From 9006521b68fac7bca002552cad83cf06f788c4ee Mon Sep 17 00:00:00 2001
From: Kochetkov S <kochetkov.s@sarex.io>
Date: Wed, 26 Aug 2026 14:22:02 +0300
Subject: [PATCH] ++ generate real zitadel postgres password via in-cluster
 postgres users secret

---
 infrastructure-secrets.yaml | 28 ++++++++++++++++++----------
 1 file changed, 18 insertions(+), 10 deletions(-)

diff --git a/infrastructure-secrets.yaml b/infrastructure-secrets.yaml
index 7abd45c..16e8e9e 100644
--- a/infrastructure-secrets.yaml
+++ b/infrastructure-secrets.yaml
@@ -3348,7 +3348,10 @@ environments:
                         admin:
                             enabled: ENC[AES256_GCM,data:WyShgtw=,iv:9lwrn9Tc45BdU5mp759ZrLuBdjpvUNzMXYayOCIqlG8=,tag:o65CdxMfkTCgNpR2ZxDU6g==,type:bool]
                         users:
-                            enabled: ENC[AES256_GCM,data:MBMzdmc=,iv:tMEtA9uV5+s7Bkx1J78VzpqWnBA7WedOINzemRp6RKM=,tag:bwSV/UtfmvNJWARwld1KeQ==,type:bool]
+                            enabled: ENC[AES256_GCM,data:vVefZg==,iv:1DeOhAh61MufiIEU4FNQhQKHKY+3oWNOS0x7J4m09FM=,tag:1A7sgI2nmU73rd3EkrnMrg==,type:bool]
+                        apps:
+                            zitadel:
+                                generate: ENC[AES256_GCM,data:7Qjnnw==,iv:P63VxhPVNn6xi/1xbzXvqWT/h6rR1PRz4FPG5dnwg28=,tag:L/nnoowZjdWcBmtxu9ptnA==,type:bool]
                     rabbitmq:
                         auth:
                             enabled: ENC[AES256_GCM,data:99hpGRQ=,iv:XCiu3U3EEQTEEadY1u52e2vGXusVsUE/IJlWY/x3miM=,tag:JEL/FC1N4gbP6Td7jpJv6g==,type:bool]
@@ -3375,19 +3378,24 @@ environments:
                         identity_firstuser:
                             generate: ENC[AES256_GCM,data:F3pnmg==,iv:0JsUPsF1DUh2l6js+wckLQQOw+wkIZ6VCgIiC450O7Y=,tag:1lgzozQJbEBKm6AaOYb16w==,type:bool]
         secrets:
-            - name: zitadel-postgresql
-              namespace: zitadel
-              type: database
+            - namespace: zitadel
               sink: vault
               vault_path: zitadel/postgresql
-              depends_on:
-                cluster: main
-                db: zitadel
-                user: zitadel
               random_keys:
                 humanPassword:
                     length: 32
                     special: false
+              id: zitadel-postgresql
+              schema: ""
+              ownership: managed
+              targets:
+                - kind: vault
+                  path: zitadel/postgresql
+              extra_fields:
+                password:
+                    source:
+                        kind: secret_ref
+                        ref: vault://postgresql/users#zitadel
             - name: camunda-keycloak-db-staging
               namespace: camunda
               type: database
@@ -3452,8 +3460,8 @@ sops:
             U1hiSTkrMzRwMGpOeGtYNnNyNElYOE0KOHsFrj5+iMx8tIymrIhLpB8xbLaztR7J
             E+ViNs6OGeIS90qwxAD7OP9raGB/lsTfh9V/zigM8gF+OzGErF73aQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T11:17:08Z"
-    mac: ENC[AES256_GCM,data:k0NnmWa7QIeIXDjPogRMWPzPWDEMf5I/uj6S3lzctdLMgYE79Q72Iz7yHjqw1kLj2o6JU36V+/aIUJj3PkrCmzuhVHphc+5FGOrmWC/tPTOd18DB39uag7PiOndSmQavJrKKOBWUhIbu/iiRjzMoT2Gv3DeheMMGXldyNVztC84=,iv:6JWBlfZYVp0pojw9mhY5zMuUyqT0Alz0+doNmOEhmM0=,tag:7Xio7ugDlodcpQ4rsdTnIA==,type:str]
+    lastmodified: "2026-08-26T11:20:07Z"
+    mac: ENC[AES256_GCM,data:DdUa9Ixkj+UQdMEM4NbI/QtuAYgw/lCiYf0Uiq3UbPUbhqh8CB6rbeDgJgVj3mkTJHOSPJPHz2tPKFr7wPDrc0B9SVSf3if+5/4TO4OW8X9J1aIYQsdMbKsoOSxVT+uz5A3md4Ahl66fuf+l2m0nRMozrAzBctvca/3U1jzNo6M=,iv:sVuGYBN6hWCYLTagd2JdQeoRqsrwEfAezPOIlL9IvWM=,tag:LnhIxBKDKzVFbBqcNJLWvQ==,type:str]
     pgp: []
     encrypted_regex: ^(data)$
     version: 3.12.2