderer:v5.10.1@sha256:08cef302c548801a410cec3a1c94046281b01427b1518deb7b665a97814df2f8

@@ spec.template.spec.containers.app.image @@
# apps/v1/Deployment/tools/outline
! ± value change
- docker.io/outlinewiki/outline:1.9.2@sha256:32d76719c378931dd65d93945930ca380d8376a0337d98a991fcc12b266f33cf
+ docker.io/outlinewiki/outline:1.9.1@sha256:9fe2cbdceccea0ffb82cbc8dc6f4c0d4ba1d377454e502d5d2bddececb34d4f1

@@ (root level) @@
# source.toolkit.fluxcd.io/v1/HelmRepository/flux-system/zitadel
! - one document removed:
- apiVersion: source.toolkit.fluxcd.io/v1
- kind: HelmRepository
- metadata:
-   name: zitadel
-   namespace: flux-system
-   labels:
-     kustomize.toolkit.fluxcd.io/name: cluster
-     kustomize.toolkit.fluxcd.io/namespace: flux-system
- spec:
-   url: "https://charts.zitadel.com/"
-   interval: 1h

@@ (root level) @@
# kustomize.toolkit.fluxcd.io/v1/Kustomization/flux-system/zitadel-secrets
! - one document removed:
- apiVersion: kustomize.toolkit.fluxcd.io/v1
- kind: Kustomization
- metadata:
-   name: zitadel-secrets
-   namespace: flux-system
-   labels:
-     kustomize.toolkit.fluxcd.io/name: cluster-apps
-     kustomize.toolkit.fluxcd.io/namespace: flux-system
- spec:
-   commonMetadata:
-     labels:
-       app.kubernetes.io/name: zitadel-secrets
-   dependsOn:
-   - name: external-secrets-stores
-   interval: 30m
-   path: ./kubernetes/apps/authentication/zitadel/secrets
-   prune: true
-   retryInterval: 1m
-   sourceRef:
-     name: immich-kubernetes
-     kind: GitRepository
-   targetNamespace: authentication
-   timeout: 5m
-   wait: true

@@ (root level) @@
# kustomize.toolkit.fluxcd.io/v1/Kustomization/flux-system/zitadel-database
! - one document removed:
- apiVersion: kustomize.toolkit.fluxcd.io/v1
- kind: Kustomization
- metadata:
-   name: zitadel-database
-   namespace: flux-system
-   labels:
-     kustomize.toolkit.fluxcd.io/name: cluster-apps
-     kustomize.toolkit.fluxcd.io/namespace: flux-system
- spec:
-   commonMetadata:
-     labels:
-       app.kubernetes.io/name: zitadel-database
-   dependsOn:
-   - name: database-cloudnative-pg
-   interval: 30m
-   path: ./kubernetes/apps/authentication/zitadel/database
-   prune: true
-   retryInterval: 1m
-   sourceRef:
-     name: immich-kubernetes
-     kind: GitRepository
-   targetNamespace: authentication
-   timeout: 5m
-   wait: true

@@ (root level) @@
# kustomize.toolkit.fluxcd.io/v1/Kustomization/flux-system/zitadel
! - one document removed:
- apiVersion: kustomize.toolkit.fluxcd.io/v1
- kind: Kustomization
- metadata:
-   name: zitadel
-   namespace: flux-system
-   labels:
-     kustomize.toolkit.fluxcd.io/name: cluster-apps
-     kustomize.toolkit.fluxcd.io/namespace: flux-system
- spec:
-   commonMetadata:
-     labels:
-       app.kubernetes.io/name: zitadel
-   dependsOn:
-   - name: zitadel-secrets
-   - name: zitadel-database
-   interval: 30m
-   path: ./kubernetes/apps/authentication/zitadel/app
-   prune: true
-   retryInterval: 1m
-   sourceRef:
-     name: immich-kubernetes
-     kind: GitRepository
-   targetNamespace: authentication
-   timeout: 5m
-   wait: true

@@ (root level) @@
# kustomize.toolkit.fluxcd.io/v1/Kustomization/flux-system/zitadel-pushsecret
! - one document removed:
- apiVersion: kustomize.toolkit.fluxcd.io/v1
- kind: Kustomization
- metadata:
-   name: zitadel-pushsecret
-   namespace: flux-system
-   labels:
-     kustomize.toolkit.fluxcd.io/name: cluster-apps
-     kustomize.toolkit.fluxcd.io/namespace: flux-system
- spec:
-   commonMetadata:
-     labels:
-       app.kubernetes.io/name: zitadel-pushsecret
-   dependsOn:
-   - name: zitadel
-   interval: 30m
-   path: ./kubernetes/apps/authentication/zitadel/pushsecret
-   prune: true
-   retryInterval: 1m
-   sourceRef:
-     name: immich-kubernetes
-     kind: GitRepository
-   targetNamespace: authentication
-   timeout: 5m
-   wait: true

