feat: add system user TLS certificate for login backend auth [HOLD]#545
feat: add system user TLS certificate for login backend auth [HOLD]#545
Conversation
Qodana for Go5 new problems were found
💡 Qodana analysis was run in the pull request mode: only the changed files were checked Contact Qodana teamContact us at [email protected]
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ce2957021d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| {{- if and $existingSecret $existingSecret.data }} | ||
| {{- $cert = dict "Cert" (index $existingSecret.data "tls.crt" | b64dec) "Key" (index $existingSecret.data "tls.key" | b64dec) }} | ||
| {{- else }} | ||
| {{- $cert = genSelfSignedCert $cn nil $sans (int .Values.zitadel.systemUser.validityDays) }} |
There was a problem hiding this comment.
This template generates a fresh keypair via genSelfSignedCert whenever lookup cannot read an existing secret, and that output is also hashed into pod annotations (deployment_zitadel.yaml/deployment_login.yaml include this template for checksum/secret-system-user). In render-only environments (for example helm template or GitOps controllers that do not provide live lookup data), lookup stays empty on every reconcile, so the rendered Secret and checksum change every run, causing perpetual drift and repeated rollouts with the default zitadel.systemUser.enabled=true.
Useful? React with 👍 / 👎.
| {{- if lt $renewBeforeHours 24 }} | ||
| {{- $renewBeforeHours = 24 }} |
There was a problem hiding this comment.
When validityDays is set to 1, duration becomes 24h, but the minimum clamp here forces renewBefore to 24h as well. That produces an invalid cert-manager Certificate spec because renewal must be scheduled before expiration (renewBefore < duration), so cert issuance fails and the mounted system-user secret is never created.
Useful? React with 👍 / 👎.
Qodana for Go5 new problems were found
💡 Qodana analysis was run in the pull request mode: only the changed files were checked Contact Qodana teamContact us at [email protected]
|
1 participant
Definition of Ready