Zitadel in Kubernetes and access from within the cluster

curl http://zitadel.zitadel.svc.cluster.local:8080/.well-known/openid-configuration \
  -H 'Host: zitadel.my-cool-domain.com'

curl http://zitadel.zitadel.svc.cluster.local:8080/.well-known/openid-configuration \
  -H 'Host: zitadel.my-cool-domain.com'

# - superuser2:
#     # If no memberships are specified, the user has a membership of type System with the role "SYSTEM_OWNER"
#     KeyData: <base64 encoded key>     # or you can directly embed it as base64 encoded value

# - superuser2:
#     # If no memberships are specified, the user has a membership of type System with the role "SYSTEM_OWNER"
#     KeyData: <base64 encoded key>     # or you can directly embed it as base64 encoded value

const secretYaml = `
apiVersion: v1
kind: Secret
metadata:
  name: zitadel-system-api-config
  namespace: default
type: Opaque
stringData:
  config.yaml: |
    SystemAPIUsers:
      - ${userId}:
          KeyData: ${publicKeyBase64}
          Memberships:
            - MemberType: System
              Roles:
                - "SYSTEM_OWNER"
                - "IAM_OWNER"
                - "ORG_OWNER"
`;

const secretYaml = `
apiVersion: v1
kind: Secret
metadata:
  name: zitadel-system-api-config
  namespace: default
type: Opaque
stringData:
  config.yaml: |
    SystemAPIUsers:
      - ${userId}:
          KeyData: ${publicKeyBase64}
          Memberships:
            - MemberType: System
              Roles:
                - "SYSTEM_OWNER"
                - "IAM_OWNER"
                - "ORG_OWNER"
`;

/**
 * ZitadelSuperadmin - System API client with superadmin privileges
 * Uses self-signed JWTs for authentication (NOT OAuth)
 * Requires SystemAPIUsers configuration in ZITADEL runtime config
 */
export class ZitadelSuperadmin {
  private privateKey: CryptoKey | null = null;
  private userId: string;
  private baseUrl: string;
  private cachedToken: string | null = null;
  private tokenExpiry: number = 0;

  constructor(userId: string, baseUrl: string) {
    this.userId = userId;
    this.baseUrl = baseUrl.replace(/\/$/, "");
  }

  async loadPrivateKey(privateKeyPem: string): Promise<void> {
    this.privateKey = await convertPKCS1ToPKCS8(privateKeyPem);
  }

  /**
   * Generate a self-signed JWT for System API authentication
   */
  private async generateSystemToken(): Promise<string> {
    if (!this.privateKey) {
      throw new Error("Private key not loaded");
    }

    const now = Math.floor(Date.now() / 1000);
    const exp = now + 3600; // 1 hour

    const payload = {
      iss: this.userId,
      sub: this.userId,
      aud: this.baseUrl,
      iat: now,
      exp: exp,
    };

    
    const jwt = await new SignJWT(payload)
      .setProtectedHeader({ alg: "RS256" })
      .sign(this.privateKey);

    this.cachedToken = jwt;
    this.tokenExpiry = exp;

    return jwt;
  }

  // Cont below

/**
 * ZitadelSuperadmin - System API client with superadmin privileges
 * Uses self-signed JWTs for authentication (NOT OAuth)
 * Requires SystemAPIUsers configuration in ZITADEL runtime config
 */
export class ZitadelSuperadmin {
  private privateKey: CryptoKey | null = null;
  private userId: string;
  private baseUrl: string;
  private cachedToken: string | null = null;
  private tokenExpiry: number = 0;

  constructor(userId: string, baseUrl: string) {
    this.userId = userId;
    this.baseUrl = baseUrl.replace(/\/$/, "");
  }

  async loadPrivateKey(privateKeyPem: string): Promise<void> {
    this.privateKey = await convertPKCS1ToPKCS8(privateKeyPem);
  }