@@ (root level) @@
# helm.toolkit.fluxcd.io/v2/HelmRelease/authentication/zitadel
! - one document removed:
- apiVersion: helm.toolkit.fluxcd.io/v2
- kind: HelmRelease
- metadata:
-   name: zitadel
-   namespace: authentication
-   labels:
-     app.kubernetes.io/name: zitadel
-     kustomize.toolkit.fluxcd.io/name: zitadel
-     kustomize.toolkit.fluxcd.io/namespace: flux-system
- spec:
-   chart:
-     spec:
-       version: "10.0.4"
-       chart: zitadel
-       interval: 5m
-       sourceRef:
-         name: zitadel
-         kind: HelmRepository
-         namespace: flux-system
-   interval: 5m
-   values:
-     resources:
-       limits:
-         cpu: 1
-         memory: 2Gi
-       requests:
-         cpu: 500m
-         memory: 512Mi
-     image:
-       repository: ghcr.io/zitadel/zitadel
-       tag: "v4.16.1@sha256:fea7ea2e4648d2dfe6a22a446252f084e4a370d8caedf08d3af4632cf517d4ef"
-     login:
-       enabled: false
-     setupJob:
-       machinekeyWriter:
-         image:
-           tag: "1.32.3"
-     env:
-     - name: ZITADEL_DATABASE_POSTGRES_HOST
-       valueFrom:
-         secretKeyRef:
-           name: zitadel-db-app
-           key: host
-     - name: ZITADEL_DATABASE_POSTGRES_DATABASE
-       valueFrom:
-         secretKeyRef:
-           name: zitadel-db-app
-           key: dbname
-     - name: ZITADEL_DATABASE_POSTGRES_USER_USERNAME
-       valueFrom:
-         secretKeyRef:
-           name: zitadel-db-app
-           key: user
-     - name: ZITADEL_DATABASE_POSTGRES_USER_PASSWORD
-       valueFrom:
-         secretKeyRef:
-           name: zitadel-db-app
-           key: password
-     - name: ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME
-       valueFrom:
-         secretKeyRef:
-           name: zitadel-db-superuser
-           key: user
-     - name: ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD
-       valueFrom:
-         secretKeyRef:
-           name: zitadel-db-superuser
-           key: password
-     ingress:
-       annotations:
-         cert-manager.io/cluster-issuer: letsencrypt-production
-         nginx.ingress.kubernetes.io/backend-protocol: GRPC
-         nginx.ingress.kubernetes.io/configuration-snippet: |
-           grpc_set_header Host $host;
-           
-       className: nginx
-       enabled: true
-       hosts:
-       - host: zitadel.internal.immich.cloud
-         paths:
-         - path: /
-           pathType: Prefix
-       tls:
-       - hosts:
-         - zitadel.internal.immich.cloud
-         secretName: zitadel-tls
-     zitadel:
-       configmapConfig:
-         ExternalDomain: zitadel.internal.immich.cloud
-         FirstInstance:
-           Org:
-             Machine:
-               Machine:
-                 Name: Admin
-                 Username: zitadel-iac-admin-sa
-               MachineKey:
-                 Type: 1
-         TLS:
-           Enabled: false
-       masterkeySecretName: zitadel-master-key

@@ (root level) @@
# postgresql.cnpg.io/v1/Cluster/authentication/zitadel-db
! - one document removed:
- apiVersion: postgresql.cnpg.io/v1
- kind: Cluster
- metadata:
-   name: zitadel-db
-   namespace: authentication
-   labels:
-     app.kubernetes.io/name: zitadel-database
-     kustomize.toolkit.fluxcd.io/name: zitadel-database
-     kustomize.toolkit.fluxcd.io/namespace: flux-system
- spec:
-   enableSuperuserAccess: true
-   storage:
-     size: 10Gi
-     storageClass: zfs

@@ (root level) @@
# external-secrets.io/v1alpha1/PushSecret/authentication/zitadel-iac-admin-sa
! - one document removed:
- apiVersion: external-secrets.io/v1alpha1
- kind: PushSecret
- metadata:
-   name: zitadel-iac-admin-sa
-   namespace: authentication
-   labels:
-     app.kubernetes.io/name: zitadel-pushsecret
-     kustomize.toolkit.fluxcd.io/name: zitadel-pushsecret
-     kustomize.toolkit.fluxcd.io/namespace: flux-system
- spec:
-   data:
-   - match:
-       remoteRef:
-         remoteKey: PUSHED_ZITADEL_IAC_ADMIN_SA
-       secretKey: zitadel-iac-admin-sa.json
-   secretStoreRefs:
-   - name: 1p-kubernetes
-     kind: ClusterSecretStore
-   selector:
-     secret:
-       name: zitadel-iac-admin-sa

@@ (root level) @@
# external-secrets.io/v1/ExternalSecret/authentication/zitadel-master-key
! - one document removed:
- apiVersion: external-secrets.io/v1
- kind: ExternalSecret
- metadata:
-   name: zitadel-master-key
-   namespace: authentication
-   labels:
-     app.kubernetes.io/name: zitadel-secrets
-     kustomize.toolkit.fluxcd.io/name: zitadel-secrets
-     kustomize.toolkit.fluxcd.io/namespace: flux-system
- spec:
-   data:
-   - remoteRef:
-       key: AUTH_ZITADEL_MASTER_KEY
-     secretKey: masterkey
-   refreshInterval: 20s
-   secretStoreRef:
-     name: 1p-tf
-     kind: ClusterSecretStore

