chore(deps): update helm release zitadel to v9.16.0

[renovate]

This PR contains the following updates:

Package	Update	Change
zitadel	minor	9.15.0 → 9.16.0

---

Release Notes

zitadel/zitadel-charts (zitadel)

v9.16.0

Compare Source

A Helm chart for ZITADEL

What's Changed

• feat: make tool container images configurable via tools.* values by @​mridang in #​493

Full Changelog: zitadel/zitadel-charts@zitadel-9.15.1...zitadel-9.16.0

v9.15.1

Compare Source

A Helm chart for ZITADEL

What's Changed

• ci: upgrade test environment, Traefik, and add K8s 1.35 by @​mridang in #​507
• fix: prevent gitops from pruning dynamic secrets by @​axellpadilla in #​506

New Contributors

• @​axellpadilla made their first contribution in #​506

Full Changelog: zitadel/zitadel-charts@zitadel-9.15.0...zitadel-9.15.1

---

Configuration

📅 Schedule: Branch creation - "before 9am on tuesday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

--- kubernetes/apps/authentication/zitadel/app Kustomization: flux-system/zitadel HelmRelease: authentication/zitadel

+++ kubernetes/apps/authentication/zitadel/app Kustomization: flux-system/zitadel HelmRelease: authentication/zitadel

@@ -14,13 +14,13 @@

       chart: zitadel
       interval: 5m
       sourceRef:
         kind: HelmRepository
         name: zitadel
         namespace: flux-system
-      version: 9.15.0
+      version: 9.16.0
   interval: 5m
   values:
     env:
     - name: ZITADEL_DATABASE_POSTGRES_HOST
       valueFrom:
         secretKeyRef:

[github-actions]

--- HelmRelease: authentication/zitadel Deployment: authentication/zitadel

+++ HelmRelease: authentication/zitadel Deployment: authentication/zitadel

@@ -16,13 +16,13 @@

       app.kubernetes.io/name: zitadel
       app.kubernetes.io/instance: zitadel
       app.kubernetes.io/component: start
   template:
     metadata:
       annotations:
-        checksum/configmap: a340c024d17994918e25fed32855de84434eaddad438e9823c9657e850fa2d08
+        checksum/configmap: 5feac63d7ccdaaa8d9c0ecffc054b7e0b3910c8f85dbcf73828ef696ebe283c1
         checksum/secret-db-ssl-ca-crt: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
         checksum/secret-zitadel-secrets: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
       labels:
         app.kubernetes.io/name: zitadel
         app.kubernetes.io/instance: zitadel
         app.kubernetes.io/managed-by: Helm
--- HelmRelease: authentication/zitadel Job: authentication/zitadel-cleanup

+++ HelmRelease: authentication/zitadel Job: authentication/zitadel-cleanup

@@ -34,13 +34,13 @@

       - name: zitadel-cleanup
         securityContext:
           privileged: false
           readOnlyRootFilesystem: true
           runAsNonRoot: true
           runAsUser: 1000
-        image: alpine/k8s:1.34.0
+        image: docker.io/alpine/k8s:1.34.0
         imagePullPolicy: IfNotPresent
         command:
         - sh
         - -c
         - |
           echo "Cleaning up secrets created by zitadel-setup..."
--- HelmRelease: authentication/zitadel Job: authentication/zitadel-setup

+++ HelmRelease: authentication/zitadel Job: authentication/zitadel-setup

@@ -106,13 +106,14 @@

       - name: zitadel-machinekey
         securityContext:
           privileged: false
           readOnlyRootFilesystem: true
           runAsNonRoot: true
           runAsUser: 1000
-        image: alpine/k8s:1.32.3
+        image: docker.io/alpine/k8s:1.34.0
+        imagePullPolicy: IfNotPresent
         command:
         - sh
         - -c
         - |
           until [ ! -z $(kubectl --namespace=authentication get pod ${POD_NAME} --output=jsonpath="{.status.containerStatuses[?(@.name=='zitadel-setup')].state.terminated}") ]; do
             echo 'waiting for zitadel-setup container to terminate';
@@ -120,12 +121,15 @@

           done &&
           echo 'zitadel-setup container terminated' &&
           if [ -f /machinekey/sa.json ]; then
             kubectl --namespace=authentication create secret generic zitadel-iac-admin-sa \
               --from-file=zitadel-iac-admin-sa.json=/machinekey/sa.json \
               --dry-run=client --output=yaml | \
+            kubectl annotate --local --filename=- \
+              helm.sh/resource-policy=keep \
+              --output=yaml | \
             kubectl label --local --filename=- \
               app.kubernetes.io/managed-by=Zitadel \
               app.kubernetes.io/name=zitadel \
               app.kubernetes.io/instance=zitadel \
               --output=yaml | \
             kubectl apply --filename=-;
@@ -143,13 +147,14 @@

       - name: zitadel-machine-pat
         securityContext:
           privileged: false
           readOnlyRootFilesystem: true
           runAsNonRoot: true
           runAsUser: 1000
-        image: alpine/k8s:1.32.3
+        image: docker.io/alpine/k8s:1.34.0
+        imagePullPolicy: IfNotPresent
         command:
         - sh
         - -c
         - |
           until [ ! -z $(kubectl --namespace=authentication get pod ${POD_NAME} --output=jsonpath="{.status.containerStatuses[?(@.name=='zitadel-setup')].state.terminated}") ]; do
             echo 'waiting for zitadel-setup container to terminate';
@@ -157,12 +162,15 @@

           done &&
           echo 'zitadel-setup container terminated' &&
           if [ -f /machinekey/pat ]; then
             kubectl --namespace=authentication create secret generic zitadel-iac-admin-sa-pat \
               --from-file=pat=/machinekey/pat \
               --dry-run=client --output=yaml | \
+            kubectl annotate --local --filename=- \
+              helm.sh/resource-policy=keep \
+              --output=yaml | \
             kubectl label --local --filename=- \
               app.kubernetes.io/managed-by=Zitadel \
               app.kubernetes.io/name=zitadel \
               app.kubernetes.io/instance=zitadel \
               --output=yaml | \
             kubectl apply --filename=-;
@@ -180,13 +188,14 @@

       - name: zitadel-login-client-pat
         securityContext:
           privileged: false
           readOnlyRootFilesystem: true
           runAsNonRoot: true
           runAsUser: 1000
-        image: alpine/k8s:1.32.3
+        image: docker.io/alpine/k8s:1.34.0
+        imagePullPolicy: IfNotPresent
         command:
         - sh
         - -c
         - |
           until [ ! -z $(kubectl --namespace=authentication get pod ${POD_NAME} --output=jsonpath="{.status.containerStatuses[?(@.name=='zitadel-setup')].state.terminated}") ]; do
             echo 'waiting for zitadel-setup container to terminate';
@@ -194,12 +203,15 @@

           done &&
           echo 'zitadel-setup container terminated' &&
           if [ -f /login-client/pat ]; then
             kubectl --namespace=authentication create secret generic login-client \
               --from-file=pat=/login-client/pat \
               --dry-run=client --output=yaml | \
+            kubectl annotate --local --filename=- \
+              helm.sh/resource-policy=keep \
+              --output=yaml | \
             kubectl label --local --filename=- \
               app.kubernetes.io/managed-by=Zitadel \
               app.kubernetes.io/name=zitadel \
               app.kubernetes.io/instance=zitadel \
               --output=yaml | \
             kubectl apply --filename=-;