Skip to main content
Version: 2026.07

Database

The Istari Digital platform requires a PostgreSQL database to store user data, application data, and other information. Istari’s recommendation for Azure is to use Azure Database for PostgreSQL – Flexible Server. The customer can also use a PostgreSQL HA Helm chart for development and testing purposes.

tip

The Istari Digital platform supports PostgreSQL 16 and later versions. It is recommended to use the latest stable version of PostgreSQL for optimal performance and security.

PostgreSQL Database Resources and Install Process​

Azure Database for PostgreSQL – Flexible Server​

Step 1: Create the Azure Database for PostgreSQL – Flexible Server​

  1. In the Azure Portal, search for Azure Database for PostgreSQL servers (Flexible Server)

  2. Click Create.

  3. Basics:

    • Subscription: Your subscription.
    • Resource group: Your AKS resource group.
    • Server name: <databasename>
    • Region: Same region as resource group/AKS.
    • PostgreSQL version: 16
    • Workload type Production (or development depending on use)

  4. Compute + Storage:

    • Click on Configure Server
    • Cluster options: Server
    • Compute tier: Memory Optimized
    • Compute processor: Intel or AMD
    • Compute size: Standard_E8ds or equivalent size that provides at least 8 vCPU and 64 GiB Memory
    • Storage size: Minimum 32 GiB or more as needed.
    • High availablity: Zone Redundant
    • Standby availability zone: Pick from any available
    • Backup:
      • Backup retention: 7 days
      • Geo-redundant backup: Disabled
      • Click Save

  5. High availability

    • High availability: Zone Redundant
    • Availability zone: Any

  6. Authentication

    • Authentication method: PostgresSQL authentication only

    • Set the Administrator login to your desired username.

    • Set the Master password to your desired password.

      warning

      The PostgreSQL password ends up becoming part of a URI connection string and thus the characters used must be limited to the following due to URI escaping rules: A–Z a–z 0–9 - _ . ~

      Passwords must be at least 15 characters and include uppercase, lowercase, numeric, and special characters

  7. Networking:

    • Network connectivity: Private access (VNet Integration)
    • Virtual network: vnet
    • Subnet: Select your Database subnet

  8. Private DNS integration

    • from the dropdown menu select:
      • <databasename>.private.postgres.database.azure.com

  9. Security

    • Data encryption key: Service-managed key

  10. Review + create

  • Verify your settings
  • Click Create

Create Istari Platform Databases and Users​

Databases​

CREATE DATABASE identity;
CREATE DATABASE registry;
CREATE DATABASE spicedb;
CREATE DATABASE zitadel;

Users​

CREATE USER identity WITH PASSWORD 'identity_user_password';
GRANT ALL PRIVILEGES ON DATABASE identity TO identity;

CREATE USER registry WITH PASSWORD 'registry_user_password';
GRANT ALL PRIVILEGES ON DATABASE registry TO registry;

CREATE USER spicedb WITH PASSWORD 'spicedb_user_password';
GRANT ALL PRIVILEGES ON DATABASE spicedb TO spicedb;

CREATE USER zitadel WITH PASSWORD 'zitadel_user_password';
GRANT ALL PRIVILEGES ON DATABASE zitadel TO zitadel;

Replace the example passwords with strong, secure ones!

Database Schema Privileges​

After creating users and databases, grant schema-level permissions on the public schema of each respective database:

Connect to each database as an admin user and run:

-- Identity Service
\c identity
GRANT ALL ON SCHEMA public TO identity;

-- File service / registry
\c registry
GRANT ALL ON SCHEMA public TO registry;

-- SpiceDB
\c spicedb
GRANT ALL ON SCHEMA public TO spicedb;

-- Zitadel
\c zitadel
GRANT ALL ON SCHEMA public TO zitadel;

These users will have ALL privileges on their respective public schemas, ensuring they can fully administer objects inside the schema.

Database Ownership​

ALTER DATABASE identity OWNER TO identity;
ALTER DATABASE registry OWNER TO registry;
ALTER DATABASE spicedb OWNER TO spicedb;
ALTER DATABASE zitadel OWNER TO zitadel;

Tip
You can update usernames and database names to match your organization's standards.

Allow-list Required PostgreSQL Extensions​

Azure Database for PostgreSQL only permits CREATE EXTENSION for extensions listed in the server-level azure.extensions parameter, which is empty by default. The Istari file service runs database migrations that create the unaccent and pg_trgm extensions. These must be allow-listed before installing or upgrading the Istari platform. Allow-list them via the Azure Portal:

  1. Open your Azure Database for PostgreSQL flexible server.
  2. Go to Settings → Parameters.
  3. In the filter box, search for the parameter azure.extensions. The extensions are values of this single parameter — searching for unaccent or pg_trgm directly returns no results.
  4. Click the Value field on the azure.extensions row and, in the multi-select dropdown, select UNACCENT and PG_TRGM. Existing selections are preserved — just add these.
  5. Click Save. Azure launches a deployment to apply the change.
  6. Wait for the deployment to complete before installing or upgrading the Istari platform.