apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: idp
  namespace: zitadel
spec:
  interval: 10m
  timeout: 15m
  dependsOn:
    - name: istio-base
      namespace: istio-system
    - name: istiod
      namespace: istio-system
  chart:
    spec:
      chart: idp-infra
      version: "4.19.4-1"
      sourceRef:
        kind: HelmRepository
        name: yc-oci-charts
        namespace: flux-system
      interval: 10m
  install:
    remediation:
      retries: 3
  upgrade:
    remediation:
      retries: 3
  values:
    replicaCount: 3
    imagePullSecrets:
      - name: istio-registry-secret
    nodeSelector:
      sarex.io/pool: svc
    affinity:
      podAntiAffinity:
        requiredDuringSchedulingIgnoredDuringExecution:
          - topologyKey: topology.kubernetes.io/zone
            labelSelector:
              matchLabels:
                app.kubernetes.io/name: idp
                app.kubernetes.io/instance: idp
    env:
      - name: ZITADEL_DEFAULTINSTANCE_FEATURES_LOGINV2_REQUIRED
        value: 'false'
      - name: ZITADEL_SYSTEMDEFAULTS_PASSWORDHASHER_VERIFIERS
        value: bcrypt,pbkdf2
      - name: ZITADEL_MACHINE_IDENTIFICATION_HOSTNAME_ENABLED
        value: 'true'
      - name: ZITADEL_DATABASE_POSTGRES_HOST
        valueFrom:
          secretKeyRef:
            name: zitadel-db
            key: host
      - name: ZITADEL_DATABASE_POSTGRES_PORT
        valueFrom:
          secretKeyRef:
            name: zitadel-db
            key: port
      - name: ZITADEL_DATABASE_POSTGRES_USER_USERNAME
        valueFrom:
          secretKeyRef:
            name: zitadel-db
            key: user
      - name: ZITADEL_DATABASE_POSTGRES_USER_PASSWORD
        valueFrom:
          secretKeyRef:
            name: zitadel-db
            key: password
      - name: ZITADEL_DATABASE_POSTGRES_ADMIN_EXISTINGDATABASE
        valueFrom:
          secretKeyRef:
            name: zitadel-db
            key: database
      - name: ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME
        valueFrom:
          secretKeyRef:
            name: zitadel-db
            key: user
      - name: ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD
        valueFrom:
          secretKeyRef:
            name: zitadel-db
            key: password
      - name: ZITADEL_DATABASE_POSTGRES_DATABASE
        valueFrom:
          secretKeyRef:
            name: zitadel-db
            key: database
      - name: ZITADEL_DATABASE_POSTGRES_USER_SSL_MODE
        value: require
      - name: ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_MODE
        value: require
      - name: ZITADEL_DEFAULTINSTANCE_ORG_HUMAN_USERNAME
        value: zitadel-admin
      - name: ZITADEL_DEFAULTINSTANCE_ORG_HUMAN_PASSWORD
        valueFrom:
          secretKeyRef:
            name: zitadel-first-admin
            key: password
      - name: ZITADEL_DEFAULTINSTANCE_ORG_NAME
        value: Sarex