aaron/infra-core
1
0
Fork 2
Code Issues Pull requests 12 Projects Releases 1 Packages Wiki Activity Actions

chore(zitadel): rotate Outline OIDC client secret (HOMELAB-1414) #406

Open
aaron wants to merge 3 commits from chore/zitadel-oidc-rotate-outline into live
pull from: chore/zitadel-oidc-rotate-outline
merge into: aaron:live
Conversation 11 Commits 3 Files changed 4 +52 -2
aaron commented 2026-07-16 20:05:58 +00:00
Owner
Copy link

Forces replacement of the zitadel_application_oidc.outline resource to generate a new client_id / client_secret pair.

  • Changes display name from Outline to Outline-Rotated to trigger replacement.
  • Adds lifecycle { create_before_destroy = true } to create the new app before destroying the old one, minimizing SSO downtime.
  • The Outline Helm chart consumes outline-credentials (SopsSecret), so a follow-up PR in the homelab repo will copy the new credentials into that secret and roll the pods.

Terraform 1.9.8 / provider 3.3.0 do not support the ephemeral zitadel_application_oidc_client_secret resource (requires Terraform 1.10+), so replacement is the available rotation path.

Ticket: HOMELAB-1414

Forces replacement of the `zitadel_application_oidc.outline` resource to generate a new `client_id` / `client_secret` pair. - Changes display name from `Outline` to `Outline-Rotated` to trigger replacement. - Adds `lifecycle { create_before_destroy = true }` to create the new app before destroying the old one, minimizing SSO downtime. - The Outline Helm chart consumes `outline-credentials` (SopsSecret), so a follow-up PR in the `homelab` repo will copy the new credentials into that secret and roll the pods. Terraform 1.9.8 / provider 3.3.0 do not support the ephemeral `zitadel_application_oidc_client_secret` resource (requires Terraform 1.10+), so replacement is the available rotation path. Ticket: HOMELAB-1414
chore(zitadel): force replacement of Outline OIDC app to rotate client secret (HOMELAB-1414)
Some checks failed
CI Review / pr-title (pull_request) Failing after 0s
Details
0/1 projects planned successfully.
CI Review / helm-validate (pull_request) Successful in 32s
Details
CI Review / ai-review (pull_request) Failing after 4s
Details
Lint & Validate / terraform-validate (pull_request) Successful in 1m53s
Details
Lint & Validate / yaml-lint (pull_request) Successful in 9s
Details
Lint & Validate / shellcheck (pull_request) Successful in 3s
Details
38063826c5
atlantis commented 2026-07-16 20:06:01 +00:00
Collaborator
Copy link

Ran Plan for dir: core/terraform/live/zitadel workspace: default

Plan Error

error downloading terraform version 1.15.8: unable to verify checksums signature: openpgp: key expired
Ran Plan for dir: `core/terraform/live/zitadel` workspace: `default` **Plan Error** ``` error downloading terraform version 1.15.8: unable to verify checksums signature: openpgp: key expired ```
chore(atlantis): pin zitadel project to terraform v1.9.8 (HOMELAB-1414)
Some checks failed
CI Review / pr-title (pull_request) Failing after 0s
Details
CI Review / helm-validate (pull_request) Successful in 5s
Details
CI Review / ai-review (pull_request) Failing after 4s
Details
Lint & Validate / terraform-validate (pull_request) Successful in 1m53s
Details
0/1 projects planned successfully.
Lint & Validate / yaml-lint (pull_request) Successful in 9s
Details
Lint & Validate / shellcheck (pull_request) Successful in 3s
Details
907af9a4d6
aaron commented 2026-07-16 20:10:58 +00:00
Author
Owner
Copy link

atlantis plan

atlantis plan
atlantis commented 2026-07-16 20:11:05 +00:00
Collaborator
Copy link

