is there anyway to use zitadel without giving database admin access? about zitadel-charts HOT 11 CLOSED

---
apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: zitadel-web-app-set
  namespace: argocd
  annotations:
    pref.argocd.argoproj.io/default-view: "network"
    pref.argocd.argoproj.io/default-pod-sort: "topLevelResource"
spec:
  goTemplate: true
  # generator allows us to source specific values from an external k8s secret
  generators:
    - plugin:
        configMapRef:
          name: secret-var-plugin-generator
        input:
          parameters:
            secret_vars:
              - zitadel_hostname
              - global_cluster_issuer
  template:
    metadata:
      name: zitadel-web-app
      annotations:
        argocd.argoproj.io/sync-wave: "4"
    spec:
      project: zitadel
      destination:
        server: https://kubernetes.default.svc
        namespace: zitadel
      syncPolicy:
        syncOptions:
          - ApplyOutOfSyncOnly=true
        automated:
          prune: true
          selfHeal: true
      source:
        repoURL: https://zitadel.github.io/zitadel-charts
        chart: zitadel
        targetRevision: 7.1.0
        helm:
          releaseName: zitadel
          # https://github.com/zitadel/zitadel-charts/blob/main/charts/zitadel/values.yaml
          values: |
            replicaCount: 1

            # Overrides the image tag to the latest version
            # as kept up to date by renovateBot
            image:
              tag: "v2.35.0"

            zitadel:
              # See all defaults here:
              # https://github.com/zitadel/zitadel/blob/main/cmd/defaults.yaml
              configmapConfig:
                DefaultInstance:
                  LoginPolicy:
                    # disable registration AKA signups
                    AllowRegister: false
                Database:
                  Postgres:
                    Host: zitadel-postgres-rw.zitadel.svc
                    Port: 5432
                    Database: zitadel
                    User:
                      Username: zitadel
                      SSL:
                        Mode: verify-full
                    #Admin:
                    #  Username: postgres
                    #  SSL:
                    #    Mode: verify-full

                ExternalDomain: {{ .zitadel_hostname }}

                TLS:
                  # off until https://github.com/zitadel/zitadel-charts/pull/141
                  # or a similar easy fix would be merged
                  Enabled: false

                # specifies if ZITADEL is exposed externally through TLS this
                # must be set to true even if TLS is not enabled on ZITADEL itself
                # but TLS traffic is terminated on a reverse proxy
                # !!! Changing this after initial setup breaks your system !!!
                ExternalSecure: true
                ExternalPort: 443

                Machine:
                  Identification:
                    Hostname:
                      Enabled: true
                    Webhook:
                      Enabled: false

                # setup ZITADEL with a service account
                FirstInstance:
                  Org:
                    Machine:
                      Machine:
                        # Creates a service account with the name zitadel-admin-sa,
                        # which results in a secret 'zitadel-admin-sa' with a key 'zitadel-admin-sa.json'
                        Username: zitadel-admin-sa
                        Name: Admin
                      MachineKey:
                        Type: 1

              # Reference the name of the secret that contains the masterkey.
              # The key should be named "masterkey".
              masterkeySecretName: "zitadel-core-key"

              # The Secret containing the CA certificate at key ca.crt needed for establishing secure database connections
              dbSslCaCrtSecret: "zitadel-postgres-server-ca-key-pair"

              # The db admins secret containing the client certificate and key at tls.crt and tls.key needed for establishing secure database connections
              # dbSslAdminCrtSecret: "zitadel-postgres-postgres-cert"

              # The db users secret containing the client certificate and key at tls.crt and tls.key needed for establishing secure database connections
              dbSslUserCrtSecret: "zitadel-postgres-zitadel-cert"

            initJob:
              # Once ZITADEL is installed, the initJob can be disabled.
              enabled: false

            ingress:
              enabled: true
              className: "nginx"
              annotations:
                kubernetes.io/tls-acme: "true"
                cert-manager.io/cluster-issuer: {{ .global_cluster_issuer }}
              hosts:
                - host: {{ .zitadel_hostname }}
                  paths:
                    - path: /
                      pathType: Prefix
              tls:
                - secretName: zitadel-tls
                  hosts:
                    - {{ .zitadel_hostname }}

            metrics:
              enabled: false
              serviceMonitor:
                enabled: false

            readinessProbe:
              enabled: true
              initialDelaySeconds: 20
              periodSeconds: 15
              failureThreshold: 6

            livenessProbe:
              enabled: true
              initialDelaySeconds: 20
              periodSeconds: 15
              failureThreshold: 6

