Infrastructure now gives each project its own Postgres role, S3 identity
limited to its bucket and a Zitadel service account that owns only its
project, instead of handing out the admin accounts.
Postgres and S3 settings default to Ping's own (ping).
zitadel-init mounts ZITADEL_PAT_DIR (Infrastructure's
zitadel/.output/ping), waits for that PAT and uses it. It no longer
creates the Zitadel project, which that account can't do:
Infrastructure does.
Infrastructure now gives each project its own Postgres role, S3 identity
limited to its bucket and a Zitadel service account that owns only its
project, instead of handing out the admin accounts.
- Postgres and S3 settings default to Ping's own (ping).
- zitadel-init mounts ZITADEL_PAT_DIR (Infrastructure's
zitadel/.output/ping), waits for that PAT and uses it. It no longer
creates the Zitadel project, which that account can't do:
Infrastructure does.
Infrastructure now gives each project its own Postgres role, S3 identity
limited to its bucket and a Zitadel service account that owns only its
project, instead of handing out the admin accounts.
- Postgres and S3 settings default to Ping's own (ping).
- zitadel-init mounts ZITADEL_PAT_DIR (Infrastructure's
zitadel/.output/ping), waits for that PAT and uses it. It no longer
creates the Zitadel project, which that account can't do:
Infrastructure does.
NotS1mp
merged commit 52022244d0 into master2026-09-24 15:22:16 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Infrastructure now gives each project its own Postgres role, S3 identity
limited to its bucket and a Zitadel service account that owns only its
project, instead of handing out the admin accounts.
zitadel/.output/ping), waits for that PAT and uses it. It no longer
creates the Zitadel project, which that account can't do:
Infrastructure does.