mirror of
https://github.com/zitadel/zitadel.git
synced 2026-07-25 18:28:00 +00:00
SilvanandGitHub
6d90a120a6
## Problem description - Setup currently creates/updates relational tables, but there is no built-in way to fully reset the relational schema during iterative development. - Re-running setup after schema/projection changes can leave stale relational objects and projection state behind, which makes local/dev validation harder. - There is no explicit, configurable switch in setup steps for destructive schema recreation behavior. ## How the Problems Are Solved - Adds a new setup step configuration section for relational tables with a `ShouldRecreateSchema` flag (default `false`). - Wires the new config flag into the transactional tables setup step. - Extends the transactional tables execution logic to optionally: - Drop the `zitadel` schema with `CASCADE` - Clean related projection state entries for relational tables in `projections.current_states` - Recreate tables through the existing setup flow afterward - Wraps the destructive operations in a transaction and keeps error/rollback handling plus logging for visibility. ## Additional Changes - Adds an explicit warning in step configuration that schema recreation is intended for development and not production use. - Keeps behavior fully backward-compatible by default (`ShouldRecreateSchema: false`), so existing setups are unchanged unless the flag is enabled. ## Additional Context - Follow-up for relational setup/dev workflow improvements. - PR: #11833 ## How to use it ### Env `export ZITADEL_RELATIONALTABLES_SHOULDRECREATESCHEMA=true` ### Config Add the following to your custom setup steps config: ```yaml RelationalTables: ShouldRecreateSchema: true ```
187 lines
11 KiB
YAML
187 lines
11 KiB
YAML
Instrumentation:
|
|
ServiceName: "zitadel-setup" # ZITADEL_INSTRUMENTATION_SERVICENAME
|
|
Trace:
|
|
Fraction: 1.0 # ZITADEL_INSTRUMENTATION_TRACE_FRACTION
|
|
# Trust incoming trace context from remote services for distributed tracing.
|
|
# Enable only in controlled environments; defaults to false for security.
|
|
TrustRemoteSpans: false # ZITADEL_INSTRUMENTATION_TRACE_TRUSTREMOTESPANS
|
|
Exporter:
|
|
# The following exporter types are supported:
|
|
# "none": Disables trace exporting
|
|
# "stdOut": Exports traces to standard output
|
|
# "stdErr": Exports traces to standard error
|
|
# "grpc": Exports traces using the OTEL gRPC exporter (recommended)
|
|
# "http": Exports traces using the OTEL HTTP exporter
|
|
# "google": Exports traces to Google Cloud. Need to configure GoogleProjectID below!
|
|
Type: "none" # ZITADEL_INSTRUMENTATION_TRACE_EXPORTER_TYPE
|
|
# Endpoint of the OTEL collector for grpc and http exporters
|
|
Endpoint: "" # ZITADEL_INSTRUMENTATION_TRACE_EXPORTER_ENDPOINT
|
|
# Disable TLS for grpc and http exporters
|
|
Insecure: false # ZITADEL_INSTRUMENTATION_TRACE_EXPORTER_INSECURE
|
|
# Interval for batching traces before export
|
|
BatchDuration: 1s # ZITADEL_INSTRUMENTATION_TRACE_EXPORTER_BATCHDURATION
|
|
# Project ID for Google Cloud Trace exporter
|
|
GoogleProjectID: "" # ZITADEL_INSTRUMENTATION_TRACE_EXPORTER_GOOGLEPROJECTID
|
|
Metric:
|
|
Exporter:
