Error when installing with FirstInstance

[firstdorsal]

Hi!
I want to configure the first instance to use a specific admin password, I looked through the documentation and figured it should work like this:

# values.yaml
replicaCount: 1
zitadel:
    masterkeySecretName: "zitadel-masterkey"
    configSecretName: zitadel-config
    configSecretKey: config.yaml

# config.yaml coming from the opaque secret `zitadel-config`
ExternalSecure: true
ExternalDomain: zitadel.vindelicorum.eu
TLS:
    Enabled: false
FirstInstance:
    Org:
        Name: ZITADEL
        Human:
            UserName: zitadel-admin
            Password: "Zvpj9rdjKuy35syuAOmGtuvNa76MyPKPJAjZ5i4jaHcvUtCy1kYpaxynHTDI6NlgCkR4DarFbpNEYlXFnN0rpk46kwDvxScunvJM"
Database:
    Postgres:
        Host: zitadel-postgres-rw
        Port: 5432
        Database: zitadel
        MaxOpenConns: 20
        MaxIdleConns: 10
        MaxConnLifetime: 30m
        MaxConnIdleTime: 5m
        User:
            Username: zitadel
            Password: "8GJHD4M3EgKUFPdOqmYY3XIpJ4DwCApn7H6DVrnqvAIgrk7rEtBg4bQrDAD56CdAArHSCzDvQFtK3BQE3pgwXTkrq2Gr5rCU5Oy8"
            SSL:
                Mode: disable
        Admin:
            Username: postgres
            Password: "4XFJWrT06QYA0IshErSvvN5tSByWcI5BQcAhx12d2BU5Xcyvw2AzqHYKBfMVonoOxRYuwGZouYxDHDCNclJRFQowpGViYKuJJkp2"
            SSL:
                Mode: disable

Without the FirstInstance section this works like expected. With the section the setup pod fails and logs:

time="2025-01-29T22:00:48Z" level=info msg="setup started" caller="/home/runner/work/zitadel/zitadel/cmd/setup/setup.go:101"
time="2025-01-29T22:00:48Z" level=info msg="verify migration" caller="/home/runner/work/zitadel/zitadel/internal/migration/migration.go:43" name=14_events_push
time="2025-01-29T22:00:48Z" level=info msg="query failed" caller="/home/runner/work/zitadel/zitadel/internal/eventstore/repository/sql/query.go:141" error="ERROR: relation \"eventstore.events2\" does not exist (SQLSTATE 42P01)"
time="2025-01-29T22:00:48Z" level=info msg="query failed" caller="/home/runner/work/zitadel/zitadel/internal/eventstore/repository/sql/query.go:141" error="ERROR: relation \"eventstore.events\" does not exist (SQLSTATE 42P01)"
time="2025-01-29T22:00:48Z" level=info msg="verify migration" caller="/home/runner/work/zitadel/zitadel/internal/migration/migration.go:43" name=40_init_push_func_v2
time="2025-01-29T22:00:48Z" level=info msg="query failed" caller="/home/runner/work/zitadel/zitadel/internal/eventstore/repository/sql/query.go:141" error="ERROR: relation \"eventstore.events2\" does not exist (SQLSTATE 42P01)"
time="2025-01-29T22:00:48Z" level=info msg="query failed" caller="/home/runner/work/zitadel/zitadel/internal/eventstore/repository/sql/query.go:141" error="ERROR: relation \"eventstore.events\" does not exist (SQLSTATE 42P01)"
time="2025-01-29T22:00:48Z" level=fatal msg="migration failed" caller="/home/runner/work/zitadel/zitadel/cmd/setup/setup.go:269" error="ID=SQL-KyeAx Message=unable to filter events Parent=(ERROR: relation \"eventstore.events\" does not exist (SQLSTATE 42P01))" name=40_init_push_func_v2

Init then succeeds but the server logs:

 _____  ___   _____      _      ____    _____   _
 |__  / |_ _| |_   _|    / \    |  _ \  | ____| | |
   / /   | |    | |     / _ \   | | | | |  _|   | |
  / /_   | |    | |    / ___ \  | |_| | | |___  | |___
 /____| |___|   |_|   /_/   \_\ |____/  |_____| |_____|
 ===============================================================
 Version           : v2.67.2
 TLS enabled       : false
 External Secure  : true
 Machine Id Method : Private Ip
 Console URL       : https://zitadel.vindelicorum.eu:8080/ui/console
 Health Check URL  : https://zitadel.vindelicorum.eu:8080/debug/healthz
 ===============================================================
time="2025-01-29T22:02:22Z" level=info msg="auth request cache disabled" caller="/home/runner/work/zitadel/zitadel/internal/auth_request/repository/cache/cache.go:31" error="must provide a positive size"
time="2025-01-29T22:02:22Z" level=info msg="auth request cache disabled" caller="/home/runner/work/zitadel/zitadel/internal/auth_request/repository/cache/cache.go:36" error="must provide a positive size"
time=2025-01-29T22:02:22.516Z level=INFO msg="registered route" endpoint=/oauth/v2/authorize
time=2025-01-29T22:02:22.516Z level=INFO msg="registered route" endpoint=/oauth/v2/device_authorization
time=2025-01-29T22:02:22.516Z level=INFO msg="registered route" endpoint=/oauth/v2/token
time=2025-01-29T22:02:22.516Z level=INFO msg="registered route" endpoint=/oauth/v2/introspect
time=2025-01-29T22:02:22.516Z level=INFO msg="registered route" endpoint=/oidc/v1/userinfo
time=2025-01-29T22:02:22.516Z level=INFO msg="registered route" endpoint=/oauth/v2/revoke
time=2025-01-29T22:02:22.516Z level=INFO msg="registered route" endpoint=/oidc/v1/end_session
time=2025-01-29T22:02:22.516Z level=INFO msg="registered route" endpoint=/oauth/v2/keys
Error: unable to start login: start cache: ERROR: schema "cache" does not exist (SQLSTATE 3F000)
Usage:
  zitadel start [flags]
Flags:
      --externalDomain string    domain ZITADEL will be exposed on
      --externalPort string      port ZITADEL will be exposed on
  -h, --help                     help for start
      --masterkey string         masterkey as argument for en/decryption keys
  -m, --masterkeyFile string     path to the masterkey for en/decryption keys
      --masterkeyFromEnv         read masterkey for en/decryption keys from environment variable (ZITADEL_MASTERKEY)
      --port uint16              port to run ZITADEL on
      --tlsMode externalSecure   start ZITADEL with (enabled), without (disabled) TLS or external component e.g. reverse proxy (external) terminating TLS, this flag will overwrite externalSecure and `tls.enabled` in configs files
Global Flags:
      --config stringArray   path to config file to overwrite system defaults
Error: unable to start login: start cache: ERROR: schema "cache" does not exist (SQLSTATE 3F000)

For docker-compose it can be mounted as extra file but I don't see how this would be done with the chart.

Is there something missing in the docs here?

ChartVersion: 8.11.2

Without the FirstInstance section everything works as expected.

Thank you!

[fforootd]

Hm I think you need to pass the first instance settings as a steps and not as the config.

[firstdorsal]

It shows here that it is possible in the configmapConfig in the values file, but I don't want to have a password in there (The values file is commited to git), but provide it (and the whole config with all passwords) as a secret.

Can a secret be passed to the steps?

[firstdorsal]

The problem was that the password was too long and did not contain any special characters. When only missing special characters at least the error message makes sense, when it is too long it just fails with this strange database migration failure.