@@ (root level) @@
# v1/Service/authentication/zitadel
! - one document removed:
- apiVersion: v1
- kind: Service
- metadata:
-   name: zitadel
-   namespace: authentication
-   annotations:
-     traefik.ingress.kubernetes.io/service.serversscheme: h2c
-   labels:
-     app.kubernetes.io/instance: zitadel
-     app.kubernetes.io/managed-by: Helm
-     app.kubernetes.io/name: zitadel
-     helm.toolkit.fluxcd.io/name: zitadel
-     helm.toolkit.fluxcd.io/namespace: authentication
- spec:
-   type: ClusterIP
-   selector:
-     app.kubernetes.io/component: start
-     app.kubernetes.io/instance: zitadel
-     app.kubernetes.io/name: zitadel
-   ports:
-   - name: http2-server
-     appProtocol: kubernetes.io/h2c
-     port: 8080
-     protocol: TCP
-     targetPort: 8080

@@ (root level) @@
# apps/v1/Deployment/authentication/zitadel
! - one document removed:
- apiVersion: apps/v1
- kind: Deployment
- metadata:
-   name: zitadel
-   namespace: authentication
-   labels:
-     app.kubernetes.io/component: start
-     app.kubernetes.io/instance: zitadel
-     app.kubernetes.io/managed-by: Helm
-     app.kubernetes.io/name: zitadel
-     helm.toolkit.fluxcd.io/name: zitadel
-     helm.toolkit.fluxcd.io/namespace: authentication
- spec:
-   replicas: 1
-   revisionHistoryLimit: 10
-   selector:
-     matchLabels:
-       app.kubernetes.io/component: start
-       app.kubernetes.io/instance: zitadel
-       app.kubernetes.io/name: zitadel
-   template:
-     metadata:
-       labels:
-         app.kubernetes.io/component: start
-         app.kubernetes.io/instance: zitadel
-         app.kubernetes.io/managed-by: Helm
-         app.kubernetes.io/name: zitadel
-     spec:
-       containers:
-       - name: zitadel
-         image: "ghcr.io/zitadel/zitadel:v4.16.1@sha256:fea7ea2e4648d2dfe6a22a446252f084e4a370d8caedf08d3af4632cf517d4ef"
-         imagePullPolicy: IfNotPresent
-         args:
-         - start
-         - "--config"
-         - /config/zitadel-config-yaml
-         - "--masterkeyFromEnv"
-         securityContext:
-           privileged: false
-           readOnlyRootFilesystem: true
-           runAsNonRoot: true
-           runAsUser: 1000
-         ports:
-         - name: http2-server
-           containerPort: 8080
-           protocol: TCP
-         resources:
-           limits:
-             cpu: 1
-             memory: 2Gi
-           requests:
-             cpu: 500m
-             memory: 512Mi
-         volumeMounts:
-         - name: zitadel-config-yaml
-           mountPath: /config
-           readOnly: true
-         env:
-         - name: POD_IP
-           valueFrom:
-             fieldRef:
-               apiVersion: v1
-               fieldPath: status.podIP
-         - name: ZITADEL_MASTERKEY
-           valueFrom:
-             secretKeyRef:
-               name: zitadel-master-key
-               key: masterkey
-         - name: ZITADEL_DATABASE_POSTGRES_AWAITINITIALCONN
-           value: 5m
-         - name: ZITADEL_DATABASE_POSTGRES_HOST
-           valueFrom:
-             secretKeyRef:
-               name: zitadel-db-app
-               key: host
-         - name: ZITADEL_DATABASE_POSTGRES_DATABASE
-           valueFrom:
-             secretKeyRef:
-               name: zitadel-db-app
-               key: dbname
-         - name: ZITADEL_DATABASE_POSTGRES_USER_USERNAME
-           valueFrom:
-             secretKeyRef:
-               name: zitadel-db-app
-               key: user
-         - name: ZITADEL_DATABASE_POSTGRES_USER_PASSWORD
-           valueFrom:
-             secretKeyRef:
-               name: zitadel-db-app
-               key: password
-         - name: ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME
-           valueFrom:
-             secretKeyRef:
-               name: zitadel-db-superuser
-               key: user
-         - name: ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD
-           valueFrom:
-             secretKeyRef:
-               name: zitadel-db-superuser
-               key: password
-         livenessProbe:
-           failureThreshold: 3
-           httpGet:
-             httpHeaders:
-             - name: Host
-               value: zitadel.internal.immich.cloud
-             path: /debug/healthz
-             port: http2-server
-             scheme: HTTP
-           initialDelaySeconds: 0
-           periodSeconds: 5
-         readinessProbe:
-           failureThreshold: 3
-           httpGet:
-             httpHeaders:
-             - name: Host
-               value: zitadel.internal.immich.cloud
-             path: /debug/ready
-             port: http2-server
-             scheme: HTTP
-           initialDelaySeconds: 0
-           periodSeconds: 5
-         startupProbe:
-           failureThreshold: 30
-           httpGet:
-             httpHeaders:
-             - name: Host
-               value: zitadel.internal.immich.cloud
-             path: /debug/ready
-             port: http2-server
-             scheme: HTTP
-           periodSeconds: 1
-       enableServiceLinks: false
-       securityContext:
-         fsGroup: 1000
-         runAsNonRoot: true
-         runAsUser: 1000
-       serviceAccountName: zitadel
-       volumes:
-       - name: zitadel-config-yaml
-         configMap:
-           name: zitadel-config-yaml

