feat: label policy (#1708)

* feat: label policy proto extension

* feat: label policy and activate event

* feat: label policy asset events

* feat: label policy asset commands

* feat: add storage key

* feat: storage key validation

* feat: label policy asset tests

* feat: label policy query side

* feat: avatar

* feat: avatar event

* feat: human avatar

* feat: avatar read side

* feat: font on iam label policy

* feat: label policy font

* feat: possiblity to create bucket on put file

* uplaoder

* login policy logo

* set bucket prefix

* feat: avatar upload

* feat: avatar upload

* feat: use assets on command side

* feat: fix human avatar removed event

* feat: remove human avatar

* feat: mock asset storage

* feat: remove human avatar

* fix(operator): add configuration of asset storage to zitadel operator

* feat(console): private labeling policy (#1697)

* private labeling component, routing, preview

* font, colors, upload, i18n

* show logo

* fix: uniqueness (#1710)

* fix: uniqueconstraint to lower

* feat: change org

* feat: org change test

* feat: change org

* fix: tests

* fix: handle domain claims correctly

* feat: update org

Co-authored-by: fabi <[email protected]>

* fix: handle domain claimed event correctly for service users (#1711)

* fix: handle domain claimed event correctly on user view

* fix: ignore domain claimed events for email notifications

* fix: change org

* handle org changed in read models correctly

* fix: change org in user grant handler

Co-authored-by: fabi <[email protected]>

* fix: correct value (#1695)

* docs(api): correct link (#1712)

* upload service

Co-authored-by: Livio Amstutz <[email protected]>
Co-authored-by: fabi <[email protected]>
Co-authored-by: Florian Forster <[email protected]>

* feat: fix tests,

* feat: remove assets from label policy

* fix npm, set environment

* lint ts

* remove stylelinting

* fix(operator): add mapping for console with changed unit tests

* fix(operator): add secrets as env variables to pod

* feat: remove human avatar

* fix(operator): add secrets as env variables to pod

* feat: map label policy

* feat: labelpolicy, admin, mgmt, adv settings (#1715)

* fetch label policy, mgmt, admin service

* feat: advanced beh, links, add, update

* lint ts

* feat: watermark

* feat: remove human avatar

* feat: remove human avatar

* feat: remove human avatar

* feat: remove human avatar

* feat: remove human avatar

* feat: remove human avatar

* feat: remove human avatar

* feat: custom css

* css

* css

* css

* css

* css

* getobject

* feat: dynamic handler

* feat: varibale css

* content info

* css overwrite

* feat: variablen css

* feat: generate css file

* feat: dark mode

* feat: dark mode

* fix logo css

* feat: upload logos

* dark mode with cookie

* feat: handle images in login

* avatar css and begin font

* feat: avatar

* feat: user avatar

* caching of static assets in login

* add avatar.js to main.html

* feat: header dont show logo if no url

* feat: label policy colors

* feat: mock asset storage

* feat: mock asset storage

* feat: fix tests

* feat: user avatar

* feat: header logo

* avatar

* avatar

* make it compatible with go 1.15

* feat: remove unused logos

* fix handler

* fix: styling error handling

* fonts

* fix: download func

* switch to mux

* fix: change upload api to assets

* fix build

* fix: download avatar

* fix: download logos

* fix: my avatar

* font

* fix: remove error msg popup possibility

* fix: docs

* fix: svalidate colors

* rem msg popup from frontend

* fix: email with private labeling

* fix: tests

* fix: email templates

* fix: change migration version

* fix: fix duplicate imports

* fix(console): assets, service url, upload, policy current and preview  (#1781)

* upload endpoint, layout

* fetch current, preview, fix upload

* cleanup private labeling

* fix linting

* begin generated asset handler

* generate asset api in dockerfile

* features for label policy

* features for label policy

* features

* flag for asset generator

* change asset generator flag

* fix label policy view in grpc

* fix: layout, activate policy (#1786)

* theme switcher up on top

* change layout

* activate policy

* feat(console): label policy back color, layout (#1788)

* theme switcher up on top

* change layout

* activate policy

* fix overwrite value fc

* reset policy, reset service

* autosave policy, preview desc, layout impv

* layout, i18n

* background colors, inject material styles

* load images

* clean, lint

* fix layout

* set custom hex

* fix content size conversion

* remove font format in generated css

* fix features for assets

* fix(console): label policy colors, image downloads, preview (#1804)

* load images

* colors, images binding

* lint

* refresh emitter

* lint

* propagate font colors

* upload error handling

* label policy feature check

* add blob in csp for console

* log

* fix: feature edits for label policy, refresh state on upload (#1807)

