Kubernetes: v1.29.5
CNI: Calico v3.27.3
PostgreSQL 15.6 (Ubuntu 15.6-1.pgdg22.04+1) on x86_64-pc-linux-gnu (Deployed via Zalando postgresql operator)
Zitadel Helm chart version: 8.1.0
zitadel image version: v2.55.0
Helm chart custom values:
zitadel:
  resources:
    requests:
      memory: 512Mi
      cpu: 1
    limits:
      memory: 2Gi
      cpu: 2
  masterkeySecretName: zitadel-secrets
  configSecretName: zitadel-secrets
  configSecretKey: config.yaml
  configmapConfig:
    Projections:
      TransactionDuration: 1000ms
    Log:
      Level: info
    ExternalSecure: true
    ExternalDomain: <obfuscated>
    ExternalPort: 443
    TLS:
      Enabled: false
    Database:
      Postgres:
        Host: <obfuscated>
        Port: 5432
        Database: <obfuscated>
        MaxOpenConns: 20
        MaxIdleConns: 10
        MaxConnLifetime: 30m
        MaxConnIdleTime: 5m
        User:
          Username: <obfuscated>
          SSL:
            Mode: prefer
        Admin:
          Username: <obfuscated>
          SSL:
            Mode: prefer
    FirstInstance:
      Org:
        Name: Default
        Human:
          Username: admin-human
          FirstName: Admin
          LastName: Human
          PasswordChangeRequired: false
          Email:
            Address: admin-human@common.<obfuscated>
            Verified: true
    DefaultInstance:
      PasswordComplexityPolicy:
        MinLength: 1
        HasLowercase: false
        HasUppercase: false
        HasNumber: false
        HasSymbol: false
      LoginPolicy:
        AllowUsernamePassword: true
        AllowRegister: false
        AllowExternalIDP: false
        ForceMFA: false
        HidePasswordReset: true
        IgnoreUnknownUsernames: true
        AllowDomainDiscovery: false
        PasswordlessType: 1
        PasswordCheckLifetime: 240h
        ExternalLoginCheckLifetime: 240h
        MfaInitSkipLifetime: 720h
        SecondFactorCheckLifetime: 18h
        MultiFactorCheckLifetime: 12h
      PrivacyPolicy:
        TOSLink: ''
        PrivacyLink: ''
        HelpLink: ''
        SupportEmail: ''
      LabelPolicy:
        PrimaryColor: '#990BE3'
        BackgroundColor: '#FFFFFF'
        WarnColor: '#C00543'
        FontColor: '#222222'
        PrimaryColorDark: '#990BE3'
        BackgroundColorDark: '#222222'
        WarnColorDark: '#E4175C'
        FontColorDark: '#FFFFFF'
        HideLoginNameSuffix: true
        ErrorMsgPopup: false
        DisableWatermark: true
      Restrictions:
        DisallowPublicOrgRegistration: true
    SystemDefaults:
      Multifactors:
        OTP:
          Issuer: '<obfuscated>'
      PasswordHasher:
        Hasher:
          Algorithm: argon2id
          Time: 1
          Memory: 65536
          Threads: 4
        Verifiers:
          - argon2
          - pbkdf2
          - bcrypt
      SecretHasher:
        Hasher:
          Algorithm: argon2id
          Time: 1
          Memory: 65536
          Threads: 4
        Verifiers:
          - argon2
          - pbkdf2
          - bcrypt
  debug:
    enabled: false
    annotations:
      helm.sh/hook: 'pre-install,pre-upgrade'
      helm.sh/hook-weight: '1'
podSecurityContext:
  runAsNonRoot: true
  runAsUser: 1000
  runAsGroup: 1000
  fsGroup: 1000
securityContext:
  runAsNonRoot: true
  runAsUser: 1000
  runAsGroup: 1000
  readOnlyRootFilesystem: true
  privileged: false
resources:
  requests:
    memory: 512Mi
    cpu: 1
  limits:
    memory: 1Gi
    cpu: 2
initJob:
  enabled: true # Once ZITADEL is installed, the initJob can be disabled.
  resources:
    limits:
      cpu: 200m
      memory: 200Mi
    requests:
      cpu: 100m
      memory: 100Mi
setupJob:
  resources:
    limits:
      cpu: 200m
      memory: 200Mi
    requests:
      cpu: 100m
      memory: 100Mi
image:
  repository: <obfuscated>/ghcr-proxy/zitadel/zitadel
  pullPolicy: Always
  tag: v2.55.0
ingress:
  enabled: true
  className: nginx
  annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: 'true'
    nginx.ingress.kubernetes.io/backend-protocol: 'GRPC'
    # cert-manager.io/cluster-issuer: 'letsencrypt-prod'
  hosts:
    - host: '*.auth.<obfuscated>'
      paths:
        - path: /
          pathType: Prefix
  tls:
    - hosts:
        - '*.auth.<obfuscated>'
      secretName: wildcard.auth.<obfuscated>-tls
pdb:
  enabled: true
  minAvailable: 30%
metrics:
  enabled: true
  serviceMonitor:
    enabled: true
    honorLabels: false
    honorTimestamps: true