|
|
# The following exporter types are supported:
|
|
# "none": Disables metric exporting
|
|
# "stdOut": Exports metrics to standard output
|
|
# "stdErr": Exports metrics to standard error
|
|
# "grpc": Exports metrics using the OTEL gRPC exporter (recommended)
|
|
# "http": Exports metrics using the OTEL HTTP exporter
|
|
# "google": Exports metrics to Google Cloud. Need to configure GoogleProjectID below!
|
|
# "prometheus": Exposes metrics via an HTTP endpoint for Prometheus to scrape
|
|
Type: "none" # ZITADEL_INSTRUMENTATION_METRIC_EXPORTER_TYPE
|
|
# Endpoint of the OTEL collector for grpc and http exporters
|
|
Endpoint: "" # ZITADEL_INSTRUMENTATION_METRIC_EXPORTER_ENDPOINT
|
|
# Disable TLS for grpc and http exporters
|
|
Insecure: false # ZITADEL_INSTRUMENTATION_METRIC_EXPORTER_INSECURE
|
|
# Interval at which metrics are exported
|
|
BatchDuration: 1m # ZITADEL_INSTRUMENTATION_METRIC_EXPORTER_BATCHDURATION
|
|
# Project ID for Google Cloud Trace exporter
|
|
GoogleProjectID: "" # ZITADEL_INSTRUMENTATION_METRIC_EXPORTER_GOOGLEPROJECTID
|
|
|
|
# Structured logging can print logs on standard error and/or export them using OTEL.
|
|
Log:
|
|
# Log lines lower than this level are not emitted.
|
|
Level: "INFO" # ZITADEL_INSTRUMENTATION_LOG_LEVEL
|
|
# Streams enable logging for specific parts of the application.
|
|
Streams: # ZITADEL_INSTRUMENTATION_LOG_STREAMS (comma separated list)
|
|
- runtime # General runtime logs, such as startup and shutdown messages.
|
|
- ready # Logs related to readiness and health checks. (zitadel ready command)
|
|
- request # Logs for incoming API and HTTP requests.
|
|
- event_handler # Logs for event handling in projections.
|
|
- queue # Logs for the job queue processing.
|
|
# - event_pusher # Logs for event pushing to the database. Warning: contains sensitive information.
|
|
# Mask replaces sensitive information with Value in logs matched by Key
|
|
Mask:
|
|
# Keys are the attribute keys to be masked in logs.
|
|
# Keys are unqualified attribute names and apply to all attributes with the specified name,
|
|
# regardless of their position in the attribute hierarchy.
|
|
# Eg. "some_key" matches "some_key" and "parent.some_key" etc.
|
|
# When the key matches a group of attributes (e.g. slog.Group), all attribute values in the
|
|
# group are masked and the structure of the group is preserved.
|
|
# When the key matches a non-group attribute whose value is a nested object/array
|
|
# (e.g. added via slog.Any), the entire value is replaced with Value and its structure is not preserved.
|
|
Keys: # ZITADEL_INSTRUMENTATION_LOG_MASK_KEYS (comma separated list)
