ZITADEL•12mo ago

Fully automated API access

I'm setting up Zitadel in a Kubernetes environment, and want to do some automated configuration using operators/metacontroller. This means having API access to Zitadel, which of course it possible, but ideally I'd like to be able to have a fully automated solution, for easy setup for development. The method to get tokens for API access however require manual steps to grant permissions to the machine user. Is there a way to create a machine user, give it the needed permissions and retrieve it's client secret without user involvement?

Raccine•1/13/25, 4:11 PM

@Jan Hi there! :gigipixel:

Just a few questions:

What level of automation are you aiming for?
Is this primarily for a dev or prod environment? Or both?
Are there specific actions you need the machine user to perform via the API?
Are you already using Helm?

JanOP•1/13/25, 4:41 PM

Level of automation: One command results in environment with Zitadel including org, project and application, as well as K8s Secret containing credentials for the application
Both dev and prod but slightly different - in dev it's usually just one project and application in the default org, while in prod it'll usually be multiple (but still configured from CRDs and the operator)
Actions: Creating organisations, projects and applications (theoretically also deleting and updating, but that's not a priority)
Yes, Zitadel itself is installed via Helm

So essentially, given some CRDs (representing organisations, projects and applications in zitadel) I want the corresponding resources to be setup in zitadel, as well as a secret created in k8s for each application. While a zitadel-specific operator would be ideal (and I might get around to that at some point), for now this can be achieved reasonably easily using metacontroller and a few lines of Python, as long as I can get the initial access to the API.

JanOP•1/14/25, 6:06 AM

Knowing the admin username (and password) sadly isn't enough though, as you'd need client ID/secret to use the API as them.

I did however just realize that you can create a machine user as well and even assign a role using the configuration file, so only the step of creating client ID/secret programmatically is left now.

JanOP•1/16/25, 7:35 PM

It turned out that the solution was "right in front of me", I was just to wrapped up in getting the traditional client id and secret. Instead this is solved by using cryptographic keys and signing your own JWT.

Look at https://zitadel.com/docs/guides/integrate/zitadel-apis/access-zitadel-system-api or the machine user configuration (which together with the helm chart is very convenient: https://zitadel.com/docs/guides/integrate/zitadel-apis/access-zitadel-system-api)

ZITADEL Docs

This guide focuses on the ZITADEL System API. To access the other APIs (Admin, Auth, Management), please checkout this guide.