Failing to create FirstInstance user

[anthonyoteri]

I'm trying to follow the examples about adding a machine user when deploying Zitadel, but every time I've tried, the user is not actually created. I was able to follow the example verbatim and that worked, yet, when I try to use a custom configuration, the user is never created.

Here is my current config. As far as I can tell, it should be identical to the example with the only change being the database connection information.

zitadel:
  masterkey: x123456789012345678901234567891y
  configmapConfig:
    ExternalSecure: false
    ExternalDomain: 127.0.0.1.sslip.io
    TLS:
      Enabled: false
    FirstInstance:
      Org:
        Machine:
          Machine:
            Username: zitadel-admin-sa
            Name: Admin
          MachineKey:
            ExpirationDate: "2026-01-01T00:00:00Z"
            # Type: 1 means JSON. This is currently the only supported machine key type.
            Type: 1
        # PAT:
        #   ExpirationDate: "2026-01-01T00:00:00Z"
    Database:
      Postgres:
        Host: postgresql
        Port: 5432
        Database: zitadel
        MaxOpenConns: 20
        MaxIdleConns: 10
        MaxConnLifetime: 30m
        MaxConnIdleTime: 5m
        User:
          Username: postgres
          SSL:
            Mode: disable
        Admin:
          Username: postgres
          SSL:
            Mode: disable

I'm attempting to examine the K8s secrets to find the machine-key however no secret is being created here. Upon digging further into why the key wasn't written, I've discovered that the user isn't actually even being created. Neither a human user nor a Machine user are created. I've tried removing everything and starting from scratch, including completely rebuilding the Kubernetes cluster (I'm using minikube so that is trivial), as well as using a different computer all together.

I'm assuming this is something very simple, like a small syntax error or something of that nature, but I've spent several days on this trying to troubleshoot to no avail. This is sort of a last ditch effort here, as the backup plan will be configure everything using environment variables which is far less than ideal, but at least it works.

For reference, here is the configmap that gets created.

Name:         zitadel-config-yaml
Namespace:    default
Labels:       app.kubernetes.io/instance=zitadel
              app.kubernetes.io/managed-by=Helm
              app.kubernetes.io/name=zitadel
              app.kubernetes.io/version=v2.67.2
              helm.sh/chart=zitadel-8.11.2
Annotations:  helm.sh/hook: pre-install,pre-upgrade
              helm.sh/hook-delete-policy: before-hook-creation
              helm.sh/hook-weight: 0

Data
====
zitadel-config-yaml:
----

Database:
  Postgres:
    Admin:
      SSL:
        Mode: disable
      Username: postgres
    Database: zitadel
    Host: postgresql
    MaxConnIdleTime: 5m
    MaxConnLifetime: 30m
    MaxIdleConns: 10
    MaxOpenConns: 20
    Port: 5432
    User:
      SSL:
        Mode: disable
      Username: postgres
ExternalDomain: 127.0.0.1.sslip.io
ExternalSecure: false
FirstInstance:
  Org:
    Machine:
      Machine:
        Name: Admin
        Username: zitadel-admin-sa
      MachineKey:
        ExpirationDate: "2026-01-01T00:00:00Z"
        Type: 1
Machine:
  Identification:
    Hostname:
      Enabled: true
    Webhook:
      Enabled: false
TLS:
  Enabled: false


BinaryData
====

Events:  <none>

And the list of secrets

❯ kubectl get secret
NAME                               TYPE                 DATA   AGE
postgresql                         Opaque               1      107s
sh.helm.release.v1.postgresql.v1   helm.sh/release.v1   1      107s
sh.helm.release.v1.zitadel.v1      helm.sh/release.v1   1      103s
zitadel-masterkey                  Opaque               1      103s