Ran Plan for dir: core/terraform/live/zitadel workspace: default

Plan Error

Show Output 
running 'sh -c' '/usr/local/bin/terraform1.9.8 init -input=false -upgrade' in '/atlantis-data/repos/aaron/infra-core/406/default/core/terraform/live/zitadel': exit status 1
Initializing the backend...
╷
│ Error: Missing Required Value
│ 
│   on versions.tf line 4, in terraform:
│    4:   backend "s3" {
│ 
│ The attribute "bucket" is required by the backend.
│ 
│ Refer to the backend documentation for additional information which
│ attributes are required.
╵
╷
│ Error: Missing Required Value
│ 
│   on versions.tf line 4, in terraform:
│    4:   backend "s3" {
│ 
│ The attribute "key" is required by the backend.
│ 
│ Refer to the backend documentation for additional information which
│ attributes are required.
╵
╷
│ Error: Missing region value
│ 
│   on versions.tf line 4, in terraform:
│    4:   backend "s3" {
│ 
│ The "region" attribute or the "AWS_REGION" or "AWS_DEFAULT_REGION"
│ environment variables must be set.
╵
Ran Plan for dir: `core/terraform/live/zitadel` workspace: `default` **Plan Error** <details><summary>Show Output</summary> ``` running 'sh -c' '/usr/local/bin/terraform1.9.8 init -input=false -upgrade' in '/atlantis-data/repos/aaron/infra-core/406/default/core/terraform/live/zitadel': exit status 1 Initializing the backend... ╷ │ Error: Missing Required Value │ │ on versions.tf line 4, in terraform: │ 4: backend "s3" { │ │ The attribute "bucket" is required by the backend. │ │ Refer to the backend documentation for additional information which │ attributes are required. ╵ ╷ │ Error: Missing Required Value │ │ on versions.tf line 4, in terraform: │ 4: backend "s3" { │ │ The attribute "key" is required by the backend. │ │ Refer to the backend documentation for additional information which │ attributes are required. ╵ ╷ │ Error: Missing region value │ │ on versions.tf line 4, in terraform: │ 4: backend "s3" { │ │ The "region" attribute or the "AWS_REGION" or "AWS_DEFAULT_REGION" │ environment variables must be set. ╵ ``` </details>
chore(atlantis): add zitadel backend.hcl + custom workflow for Atlantis (HOMELAB-1414)
Some checks failed
CI Review / pr-title (pull_request) Failing after 0s
Details
0/1 projects planned successfully.
CI Review / helm-validate (pull_request) Successful in 5s
Details
CI Review / ai-review (pull_request) Failing after 3s
Details
Lint & Validate / terraform-validate (pull_request) Successful in 2m10s
Details
Lint & Validate / yaml-lint (pull_request) Successful in 9s
Details
Lint & Validate / shellcheck (pull_request) Successful in 3s
Details
3e3278c9ca
aaron commented 2026-07-16 20:13:12 +00:00
Author
Owner
Copy link

atlantis plan

atlantis plan
atlantis commented 2026-07-16 20:13:14 +00:00
Collaborator
Copy link

Ran Plan for dir: core/terraform/live/zitadel workspace: default

Plan Error

running 'sh -c' '/usr/local/bin/terraform1.9.8 init -input=false -upgrade -backend-config=backend.hcl' in '/atlantis-data/repos/aaron/infra-core/406/default/core/terraform/live/zitadel': exit status 1
Initializing the backend...
╷
│ Error: Failed to read file
│ 
│ The file "backend.hcl" could not be read.
╵
Ran Plan for dir: `core/terraform/live/zitadel` workspace: `default` **Plan Error** ``` running 'sh -c' '/usr/local/bin/terraform1.9.8 init -input=false -upgrade -backend-config=backend.hcl' in '/atlantis-data/repos/aaron/infra-core/406/default/core/terraform/live/zitadel': exit status 1 Initializing the backend... ╷ │ Error: Failed to read file │ │ The file "backend.hcl" could not be read. ╵ ```
aaron force-pushed chore/zitadel-oidc-rotate-outline from 3e3278c9ca
Some checks failed
CI Review / pr-title (pull_request) Failing after 0s
Details
0/1 projects planned successfully.
CI Review / helm-validate (pull_request) Successful in 5s
Details
CI Review / ai-review (pull_request) Failing after 3s
Details
Lint & Validate / terraform-validate (pull_request) Successful in 2m10s
Details
Lint & Validate / yaml-lint (pull_request) Successful in 9s
Details
Lint & Validate / shellcheck (pull_request) Successful in 3s
Details
to bf677e3029
Some checks failed
Lint & Validate / yaml-lint (pull_request) Waiting to run
Details
Lint & Validate / shellcheck (pull_request) Waiting to run
Details
CI Review / pr-title (pull_request) Failing after 0s
Details
CI Review / helm-validate (pull_request) Successful in 5s
Details
CI Review / ai-review (pull_request) Failing after 3s
Details
0/1 projects planned successfully.
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
2026-07-16 20:16:04 +00:00 Compare
aaron commented 2026-07-16 20:16:06 +00:00
Author
Owner
Copy link