---
# webapp is deployed 2nd because we need secrets and persistent volumes up 1st
apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: zitadel-postgres-app-set
  namespace: argocd
spec:
  goTemplate: true
  # generator allows us to source specific values from an external k8s secret
  generators:
    - plugin:
        configMapRef:
          name: secret-var-plugin-generator
        input:
          parameters:
            secret_vars:
              - zitadel_s3_endpoint
              - zitadel_s3_bucket
  template:
    metadata:
      name: zitadel-postgres-cluster
      namespace: zitadel
      annotations:
        argocd.argoproj.io/sync-wave: "3"
    spec:
      project: zitadel
      destination:
        server: "https://kubernetes.default.svc"
        namespace: zitadel
      syncPolicy:
        syncOptions:
          - ApplyOutOfSyncOnly=true
        automated:
          prune: true
          selfHeal: true
      source:
        repoURL: https://small-hack.github.io/cloudnative-pg-cluster-chart
        chart: cnpg-cluster
        targetRevision: 0.3.9
        helm:
          releaseName: zitadel-postgres-cluster
          values: |
            name: zitadel-postgres
            instances: 1

            bootstrap:
              initdb:
                database: zitadel
                owner: zitadel
                postInitApplicationSQLRefs:
                  secretRefs:
                    - name: zitadel-postgres-init-script
                      key: init.sql

            enableSuperuserAccess: true

            backup:
              # barman is a utility for backing up postgres to s3
              barmanObjectStore:
                destinationPath: "s3://{{ .zitadel_s3_bucket }}"
                endpointURL: "https://{{ .zitadel_s3_endpoint }}"
                s3Credentials:
                  accessKeyId:
                    name: zitadel-db-credentials
                    key : "ACCESS_KEY"
                  secretAccessKey:
                    name: zitadel-db-credentials
                    key : "SECRET_KEY"
              retentionPolicy: "30d"

            certificates:
              server:
                enabled: true
                generate: true
              client:
                enabled: true
                generate: true
              user:
                enabled: true
                username:
                  - zitadel
                  - postgres

            scheduledBackup:
              name: zitadel-pg-backup
              spec:
                schedule: "0 0 0 * * *"
                backupOwnerReference: self
                cluster:
                  name: pg-backup

            monitoring:
              enablePodMonitor: false

            postgresql:
              pg_hba:
                - hostnossl all all 0.0.0.0/0 reject
                - hostssl all all 0.0.0.0/0 cert clientcert=verify-full

apiVersion: v1
kind: Secret
metadata:
  name: zitadel-postgres-init-script
type: Opaque
stringData:
  init.sql: |
    BEGIN;
    CREATE SCHEMA IF NOT EXISTS eventstore;
    CREATE SCHEMA IF NOT EXISTS projections;
    CREATE SCHEMA IF NOT EXISTS system;
    CREATE TABLE IF NOT EXISTS system.encryption_keys (id TEXT NOT NULL, key TEXT NOT NULL, PRIMARY KEY (id));
    CREATE TABLE IF NOT EXISTS eventstore.events (
        instance_id TEXT NOT NULL
        , aggregate_type TEXT NOT NULL
        , aggregate_id TEXT NOT NULL
        , event_type TEXT NOT NULL
        , "sequence" BIGINT NOT NULL
        , revision SMALLINT NOT NULL
        , created_at TIMESTAMPTZ NOT NULL
        , payload JSONB
        , creator TEXT NOT NULL
        , "owner" TEXT NOT NULL
        , "position" DECIMAL NOT NULL
        , in_tx_order INTEGER NOT NULL
        , PRIMARY KEY (instance_id, aggregate_type, aggregate_id, "sequence"));
    CREATE INDEX IF NOT EXISTS es_active_instances ON eventstore.events (created_at DESC, instance_id);
    CREATE INDEX IF NOT EXISTS es_wm ON eventstore.events (aggregate_id, instance_id, aggregate_type, event_type);
    CREATE INDEX IF NOT EXISTS es_projection ON eventstore.events (
        instance_id
        , aggregate_type
        , event_type
        , "position");
    CREATE SEQUENCE IF NOT EXISTS eventstore.system_seq;
    CREATE TABLE IF NOT EXISTS eventstore.unique_constraints (
        instance_id TEXT
        , unique_type TEXT
        , unique_field TEXT
        , PRIMARY KEY (instance_id, unique_type, unique_field));
    GRANT ALL ON SCHEMA system TO zitadel;
    GRANT ALL ON ALL TABLES IN SCHEMA system TO zitadel;
    GRANT ALL ON SCHEMA eventstore TO zitadel;
    GRANT ALL ON ALL TABLES IN SCHEMA eventstore TO zitadel;
    GRANT ALL ON SCHEMA projections TO zitadel;
    GRANT ALL ON ALL TABLES IN SCHEMA projections TO zitadel;
    COMMIT;