  /**
   * Generate a self-signed JWT for System API authentication
   */
  private async generateSystemToken(): Promise<string> {
    if (!this.privateKey) {
      throw new Error("Private key not loaded");
    }

    const now = Math.floor(Date.now() / 1000);
    const exp = now + 3600; // 1 hour

    const payload = {
      iss: this.userId,
      sub: this.userId,
      aud: this.baseUrl,
      iat: now,
      exp: exp,
    };

    
    const jwt = await new SignJWT(payload)
      .setProtectedHeader({ alg: "RS256" })
      .sign(this.privateKey);

    this.cachedToken = jwt;
    this.tokenExpiry = exp;

    return jwt;
  }

  // Cont below

private async getToken(): Promise<string> {
    const now = Math.floor(Date.now() / 1000);

    if (!this.cachedToken || now >= this.tokenExpiry - 300) {
      return await this.generateSystemToken();
    }

    return this.cachedToken;
  }

  private async request<T>(
    endpoint: string,
    options: {
      method?: string;
      body?: any;
    } = {}
  ): Promise<T> {
    const token = await this.getToken();
    const url = `${this.baseUrl}${endpoint}`;

    const response = await ofetch<T>(url, {
      method: options.method || "GET",
      headers: {
        Authorization: `Bearer ${token}`,
        "Content-Type": "application/json",
      },
      body: options.body,
    });

    return response;
  }

  async listInstances(queries?: any) {
    return this.request(
      "/zitadel.instance.v2beta.InstanceService/ListInstances",
      {
        method: "POST",
        body: {
          queries: queries || [],
        },
      }
    );
  }
// Other privilaged methods
}

private async getToken(): Promise<string> {
    const now = Math.floor(Date.now() / 1000);

    if (!this.cachedToken || now >= this.tokenExpiry - 300) {
      return await this.generateSystemToken();
    }

    return this.cachedToken;
  }

  private async request<T>(
    endpoint: string,
    options: {
      method?: string;
      body?: any;
    } = {}
  ): Promise<T> {
    const token = await this.getToken();
    const url = `${this.baseUrl}${endpoint}`;

    const response = await ofetch<T>(url, {
      method: options.method || "GET",
      headers: {
        Authorization: `Bearer ${token}`,
        "Content-Type": "application/json",
      },
      body: options.body,
    });

    return response;
  }

  async listInstances(queries?: any) {
    return this.request(
      "/zitadel.instance.v2beta.InstanceService/ListInstances",
      {
        method: "POST",
        body: {
          queries: queries || [],
        },
      }
    );
  }
// Other privilaged methods
}

openssl genrsa -traditional -out system-owner.pem 2048
openssl rsa -in system-owner.pem -outform PEM -pubout -out system-owner.pub
openssl pkcs8 -topk8 -inform PEM -in system-owner.pem -out system-owner-pkcs8.pem -nocrypt

openssl genrsa -traditional -out system-owner.pem 2048
openssl rsa -in system-owner.pem -outform PEM -pubout -out system-owner.pub
openssl pkcs8 -topk8 -inform PEM -in system-owner.pem -out system-owner-pkcs8.pem -nocrypt

  zitadel-config-yaml: |-
    ..
    SystemAPIUsers:
    - system-owner:
        # system-owner.pub: -----BEGIN PUBLIC KEY-----MIIB..QAB-----END PUBLIC KEY-----
        KeyData: LS0t..S0tLQ==
        Memberships:
        - MemberType: System
          Roles:
          - SYSTEM_OWNER
          - IAM_OWNER
          - ORG_OWNER

  zitadel-config-yaml: |-
    ..
    SystemAPIUsers:
    - system-owner:
        # system-owner.pub: -----BEGIN PUBLIC KEY-----MIIB..QAB-----END PUBLIC KEY-----
        KeyData: LS0t..S0tLQ==
        Memberships:
        - MemberType: System
          Roles:
          - SYSTEM_OWNER
          - IAM_OWNER
          - ORG_OWNER

    SystemAPIUsers:
    - system-owner:
        KeyData: LS0t..LQ==

    SystemAPIUsers:
    - system-owner:
        KeyData: LS0t..LQ==

    SystemAPIUsers: [
        {
            "system-owner": {
                 "KeyData": "LS0t..LQ=="
            }
        }
    ]