atlantis plan

atlantis plan
atlantis commented 2026-07-16 20:16:43 +00:00
Collaborator
Copy link

Ran Plan for dir: core/terraform/live/zitadel workspace: default

Plan Error

Show Output 
running 'sh -c' '/usr/local/bin/terraform1.9.8 plan -input=false -refresh -out "/atlantis-data/repos/aaron/infra-core/406/default/core/terraform/live/zitadel/zitadel-default.tfplan"' in '/atlantis-data/repos/aaron/infra-core/406/default/core/terraform/live/zitadel': exit status 1
╷
│ Error: No value for required variable
│ 
│   on variables.tf line 2:
│    2: variable "base_domain" {
│ 
│ The root module input variable "base_domain" is not set, and has no default
│ value. Use a -var or -var-file command line argument to provide a value for
│ this variable.
╵
╷
│ Error: No value for required variable
│ 
│   on variables.tf line 8:
│    8: variable "zitadel_org_id" {
│ 
│ The root module input variable "zitadel_org_id" is not set, and has no
│ default value. Use a -var or -var-file command line argument to provide a
│ value for this variable.
╵
╷
│ Error: No value for required variable
│ 
│   on variables.tf line 27:
│   27: variable "admin_email" {
│ 
│ The root module input variable "admin_email" is not set, and has no default
│ value. Use a -var or -var-file command line argument to provide a value for
│ this variable.
╵
╷
│ Error: No value for required variable
│ 
│   on variables.tf line 32:
│   32: variable "admin_first_name" {
│ 
│ The root module input variable "admin_first_name" is not set, and has no
│ default value. Use a -var or -var-file command line argument to provide a
│ value for this variable.
╵
╷
│ Error: No value for required variable
│ 
│   on variables.tf line 37:
│   37: variable "admin_last_name" {
│ 
│ The root module input variable "admin_last_name" is not set, and has no
│ default value. Use a -var or -var-file command line argument to provide a
│ value for this variable.
╵
Ran Plan for dir: `core/terraform/live/zitadel` workspace: `default` **Plan Error** <details><summary>Show Output</summary> ``` running 'sh -c' '/usr/local/bin/terraform1.9.8 plan -input=false -refresh -out "/atlantis-data/repos/aaron/infra-core/406/default/core/terraform/live/zitadel/zitadel-default.tfplan"' in '/atlantis-data/repos/aaron/infra-core/406/default/core/terraform/live/zitadel': exit status 1 ╷ │ Error: No value for required variable │ │ on variables.tf line 2: │ 2: variable "base_domain" { │ │ The root module input variable "base_domain" is not set, and has no default │ value. Use a -var or -var-file command line argument to provide a value for │ this variable. ╵ ╷ │ Error: No value for required variable │ │ on variables.tf line 8: │ 8: variable "zitadel_org_id" { │ │ The root module input variable "zitadel_org_id" is not set, and has no │ default value. Use a -var or -var-file command line argument to provide a │ value for this variable. ╵ ╷ │ Error: No value for required variable │ │ on variables.tf line 27: │ 27: variable "admin_email" { │ │ The root module input variable "admin_email" is not set, and has no default │ value. Use a -var or -var-file command line argument to provide a value for │ this variable. ╵ ╷ │ Error: No value for required variable │ │ on variables.tf line 32: │ 32: variable "admin_first_name" { │ │ The root module input variable "admin_first_name" is not set, and has no │ default value. Use a -var or -var-file command line argument to provide a │ value for this variable. ╵ ╷ │ Error: No value for required variable │ │ on variables.tf line 37: │ 37: variable "admin_last_name" { │ │ The root module input variable "admin_last_name" is not set, and has no │ default value. Use a -var or -var-file command line argument to provide a │ value for this variable. ╵ ``` </details>
aaron force-pushed chore/zitadel-oidc-rotate-outline from bf677e3029
Some checks failed
Lint & Validate / yaml-lint (pull_request) Waiting to run
Details
Lint & Validate / shellcheck (pull_request) Waiting to run
Details
CI Review / pr-title (pull_request) Failing after 0s
Details
CI Review / helm-validate (pull_request) Successful in 5s
Details
CI Review / ai-review (pull_request) Failing after 3s
Details
0/1 projects planned successfully.
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
to 01a2f9bc83
Some checks failed
CI Review / pr-title (pull_request) Failing after 0s
Details
CI Review / helm-validate (pull_request) Successful in 7s
Details
CI Review / ai-review (pull_request) Failing after 4s
Details
0/1 projects planned successfully.
Lint & Validate / terraform-validate (pull_request) Successful in 1m43s
Details
Lint & Validate / yaml-lint (pull_request) Successful in 13s
Details
Lint & Validate / shellcheck (pull_request) Successful in 3s
Details
2026-07-16 20:18:07 +00:00 Compare
aaron commented 2026-07-16 20:18:10 +00:00
Author
Owner
Copy link

