Error when installing with FirstInstance

[firstdorsal]

Hi!
I want to configure the first instance to use a specific admin password, I looked through the documentation and figured it should work like this:

# values.yaml
replicaCount: 1
zitadel:
    masterkeySecretName: "zitadel-masterkey"
    configSecretName: zitadel-config
    configSecretKey: config.yaml

# config.yaml coming from the opaque secret `zitadel-config`
ExternalSecure: true
ExternalDomain: zitadel.vindelicorum.eu
TLS:
    Enabled: false
FirstInstance:
    Org:
        Name: ZITADEL
        Human:
            UserName: zitadel-admin
            Password: "Zvpj9rdjKuy35syuAOmGtuvNa76MyPKPJAjZ5i4jaHcvUtCy1kYpaxynHTDI6NlgCkR4DarFbpNEYlXFnN0rpk46kwDvxScunvJM"
Database:
    Postgres:
        Host: zitadel-postgres-rw
        Port: 5432
        Database: zitadel
        MaxOpenConns: 20
        MaxIdleConns: 10
        MaxConnLifetime: 30m
        MaxConnIdleTime: 5m
        User:
            Username: zitadel
            Password: "8GJHD4M3EgKUFPdOqmYY3XIpJ4DwCApn7H6DVrnqvAIgrk7rEtBg4bQrDAD56CdAArHSCzDvQFtK3BQE3pgwXTkrq2Gr5rCU5Oy8"
            SSL:
                Mode: disable
        Admin:
            Username: postgres
            Password: "4XFJWrT06QYA0IshErSvvN5tSByWcI5BQcAhx12d2BU5Xcyvw2AzqHYKBfMVonoOxRYuwGZouYxDHDCNclJRFQowpGViYKuJJkp2"
            SSL:
                Mode: disable

Without the FirstInstance section this works like expected. With the section the setup pod fails and logs:

time="2025-01-29T22:00:48Z" level=info msg="setup started" caller="/home/runner/work/zitadel/zitadel/cmd/setup/setup.go:101"
time="2025-01-29T22:00:48Z" level=info msg="verify migration" caller="/home/runner/work/zitadel/zitadel/internal/migration/migration.go:43" name=14_events_push
time="2025-01-29T22:00:48Z" level=info msg="query failed" caller="/home/runner/work/zitadel/zitadel/internal/eventstore/repository/sql/query.go:141" error="ERROR: relation \"eventstore.events2\" does not exist (SQLSTATE 42P01)"
time="2025-01-29T22:00:48Z" level=info msg="query failed" caller="/home/runner/work/zitadel/zitadel/internal/eventstore/repository/sql/query.go:141" error="ERROR: relation \"eventstore.events\" does not exist (SQLSTATE 42P01)"
time="2025-01-29T22:00:48Z" level=info msg="verify migration" caller="/home/runner/work/zitadel/zitadel/internal/migration/migration.go:43" name=40_init_push_func_v2
time="2025-01-29T22:00:48Z" level=info msg="query failed" caller="/home/runner/work/zitadel/zitadel/internal/eventstore/repository/sql/query.go:141" error="ERROR: relation \"eventstore.events2\" does not exist (SQLSTATE 42P01)"
time="2025-01-29T22:00:48Z" level=info msg="query failed" caller="/home/runner/work/zitadel/zitadel/internal/eventstore/repository/sql/query.go:141" error="ERROR: relation \"eventstore.events\" does not exist (SQLSTATE 42P01)"
time="2025-01-29T22:00:48Z" level=fatal msg="migration failed" caller="/home/runner/work/zitadel/zitadel/cmd/setup/setup.go:269" error="ID=SQL-KyeAx Message=unable to filter events Parent=(ERROR: relation \"eventstore.events\" does not exist (SQLSTATE 42P01))" name=40_init_push_func_v2

Init then succeeds but the server logs:

 _____  ___   _____      _      ____    _____   _
 |__  / |_ _| |_   _|    / \    |  _ \  | ____| | |
   / /   | |    | |     / _ \   | | | | |  _|   | |
  / /_   | |    | |    / ___ \  | |_| | | |___  | |___
 /____| |___|   |_|   /_/   \_\ |____/  |_____| |_____|
 ===============================================================
 Version           : v2.67.2
 TLS enabled       : false
 External Secure  : true
 Machine Id Method : Private Ip
 Console URL       : https://zitadel.vindelicorum.eu:8080/ui/console
 Health Check URL  : https://zitadel.vindelicorum.eu:8080/debug/healthz
 ===============================================================
time="2025-01-29T22:02:22Z" level=info msg="auth request cache disabled" caller="/home/runner/work/zitadel/zitadel/internal/auth_request/repository/cache/cache.go:31" error="must provide a positive size"
time="2025-01-29T22:02:22Z" level=info msg="auth request cache disabled" caller="/home/runner/work/zitadel/zitadel/internal/auth_request/repository/cache/cache.go:36" error="must provide a positive size"
time=2025-01-29T22:02:22.516Z level=INFO msg="registered route" endpoint=/oauth/v2/authorize
time=2025-01-29T22:02:22.516Z level=INFO msg="registered route" endpoint=/oauth/v2/device_authorization
time=2025-01-29T22:02:22.516Z level=INFO msg="registered route" endpoint=/oauth/v2/token
time=2025-01-29T22:02:22.516Z level=INFO msg="registered route" endpoint=/oauth/v2/introspect
time=2025-01-29T22:02:22.516Z level=INFO msg="registered route" endpoint=/oidc/v1/userinfo
time=2025-01-29T22:02:22.516Z level=INFO msg="registered route" endpoint=/oauth/v2/revoke
time=2025-01-29T22:02:22.516Z level=INFO msg="registered route" endpoint=/oidc/v1/end_session
time=2025-01-29T22:02:22.516Z level=INFO msg="registered route" endpoint=/oauth/v2/keys
Error: unable to start login: start cache: ERROR: schema "cache" does not exist (SQLSTATE 3F000)
Usage:
  zitadel start [flags]
Flags:
      --externalDomain string    domain ZITADEL will be exposed on
      --externalPort string      port ZITADEL will be exposed on
  -h, --help                     help for start
      --masterkey string         masterkey as argument for en/decryption keys
  -m, --masterkeyFile string     path to the masterkey for en/decryption keys
      --masterkeyFromEnv         read masterkey for en/decryption keys from environment variable (ZITADEL_MASTERKEY)
      --port uint16              port to run ZITADEL on
      --tlsMode externalSecure   start ZITADEL with (enabled), without (disabled) TLS or external component e.g. reverse proxy (external) terminating TLS, this flag will overwrite externalSecure and `tls.enabled` in configs files
Global Flags:
      --config stringArray   path to config file to overwrite system defaults
Error: unable to start login: start cache: ERROR: schema "cache" does not exist (SQLSTATE 3F000)

For docker-compose it can be mounted as extra file but I don't see how this would be done with the chart.

Is there something missing in the docs here?

ChartVersion: 8.11.2

Without the FirstInstance section everything works as expected.

Thank you!

[fforootd]

Hm I think you need to pass the first instance settings as a steps and not as the config.

[firstdorsal]

It shows here that it is possible in the configmapConfig in the values file, but I don't want to have a password in there (The values file is commited to git), but provide it (and the whole config with all passwords) as a secret.

Can a secret be passed to the steps?