* show error on load image, stop spinner

* fix merge

* fix migration versions

* fix assets

* fix csp

* fix background color

* scss

* fix build

* lint scss

* fix statik for console

* fix features check for label policy

* cleanup

* lint

* public links

* fix notifications

* public links

* feat: merge main

* feat: fix translation files

* fix migration

* set api domain

* fix logo in email

* font face in email

* font face in email

* validate assets on upload

* cleanup

* add missing translations

* add missing translations

Co-authored-by: Livio Amstutz <[email protected]>
Co-authored-by: Stefan Benz <[email protected]>
Co-authored-by: Max Peintner <[email protected]>
Co-authored-by: Florian Forster <[email protected]>

operator/zitadel/kinds/iam/zitadel/ambassador/adapt_test.go

@@ -64,6 +64,8 @@ func SetMappingsHTTP(
 
 	SetReturnResourceVersion(k8sClient, group, version, kind, namespace, http.AdminRName, "")
 	k8sClient.EXPECT().ApplyNamespacedCRDResource(group, version, kind, namespace, http.AdminRName, gomock.Any()).MinTimes(1).MaxTimes(1)
+	SetReturnResourceVersion(k8sClient, group, version, kind, namespace, http.Upload, "")
+	k8sClient.EXPECT().ApplyNamespacedCRDResource(group, version, kind, namespace, http.Upload, gomock.Any()).MinTimes(1).MaxTimes(1)
 	SetReturnResourceVersion(k8sClient, group, version, kind, namespace, http.AuthorizeName, "")
 	k8sClient.EXPECT().ApplyNamespacedCRDResource(group, version, kind, namespace, http.AuthorizeName, gomock.Any()).MinTimes(1).MaxTimes(1)
 	SetReturnResourceVersion(k8sClient, group, version, kind, namespace, http.AuthRName, "")

operator/zitadel/kinds/iam/zitadel/ambassador/http/adapt.go

@@ -12,6 +12,7 @@ import (
 
 const (
 	AdminRName     = "admin-rest-v1"
+	Upload         = "assets-v1"
 	MgmtName       = "mgmt-v1"
 	OauthName      = "oauth-v1"
 	AuthRName      = "auth-rest-v1"
@@ -39,6 +40,11 @@ func AdaptFunc(
 		return nil, nil, err
 	}
 
+	destroyUpload, err := mapping.AdaptFuncToDestroy(namespace, Upload)
+	if err != nil {
+		return nil, nil, err
+	}
+
 	destroyMgmtRest, err := mapping.AdaptFuncToDestroy(namespace, MgmtName)
 	if err != nil {
 		return nil, nil, err
@@ -76,6 +82,7 @@ func AdaptFunc(
 
 	destroyers := []operator.DestroyFunc{
 		operator.ResourceDestroyToZitadelDestroy(destroyAdminR),
+		operator.ResourceDestroyToZitadelDestroy(destroyUpload),
 		operator.ResourceDestroyToZitadelDestroy(destroyMgmtRest),
 		operator.ResourceDestroyToZitadelDestroy(destroyOAuthv2),
 		operator.ResourceDestroyToZitadelDestroy(destroyAuthR),
@@ -120,6 +127,22 @@ func AdaptFunc(
 				return nil, err
 			}
 
+			queryUpload, err := mapping.AdaptFuncToEnsure(
+				namespace,
+				labels.MustForName(componentLabels, Upload),
+				false,
+				apiDomain,
+				"/assets/v1",
+				"",
+				httpUrl,
+				30000,
+				30000,
+				cors,
+			)
+			if err != nil {
+				return nil, err
+			}
+
 			queryMgmtRest, err := mapping.AdaptFuncToEnsure(
 				namespace,
 				labels.MustForName(componentLabels, MgmtName),
@@ -234,6 +257,7 @@ func AdaptFunc(
 
 			queriers := []operator.QueryFunc{
 				operator.ResourceQueryToZitadelQuery(queryAdminR),
+				operator.ResourceQueryToZitadelQuery(queryUpload),
 				operator.ResourceQueryToZitadelQuery(queryMgmtRest),
 				operator.ResourceQueryToZitadelQuery(queryOAuthv2),
 				operator.ResourceQueryToZitadelQuery(queryAuthR),

operator/zitadel/kinds/iam/zitadel/ambassador/http/adapt_test.go

@@ -89,6 +89,30 @@ func TestHttp_Adapt(t *testing.T) {
 	SetReturnResourceVersion(k8sClient, group, version, kind, namespace, EndsessionName, "")
 	k8sClient.EXPECT().ApplyNamespacedCRDResource(group, version, kind, namespace, EndsessionName, endsession).MinTimes(1).MaxTimes(1)
 