@@ (root level) @@
# networking.k8s.io/v1/Ingress/authentication/zitadel
! - one document removed:
- apiVersion: networking.k8s.io/v1
- kind: Ingress
- metadata:
-   name: zitadel
-   namespace: authentication
-   annotations:
-     cert-manager.io/cluster-issuer: letsencrypt-production
-     nginx.ingress.kubernetes.io/backend-protocol: GRPC
-     nginx.ingress.kubernetes.io/configuration-snippet: |
-       grpc_set_header Host $host;
-       
-   labels:
-     app.kubernetes.io/instance: zitadel
-     app.kubernetes.io/managed-by: Helm
-     app.kubernetes.io/name: zitadel
-     helm.toolkit.fluxcd.io/name: zitadel
-     helm.toolkit.fluxcd.io/namespace: authentication
- spec:
-   ingressClassName: nginx
-   rules:
-   - host: zitadel.internal.immich.cloud
-     http:
-       paths:
-       - backend:
-           service:
-             name: zitadel
-             port:
-               number: 8080
-         path: /
-         pathType: Prefix
-   tls:
-   - hosts:
-     - zitadel.internal.immich.cloud
-     secretName: zitadel-tls

@@ (root level) @@
# v1/ServiceAccount/authentication/zitadel
! - one document removed:
- apiVersion: v1
- kind: ServiceAccount
- metadata:
-   name: zitadel
-   namespace: authentication
-   annotations:
-     helm.sh/hook: "pre-install,pre-upgrade"
-     helm.sh/hook-delete-policy: before-hook-creation
-     helm.sh/hook-weight: "0"
-   labels:
-     app.kubernetes.io/instance: zitadel
-     app.kubernetes.io/managed-by: Helm
-     app.kubernetes.io/name: zitadel

@@ (root level) @@
# v1/ConfigMap/authentication/zitadel-config-yaml
! - one document removed:
- apiVersion: v1
- kind: ConfigMap
- metadata:
-   name: zitadel-config-yaml
-   namespace: authentication
-   annotations:
-     helm.sh/hook: "pre-install,pre-upgrade"
-     helm.sh/hook-delete-policy: before-hook-creation
-     helm.sh/hook-weight: "0"
-   labels:
-     app.kubernetes.io/instance: zitadel
-     app.kubernetes.io/managed-by: Helm
-     app.kubernetes.io/name: zitadel
- data:
-   zitadel-config-yaml: |
-     ExternalDomain: zitadel.internal.immich.cloud
-     ExternalSecure: true
-     FirstInstance:
-       Org:
-         Machine:
-           Machine:
-             Name: Admin
-             Username: zitadel-iac-admin-sa
-           MachineKey:
-             ExpirationDate: "2029-01-01T00:00:00Z"
-             Type: 1
-           Pat:
-             ExpirationDate: "2029-01-01T00:00:00Z"
-       Skip: false
-     Machine:
-       Identification:
-         Hostname:
-           Enabled: true
-         Webhook:
-           Enabled: false
-     TLS:
-       Enabled: false

@@ (root level) @@
# rbac.authorization.k8s.io/v1/Role/authentication/zitadel
! - one document removed:
- apiVersion: rbac.authorization.k8s.io/v1
- kind: Role
- metadata:
-   name: zitadel
-   namespace: authentication
-   annotations:
-     helm.sh/hook: "pre-install,pre-upgrade"
-     helm.sh/hook-delete-policy: before-hook-creation
-     helm.sh/hook-weight: "0"
-   labels:
-     app.kubernetes.io/instance: zitadel
-     app.kubernetes.io/managed-by: Helm
-     app.kubernetes.io/name: zitadel
- rules:
- - resources:
-   - secrets
-   apiGroups:
-   - 
-   verbs:
-   - get
-   - create
-   - patch
-   - list
-   - delete
- - resources:
-   - pods
-   apiGroups:
-   - 
-   verbs:
-   - get

@@ (root level) @@
# rbac.authorization.k8s.io/v1/RoleBinding/authentication/zitadel
! - one document removed:
- apiVersion: rbac.authorization.k8s.io/v1
- kind: RoleBinding
- metadata:
-   name: zitadel
-   namespace: authentication
-   annotations:
-     helm.sh/hook: "pre-install,pre-upgrade"
-     helm.sh/hook-delete-policy: before-hook-creation
-     helm.sh/hook-weight: "0"
-   labels:
-     app.kubernetes.io/instance: zitadel
-     app.kubernetes.io/managed-by: Helm
-     app.kubernetes.io/name: zitadel
- roleRef:
-   name: zitadel
-   apiGroup: rbac.authorization.k8s.io
-   kind: Role
- subjects:
- - name: zitadel
-   kind: ServiceAccount

