Merge branch 'main' into feat/initContainers

Author: eliobischof

charts/zitadel/templates/debug_replicaset.yaml

@@ -18,7 +18,7 @@ spec:
     metadata:
       annotations:
         checksum/configmap: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
-        checksum/secret-db-ssl-root-crt: {{ include (print $.Template.BasePath "/secret_db-ssl-root-crt.yaml") . | sha256sum }}
+        checksum/secret-db-ssl-ca-crt: {{ include (print $.Template.BasePath "/secret_db-ssl-ca-crt.yaml") . | sha256sum }}
         checksum/secret-zitadel-secrets: {{ include (print $.Template.BasePath "/secret_zitadel-secrets.yaml") . | sha256sum }}
       labels:
         {{- include "zitadel.debugSelectorLabels" . | nindent 8 }}

charts/zitadel/templates/deployment.yaml

@@ -21,7 +21,7 @@ spec:
           {{- toYaml . | nindent 8 }}
         {{- end }}
         checksum/configmap: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
-        checksum/secret-db-ssl-root-crt: {{ include (print $.Template.BasePath "/secret_db-ssl-root-crt.yaml") . | sha256sum }}
+        checksum/secret-db-ssl-ca-crt: {{ include (print $.Template.BasePath "/secret_db-ssl-ca-crt.yaml") . | sha256sum }}
         checksum/secret-zitadel-secrets: {{ include (print $.Template.BasePath "/secret_zitadel-secrets.yaml") . | sha256sum }}
       labels:
         app.kubernetes.io/component: start

charts/zitadel/templates/secret_db-ssl-ca-crt.yaml

@@ -0,0 +1,16 @@
+{{- if .Values.zitadel.dbSslCaCrt }}
+apiVersion: v1
+kind: Secret
+type: Opaque
+metadata:
+  name: db-ssl-ca-crt
+  {{- with .Values.zitadel.dbSslCaCrtAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  labels:
+    {{- include "zitadel.labels" . | nindent 4 }}
+stringData:
+  ca.crt: |-
+{{ .Values.zitadel.dbSslCaCrt | default "" | nindent 6 }}
+{{- end }}

charts/zitadel/templates/secret_db-ssl-root-crt.yaml

@@ -44,6 +44,12 @@ zitadel:
   # The CA Certificate needed for establishing secure database connections
   dbSslCaCrt: ""
 
+  # Annotations set on database SSL CA certificate secret
+  dbSslCaCrtAnnotations:
+    helm.sh/hook: pre-install,pre-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation
+    helm.sh/hook-weight: "0"
+
   # The Secret containing the CA certificate at key ca.crt needed for establishing secure database connections
   dbSslCaCrtSecret: ""