+	uploadName := labels.MustForName(componentLabels, Upload)
+	upload := &unstructured.Unstructured{
+		Object: map[string]interface{}{
+			"apiVersion": group + "/" + version,
+			"kind":       kind,
+			"metadata": map[string]interface{}{
+				"labels":    labels.MustK8sMap(uploadName),
+				"name":      uploadName.Name(),
+				"namespace": namespace,
+			},
+			"spec": map[string]interface{}{
+				"connect_timeout_ms": 30000,
+				"host":               ".",
+				"prefix":             "/assets/v1",
+				"rewrite":            "",
+				"service":            url,
+				"timeout_ms":         30000,
+				"cors":               cors,
+			},
+		},
+	}
+	SetReturnResourceVersion(k8sClient, group, version, kind, namespace, Upload, "")
+	k8sClient.EXPECT().ApplyNamespacedCRDResource(group, version, kind, namespace, Upload, upload).MinTimes(1).MaxTimes(1)
+
 	issuerName := labels.MustForName(componentLabels, IssuerName)
 	issuer := &unstructured.Unstructured{
 		Object: map[string]interface{}{
@@ -321,6 +345,30 @@ func TestHttp_Adapt2(t *testing.T) {
 	SetReturnResourceVersion(k8sClient, group, version, kind, namespace, EndsessionName, "")
 	k8sClient.EXPECT().ApplyNamespacedCRDResource(group, version, kind, namespace, EndsessionName, endsession).MinTimes(1).MaxTimes(1)
 
+	uploadName := labels.MustForName(componentLabels, Upload)
+	upload := &unstructured.Unstructured{
+		Object: map[string]interface{}{
+			"apiVersion": group + "/" + version,
+			"kind":       kind,
+			"metadata": map[string]interface{}{
+				"labels":    labels.MustK8sMap(uploadName),
+				"name":      uploadName.Name(),
+				"namespace": namespace,
+			},
+			"spec": map[string]interface{}{
+				"connect_timeout_ms": 30000,
+				"host":               "api.domain",
+				"prefix":             "/assets/v1",
+				"rewrite":            "",
+				"service":            url,
+				"timeout_ms":         30000,
+				"cors":               cors,
+			},
+		},
+	}
+	SetReturnResourceVersion(k8sClient, group, version, kind, namespace, Upload, "")
+	k8sClient.EXPECT().ApplyNamespacedCRDResource(group, version, kind, namespace, Upload, upload).MinTimes(1).MaxTimes(1)
+
 	issuerName := labels.MustForName(componentLabels, IssuerName)
 	issuer := &unstructured.Unstructured{
 		Object: map[string]interface{}{

operator/zitadel/kinds/iam/zitadel/configuration/adapt.go

@@ -13,11 +13,12 @@ import (
 )
 
 type ConsoleEnv struct {
-	AuthServiceURL string `json:"authServiceUrl"`
-	MgmtServiceURL string `json:"mgmtServiceUrl"`
-	Issuer         string `json:"issuer"`
-	ClientID       string `json:"clientid"`
-	SubServiceURL  string `json:"subscriptionServiceUrl"`
+	AuthServiceURL   string `json:"authServiceUrl"`
+	MgmtServiceURL   string `json:"mgmtServiceUrl"`
+	Issuer           string `json:"issuer"`
+	ClientID         string `json:"clientid"`
+	SubServiceURL    string `json:"subscriptionServiceUrl"`
+	UploadServiceURL string `json:"uploadServiceUrl"`
 }
 
 const (

operator/zitadel/kinds/iam/zitadel/configuration/desired.go

@@ -18,6 +18,7 @@ type Configuration struct {
 	MigrateEventStoreV1 bool           `yaml:"migrateEventstoreV1"`
 	DNS                 *DNS           `yaml:"dns"`
 	ClusterDNS          string         `yaml:"clusterdns"`
+	AssetStorage        *AssetStorage  `yaml:"assetStorage,omitempty"`
 }
 
 func (c *Configuration) Validate() (err error) {
@@ -30,6 +31,18 @@ func (c *Configuration) Validate() (err error) {
 	return c.DNS.validate()
 }
 
