Skip to content

Commit 0cfc849

Browse files
eliobischofeliobischof
authored
feat: add debug pod (zitadel#183)
1 parent 58fbd96 commit 0cfc849

File tree

5 files changed

+189
-1
lines changed

5 files changed

+189
-1
lines changed

‎README.md

+21
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,27 @@ for k8sresourcetype in job configmap secret rolebinding role serviceaccount; do
6767
done
6868
```
6969

70+
## Troubleshooting
71+
72+
### Debug Pod
73+
74+
For troubleshooting, you can deploy a debug pod by setting the `zitadel.debug.enabled` property to `true`.
75+
You can then use this pod to inspect the ZITADEL configuration and run zitadel commands using the zitadel binary.
76+
For more information, print the debug pods logs using something like the following command:
77+
78+
```bash
79+
kubectl logs rs/my-zitadel-debug
80+
```
81+
82+
### migration already started, will check again in 5 seconds
83+
84+
If you see this error message in the logs of the setup job, you need to reset the last migration step once you resolved the issue.
85+
To do so, start a [debug pod](#debug-pod) and run something like the following command:
86+
87+
```bash
88+
kubectl exec -it my-zitadel-debug -- zitadel setup cleanup --config /config/zitadel-config-yaml
89+
```
90+
7091
## Contributing
7192

7293
Lint the chart:

‎charts/zitadel/Chart.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ name: zitadel
33
description: A Helm chart for ZITADEL
44
type: application
55
appVersion: "v2.46.0"
6-
version: 7.9.2
6+
version: 7.10.0
77
kubeVersion: ">= 1.21.0-0"
88
icon: https://zitadel.com/zitadel-logo-dark.svg
99
maintainers:

‎charts/zitadel/templates/_helpers.tpl

+8
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,14 @@ app.kubernetes.io/name: {{ include "zitadel.name" . }}
4848
app.kubernetes.io/instance: {{ .Release.Name }}
4949
{{- end }}
5050

51+
{{/*
52+
Debug Selector labels
53+
*/}}
54+
{{- define "zitadel.debugSelectorLabels" -}}
55+
app.kubernetes.io/name: {{ include "zitadel.name" . }}
56+
app.kubernetes.io/instance: {{ .Release.Name }}-debug
57+
{{- end }}
58+
5159
{{/*
5260
Create the name of the service account to use
5361
*/}}

‎charts/zitadel/templates/debug_replicaset.yaml

+149
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,149 @@
1+
{{- if .Values.zitadel.debug.enabled }}
2+
apiVersion: apps/v1
3+
kind: ReplicaSet
4+
metadata:
5+
name: "{{ include "zitadel.fullname" . }}-debug"
6+
labels:
7+
app.kubernetes.io/component: debug
8+
{{- with .Values.zitadel.debug.annotations }}
9+
annotations:
10+
{{- toYaml . | nindent 4 }}
11+
{{- end }}
12+
spec:
13+
replicas: 1
14+
selector:
15+
matchLabels:
16+
{{- include "zitadel.debugSelectorLabels" . | nindent 6 }}
17+
template:
18+
metadata:
19+
annotations:
20+
checksum/configmap: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
21+
checksum/secret-db-ssl-root-crt: {{ include (print $.Template.BasePath "/secret_db-ssl-root-crt.yaml") . | sha256sum }}
22+
checksum/secret-zitadel-secrets: {{ include (print $.Template.BasePath "/secret_zitadel-secrets.yaml") . | sha256sum }}
