apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: zitadel
  namespace: zitadel
spec:
  interval: 15m
  releaseName: zitadel
  targetNamespace: zitadel
  chart:
    spec:
      chart: zitadel
      sourceRef:
        kind: HelmRepository
        name: zitadel
        namespace: flux-system
  install:
    remediation:
      retries: 3
  upgrade:
    remediation:
      retries: 3
  values:
    image:
      tag: v4.20.0@sha256:9ea0e9ecfdc43115da871242e40a0320f2ece864c7cd8b5d41a863a7f4902499
    replicaCount: 2
    service:
      labels:
        health.quorate.dev/name: Auth
    serviceAccount:
      create: false
      name: zitadel
    securityContext:
      runAsNonRoot: true
      runAsUser: 1000
      readOnlyRootFilesystem: true
      privileged: false
      allowPrivilegeEscalation: false
      capabilities:
        drop:
          - ALL
    resources:
      requests:
        cpu: 100m
        memory: 256Mi
      limits:
        memory: 1Gi
    tools:
      kubectl:
        image:
          tag: 1.37.1@sha256:712dc5385d1c1a3f83b747fa9e40f64d433a97f72ff42f9755ff7dd1f62846e4
      wait4x:
        image:
          tag: 3.7.3@sha256:aae91ea65a38117ac07c84c7e1122691ac91c3b60529edcb8fe62292d105d8ff
        resources:
          requests:
            cpu: 10m
            memory: 32Mi
          limits:
            memory: 64Mi
    zitadel:
      masterkeySecretName: zitadel-masterkey
      configmapConfig:
        ExternalDomain: auth.quorate.dev
        ExternalSecure: true
        ExternalPort: 443
        TLS:
          Enabled: false
        Database:
          Postgres:
            Host: main-rw.postgres.svc.cluster.local
            Port: 5432
            Database: zitadel
            MaxOpenConns: 20
            MaxIdleConns: 10
            ConnMaxLifetime: 30m
            User:
              Username: "********"
              SSL:
                Mode: require
            Admin:
              Username: "********"
              SSL:
                Mode: require
    env:
      - name: ZITADEL_DATABASE_POSTGRES_USER_PASSWORD
        valueFrom:
          secretKeyRef:
            name: zitadel-db
            key: password
      - name: ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD
        valueFrom:
          secretKeyRef:
            name: zitadel-db
            key: password
    affinity:
      podAntiAffinity:
        requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchLabels:
                app.kubernetes.io/name: zitadel
            topologyKey: kubernetes.io/hostname
    pdb:
      enabled: true
      minAvailable: 1
    login:
      enabled: true
      replicaCount: 2
      image:
        repository: ghcr.io/zitadel/zitadel-login
        tag: v4.20.0@sha256:f1abfdf3c5d16eda03cad3b584226207ecc640ca5c679d7c45abbbce7d1d63f0
      resources:
        requests:
          cpu: 50m
          memory: 128Mi
        limits:
          memory: 512Mi
    initJob:
      command: zitadel
      resources:
        requests:
          cpu: 50m
          memory: 64Mi
        limits:
          memory: 256Mi
    setupJob:
      resources:
        requests:
          cpu: 50m
          memory: 128Mi
        limits:
          memory: 512Mi