+type AssetStorage struct {
+	Type                    string           `yaml:"type,omitempty"`
+	Endpoint                string           `yaml:"endpoint,omitempty"`
+	AccessKeyID             *secret.Secret   `yaml:"accessKeyID,omitempty"`
+	ExistingAccessKeyID     *secret.Existing `yaml:"existingAccessKeyID,omitempty"`
+	SecretAccessKey         *secret.Secret   `yaml:"secretAccessKey,omitempty"`
+	ExistingSecretAccessKey *secret.Existing `yaml:"ExistingSecretAccessKey,omitempty"`
+	SSL                     bool             `yaml:"ssl,omitempty"`
+	Location                string           `yaml:"location,omitempty"`
+	BucketPrefix            string           `yaml:"bucketPrefix,omitempty"`
+}
+
 type DNS struct {
 	Domain        string      `yaml:"domain"`
 	TlsSecret     string      `yaml:"tlsSecret"`

operator/zitadel/kinds/iam/zitadel/configuration/literals.go

@@ -89,6 +89,7 @@ func literalsConfigMap(
 			oauth := "https://" + desired.DNS.Subdomains.API + "." + defaultDomain + "/oauth/v2"
 			authorize := "https://" + desired.DNS.Subdomains.Accounts + "." + defaultDomain + "/oauth/v2"
 			console := "https://" + desired.DNS.Subdomains.Console + "." + defaultDomain
+			apiDomain := "https://" + desired.DNS.Subdomains.API + "." + defaultDomain
 
 			literalsConfigMap["ZITADEL_ISSUER"] = issuer
 			literalsConfigMap["ZITADEL_ACCOUNTS"] = accounts
@@ -98,6 +99,14 @@ func literalsConfigMap(
 			literalsConfigMap["ZITADEL_ACCOUNTS_DOMAIN"] = accountsDomain
 			literalsConfigMap["ZITADEL_COOKIE_DOMAIN"] = accountsDomain
 			literalsConfigMap["ZITADEL_DEFAULT_DOMAIN"] = defaultDomain
+			literalsConfigMap["ZITADEL_API_DOMAIN"] = apiDomain
+		}
+		if desired.AssetStorage != nil {
+			literalsConfigMap["ZITADEL_ASSET_STORAGE_TYPE"] = desired.AssetStorage.Type
+			literalsConfigMap["ZITADEL_ASSET_STORAGE_ENDPOINT"] = desired.AssetStorage.Endpoint
+			literalsConfigMap["ZITADEL_ASSET_STORAGE_SSL"] = strconv.FormatBool(desired.AssetStorage.SSL)
+			literalsConfigMap["ZITADEL_ASSET_STORAGE_LOCATION"] = desired.AssetStorage.Location
+			literalsConfigMap["ZITADEL_ASSET_STORAGE_BUCKET_PREFIX"] = desired.AssetStorage.BucketPrefix
 		}
 	}
 
@@ -164,6 +173,23 @@ func literalsSecretVars(k8sClient kubernetes.ClientInt, desired *Configuration)
 				literalsSecretVars["ZITADEL_TWILIO_SID"] = value
 			}
 		}
+		if desired.AssetStorage != nil {
+			as := desired.AssetStorage
+			if as.AccessKeyID != nil || as.ExistingAccessKeyID != nil {
+				value, err := read.GetSecretValue(k8sClient, as.AccessKeyID, as.ExistingAccessKeyID)
+				if err != nil {
+					return nil, err
+				}
+				literalsSecretVars["ZITADEL_ASSET_STORAGE_ACCESS_KEY_ID"] = value
+			}
+			if as.SecretAccessKey != nil || as.ExistingSecretAccessKey != nil {
+				value, err := read.GetSecretValue(k8sClient, as.SecretAccessKey, as.ExistingSecretAccessKey)
+				if err != nil {
+					return nil, err
+				}
+				literalsSecretVars["ZITADEL_ASSET_STORAGE_SECRET_ACCESS_KEY"] = value
+			}
+		}
 	}
 	return literalsSecretVars, nil
 }
@@ -201,6 +227,7 @@ func literalsConsoleCM(
 	consoleEnv.AuthServiceURL = "https://" + dns.Subdomains.API + "." + dns.Domain
 	consoleEnv.MgmtServiceURL = "https://" + dns.Subdomains.API + "." + dns.Domain
 	consoleEnv.SubServiceURL = "https://" + dns.Subdomains.Subscription + "." + dns.Domain
+	consoleEnv.UploadServiceURL = "https://" + dns.Subdomains.API + "." + dns.Domain
 
 	data, err := json.Marshal(consoleEnv)
 	if err != nil {

operator/zitadel/kinds/iam/zitadel/configuration/literals_test.go

@@ -69,6 +69,17 @@ var (
 				Subscription: "",
 			},
 		},
+		AssetStorage: &AssetStorage{
+			Type:                    "",
+			Endpoint:                "",
+			AccessKeyID:             &secret.Secret{Value: ""},
+			ExistingAccessKeyID:     nil,
+			SecretAccessKey:         &secret.Secret{Value: ""},
+			ExistingSecretAccessKey: nil,
+			SSL:                     false,
+			Location:                "",
+			BucketPrefix:            "",
+		},
 		ClusterDNS: "",
 	}
 
