run zitadel on GCP cloud run or aws fragate

[mohammad-aqajani]

Hi, how can I run zitadel as serverless service on GCP or AWS? I setup a serverless cockrochdb from cockroadchlabs.cloud and get some connection string.. but further steps like set configs.yml for DB connection and settings for gcp cloud run are ambigious, any help?

[fforootd]

Hi @mohammad-aqajani

I think in the next two weeks we will publish a cloud run example.

@thesephirot @eliobischof what do you think of this

[eliobischof]

Let's do it.

@mohammad-aqajani: For mounting the config with Cloud Run, we use Googles Secret Manager. AFAIK, it is the only way to mount files to containers with Cloud Run, at least it was at the time we made the setup.

This is a configuration for one of our environments:

apiVersion: serving.knative.dev/v1
kind: Service
metadata:
...
  annotations:
    run.googleapis.com/ingress: internal-and-cloud-load-balancing
    ...
spec:
  template:
    metadata:
      annotations:
        autoscaling.knative.dev/minScale: '1'
        run.googleapis.com/vpc-access-egress: all-traffic
        autoscaling.knative.dev/maxScale: '1'
        # needed if you privately connect to cockroach cloud using a VPC tunnel
        run.googleapis.com/vpc-access-connector: projects/zitadel-cloud/locations/europe-west1/connectors/zitadel-vpcconn
        run.googleapis.com/cpu-throttling: 'false'
    spec:
      containerConcurrency: 500
      timeoutSeconds: 300
      serviceAccountName: zitadel-cloud-run@zitadel-cloud.iam.gserviceaccount.com
      containers:
      - image: europe-docker.pkg.dev/zitadel-common/zitadel-repo/zitadel:v2.0.0-scheduler.2-amd64
        args:
        - start-from-init
        - --config
        - /config/zitadel-config-yaml
        - --config
        - /secrets/zitadel-secrets-yaml
        - --steps
        - /config/zitadel-config-yaml
        - --masterkeyFile
        - /masterkey/zitadel-masterkey
        ports:
        # name h2c is important
        - name: h2c
          containerPort: 8080
        env:
        - name: ZITADEL_DATABASE_USER_SSL_ROOTCERT
          value: /rootcrt/db-ssl-root-cert
        - name: ZITADEL_ADMINUSER_SSL_ROOTCERT
          value: /rootcrt/db-ssl-root-cert
        resources:
          limits:
            cpu: 2000m
            memory: 512Mi
        volumeMounts:
        - name: zitadel-config-yaml
          mountPath: /config
        - name: zitadel-secrets-yaml
          mountPath: /secrets
        - name: db-ssl-root-cert
          mountPath: /rootcrt
        - name: zitadel-masterkey
          mountPath: /masterkey
      volumes:
      - name: zitadel-config-yaml
        secret:
          secretName: zitadel-config-yaml
          items:
            # 18 is the secret version
          - key: '18'
            path: zitadel-config-yaml
          defaultMode: 438
      - name: zitadel-secrets-yaml
        secret:
          secretName: zitadel-secrets-yaml
          items:
          - key: '5'
            path: zitadel-secrets-yaml
          defaultMode: 256
      - name: db-ssl-root-cert
        secret:
          secretName: db-ssl-root-cert
          items:
          - key: '2'
            path: db-ssl-root-cert
          defaultMode: 256
      - name: zitadel-masterkey
        secret:
          secretName: zitadel-masterkey
          items:
          - key: '1'
            path: zitadel-masterkey
          defaultMode: 256
  traffic:
  - percent: 100
    latestRevision: true
status:
...