mirror of
https://github.com/andwati/zitadel.git
synced 2026-10-18 13:52:51 +00:00
Florian ForsterandGitHub
413f8ba585
This pull request significantly expands and restructures the Kubernetes deployment documentation for Zitadel. It introduces detailed, task-focused guides for installation, configuration, ingress, and database setup, replacing the previous minimal documentation. The new docs provide comprehensive instructions and best practices for deploying Zitadel on Kubernetes using Helm, including security, scaling, and high availability considerations. The most important changes are: **Documentation Restructuring and Overview** - Added a new `index.mdx` providing an overview of the Zitadel Helm chart, architecture, prerequisites, and quick links to relevant resources and next steps. - Removed the old minimal Kubernetes deployment page and replaced it with a structured, multi-page documentation set. **Installation and Setup** - Added an `installation.mdx` guide with step-by-step instructions for preparing prerequisites, creating Kubernetes secrets, configuring `values.yaml`, installing the Helm chart, and verifying the deployment. **Configuration and Best Practices** - Added a `configuration.mdx` guide covering Helm chart configuration options, including replica count, container images, security contexts, external domain setup, secrets management, scaling, autoscaling, pod disruption budgets, and anti-affinity rules. **Ingress and Database Configuration** - Added an `ingress.mdx` guide detailing how to configure Kubernetes ingress resources for Zitadel and Login containers, including TLS termination and certificate management. - Added a `database.mdx` guide explaining how to connect Zitadel to PostgreSQL with various TLS/security options and how to manage database credentials and certificates using Kubernetes secrets.
124 lines
3.4 KiB
Plaintext
124 lines
3.4 KiB
Plaintext
---
|
|
title: Database
|
|
sidebar_label: Database
|
|
---
|
|
|
|
|
|
|
|
## PostgreSQL
|
|
|
|
Zitadel requires PostgreSQL 14 or later. The chart supports multiple ways to connect to PostgreSQL depending on your security requirements.
|
|
|
|
### Connecting Without TLS (Not Recommended)
|
|
|
|
This method connects to PostgreSQL without encryption. Only use this for testing or when the database is on a private network with no risk of interception.
|
|
|
|
```yaml
|
|
zitadel:
|
|
configmapConfig:
|
|
Database:
|
|
Postgres:
|
|
Host: "postgres.database.svc.cluster.local"
|
|
Port: 5432
|
|
Database: "zitadel"
|
|
User:
|
|
Username: "zitadel"
|
|
Password: "your-password"
|
|
SSL:
|
|
Mode: "disable"
|
|
Admin:
|
|
Username: "postgres"
|
|
Password: "your-admin-password"
|
|
SSL:
|
|
Mode: "disable"
|
|
```
|
|
|
|
The `SSL.Mode: "disable"` setting turns off TLS entirely. Traffic between Zitadel and PostgreSQL is unencrypted.
|
|
|
|
### Connecting with Credentials and TLS
|
|
|
|
This method connects to PostgreSQL with TLS encryption but without certificate verification. Use this when you trust the network path but want encryption in transit.
|
|
|
|
```yaml
|
|
zitadel:
|
|
configSecretName: zitadel-db-credentials
|
|
configmapConfig:
|
|
Database:
|
|
Postgres:
|
|
Host: "postgres.database.svc.cluster.local"
|
|
Port: 5432
|
|
Database: "zitadel"
|
|
User:
|
|
Username: "zitadel"
|
|
SSL:
|
|
Mode: "require"
|
|
Admin:
|
|
Username: "postgres"
|
|
SSL:
|
|
Mode: "require"
|
|
```
|
|
|
|
Create a secret for the database passwords:
|
|
|
|
```bash
|
|
kubectl create secret generic zitadel-db-credentials \
|
|
--from-literal=config.yaml="
|
|
Database:
|
|
Postgres:
|
|
User:
|
|
Password: your-secure-app-password
|
|
Admin:
|
|
Password: your-secure-admin-password
|
|
"
|
|
```
|
|
|
|
The `SSL.Mode: "require"` setting enforces TLS but does not verify the server certificate. This protects against passive eavesdropping but not against man-in-the-middle attacks.
|
|
|
|
### Connecting with Certificates
|
|
|
|
This method connects to PostgreSQL with full TLS verification using certificates. Use this for production deployments where you need to verify the database server's identity.
|
|
|
|
```yaml
|
|
zitadel:
|
|
configSecretName: zitadel-db-credentials
|
|
dbSslCaCrt: "ca.crt"
|
|
dbSslCaCrtSecret: "postgres-ca-cert"
|
|
configmapConfig:
|
|
Database:
|
|
Postgres:
|
|
Host: "postgres.database.svc.cluster.local"
|
|
Port: 5432
|
|
Database: "zitadel"
|
|
User:
|
|
Username: "zitadel"
|
|
SSL:
|
|
Mode: "verify-full"
|
|
Admin:
|
|
Username: "postgres"
|
|
SSL:
|
|
Mode: "verify-full"
|
|
```
|
|
|
|
Create a secret containing the CA certificate:
|
|
|
|
```bash
|
|
kubectl create secret generic postgres-ca-cert \
|
|
--from-file=ca.crt=/path/to/your/ca-certificate.crt
|
|
```
|
|
|
|
Create a secret for the database passwords:
|
|
|
|
```bash
|
|
kubectl create secret generic zitadel-db-credentials \
|
|
--from-literal=config.yaml="
|
|
Database:
|
|
Postgres:
|
|
User:
|
|
Password: your-secure-app-password
|
|
Admin:
|
|
Password: your-secure-admin-password
|
|
"
|
|
```
|
|
|
|
The `SSL.Mode: "verify-full"` setting enforces TLS and verifies that the server certificate is signed by the CA and that the server hostname matches the certificate. This provides full protection against eavesdropping and man-in-the-middle attacks. The `dbSslCaCrtSecret` references the Kubernetes Secret containing the CA certificate, and `dbSslCaCrt` specifies the key within that secret.
|