@@ (root level) @@
# batch/v1/Job/authentication/zitadel-cleanup
! - one document removed:
- apiVersion: batch/v1
- kind: Job
- metadata:
-   name: zitadel-cleanup
-   namespace: authentication
-   annotations:
-     helm.sh/hook: post-delete
-     helm.sh/hook-delete-policy: hook-succeeded
-     helm.sh/hook-weight: "-1"
-   labels:
-     app.kubernetes.io/component: cleanup
-     app.kubernetes.io/instance: zitadel
-     app.kubernetes.io/managed-by: Helm
-     app.kubernetes.io/name: zitadel
- spec:
-   activeDeadlineSeconds: 60
-   backoffLimit: 3
-   template:
-     metadata:
-       labels:
-         app.kubernetes.io/component: cleanup
-         app.kubernetes.io/instance: zitadel
-         app.kubernetes.io/managed-by: Helm
-         app.kubernetes.io/name: zitadel
-     spec:
-       containers:
-       - name: zitadel-cleanup
-         image: "docker.io/alpine/k8s:1.36.2"
-         imagePullPolicy: IfNotPresent
-         resources: {}
-         command:
-         - sh
-         - "-c"
-         - |
-           echo "Cleaning up secrets created by zitadel-setup..."
-           kubectl --namespace=authentication delete secret \
-             --selector='app.kubernetes.io/managed-by=Zitadel,app.kubernetes.io/instance=zitadel' \
-             --ignore-not-found=true
-           echo "Cleanup completed"
-           
-         securityContext:
-           privileged: false
-           readOnlyRootFilesystem: true
-           runAsNonRoot: true
-           runAsUser: 1000
-       enableServiceLinks: false
-       restartPolicy: Never
-       securityContext:
-         fsGroup: 1000
-         runAsNonRoot: true
-         runAsUser: 1000
-       serviceAccountName: zitadel

@@ (root level) @@
# batch/v1/Job/authentication/zitadel-init
! - one document removed:
- apiVersion: batch/v1
- kind: Job
- metadata:
-   name: zitadel-init
-   namespace: authentication
-   annotations:
-     helm.sh/hook: "pre-install,pre-upgrade"
-     helm.sh/hook-delete-policy: before-hook-creation
-     helm.sh/hook-weight: "1"
-   labels:
-     app.kubernetes.io/component: init
-     app.kubernetes.io/instance: zitadel
-     app.kubernetes.io/managed-by: Helm
-     app.kubernetes.io/name: zitadel
- spec:
-   activeDeadlineSeconds: 300
-   backoffLimit: 5
-   template:
-     metadata:
-       labels:
-         app.kubernetes.io/component: init
-         app.kubernetes.io/instance: zitadel
-         app.kubernetes.io/managed-by: Helm
-         app.kubernetes.io/name: zitadel
-     spec:
-       containers:
-       - name: zitadel-init
-         image: "ghcr.io/zitadel/zitadel:v4.16.1@sha256:fea7ea2e4648d2dfe6a22a446252f084e4a370d8caedf08d3af4632cf517d4ef"
-         imagePullPolicy: IfNotPresent
-         resources: {}
-         args:
-         - init
-         - "--config"
-         - /config/zitadel-config-yaml
-         securityContext:
-           privileged: false
-           readOnlyRootFilesystem: true
-           runAsNonRoot: true
-           runAsUser: 1000
-         volumeMounts:
-         - name: zitadel-config-yaml
-           mountPath: /config
-           readOnly: true
-         env:
-         - name: POD_IP
-           valueFrom:
-             fieldRef:
-               apiVersion: v1
-               fieldPath: status.podIP
-         - name: ZITADEL_DATABASE_POSTGRES_AWAITINITIALCONN
-           value: 5m
-         - name: ZITADEL_DATABASE_POSTGRES_HOST
-           valueFrom:
-             secretKeyRef:
-               name: zitadel-db-app
-               key: host
-         - name: ZITADEL_DATABASE_POSTGRES_DATABASE
-           valueFrom:
-             secretKeyRef:
-               name: zitadel-db-app
-               key: dbname
-         - name: ZITADEL_DATABASE_POSTGRES_USER_USERNAME
-           valueFrom:
-             secretKeyRef:
-               name: zitadel-db-app
-               key: user
-         - name: ZITADEL_DATABASE_POSTGRES_USER_PASSWORD
-           valueFrom:
-             secretKeyRef:
-               name: zitadel-db-app
-               key: password
-         - name: ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME
-           valueFrom:
-             secretKeyRef:
-               name: zitadel-db-superuser
-               key: user
-         - name: ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD
-           valueFrom:
-             secretKeyRef:
-               name: zitadel-db-superuser
-               key: password
-       enableServiceLinks: false
-       restartPolicy: Never
-       securityContext:
-         fsGroup: 1000
-         runAsNonRoot: true
-         runAsUser: 1000
-       serviceAccountName: zitadel
-       volumes:
-       - name: zitadel-config-yaml
-         configMap:
-           name: zitadel-config-yaml
-           defaultMode: 288