23+
labels:
24+
{{- include "zitadel.debugSelectorLabels" . | nindent 8 }}
25+
spec:
26+
{{- with .Values.imagePullSecrets }}
27+
imagePullSecrets:
28+
{{- toYaml . | nindent 8 }}
29+
{{- end }}
30+
serviceAccountName: {{ include "zitadel.serviceAccountName" . }}
31+
securityContext:
32+
{{- toYaml .Values.podSecurityContext | nindent 8 }}
33+
enableServiceLinks: false
34+
containers:
35+
- name: "{{ .Chart.Name }}-debug"
36+
securityContext:
37+
{{- toYaml .Values.securityContext | nindent 14 }}
38+
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}-debug"
39+
imagePullPolicy: {{ .Values.image.pullPolicy }}
40+
command: [ "/bin/bash", "-c", 'echo "You can now open a shell within this pod by running the following command:"; echo ""; echo "kubectl --namespace {{ .Release.Namespace }} exec -it ${HOSTNAME} -- bash"; echo ""; echo "Check the directories /config and /.secrets for ZITADEL config files"; echo "also check the ZITADEL_ prefixed environment variables"; echo "For zitadel commands that need the masterkey, pass the flag --masterkeyFromEnv"; echo "this pod completes automatically in a day"; echo "Make sure you set zitadel.debug.enabled to false and upgrade the release when you are done"; echo "Also, delete the debug pods replica set by running the following command:"; echo; echo "kubectl --namespace {{ .Release.Namespace }} delete replicaset {{ include "zitadel.fullname" . }}-debug"; sleep 86400' ]
41+
env:
42+
- name: ZITADEL_MASTERKEY
43+
valueFrom:
44+
secretKeyRef:
45+
name: {{ default "zitadel-masterkey" .Values.zitadel.masterkeySecretName }}
46+
key: masterkey
47+
- name: ZITADEL_FIRSTINSTANCE_MACHINEKEYPATH
48+
value: "/machinekey/sa.json"
49+
{{- $dbEnv := get (include "zitadel.dbkey.json" . | fromJson) "env" }}
50+
{{- if (or .Values.zitadel.dbSslCaCrt .Values.zitadel.dbSslCaCrtSecret) }}
51+
- name: ZITADEL_DATABASE_{{ $dbEnv }}_USER_SSL_ROOTCERT
52+
value: /.secrets/db-ssl-ca-crt/ca.crt
53+
{{- end }}
54+
{{- if .Values.zitadel.dbSslUserCrtSecret }}
55+
- name: ZITADEL_DATABASE_{{ $dbEnv }}_USER_SSL_CERT
56+
value: /.secrets/db-ssl-user-crt/tls.crt
57+
- name: ZITADEL_DATABASE_{{ $dbEnv }}_USER_SSL_KEY
58+
value: /.secrets/db-ssl-user-crt/tls.key
59+
{{- end}}
60+
{{- with .Values.env }}
61+
{{- toYaml . | nindent 12 }}
62+
{{- end }}
63+
volumeMounts:
64+
- name: zitadel-config-yaml
65+
mountPath: /config
66+
- name: chowned-secrets
67+
mountPath: /.secrets
68+
{{- if or .Values.zitadel.secretConfig .Values.zitadel.dbSslCaCrt .Values.zitadel.dbSslCaCrtSecret .Values.zitadel.dbSslUserCrtSecret .Values.zitadel.configSecretName }}
69+
initContainers:
70+
- args:
71+
- "{{ include "zitadel.joincpcommands" (dict "commands" (list
72+
(include "zitadel.makecpcommand" (dict "value" .Values.zitadel.secretConfig "path" "/zitadel-secrets-yaml/" ))
73+
(include "zitadel.makecpcommand" (dict "value" .Values.zitadel.configSecretName "path" "/zitadel-secret-config-yaml/" ))
74+
(include "zitadel.makecpcommand" (dict "value" (or .Values.zitadel.dbSslCaCrt .Values.zitadel.dbSslCaCrtSecret) "path" "/db-ssl-ca-crt/" ))
