initjob.yaml

{{- if .Values.initJob.enabled }}
apiVersion: batch/v1
kind: Job
metadata:
  name: "{{ include "zitadel.fullname" . }}-init"
  labels:
    {{- include "zitadel.labels" . | nindent 4 }}
    app.kubernetes.io/component: init
    {{- with .Values.initJob.annotations }}
  annotations:
      {{- toYaml . | nindent 4 }}
    {{- end }}
spec:
  backoffLimit: {{ .Values.initJob.backoffLimit }}
  activeDeadlineSeconds: {{ .Values.initJob.activeDeadlineSeconds }}
  template:
    metadata:
      labels:
        {{- include "zitadel.selectorLabels" . | nindent 8 }}
        app.kubernetes.io/component: init
        {{- with .Values.initJob.podAdditionalLabels }}
          {{- toYaml . | nindent 8 }}
        {{- end }}
      {{- with .Values.initJob.podAnnotations }}
      annotations:
        {{- toYaml . | nindent 8 }}
      {{- end }}
    spec:
      {{- with .Values.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      serviceAccountName: {{ include "zitadel.serviceAccountName" . }}
      securityContext:
        {{- toYaml .Values.podSecurityContext | nindent 8 }}
      enableServiceLinks: false
      restartPolicy: OnFailure
      containers:
        - name: "{{ .Chart.Name }}-init"
          securityContext:
            {{- toYaml .Values.securityContext | nindent 14 }}
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
          imagePullPolicy: {{ .Values.image.pullPolicy }}

          args:
            - init
            {{- with .Values.initJob.command }}
            {{/* test if command is valid */}}
            {{- if not (has . (list "database" "grant" "user" "zitadel")) }}
            {{- fail "You can only set one of the following command: database, grant, user, zitadel" }}
            {{- end -}}
            - {{ . }}
            {{- end }}
            - --config
            - /config/zitadel-config-yaml
            {{- if .Values.zitadel.secretConfig }}
            - --config
            - /.secrets/zitadel-secrets-yaml/zitadel-secrets-yaml
            {{- end }}
            {{- if and .Values.zitadel.configSecretName .Values.zitadel.configSecretKey }}
            - --config
            - /.secrets/zitadel-secret-config-yaml/{{ .Values.zitadel.configSecretKey }}
            {{- end }}
          env:
            - name: POD_IP
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: status.podIP
            {{- $dbEnv := get (include "zitadel.dbkey.json" . | fromJson) "env" }}
            {{- if (or .Values.zitadel.dbSslCaCrt .Values.zitadel.dbSslCaCrtSecret) }}
            - name: ZITADEL_DATABASE_{{ $dbEnv }}_USER_SSL_ROOTCERT
              value: /.secrets/db-ssl-ca-crt/ca.crt
            - name: ZITADEL_DATABASE_{{ $dbEnv }}_ADMIN_SSL_ROOTCERT
              value: /.secrets/db-ssl-ca-crt/ca.crt
            {{- end}}
            {{- if .Values.zitadel.dbSslAdminCrtSecret }}
            - name: ZITADEL_DATABASE_{{ $dbEnv }}_ADMIN_SSL_CERT
              value: /.secrets/db-ssl-admin-crt/tls.crt
            - name: ZITADEL_DATABASE_{{ $dbEnv }}_ADMIN_SSL_KEY
              value: /.secrets/db-ssl-admin-crt/tls.key
            {{- end}}
            {{- if .Values.zitadel.dbSslUserCrtSecret }}
            - name: ZITADEL_DATABASE_{{ $dbEnv }}_USER_SSL_CERT
              value: /.secrets/db-ssl-user-crt/tls.crt
            - name: ZITADEL_DATABASE_{{ $dbEnv }}_USER_SSL_KEY
              value: /.secrets/db-ssl-user-crt/tls.key
            {{- end}}
            {{- with .Values.env }}
              {{- toYaml . | nindent 12 }}
            {{- end }}
          volumeMounts:
          - name: zitadel-config-yaml
            mountPath: /config
          - name: chowned-secrets
            mountPath: /.secrets
          {{- with .Values.extraVolumeMounts }}
          {{- toYaml . | nindent 10 }}
          {{- end }}
          resources:
            {{- toYaml .Values.initJob.resources | nindent 14 }}
