clean install v9 login-client secret not found instanceHost not found zitadel-login pod

i upgraded to v9 from v8 . zitadel login container wont finish.

MountVolume.SetUp failed for volume "login-client"  : secret "login-client" not found

MountVolume.SetUp failed for volume "login-client" : secret "login-client" not found

MountVolume.SetUp failed for volume "login-client"  : secret "login-client" not found

MountVolume.SetUp failed for volume "login-client" : secret "login-client" not found

instanceHost not found

instanceHost not found

instanceHost not found

instanceHost not found in zitadel-login pod

i know the manual migration note but i nuked everything including the db installed clean with below values and its failing.

apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: zitadel
spec:
  chart:
    spec:
      chart: zitadel
      version: "9.13.0"
      sourceRef:
        kind: HelmRepository
        name: zitadel
        namespace: zitadel
  values:
    env:
      - name: ZITADEL_FIRSTINSTANCE_ORG_HUMAN_EMAIL_ADDRESS
        value: admin@admin.com
      - name: ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PASSWORD
        value: RootPassword1!
    replicaCount: 1
    zitadel:
      masterkey: vault:secret/data/zitadel#MASTERKEY
      configmapConfig:
        ExternalSecure: false
        TLS:
          Enabled: false
      secretConfig:
        ExternalDomain: &host "zitadel.xxx,xxx"
        ExternalSecure: true
        ExternalPort: 443
        Database:
          ...

apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: zitadel
spec:
  chart:
    spec:
      chart: zitadel
      version: "9.13.0"
      sourceRef:
        kind: HelmRepository
        name: zitadel
        namespace: zitadel
  values:
    env:
      - name: ZITADEL_FIRSTINSTANCE_ORG_HUMAN_EMAIL_ADDRESS
        value: admin@admin.com
      - name: ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PASSWORD
        value: RootPassword1!
    replicaCount: 1
    zitadel:
      masterkey: vault:secret/data/zitadel#MASTERKEY
      configmapConfig:
        ExternalSecure: false
        TLS:
          Enabled: false
      secretConfig:
        ExternalDomain: &host "zitadel.xxx,xxx"
        ExternalSecure: true
        ExternalPort: 443
        Database:
          ...

apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: zitadel
spec:
  chart:
    spec:
      chart: zitadel
      version: "9.13.0"
      sourceRef:
        kind: HelmRepository
        name: zitadel
        namespace: zitadel
  values:
    env:
      - name: ZITADEL_FIRSTINSTANCE_ORG_HUMAN_EMAIL_ADDRESS
        value: admin@admin.com
      - name: ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PASSWORD
        value: RootPassword1!
    replicaCount: 1
    zitadel:
      masterkey: vault:secret/data/zitadel#MASTERKEY
      configmapConfig:
        ExternalSecure: false
        TLS:
          Enabled: false
      secretConfig:
        ExternalDomain: &host "zitadel.xxx,xxx"
        ExternalSecure: true
        ExternalPort: 443
        Database:
          ...

apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: zitadel
spec:
  chart:
    spec:
      chart: zitadel
      version: "9.13.0"
      sourceRef:
        kind: HelmRepository
        name: zitadel
        namespace: zitadel
  values:
    env:
      - name: ZITADEL_FIRSTINSTANCE_ORG_HUMAN_EMAIL_ADDRESS
        value: admin@admin.com
      - name: ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PASSWORD
        value: RootPassword1!
    replicaCount: 1
    zitadel:
      masterkey: vault:secret/data/zitadel#MASTERKEY
      configmapConfig:
        ExternalSecure: false
        TLS:
          Enabled: false
      secretConfig:
        ExternalDomain: &host "zitadel.xxx,xxx"
        ExternalSecure: true
        ExternalPort: 443
        Database:
          ...

Ask Inkeep•12/13/25, 7:07 AM

Hi @ice.hl, I'm an AI assistant for ZITADEL. While a team member reviews this question, I'll see if I can find relevant sources for your question.

Ask Inkeep•12/13/25, 7:08 AM

Answer

I wasn't able to find a direct answer about the Helm chart v9 login-clientlogin-client secret issue or the

instanceHost not found

instanceHost not found

error in the available sources. Here are some potentially relevant resources:

machine user or pat (1) : Discusses machine user credential creation during Helm chart installation and troubleshooting steps for missing secrets.
Configuration Options in ZITADEL (2) : Covers ZITADEL configuration including ZITADEL_FIRSTINSTANCE_*ZITADEL_FIRSTINSTANCE_* environment variables and the login client PAT setup.

The login-clientlogin-client secret is created by ZITADEL during initialization when a login client service account is configured. The reverse proxy examples show that the login service expects a PAT file to be available:

ZITADEL_FIRSTINSTANCE_LOGINCLIENTPATPATH: /current-dir/login-client.pat
ZITADEL_FIRSTINSTANCE_ORG_LOGINCLIENT_MACHINE_USERNAME: login-client
ZITADEL_FIRSTINSTANCE_ORG_LOGINCLIENT_MACHINE_NAME: Automatically Initialized IAM Login Client
ZITADEL_FIRSTINSTANCE_ORG_LOGINCLIENT_PAT_EXPIRATIONDATE: '2029-01-01T00:00:00Z'

ZITADEL_FIRSTINSTANCE_LOGINCLIENTPATPATH: /current-dir/login-client.pat
ZITADEL_FIRSTINSTANCE_ORG_LOGINCLIENT_MACHINE_USERNAME: login-client
ZITADEL_FIRSTINSTANCE_ORG_LOGINCLIENT_MACHINE_NAME: Automatically Initialized IAM Login Client
ZITADEL_FIRSTINSTANCE_ORG_LOGINCLIENT_PAT_EXPIRATIONDATE: '2029-01-01T00:00:00Z'

(3) , (4)

The Helm chart v9 likely requires these login client configurations to be properly set for the secret to be created. You may want to click the Ask for help button to have a team member review this specific Helm chart v9 migration issue.

Would you like me to provide a general answer based on my knowledge instead?

Ask Inkeep•12/13/25, 7:08 AM

To learn more, see the sources I considered:

[1] machine user or pat
[2] Configuration Options in ZITADEL
[3] Configure Zitadel with Apache httpd
[4] Configure Zitadel with Caddy

Ask Inkeep•12/13/25, 7:08 AM

Feel free to tag @Ask Inkeep with additional questions.

AAsk Inkeep To learn more, see the sources I considered: [[1] machine user or pat](https:...

Ask InkeepAPP•12/13/25, 7:09 AM

Got it. Tagging @Rajat for additional help.

ice.hlOP•12/13/25, 7:45 AM

setting zitadel.configmapConfig.ExternalDomain works nvm

AAsk Inkeep To learn more, see the sources I considered: [[1] machine user or pat](https:...

Ask InkeepAPP•12/13/25, 7:45 AM

Glad I could be helpful. Feel free to create a new thread with any new questions you may have.

AAsk Inkeep To learn more, see the sources I considered: [[1] machine user or pat](https:...

Ask InkeepAPP•12/13/25, 7:45 AM

Glad I could be helpful. Feel free to create a new thread with any new questions you may have.