@@ -128,6 +139,15 @@ var (
 			},
 		},
 		ClusterDNS: "cluster",
+		AssetStorage: &AssetStorage{
+			Type:            "type",
+			Endpoint:        "endpoint",
+			AccessKeyID:     &secret.Secret{Value: "accesskeyid"},
+			SecretAccessKey: &secret.Secret{Value: "secretaccesskey"},
+			SSL:             true,
+			Location:        "location",
+			BucketPrefix:    "bucketprefix",
+		},
 	}
 	desiredFullExisting = &Configuration{
 		Tracing: &Tracing{
@@ -185,6 +205,15 @@ var (
 			},
 		},
 		ClusterDNS: "cluster",
+		AssetStorage: &AssetStorage{
+			Type:                    "type",
+			Endpoint:                "endpoint",
+			ExistingAccessKeyID:     &secret.Existing{"accesskeyid", "accesskeyid", "accesskeyid"},
+			ExistingSecretAccessKey: &secret.Existing{"secretaccesskey", "secretaccesskey", "secretaccesskey"},
+			SSL:                     true,
+			Location:                "location",
+			BucketPrefix:            "bucketprefix",
+		},
 	}
 )
 
@@ -246,6 +275,7 @@ func TestConfiguration_LiteralsConfigMap(t *testing.T) {
 		"ZITADEL_ISSUER":                      "https://.",
 		"ZITADEL_CONSOLE":                     "https://.",
 		"ZITADEL_ACCOUNTS_DOMAIN":             ".",
+		"ZITADEL_API_DOMAIN":                  "https://.",
 		"GOOGLE_APPLICATION_CREDENTIALS":      "test/test",
 		"CR_MIGRATION_KEY":                    "test/client.migration.key",
 		"ZITADEL_TRACING_FRACTION":            "",
@@ -259,6 +289,11 @@ func TestConfiguration_LiteralsConfigMap(t *testing.T) {
 		"CR_MANAGEMENT_KEY":                   "test/client.management.key",
 		"ZITADEL_TRACING_TYPE":                "",
 		"ZITADEL_AUTHORIZE":                   "https://./oauth/v2",
+		"ZITADEL_ASSET_STORAGE_TYPE":          "",
+		"ZITADEL_ASSET_STORAGE_ENDPOINT":      "",
+		"ZITADEL_ASSET_STORAGE_SSL":           "false",
+		"ZITADEL_ASSET_STORAGE_LOCATION":      "",
+		"ZITADEL_ASSET_STORAGE_BUCKET_PREFIX": "",
 	}
 
 	literals := literalsConfigMap(desiredEmpty, users, certPath, secretPath, googleSA, zitadelKeyPath, queried)
@@ -318,6 +353,7 @@ func TestConfiguration_LiteralsConfigMapFull(t *testing.T) {
 		"ZITADEL_ACCOUNTS_DOMAIN":             "accounts.domain",
 		"ZITADEL_AUTHORIZE":                   "https://accounts.domain/oauth/v2",
 		"ZITADEL_CONSOLE":                     "https://console.domain",
+		"ZITADEL_API_DOMAIN":                  "https://api.domain",
 		"ZITADEL_COOKIE_DOMAIN":               "accounts.domain",
 		"ZITADEL_COOKIE_KEY":                  "cookieid",
 		"ZITADEL_CSRF_KEY":                    "csrfid",
@@ -337,6 +373,11 @@ func TestConfiguration_LiteralsConfigMapFull(t *testing.T) {
 		"ZITADEL_TRACING_PROJECT_ID":          "projectid",
 		"ZITADEL_TRACING_TYPE":                "type",
 		"ZITADEL_USER_VERIFICATION_KEY":       "userid",
+		"ZITADEL_ASSET_STORAGE_TYPE":          "type",
+		"ZITADEL_ASSET_STORAGE_ENDPOINT":      "endpoint",
+		"ZITADEL_ASSET_STORAGE_SSL":           "true",
+		"ZITADEL_ASSET_STORAGE_LOCATION":      "location",
+		"ZITADEL_ASSET_STORAGE_BUCKET_PREFIX": "bucketprefix",
 	}
 	literals := literalsConfigMap(desiredFull, users, certPath, secretPath, googleSA, zitadelKeyPath, queried)
 