    SystemAPIUsers: [
        {
            "system-owner": {
                 "KeyData": "LS0t..LQ=="
            }
        }
    ]

go install github.com/zitadel/zitadel-tools@latest
export SYSTEM_OWNER_JWT=$(~/go/bin/zitadel-tools key2jwt --audience=https://zitadel.kube.local:999 --key=system-owner-pkcs8.pem --issuer=system-owner)

go install github.com/zitadel/zitadel-tools@latest
export SYSTEM_OWNER_JWT=$(~/go/bin/zitadel-tools key2jwt --audience=https://zitadel.kube.local:999 --key=system-owner-pkcs8.pem --issuer=system-owner)

curl --request POST -k \
  --url https://zitadel.kube.local:999/zitadel.instance.v2beta.InstanceService/ListInstances \
  --header "Authorization: Bearer ${SYSTEM_OWNER_JWT}" \
  --header 'Connect-Protocol-Version: 1' \
  --header 'Content-Type: application/json' \
  --data '{}'

curl --request POST -k \
  --url https://zitadel.kube.local:999/zitadel.instance.v2beta.InstanceService/ListInstances \
  --header "Authorization: Bearer ${SYSTEM_OWNER_JWT}" \
  --header 'Connect-Protocol-Version: 1' \
  --header 'Content-Type: application/json' \
  --data '{}'

{"code":"unauthenticated","message":"Errors.Token.Invalid (AUTH-7fs1e)","details":[{"type":"zitadel.v1.ErrorDetail","value":"CgpBVVRILTdmczFlEhRFcnJvcnMuVG9rZW4uSW52YWxpZA","debug":{"id":"AUTH-7fs1e","message":"Errors.Token.Invalid"}}]}

{"code":"unauthenticated","message":"Errors.Token.Invalid (AUTH-7fs1e)","details":[{"type":"zitadel.v1.ErrorDetail","value":"CgpBVVRILTdmczFlEhRFcnJvcnMuVG9rZW4uSW52YWxpZA","debug":{"id":"AUTH-7fs1e","message":"Errors.Token.Invalid"}}]}

 // Generate private key with traditional format (PKCS#1)
// DONE WITH BUN SYNTAX
      await $`openssl genrsa -traditional -out ${privateKeyPath} 2048`.quiet();

      // Export public key
      await $`openssl rsa -in ${privateKeyPath} -outform PEM -pubout -out ${publicKeyPath}`.quiet()

      // Read public key and encode as base64
      const publicKey = fs.readFileSync(publicKeyPath, "utf-8");
      const publicKeyBase64 = Buffer.from(publicKey).toString("base64");

      //  THIS SHOVES THE PUB KEY INTO A K8S SECRET AND does kubectl apply
      await createOrPatchSystemApiSecret(publicKeyBase64, userId);

 // Generate private key with traditional format (PKCS#1)
// DONE WITH BUN SYNTAX
      await $`openssl genrsa -traditional -out ${privateKeyPath} 2048`.quiet();

      // Export public key
      await $`openssl rsa -in ${privateKeyPath} -outform PEM -pubout -out ${publicKeyPath}`.quiet()

      // Read public key and encode as base64
      const publicKey = fs.readFileSync(publicKeyPath, "utf-8");
      const publicKeyBase64 = Buffer.from(publicKey).toString("base64");

      //  THIS SHOVES THE PUB KEY INTO A K8S SECRET AND does kubectl apply
      await createOrPatchSystemApiSecret(publicKeyBase64, userId);

  # Reference the name of a secret that contains ZITADEL configuration.
  # This secret is created by the seed script and contains SystemAPIUsers config
  configSecretName: zitadel-system-api-config
  # The key under which the ZITADEL configuration is located in the secret.
  configSecretKey: config.yaml

  # Reference the name of a secret that contains ZITADEL configuration.
  # This secret is created by the seed script and contains SystemAPIUsers config
  configSecretName: zitadel-system-api-config
  # The key under which the ZITADEL configuration is located in the secret.
  configSecretKey: config.yaml