75+
(include "zitadel.makecpcommand" (dict "value" .Values.zitadel.dbSslUserCrtSecret "path" "/db-ssl-user-crt/" ))
76+
)) }} chown -R 1000:1000 /chowned-secrets/ && find /chowned-secrets/ -type f -exec chmod 400 -- {} + "
77+
command:
78+
- sh
79+
- -c
80+
image: "{{ .Values.chownImage.repository }}:{{ .Values.chownImage.tag }}"
81+
imagePullPolicy: {{ .Values.chownImage.pullPolicy }}
82+
name: chown
83+
volumeMounts:
84+
- name: chowned-secrets
85+
mountPath: /chowned-secrets
86+
{{- if .Values.zitadel.secretConfig }}
87+
- name: zitadel-secrets-yaml
88+
mountPath: /zitadel-secrets-yaml
89+
{{- end }}
90+
{{- if .Values.zitadel.configSecretName }}
91+
- name: zitadel-secret-config-yaml
92+
mountPath: /zitadel-secret-config-yaml
93+
{{- end }}
94+
{{- if (or .Values.zitadel.dbSslCaCrt .Values.zitadel.dbSslCaCrtSecret) }}
95+
- name: db-ssl-ca-crt
96+
mountPath: /db-ssl-ca-crt
97+
{{- end }}
98+
{{- if .Values.zitadel.dbSslUserCrtSecret }}
99+
- name: db-ssl-user-crt
100+
mountPath: /db-ssl-user-crt
101+
{{- end }}
102+
securityContext:
103+
runAsNonRoot: false
104+
runAsUser: 0
105+
{{- end }}
106+
volumes:
107+
- name: zitadel-config-yaml
108+
configMap:
109+
name: zitadel-config-yaml
110+
{{- if .Values.zitadel.secretConfig }}
111+
- name: zitadel-secrets-yaml
112+
secret:
113+
secretName: zitadel-secrets-yaml
114+
{{- end }}
115+
{{- if .Values.zitadel.configSecretName }}
116+
- name: zitadel-secret-config-yaml
117+
secret:
118+
secretName: {{ .Values.zitadel.configSecretName }}
119+
{{- end }}
120+
{{- if .Values.zitadel.dbSslCaCrt }}
121+
- name: db-ssl-ca-crt
122+
secret:
123+
secretName: db-ssl-ca-crt
124+
{{- end }}
125+
{{- if .Values.zitadel.dbSslCaCrtSecret }}
126+
- name: db-ssl-ca-crt
127+
secret:
128+
secretName: {{ .Values.zitadel.dbSslCaCrtSecret }}
129+
{{- end }}
130+
{{- if .Values.zitadel.dbSslUserCrtSecret }}
131+
- name: db-ssl-user-crt
132+
secret:
133+
secretName: {{ .Values.zitadel.dbSslUserCrtSecret }}
134+
{{- end }}
135+
- name: chowned-secrets
136+
emptyDir: {}
137+
{{- with .Values.nodeSelector }}
138+
nodeSelector:
139+
{{- toYaml . | nindent 8 }}
140+
{{- end }}
141+
{{- with .Values.affinity }}
142+
affinity:
143+
{{- toYaml . | nindent 8 }}
144+
{{- end }}
145+
{{- with .Values.tolerations }}
146+
tolerations:
147+
{{- toYaml . | nindent 8 }}
148+
{{- end }}
149+
{{- end }}

‎charts/zitadel/values.yaml

+10
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,16 @@ zitadel:
6161
enabled: false
6262
additionalDnsName:
6363

64+
# Enabling this will create a debug pod that can be used to inspect the ZITADEL configuration and run zitadel commands using the zitadel binary.
65+
# This is useful for debugging and troubleshooting.
66+
# After the debug pod is created, you can open a shell within the pod.
67+
# See more instructions by printing the pods logs using kubectl logs [pod name].
68+
debug:
69+
enabled: false
70+
annotations:
71+
helm.sh/hook: pre-install,pre-upgrade
72+
helm.sh/hook-weight: "1"
73+
6474
replicaCount: 3
6575

6676
image:

0 commit comments

Comments
 (0)