@@ -410,10 +451,12 @@ func TestConfiguration_LiteralsSecretsExisting(t *testing.T) {
 func TestConfiguration_LiteralsSecretVars(t *testing.T) {
 	client := kubernetesmock.NewMockClientInt(gomock.NewController(t))
 	equals := map[string]string{
-		"ZITADEL_EMAILAPPKEY":       "",
-		"ZITADEL_GOOGLE_CHAT_URL":   "",
-		"ZITADEL_TWILIO_AUTH_TOKEN": "",
-		"ZITADEL_TWILIO_SID":        "",
+		"ZITADEL_EMAILAPPKEY":                     "",
+		"ZITADEL_GOOGLE_CHAT_URL":                 "",
+		"ZITADEL_TWILIO_AUTH_TOKEN":               "",
+		"ZITADEL_TWILIO_SID":                      "",
+		"ZITADEL_ASSET_STORAGE_ACCESS_KEY_ID":     "",
+		"ZITADEL_ASSET_STORAGE_SECRET_ACCESS_KEY": "",
 	}
 	literals, err := literalsSecretVars(client, desiredEmpty)
 	assert.NoError(t, err)
@@ -424,10 +467,12 @@ func TestConfiguration_LiteralsSecretVars(t *testing.T) {
 func TestConfiguration_LiteralsSecretVarsFull(t *testing.T) {
 	client := kubernetesmock.NewMockClientInt(gomock.NewController(t))
 	equals := map[string]string{
-		"ZITADEL_EMAILAPPKEY":       "appkey",
-		"ZITADEL_GOOGLE_CHAT_URL":   "chat",
-		"ZITADEL_TWILIO_AUTH_TOKEN": "authtoken",
-		"ZITADEL_TWILIO_SID":        "sid",
+		"ZITADEL_EMAILAPPKEY":                     "appkey",
+		"ZITADEL_GOOGLE_CHAT_URL":                 "chat",
+		"ZITADEL_TWILIO_AUTH_TOKEN":               "authtoken",
+		"ZITADEL_TWILIO_SID":                      "sid",
+		"ZITADEL_ASSET_STORAGE_ACCESS_KEY_ID":     "accesskeyid",
+		"ZITADEL_ASSET_STORAGE_SECRET_ACCESS_KEY": "secretaccesskey",
 	}
 	literals, err := literalsSecretVars(client, desiredFull)
 
@@ -442,6 +487,8 @@ func TestConfiguration_LiteralsSecretVarsExisting(t *testing.T) {
 	chat := "chat"
 	authtoken := "authtoken"
 	sid := "sid"
+	akid := "accesskeyid"
+	sak := "secretaccesskey"
 	/* TODO: incomment!!!
 	client.EXPECT().GetSecret(namespace, desiredFullExisting.Notifications.Email.ExistingAppKey.Name).Return(&corev1.Secret{
 			StringData: map[string]string{
@@ -477,10 +524,12 @@ func TestConfiguration_LiteralsSecretVarsExisting(t *testing.T) {
 		}, nil)
 	*/
 	equals := map[string]string{
-		"ZITADEL_EMAILAPPKEY":       appkey,
-		"ZITADEL_GOOGLE_CHAT_URL":   chat,
-		"ZITADEL_TWILIO_AUTH_TOKEN": authtoken,
-		"ZITADEL_TWILIO_SID":        sid,
+		"ZITADEL_EMAILAPPKEY":                     appkey,
+		"ZITADEL_GOOGLE_CHAT_URL":                 chat,
+		"ZITADEL_TWILIO_AUTH_TOKEN":               authtoken,
+		"ZITADEL_TWILIO_SID":                      sid,
+		"ZITADEL_ASSET_STORAGE_ACCESS_KEY_ID":     akid,
+		"ZITADEL_ASSET_STORAGE_SECRET_ACCESS_KEY": sak,
 	}
 	literals, err := literalsSecretVars(client, desiredFull)
 
@@ -502,7 +551,7 @@ func TestConfiguration_LiteralsConsoleCM(t *testing.T) {
 		Data: map[string]string{"environment.json": "{\"authServiceUrl\":\"https://.\",\"mgmtServiceUrl\":\"https://.\",\"issuer\":\"https://.\",\"clientid\":\"\",\"subscriptionServiceUrl\":\"https://.\"}"},
 	}
 