        {{- if .Values.initJob.extraContainers }}
        {{- toYaml .Values.initJob.extraContainers | nindent 8 }}
        {{- end }}
      {{- if or .Values.zitadel.secretConfig .Values.zitadel.dbSslCaCrt .Values.zitadel.dbSslCaCrtSecret .Values.zitadel.dbSslAdminCrtSecret .Values.zitadel.dbSslUserCrtSecret .Values.zitadel.configSecretName }}
      initContainers:
        - args:
          - "{{ include "zitadel.joincpcommands" (dict "commands" (list
            (include "zitadel.makecpcommand" (dict "value" .Values.zitadel.secretConfig "path" "/zitadel-secrets-yaml/" ))
            (include "zitadel.makecpcommand" (dict "value" (or .Values.zitadel.dbSslCaCrt .Values.zitadel.dbSslCaCrtSecret) "path" "/db-ssl-ca-crt/" ))
            (include "zitadel.makecpcommand" (dict "value" .Values.zitadel.dbSslAdminCrtSecret "path" "/db-ssl-admin-crt/" ))
            (include "zitadel.makecpcommand" (dict "value" .Values.zitadel.dbSslUserCrtSecret "path" "/db-ssl-user-crt/" ))
            (include "zitadel.makecpcommand" (dict "value" .Values.zitadel.configSecretName "path" "/zitadel-secret-config-yaml/" ))
          )) }} chown -R 1000:1000 /chowned-secrets/ && find /chowned-secrets/ -type f -exec chmod 400 -- {} + "
          command:
          - sh
          - -c
          image: "{{ .Values.chownImage.repository }}:{{ .Values.chownImage.tag }}"
          imagePullPolicy: {{ .Values.chownImage.pullPolicy }}
          name: chown
          volumeMounts:
          - name: chowned-secrets
            mountPath: /chowned-secrets
          {{- if .Values.zitadel.secretConfig }}
          - name: zitadel-secrets-yaml
            mountPath: /zitadel-secrets-yaml
          {{- end }}
          {{- if .Values.zitadel.configSecretName }}
          - name: zitadel-secret-config-yaml
            mountPath: /zitadel-secret-config-yaml
          {{- end }}
          {{- if (or .Values.zitadel.dbSslCaCrt .Values.zitadel.dbSslCaCrtSecret) }}
          - name: db-ssl-ca-crt
            mountPath: /db-ssl-ca-crt
          {{- end }}
          {{- if .Values.zitadel.dbSslAdminCrtSecret }}
          - name: db-ssl-admin-crt
            mountPath: /db-ssl-admin-crt
          {{- end }}
          {{- if .Values.zitadel.dbSslUserCrtSecret }}
          - name: db-ssl-user-crt
            mountPath: /db-ssl-user-crt
          {{- end }}
          securityContext:
            runAsNonRoot: false
            runAsUser: 0
      {{- end}}
      volumes:
      - name: zitadel-config-yaml
        configMap:
          name: zitadel-config-yaml
      {{- if .Values.zitadel.secretConfig }}
      - name: zitadel-secrets-yaml
        secret:
          secretName: zitadel-secrets-yaml
      {{- end }}
      {{- if .Values.zitadel.configSecretName }}
      - name: zitadel-secret-config-yaml
        secret:
          secretName: {{ .Values.zitadel.configSecretName }}
      {{- end }}
      {{- if .Values.zitadel.dbSslCaCrt }}
      - name: db-ssl-ca-crt
        secret:
          secretName: db-ssl-ca-crt
      {{- end }}
      {{- if .Values.zitadel.dbSslCaCrtSecret }}
      - name: db-ssl-ca-crt
        secret:
          secretName: {{ .Values.zitadel.dbSslCaCrtSecret }}
      {{- end }}
      {{- if .Values.zitadel.dbSslAdminCrtSecret }}
      - name: db-ssl-admin-crt
        secret:
          secretName: {{ .Values.zitadel.dbSslAdminCrtSecret }}
      {{- end }}
      {{- if .Values.zitadel.dbSslUserCrtSecret }}
      - name: db-ssl-user-crt
        secret:
          secretName: {{ .Values.zitadel.dbSslUserCrtSecret }}
      {{- end }}
      - name: chowned-secrets
        emptyDir: {}
      {{- with .Values.extraVolumes }}
      {{- toYaml . | nindent 6 }}
      {{- end }}
      {{- with .Values.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.tolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
      {{- end }}
{{ end }}