@@ (root level) @@
# batch/v1/Job/authentication/zitadel-setup
! - one document removed:
- apiVersion: batch/v1
- kind: Job
- metadata:
-   name: zitadel-setup
-   namespace: authentication
-   annotations:
-     helm.sh/hook: "pre-install,pre-upgrade"
-     helm.sh/hook-delete-policy: before-hook-creation
-     helm.sh/hook-weight: "2"
-   labels:
-     app.kubernetes.io/component: setup
-     app.kubernetes.io/instance: zitadel
-     app.kubernetes.io/managed-by: Helm
-     app.kubernetes.io/name: zitadel
- spec:
-   activeDeadlineSeconds: 300
-   backoffLimit: 5
-   template:
-     metadata:
-       labels:
-         app.kubernetes.io/component: setup
-         app.kubernetes.io/instance: zitadel
-         app.kubernetes.io/managed-by: Helm
-         app.kubernetes.io/name: zitadel
-     spec:
-       containers:
-       - name: zitadel-setup
-         image: "ghcr.io/zitadel/zitadel:v4.16.1@sha256:fea7ea2e4648d2dfe6a22a446252f084e4a370d8caedf08d3af4632cf517d4ef"
-         imagePullPolicy: IfNotPresent
-         resources: {}
-         args:
-         - setup
-         - "--masterkeyFromEnv"
-         - "--config"
-         - /config/zitadel-config-yaml
-         - "--steps"
-         - /config/zitadel-config-yaml
-         - "--init-projections=true"
-         securityContext:
-           privileged: false
-           readOnlyRootFilesystem: true
-           runAsNonRoot: true
-           runAsUser: 1000
-         volumeMounts:
-         - name: zitadel-config-yaml
-           mountPath: /config
-           readOnly: true
-         - name: machinekey
-           mountPath: /machinekey
-         env:
-         - name: POD_IP
-           valueFrom:
-             fieldRef:
-               apiVersion: v1
-               fieldPath: status.podIP
-         - name: ZITADEL_MASTERKEY
-           valueFrom:
-             secretKeyRef:
-               name: zitadel-master-key
-               key: masterkey
-         - name: ZITADEL_FIRSTINSTANCE_MACHINEKEYPATH
-           value: /machinekey/sa.json
-         - name: ZITADEL_FIRSTINSTANCE_PATPATH
-           value: /machinekey/pat
-         - name: ZITADEL_DATABASE_POSTGRES_AWAITINITIALCONN
-           value: 5m
-         - name: ZITADEL_DATABASE_POSTGRES_HOST
-           valueFrom:
-             secretKeyRef:
-               name: zitadel-db-app
-               key: host
-         - name: ZITADEL_DATABASE_POSTGRES_DATABASE
-           valueFrom:
-             secretKeyRef:
-               name: zitadel-db-app
-               key: dbname
-         - name: ZITADEL_DATABASE_POSTGRES_USER_USERNAME
-           valueFrom:
-             secretKeyRef:
-               name: zitadel-db-app
-               key: user
-         - name: ZITADEL_DATABASE_POSTGRES_USER_PASSWORD
-           valueFrom:
-             secretKeyRef:
-               name: zitadel-db-app
-               key: password
-         - name: ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME
-           valueFrom:
-             secretKeyRef:
-               name: zitadel-db-superuser
-               key: user
-         - name: ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD
-           valueFrom:
-             secretKeyRef:
-               name: zitadel-db-superuser
-               key: password
-       - name: zitadel-machinekey
-         image: "docker.io/alpine/k8s:1.36.2"
-         imagePullPolicy: IfNotPresent
-         resources: {}
-         command:
-         - sh
-         - "-c"
-         - |
-           until [ -n "$(kubectl --namespace=authentication get pod ${POD_NAME} --output=jsonpath="{.status.containerStatuses[?(@.name=='zitadel-setup')].state.terminated}")" ]; do
-             echo 'waiting for zitadel-setup container to terminate';
-             sleep 5;
-           done &&
-           echo 'zitadel-setup container terminated' &&
-           if [ -f /machinekey/sa.json ]; then
-             kubectl --namespace=authentication create secret generic zitadel-iac-admin-sa \
-               --from-file=zitadel-iac-admin-sa.json=/machinekey/sa.json \
-               --dry-run=client --output=yaml | \
-             kubectl annotate --local --filename=- \
-               helm.sh/resource-policy=keep \
-               --output=yaml | \
-             kubectl label --local --filename=- \
-               app.kubernetes.io/managed-by=Zitadel \
-               app.kubernetes.io/name=zitadel \
-               app.kubernetes.io/instance=zitadel \
-               --output=yaml | \
-             kubectl apply --server-side --field-manager=zitadel-setup --filename=-;
-           fi;
-           
-         securityContext:
-           privileged: false
-           readOnlyRootFilesystem: true
-           runAsNonRoot: true
-           runAsUser: 1000
-         volumeMounts:
-         - name: machinekey
-           mountPath: /machinekey
-           readOnly: true
-         env:
-         - name: POD_NAME
-           valueFrom:
-             fieldRef:
-               fieldPath: metadata.name
-       - name: zitadel-machine-pat
-         image: "docker.io/alpine/k8s:1.36.2"
-         imagePullPolicy: IfNotPresent
-         resources: {}
-         command:
-         - sh
-         - "-c"
-         - |
-           until [ -n "$(kubectl --namespace=authentication get pod "${POD_NAME}" --output=jsonpath="{.status.containerStatuses[?(@.name=='zitadel-setup')].state.terminated}")" ]; do
-             echo 'waiting for zitadel-setup container to terminate';
-             sleep 5;
-           done &&
-           echo 'zitadel-setup container terminated' &&
-           if [ -f /machinekey/pat ]; then
-             kubectl --namespace=authentication create secret generic zitadel-iac-admin-sa-pat \
-               --from-file=pat=/machinekey/pat \
-               --dry-run=client --output=yaml | \
-             kubectl annotate --local --filename=- \
-               helm.sh/resource-policy=keep \
-               --output=yaml | \
-             kubectl label --local --filename=- \
-               app.kubernetes.io/managed-by=Zitadel \
-               app.kubernetes.io/name=zitadel \
-               app.kubernetes.io/instance=zitadel \
-               --output=yaml | \
-             kubectl apply --server-side --field-manager=zitadel-setup --filename=-;
-           fi;
-           
-         securityContext:
-           privileged: false
-           readOnlyRootFilesystem: true
-           runAsNonRoot: true
-           runAsUser: 1000
-         volumeMounts:
-         - name: machinekey
-           mountPath: /machinekey
-           readOnly: true
-         env:
-         - name: POD_NAME
-           valueFrom:
-             fieldRef:
-               fieldPath: metadata.name
-       enableServiceLinks: false
-       restartPolicy: Never
-       securityContext:
-         fsGroup: 1000
-         runAsNonRoot: true
-         runAsUser: 1000
-       serviceAccountName: zitadel
-       volumes:
-       - name: zitadel-config-yaml
-         configMap:
-           name: zitadel-config-yaml
-           defaultMode: 288
-       - name: machinekey
-         emptyDir: {}