-	equals := map[string]string{"environment.json": "{\"authServiceUrl\":\"https://.\",\"mgmtServiceUrl\":\"https://.\",\"issuer\":\"https://.\",\"clientid\":\"\",\"subscriptionServiceUrl\":\"https://.\"}"}
+	equals := map[string]string{"environment.json": "{\"authServiceUrl\":\"https://.\",\"mgmtServiceUrl\":\"https://.\",\"issuer\":\"https://.\",\"clientid\":\"\",\"subscriptionServiceUrl\":\"https://.\",\"uploadServiceUrl\":\"https://.\"}"}
 	k8sClient.EXPECT().GetConfigMap(namespace, cmName).Times(1).Return(cm, nil)
 
 	literals := literalsConsoleCM(clientID, desiredEmpty.DNS, k8sClient, namespace, cmName)
@@ -524,7 +573,7 @@ func TestConfiguration_LiteralsConsoleCMFull(t *testing.T) {
 	}
 
 	equals := map[string]string{
-		"environment.json": "{\"authServiceUrl\":\"https://api.domain\",\"mgmtServiceUrl\":\"https://api.domain\",\"issuer\":\"https://issuer.domain\",\"clientid\":\"test\",\"subscriptionServiceUrl\":\"https://sub.domain\"}",
+		"environment.json": "{\"authServiceUrl\":\"https://api.domain\",\"mgmtServiceUrl\":\"https://api.domain\",\"issuer\":\"https://issuer.domain\",\"clientid\":\"test\",\"subscriptionServiceUrl\":\"https://sub.domain\",\"uploadServiceUrl\":\"https://api.domain\"}",
 	}
 	k8sClient.EXPECT().GetConfigMap(namespace, cmName).Times(1).Return(cm, nil)
 
@@ -544,12 +593,12 @@ func TestConfiguration_LiteralsConsoleCMWithCM(t *testing.T) {
 			Name:      cmName,
 		},
 		Data: map[string]string{
-			"environment.json": "{\"authServiceUrl\":\"https://api.domain\",\"mgmtServiceUrl\":\"https://api.domain\",\"issuer\":\"https://issuer.domain\",\"clientid\":\"\",\"subscriptionServiceUrl\":\"https://sub.domain\"}",
+			"environment.json": "{\"authServiceUrl\":\"https://api.domain\",\"mgmtServiceUrl\":\"https://api.domain\",\"issuer\":\"https://issuer.domain\",\"clientid\":\"\",\"subscriptionServiceUrl\":\"https://sub.domain\",\"uploadServiceUrl\":\"https://api.domain\"}",
 		},
 	}
 
 	equals := map[string]string{
-		"environment.json": "{\"authServiceUrl\":\"https://api.domain\",\"mgmtServiceUrl\":\"https://api.domain\",\"issuer\":\"https://issuer.domain\",\"clientid\":\"test\",\"subscriptionServiceUrl\":\"https://sub.domain\"}",
+		"environment.json": "{\"authServiceUrl\":\"https://api.domain\",\"mgmtServiceUrl\":\"https://api.domain\",\"issuer\":\"https://issuer.domain\",\"clientid\":\"test\",\"subscriptionServiceUrl\":\"https://sub.domain\",\"uploadServiceUrl\":\"https://api.domain\"}",
 	}
 	k8sClient.EXPECT().GetConfigMap(namespace, cmName).Times(1).Return(cm, nil)
 
@@ -569,12 +618,12 @@ func TestConfiguration_LiteralsConsoleCMWithCMFull(t *testing.T) {
 			Name:      cmName,
 		},
 		Data: map[string]string{
-			"environment.json": "{\"authServiceUrl\":\"https://api.domain\",\"mgmtServiceUrl\":\"https://api.domain\",\"issuer\":\"https://issuer.domain\",\"clientid\":\"test\",\"subscriptionServiceUrl\":\"https://sub.domain\"}",
+			"environment.json": "{\"authServiceUrl\":\"https://api.domain\",\"mgmtServiceUrl\":\"https://api.domain\",\"issuer\":\"https://issuer.domain\",\"clientid\":\"test\",\"subscriptionServiceUrl\":\"https://sub.domain\",\"uploadServiceUrl\":\"https://api.domain\"}",
 		},
 	}
 