atlantis plan

atlantis plan
atlantis commented 2026-07-16 20:18:33 +00:00
Collaborator
Copy link

Ran Plan for dir: core/terraform/live/zitadel workspace: default

Plan Error

Show Output 
running 'sh -c' '/usr/local/bin/terraform1.9.8 plan -input=false -refresh -out "/atlantis-data/repos/aaron/infra-core/406/default/core/terraform/live/zitadel/zitadel-default.tfplan"' in '/atlantis-data/repos/aaron/infra-core/406/default/core/terraform/live/zitadel': exit status 1
╷
│ Error: Write-only Attribute Not Allowed
│ 
│   with zitadel_human_user.admin,
│   on main.tf line 595, in resource "zitadel_human_user" "admin":
│  595:   initial_password  = random_password.initial_user_password.result
│ 
│ The resource contains a non-null value for write-only attribute
│ "initial_password" Write-only attributes are only supported in Terraform
│ 1.11 and later.
╵
╷
│ Error: Write-only Attribute Not Allowed
│ 
│   with zitadel_human_user.additional,
│   on main.tf line 631, in resource "zitadel_human_user" "additional":
│  631:   initial_password  = random_password.initial_user_password.result
│ 
│ The resource contains a non-null value for write-only attribute
│ "initial_password" Write-only attributes are only supported in Terraform
│ 1.11 and later.
╵
Ran Plan for dir: `core/terraform/live/zitadel` workspace: `default` **Plan Error** <details><summary>Show Output</summary> ``` running 'sh -c' '/usr/local/bin/terraform1.9.8 plan -input=false -refresh -out "/atlantis-data/repos/aaron/infra-core/406/default/core/terraform/live/zitadel/zitadel-default.tfplan"' in '/atlantis-data/repos/aaron/infra-core/406/default/core/terraform/live/zitadel': exit status 1 ╷ │ Error: Write-only Attribute Not Allowed │ │ with zitadel_human_user.admin, │ on main.tf line 595, in resource "zitadel_human_user" "admin": │ 595: initial_password = random_password.initial_user_password.result │ │ The resource contains a non-null value for write-only attribute │ "initial_password" Write-only attributes are only supported in Terraform │ 1.11 and later. ╵ ╷ │ Error: Write-only Attribute Not Allowed │ │ with zitadel_human_user.additional, │ on main.tf line 631, in resource "zitadel_human_user" "additional": │ 631: initial_password = random_password.initial_user_password.result │ │ The resource contains a non-null value for write-only attribute │ "initial_password" Write-only attributes are only supported in Terraform │ 1.11 and later. ╵ ``` </details>
aaron force-pushed chore/zitadel-oidc-rotate-outline from 01a2f9bc83
Some checks failed
CI Review / pr-title (pull_request) Failing after 0s
Details
CI Review / helm-validate (pull_request) Successful in 7s
Details
CI Review / ai-review (pull_request) Failing after 4s
Details
0/1 projects planned successfully.
Lint & Validate / terraform-validate (pull_request) Successful in 1m43s
Details
Lint & Validate / yaml-lint (pull_request) Successful in 13s
Details
Lint & Validate / shellcheck (pull_request) Successful in 3s
Details
to 91ee321f3d
Some checks failed
CI Review / pr-title (pull_request) Failing after 0s
Details
CI Review / helm-validate (pull_request) Successful in 6s
Details
CI Review / ai-review (pull_request) Failing after 4s
Details
0/1 projects planned successfully.
Lint & Validate / yaml-lint (pull_request) Successful in 25s
Details
Lint & Validate / shellcheck (pull_request) Successful in 3s
Details
Lint & Validate / terraform-validate (pull_request) Failing after 14m19s
Details
2026-07-16 20:21:12 +00:00 Compare
aaron commented 2026-07-16 20:21:14 +00:00
Author
Owner
Copy link