@github-actions

github-actions Bot commented Jul 28, 2026 •
edited
Loading

Copy link
Copy Markdown

Terraform Plan

Shared

✅ 1password/account — No changes
✅ 1password/futo-account — No changes
✅ bunny/futo-account — No changes
✅ cloudflare/account — No changes
✅ cloudflare/api-keys — No changes
✅ cloudflare/futo-account — No changes
✅ cloudflare/futo-api-keys — No changes
✅ docker/org — No changes
⚠️ github/org — Plan: 0 to add, 4 to change, 0 to destroy. 
OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place (current -> planned)
  # github_repository_collaborators.repo_collaborators["immich"] will be updated in-place
  ~ resource "github_repository_collaborators" "repo_collaborators" {
        id             = "455229168"
      ~ invitation_ids = {
          - "koen-futo"      = "286515056"
          - "martabal"       = "284848949"
          - "martyfuhry"     = "284848968"
          - "matthinc"       = "284848954"
          - "sudoicezen"     = "284848972"
          - "xXF4mouZSt4rXx" = "327114810"
        } -> (known after apply)
        # (2 unchanged attributes hidden)
      - user {
          - permission = "admin" -> null
          - username   = "alextran1502" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "bo0tzz" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "jrasm91" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "zackpollard" -> null
        }
      + user {
          + permission = "maintain"
          + username   = "alextran1502"
        }
      + user {
          + permission = "maintain"
          + username   = "bo0tzz"
        }
      + user {
          + permission = "maintain"
          + username   = "jrasm91"
        }
      + user {
          + permission = "maintain"
          + username   = "zackpollard"
        }
        # (60 unchanged blocks hidden)
    }
  # github_repository_collaborators.repo_collaborators["static-pages"] will be updated in-place
  ~ resource "github_repository_collaborators" "repo_collaborators" {
        id             = "822727374"
      ~ invitation_ids = {
          - "PixelJonas"     = "284848947"
          - "fyfrey"         = "284848959"
          - "kennyfuto"      = "288622006"
          - "koen-futo"      = "286515046"
          - "martabal"       = "284848951"
          - "martyfuhry"     = "284848969"
          - "matthinc"       = "284848955"
          - "orhan98"        = "315880176"
          - "sudoicezen"     = "284848974"
          - "xXF4mouZSt4rXx" = "327114802"
        } -> (known after apply)
        # (2 unchanged attributes hidden)
      - user {
          - permission = "admin" -> null
          - username   = "alextran1502" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "bo0tzz" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "jrasm91" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "zackpollard" -> null
        }
      + user {
          + permission = "maintain"
          + username   = "alextran1502"
        }
      + user {
          + permission = "maintain"
          + username   = "bo0tzz"
        }
      + user {
          + permission = "maintain"
          + username   = "jrasm91"
        }
      + user {
          + permission = "maintain"
          + username   = "zackpollard"
        }
        # (59 unchanged blocks hidden)
    }
  # github_repository_collaborators.repo_collaborators["test-assets"] will be updated in-place
  ~ resource "github_repository_collaborators" "repo_collaborators" {
        id             = "697157116"
      ~ invitation_ids = {
          - "PixelJonas"     = "284848946"
          - "fyfrey"         = "284848960"
          - "kennyfuto"      = "288622000"
          - "koen-futo"      = "286515048"
          - "martabal"       = "284848952"
          - "martyfuhry"     = "284848970"
          - "matthinc"       = "284848956"
          - "orhan98"        = "315880175"
          - "staticdog"      = "320859393"
          - "sudoicezen"     = "284848973"
          - "xXF4mouZSt4rXx" = "327114808"
        } -> (known after apply)
        # (2 unchanged attributes hidden)
      - user {
          - permission = "admin" -> null