 	equals := map[string]string{
-		"environment.json": "{\"authServiceUrl\":\"https://api.domain\",\"mgmtServiceUrl\":\"https://api.domain\",\"issuer\":\"https://issuer.domain\",\"clientid\":\"test\",\"subscriptionServiceUrl\":\"https://sub.domain\"}",
+		"environment.json": "{\"authServiceUrl\":\"https://api.domain\",\"mgmtServiceUrl\":\"https://api.domain\",\"issuer\":\"https://issuer.domain\",\"clientid\":\"test\",\"subscriptionServiceUrl\":\"https://sub.domain\",\"uploadServiceUrl\":\"https://api.domain\"}",
 	}
 	k8sClient.EXPECT().GetConfigMap(namespace, cmName).Times(1).Return(cm, nil)
 

operator/zitadel/kinds/iam/zitadel/deployment/container.go

@@ -62,6 +62,20 @@ func GetContainer(
 					Key:                  "ZITADEL_EMAILAPPKEY",
 				},
 			}},
+		{Name: "ZITADEL_ASSET_STORAGE_ACCESS_KEY_ID",
+			ValueFrom: &corev1.EnvVarSource{
+				SecretKeyRef: &corev1.SecretKeySelector{
+					LocalObjectReference: corev1.LocalObjectReference{Name: secretVarsName},
+					Key:                  "ZITADEL_ASSET_STORAGE_ACCESS_KEY_ID",
+				},
+			}},
+		{Name: "ZITADEL_ASSET_STORAGE_SECRET_ACCESS_KEY",
+			ValueFrom: &corev1.EnvVarSource{
+				SecretKeyRef: &corev1.SecretKeySelector{
+					LocalObjectReference: corev1.LocalObjectReference{Name: secretVarsName},
+					Key:                  "ZITADEL_ASSET_STORAGE_SECRET_ACCESS_KEY",
+				},
+			}},
 	}
 
 	sort.Strings(users)

operator/zitadel/kinds/iam/zitadel/deployment/container_test.go

@@ -67,6 +67,20 @@ func TestDeployment_GetContainer(t *testing.T) {
 					Key:                  "ZITADEL_EMAILAPPKEY",
 				},
 			}},
+		{Name: "ZITADEL_ASSET_STORAGE_ACCESS_KEY_ID",
+			ValueFrom: &corev1.EnvVarSource{
+				SecretKeyRef: &corev1.SecretKeySelector{
+					LocalObjectReference: corev1.LocalObjectReference{Name: secretVarsName},
+					Key:                  "ZITADEL_ASSET_STORAGE_ACCESS_KEY_ID",
+				},
+			}},
+		{Name: "ZITADEL_ASSET_STORAGE_SECRET_ACCESS_KEY",
+			ValueFrom: &corev1.EnvVarSource{
+				SecretKeyRef: &corev1.SecretKeySelector{
+					LocalObjectReference: corev1.LocalObjectReference{Name: secretVarsName},
+					Key:                  "ZITADEL_ASSET_STORAGE_SECRET_ACCESS_KEY",
+				},
+			}},
 		{
 			Name: "CR_TEST_PASSWORD",
 			ValueFrom: &corev1.EnvVarSource{

operator/zitadel/kinds/iam/zitadel/secrets.go

@@ -101,5 +101,28 @@ func getSecretsMap(desiredKind *DesiredV0) (
 	mailKey := "emailappkey"
 	secrets[mailKey] = conf.Notifications.Email.AppKey
 	existing[mailKey] = conf.Notifications.Email.ExistingAppKey
+
+	if conf.AssetStorage == nil {
+		conf.AssetStorage = &configuration.AssetStorage{}
+	}
+	if conf.AssetStorage.AccessKeyID == nil {
+		conf.AssetStorage.AccessKeyID = &secret.Secret{}
+	}
+	if conf.AssetStorage.ExistingAccessKeyID == nil {
+		conf.AssetStorage.ExistingAccessKeyID = &secret.Existing{}
+	}
+	if conf.AssetStorage.SecretAccessKey == nil {
+		conf.AssetStorage.SecretAccessKey = &secret.Secret{}
+	}
+	if conf.AssetStorage.ExistingSecretAccessKey == nil {
+		conf.AssetStorage.ExistingSecretAccessKey = &secret.Existing{}
+	}
+	accessKey := "accesskeyid"
+	secrets[accessKey] = conf.AssetStorage.AccessKeyID
+	existing[accessKey] = conf.AssetStorage.ExistingAccessKeyID
+
+	secretKey := "secretaccesskey"
+	secrets[secretKey] = conf.AssetStorage.SecretAccessKey
+	existing[secretKey] = conf.AssetStorage.ExistingSecretAccessKey
 	return secrets, existing
 }