|
|
# - "first_name"
|
|
# - "last_name"
|
|
# Value is the string that replaces the original value of masked attributes.
|
|
Value: "****" # ZITADEL_INSTRUMENTATION_LOG_MASK_VALUE
|
|
# Enable printing structured logs to standard error in the specified format.
|
|
# When disabled, the legacy Log configuration is used.
|
|
# Important: when legacy Log is customized, please add a format and customize before upgrading to v5
|
|
# The following formats are supported:
|
|
# - "disabled": Disables logging (or fallback to legacy Log config)
|
|
# - "text": Logs are printed on StdErr as human-readable text
|
|
# - "json": Logs are printed on StdErr as JSON objects
|
|
# - "gcp": JSON formatted logs compatible with Google Cloud Platform logging.
|
|
# - "gcp_error_reporting": JSON formatted logs compatible with Google Cloud Platform Error Reporting.
|
|
Format: "disabled" # ZITADEL_INSTRUMENTATION_LOG_STDERR
|
|
# Adds the source file and line number where the log line was emitted.
|
|
# Not to be confused with the source of an error.
|
|
AddSource: true # ZITADEL_INSTRUMENTATION_LOG_ADDSOURCE
|
|
# Configure how errors are logged.
|
|
Errors:
|
|
# Adds the source file, line number and function where the error was created.
|
|
ReportLocation: true # ZITADEL_INSTRUMENTATION_LOG_ERRORS_REPORTLOCATION
|
|
# Adds stack traces to logged errors.
|
|
StackTrace: false # ZITADEL_INSTRUMENTATION_LOG_ERRORS_STACKTRACE
|
|
Exporter:
|
|
# The following exporter types are supported:
|
|
# - "none": Disables OTEL log exporter
|
|
# - "stdOut": Exports OTEL logs to standard output
|
|
# - "stdErr": Exports OTEL logs to standard error
|
|
# - "grpc": Exports OTEL logs using the OTEL gRPC exporter (recommended)
|
|
# - "http": Exports OTEL logs using the OTEL HTTP exporter
|
|
Type: "none" # ZITADEL_INSTRUMENTATION_LOG_EXPORTER_TYPE
|
|
# Endpoint of the OTEL collector for grpc and http exporters
|
|
Endpoint: "" # ZITADEL_INSTRUMENTATION_LOG_EXPORTER_ENDPOINT
|
|
# Disable TLS for grpc and http exporters
|
|
Insecure: false # ZITADEL_INSTRUMENTATION_LOG_EXPORTER_INSECURE
|
|
# Interval at which metrics are exported
|
|
BatchDuration: 1s # ZITADEL_INSTRUMENTATION_LOG_EXPORTER_BATCHDURATION
|
|
Profile:
|
|
Exporter:
|
|
# The following profiler types are supported:
|
|
# "none": Disables profiling
|
|
# "google": Exports profiling data to Google Cloud Profiler
|
|
Type: "none" # ZITADEL_INSTRUMENTATION_PROFILE_TYPE
|
|
# Project ID for Google Cloud Profiler
|
|
GoogleProjectID: "" # ZITADEL_INSTRUMENTATION_PROFILE_GOOGLEPROJECTID
|
|
|
|
# By using the FirstInstance section, you can overwrite the DefaultInstance configuration for the first instance created by zitadel setup.
|
|
FirstInstance:
|
|
# If set to true zitadel is setup without initial data
|
|
Skip: false
|
|
# The machine key from the section FirstInstance.Org.Machine.MachineKey is written to the MachineKeyPath.
|
|
MachineKeyPath: # ZITADEL_FIRSTINSTANCE_MACHINEKEYPATH
|
|
# The personal access token from the section FirstInstance.Org.Machine.Pat is written to the PatPath.
|
|
PatPath: # ZITADEL_FIRSTINSTANCE_PATPATH
|
|
LoginClientPatPath: # ZITADEL_FIRSTINSTANCE_LOGINCLIENTPATPATH
|
|
InstanceName: ZITADEL # ZITADEL_FIRSTINSTANCE_INSTANCENAME
|
|
# A list of trusted domains, which are allowed to be used for public responses like email links or when running
|
|
# ZITADEL or the login UI behind a reverse proxy. If no trusted domain is set, the instance domain is used.
|
|
TrustedDomains: # ZITADEL_FIRSTINSTANCE_TRUSTEDDOMAINS
|
|
# - login.example.com
|
|
# - api.example.com
|
|
DefaultLanguage: en # ZITADEL_FIRSTINSTANCE_DEFAULTLANGUAGE
|
|
Org:
|
|
Name: ZITADEL # ZITADEL_FIRSTINSTANCE_ORG_NAME
|
|
# In the FirstInstance.Org.Human section, the initial organization's admin user with the role IAM_OWNER is defined.
|
|
# If FirstInstance.Org.Machine.Machine is defined, a service account is created with the IAM_OWNER role.
|
|
Human:
|
|
# In case UserLoginMustBeDomain is false (default) and you don't overwrite the username with an email,
|
|
# it will be suffixed by the Organization Domain (org-name + domain from config).
|
|
# for example zitadel-admin in org ZITADEL on domain.tld -> zitadel-admin@zitadel.domain.tld
|
|
UserName: zitadel-admin # ZITADEL_FIRSTINSTANCE_ORG_HUMAN_USERNAME
|
|
FirstName: ZITADEL # ZITADEL_FIRSTINSTANCE_ORG_HUMAN_FIRSTNAME
|
|
LastName: Admin # ZITADEL_FIRSTINSTANCE_ORG_HUMAN_LASTNAME
|
|
NickName: # ZITADEL_FIRSTINSTANCE_ORG_HUMAN_NICKNAME
|
|
DisplayName: # ZITADEL_FIRSTINSTANCE_ORG_HUMAN_DISPLAYNAME
|
|
Email:
|
|
# uses the username if empty
|
|
Address: # ZITADEL_FIRSTINSTANCE_ORG_HUMAN_EMAIL_ADDRESS
|
|
Verified: true # ZITADEL_FIRSTINSTANCE_ORG_HUMAN_EMAIL_VERIFIED
|
|
PreferredLanguage: en # ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PREFERREDLANGUAGE
|
|
Gender: # ZITADEL_FIRSTINSTANCE_ORG_HUMAN_GENDER
|
|
Phone:
|
|
Number: # ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PHONE_NUMBER
|
|
Verified: # ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PHONE_VERIFIED
|
|
Password: Password1! # ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PASSWORD
|
|
PasswordChangeRequired: true # ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PASSWORDCHANGEREQUIRED
|
|
# In the FirstInstance.Org.Machine section, the initial organization's admin user with the role IAM_OWNER is defined.
|
|
# If FirstInstance.Org.Machine.Machine is defined, a service account is created with the IAM_OWNER role.
|
|
Machine:
|
|
Machine:
|
|
Username: # ZITADEL_FIRSTINSTANCE_ORG_MACHINE_MACHINE_USERNAME
|
|
Name: # ZITADEL_FIRSTINSTANCE_ORG_MACHINE_MACHINE_NAME
|
|
MachineKey:
|
|
# date format: 2023-01-01T00:00:00Z
|
|
ExpirationDate: # ZITADEL_FIRSTINSTANCE_ORG_MACHINE_MACHINEKEY_EXPIRATIONDATE
|
|
# Currently, the only supported value is 1 for JSON
|
|
Type: # ZITADEL_FIRSTINSTANCE_ORG_MACHINE_MACHINEKEY_TYPE
|
|
Pat:
|
|
# date format: 2023-01-01T00:00:00Z
|
|
ExpirationDate: # ZITADEL_FIRSTINSTANCE_ORG_MACHINE_PAT_EXPIRATIONDATE
|
|
LoginClient:
|
|
Machine:
|
|
Username: # ZITADEL_FIRSTINSTANCE_ORG_LOGINCLIENT_MACHINE_USERNAME
|
|
Name: # ZITADEL_FIRSTINSTANCE_ORG_LOGINCLIENT_MACHINE_NAME
|
|
Pat:
|
|
# date format: 2023-01-01T00:00:00Z
|
|
ExpirationDate: # ZITADEL_FIRSTINSTANCE_ORG_LOGINCLIENT_PAT_EXPIRATIONDATE
|
|
|
|
CorrectCreationDate:
|
|
FailAfter: 5m # ZITADEL_CORRECTCREATIONDATE_FAILAFTER
|
|
|
|
AddEventCreatedAt:
|
|
BulkAmount: 100 # ZITADEL_ADDEVENTCREATEDAT_BULKAMOUNT
|
|
|
|
FillFields:
|
|
BatchSize: 1000 # ZITADEL_EVENTSTORE_FILLFIELDS_BULKLIMIT
|
|
|
|
RelationalTables:
|
|
# This is used for development DO NOT USE IN PRODUCTION
|
|
ShouldRecreateSchema: false # ZITADEL_RELATIONALTABLES_SHOULDRECREATESCHEMA |