          - username   = "alextran1502" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "bo0tzz" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "jrasm91" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "zackpollard" -> null
        }
      + user {
          + permission = "maintain"
          + username   = "alextran1502"
        }
      + user {
          + permission = "maintain"
          + username   = "bo0tzz"
        }
      + user {
          + permission = "maintain"
          + username   = "jrasm91"
        }
      + user {
          + permission = "maintain"
          + username   = "zackpollard"
        }
        # (59 unchanged blocks hidden)
    }
  # github_repository_collaborators.repo_collaborators["walkrs"] will be updated in-place
  ~ resource "github_repository_collaborators" "repo_collaborators" {
        id             = "1156754889"
      ~ invitation_ids = {
          - "C-Otto"          = "307331486"
          - "PixelJonas"      = "307331438"
          - "adamantike"      = "307331464"
          - "dahool"          = "307331471"
          - "ddshd"           = "307331444"
          - "fyfrey"          = "307331463"
          - "github-cli"      = "307331445"
          - "jbaez"           = "307331428"
          - "kennyfuto"       = "307331447"
          - "koen-futo"       = "307331458"
          - "martabal"        = "307331390"
          - "martyfuhry"      = "307331483"
          - "matthinc"        = "307331420"
          - "michelheusschen" = "307331480"
          - "midzelis"        = "309034718"
          - "orhan98"         = "315880173"
          - "samholton"       = "307331386"
          - "schuhbacca"      = "307331432"
          - "skatsubo"        = "307331414"
          - "staticdog"       = "320859390"
          - "xXF4mouZSt4rXx"  = "327114806"
        } -> (known after apply)
        # (2 unchanged attributes hidden)
      - user {
          - permission = "admin" -> null
          - username   = "alextran1502" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "bo0tzz" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "jrasm91" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "zackpollard" -> null
        }
      + user {
          + permission = "maintain"
          + username   = "alextran1502"
        }
      + user {
          + permission = "maintain"
          + username   = "bo0tzz"
        }
      + user {
          + permission = "maintain"
          + username   = "jrasm91"
        }
      + user {
          + permission = "maintain"
          + username   = "zackpollard"
        }
        # (59 unchanged blocks hidden)
    }
Plan: 0 to add, 4 to change, 0 to destroy.
╷
│ Warning: Argument is deprecated
│ 
│   with github_repository.repositories["walkrs"],
│   on repositories.tf line 173, in resource "github_repository" "repositories":
│  173:   vulnerability_alerts      = !each.value.archived
│ 
│ Use the github_repository_vulnerability_alerts resource instead. This field
│ will be removed in a future version.
│ 
│ (and 24 more similar warnings elsewhere)
╵
─────────────────────────────────────────────────────────────────────────────
Note: You didn't use the -out option to save this plan, so OpenTofu can't
guarantee to take exactly these actions if you run "tofu apply" now.
✅ github/secrets — No changes
✅ github/webhooks — No changes
✅ netbird/account — No changes
✅ zitadel/cloud — No changes

Scoped (dev)

✅ discord/community — No changes
✅ monitoring/grafana — No changes
✅ zitadel/customer — No changes

Scoped (prod)

✅ discord/community — No changes
✅ discord/futo — No changes
✅ monitoring/grafana — No changes
✅ zitadel/customer — No changes

Scoped (staging — zitadel customer)

✅ customer — No changes

@zackpollard
zackpollard marked this pull request as ready for review July 28, 2026 11:26
@zackpollard
zackpollard requested a review from a team as a code owner July 28, 2026 11:26
@zackpollard
zackpollard enabled auto-merge (squash) July 28, 2026 11:30
@zackpollard
zackpollard merged commit 780e564 into main Jul 28, 2026
31 of 33 checks passed
@zackpollard
zackpollard deleted the chore/retire-self-hosted-zitadel branch July 28, 2026 11:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@bo0tzz bo0tzz bo0tzz approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@zackpollard @bo0tzz