replicaCount: 1

# Overrides the image tag to the latest version
# as kept up to date by renovateBot
image:
  tag: "v2.35.0"

zitadel:
  # See all defaults here:
  # https://github.com/zitadel/zitadel/blob/main/cmd/defaults.yaml
  configmapConfig:
    DefaultInstance:
      LoginPolicy:
        # disable registration AKA signups
        AllowRegister: false
    Database:
      Postgres:
        Host: zitadel-postgres-rw.zitadel.svc
        Port: 5432
        Database: zitadel
        User:
          Username: zitadel
          SSL:
            Mode: verify-full
        Admin:
          SSL:
            Mode: verify-full

    ExternalDomain: myzitadel.example.com

    TLS:
      # off until https://github.com/zitadel/zitadel-charts/pull/141
      # or a similar easy fix would be merged
      Enabled: false

    # specifies if ZITADEL is exposed externally through TLS this
    # must be set to true even if TLS is not enabled on ZITADEL itself
    # but TLS traffic is terminated on a reverse proxy
    # !!! Changing this after initial setup breaks your system !!!
    ExternalSecure: true
    ExternalPort: 443

    Machine:
      Identification:
        Hostname:
          Enabled: true
        Webhook:
          Enabled: false

    # setup ZITADEL with a service account
    FirstInstance:
      Org:
        Machine:
          Machine:
            # Creates a service account with the name zitadel-admin-sa,
            # which results in a secret 'zitadel-admin-sa' with a key 'zitadel-admin-sa.json'
            Username: zitadel-admin-sa
            Name: Admin
          MachineKey:
            Type: 1

  # Reference the name of the secret that contains the masterkey.
  # The key should be named "masterkey".
  masterkeySecretName: "zitadel-core-key"

  # The Secret containing the CA certificate at key ca.crt needed for establishing secure database connections
  dbSslCaCrtSecret: "zitadel-postgres-server-cert"

  # The db admins secret containing the client certificate and key at tls.crt and tls.key needed for establishing secure database connections
  dbSslAdminCrtSecret: "zitadel-postgres-server-cert"

  # The db users secret containing the client certificate and key at tls.crt and tls.key needed for establishing secure database connections
  dbSslUserCrtSecret: "zitadel-postgres-zitadel-cert"

ingress:
  enabled: true
  className: "nginx"
  annotations:
    kubernetes.io/tls-acme: "true"
    cert-manager.io/cluster-issuer: letsencrypt-prod
  hosts:
    - host: myzitadel.example.com
      paths:
        - path: /
          pathType: Prefix
  tls:
    - secretName: zitadel-tls
      hosts:
        - myzitadel.example.com

metrics:
  enabled: false
  serviceMonitor:
    enabled: false

readinessProbe:
  enabled: true
  initialDelaySeconds: 20
  periodSeconds: 15
  failureThreshold: 6

livenessProbe:
  enabled: true
  initialDelaySeconds: 20
  periodSeconds: 15
  failureThreshold: 6