Skip to content

fix!: remove deprecated secret keys and secret autogeneration for camunda 8.9#5100

Open
bkenez wants to merge 12 commits intomainfrom
4839-remove-deprecated-secrets-8.9
Open

fix!: remove deprecated secret keys and secret autogeneration for camunda 8.9#5100
bkenez wants to merge 12 commits intomainfrom
4839-remove-deprecated-secrets-8.9

Conversation

@bkenez
Copy link
Member

@bkenez bkenez commented Feb 10, 2026

Which problem does the PR fix?

Closes #4839
Closes #5104

What's in this PR?

Removes all deprecated secret configuration keys from chart 8.9 that were deprecated in 8.8 with the new secret standard (secret.existingSecret/existingSecretKey/inlineSecret). Also removes autogenerated secret functionality (global.secrets.autoGenerated and the secret-camunda.yaml template), eliminating the need for users to provide initial passwords and improving the default security posture.

values.yaml & schema:

  • Remove 77 lines of deprecated keys from values.yaml across 14 config sections (identity auth, connectors, orchestration, optimize, web-modeler, elasticsearch, keycloak, postgresql)
  • Remove global.secrets configuration block (autoGenerated, name, annotations)
  • Remove corresponding entries from values.schema.json

Deleted legacy templates:

  • templates/common/secret-camunda.yaml — autogenerated secret template (removed, users must provide credentials)
  • identity/postgresql-secret.yaml — legacy Identity PostgreSQL secret
  • web-modeler/secret-restapi.yaml — legacy Web Modeler REST API secret

Template cleanup (14 files):

  • Remove shouldAutogenerateSecret helper function and simplify normalizeSecretConfiguration
  • Remove legacy fallback paths from _helpers.tpl and deployment templates
  • Remove plaintextKey/legacyKeyField params from secret config helper calls
  • Add 42 keyRemoved constraints in constraints.tpl for deprecated keys and autoGenerated settings with actionable migration messages

Integration test migration (15 files):

  • Migrate all integration test values files from deprecated existingSecret.name (object form) and top-level existingSecret/existingSecretKey to the new secret.existingSecret + secret.existingSecretKey format
  • Remove autoGenerated: false settings from test values
  • Add missing existingSecretKey values alongside every existingSecret reference
  • Convert commented-out sections to new format

Unit tests:

  • Remove autogenerated secret test files (secret_test.go, helpers_autogenerate_secret_test.go, goldenfiles_test.go, secret-camunda.golden.yaml)
  • Remove tests for deleted templates
  • Update secret-related test assertions for the new format
  • Regenerate golden files

Checklist

Before opening the PR:

  • In the repo's root dir, run make go.update-golden-only.
  • There is no other open pull request for the same update/change.
  • Tests for charts are added (if needed).

After opening the PR:

  • Did you sign our CLA (Contributor License Agreement)? It will show once you open the PR.
  • Did all checks/tests pass in the PR?

@bkenez bkenez force-pushed the 4839-remove-deprecated-secrets-8.9 branch from 51767b0 to 1fedc2a Compare February 10, 2026 19:20
@bkenez bkenez changed the title fix: remove deprecated secret keys for camunda 8.9 fix!: remove deprecated secret keys for camunda 8.9 Feb 10, 2026
@bkenez bkenez force-pushed the 4839-remove-deprecated-secrets-8.9 branch 5 times, most recently from 4f7d2cd to 96544b2 Compare February 11, 2026 12:48
@bkenez bkenez changed the title fix!: remove deprecated secret keys for camunda 8.9 fix!: remove deprecated secret keys and secret autogeneration for camunda 8.9 Feb 11, 2026
@bkenez bkenez force-pushed the 4839-remove-deprecated-secrets-8.9 branch from 9cb88aa to 469b0ab Compare February 12, 2026 08:06
@bkenez bkenez marked this pull request as ready for review February 12, 2026 08:23
@bkenez bkenez requested a review from a team as a code owner February 12, 2026 08:23
@bkenez bkenez requested review from hamza-m-masood and removed request for a team February 12, 2026 08:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[ENHANCEMENT] Remove autogenerated secrets from values.yaml [TASK] Remove deprecated secret configuration parameters from 8.9 chart

1 participant