atlantis plan

atlantis plan
atlantis commented 2026-07-16 20:21:37 +00:00
Collaborator
Copy link

Ran Plan for dir: core/terraform/live/zitadel workspace: default

Plan Error

Show Output 
running 'sh -c' '/usr/local/bin/terraform plan -input=false -refresh -out "/atlantis-data/repos/aaron/infra-core/406/default/core/terraform/live/zitadel/zitadel-default.tfplan"' in '/atlantis-data/repos/aaron/infra-core/406/default/core/terraform/live/zitadel': exit status 1
random_password.initial_user_password: Refreshing state... [id=none]
random_password.radarr_oauth2_cookie_secret: Refreshing state... [id=none]
random_password.sonarr_oauth2_cookie_secret: Refreshing state... [id=none]
random_password.bazarr_oauth2_cookie_secret: Refreshing state... [id=none]
random_password.prowlarr_oauth2_cookie_secret: Refreshing state... [id=none]

Planning failed. Terraform encountered an error while generating this plan.

╷
│ Error: one authentication method must be configured
│ 
│   with provider["registry.terraform.io/zitadel/zitadel"],
│   on main.tf line 34, in provider "zitadel":
│   34: provider "zitadel" {
│ 
╵
Ran Plan for dir: `core/terraform/live/zitadel` workspace: `default` **Plan Error** <details><summary>Show Output</summary> ``` running 'sh -c' '/usr/local/bin/terraform plan -input=false -refresh -out "/atlantis-data/repos/aaron/infra-core/406/default/core/terraform/live/zitadel/zitadel-default.tfplan"' in '/atlantis-data/repos/aaron/infra-core/406/default/core/terraform/live/zitadel': exit status 1 random_password.initial_user_password: Refreshing state... [id=none] random_password.radarr_oauth2_cookie_secret: Refreshing state... [id=none] random_password.sonarr_oauth2_cookie_secret: Refreshing state... [id=none] random_password.bazarr_oauth2_cookie_secret: Refreshing state... [id=none] random_password.prowlarr_oauth2_cookie_secret: Refreshing state... [id=none] Planning failed. Terraform encountered an error while generating this plan. ╷ │ Error: one authentication method must be configured │ │ with provider["registry.terraform.io/zitadel/zitadel"], │ on main.tf line 34, in provider "zitadel": │ 34: provider "zitadel" { │ ╵ ``` </details>
Some checks failed
CI Review / pr-title (pull_request) Failing after 0s
Required
Details
CI Review / helm-validate (pull_request) Successful in 6s
Required
Details
CI Review / ai-review (pull_request) Failing after 4s
Details
0/1 projects planned successfully.
Lint & Validate / yaml-lint (pull_request) Successful in 25s
Required
Details
Lint & Validate / shellcheck (pull_request) Successful in 3s
Required
Details
Lint & Validate / terraform-validate (pull_request) Failing after 14m19s
Required
Details
Some required checks were not successful.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin chore/zitadel-oidc-rotate-outline:chore/zitadel-oidc-rotate-outline
git switch chore/zitadel-oidc-rotate-outline
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
aaron/infra-core!406
No description provided.