[TASK] Simplify deployment upgrade with Identity enabled

[aabouzaid]

Describe the use case:

Currently, as in Camunda Platform v8.0 and Helm chart v8.0.13, when Camunda Identity is enabled, the deployment upgrade is not smooth and needs many manual steps to be done.

In action:

export TASKLIST_SECRET=$(kubectl get secret "<RELEASE_NAME>-tasklist-identity-secret" -o jsonpath="{.data.tasklist-secret}" | base64 --decode)
export OPTIMIZE_SECRET=$(kubectl get secret "<RELEASE_NAME>-optimize-identity-secret" -o jsonpath="{.data.optimize-secret}" | base64 --decode)
export OPERATE_SECRET=$(kubectl get secret "<RELEASE_NAME>-operate-identity-secret" -o jsonpath="{.data.operate-secret}" | base64 --decode)
export CONNECTORS_SECRET=$(kubectl get secret "<RELEASE_NAME>-connectors-identity-secret" -o jsonpath="{.data.connectors-secret}" | base64 --decode)
export KEYCLOAK_ADMIN_SECRET=$(kubectl get secret "<RELEASE_NAME>-keycloak" -o jsonpath="{.data.admin-password}" | base64 --decode)
export ZEEBE_SECRET=$(kubectl get secret "<RELEASE_NAME>-zeebe-identity-secret" -o jsonpath="{.data.zeebe-secret}" | base64 --decode)
export KEYCLOAK_MANAGEMENT_SECRET=$(kubectl get secret "<RELEASE_NAME>-keycloak" -o jsonpath="{.data.management-password}" | base64 --decode)
export POSTGRESQL_SECRET=$(kubectl get secret "<RELEASE_NAME>-postgresql" -o jsonpath="{.data.postgres-password}" | base64 --decode)


helm upgrade <RELEASE_NAME> camunda/camunda-platform \
  --set global.identity.auth.tasklist.existingSecret=$TASKLIST_SECRET \
  --set global.identity.auth.optimize.existingSecret=$OPTIMIZE_SECRET \
  --set global.identity.auth.operate.existingSecret=$OPERATE_SECRET \
  --set global.identity.auth.connectors.existingSecret=$CONNECTORS_SECRET \
  --set global.identity.auth.zeebe.existingSecret=$ZEEBE_SECRET \
  --set identity.keycloak.auth.adminPassword=$KEYCLOAK_ADMIN_SECRET \
  --set identity.keycloak.auth.managementPassword=$KEYCLOAK_MANAGEMENT_SECRET \
  --set identity.keycloak.postgresql.auth.password=$POSTGRESQL_SECRET

Describe the enhancement/feature:
We need to enhance that probably by preserving the secrets during the upgrade.

Desired outcome and acceptance tests:

• Deployment upgrades should be done without (or with minimal) manual interactions.

Related tickets

• SUPPORT-18598 [not as a direct issue, but underlined the importance of it]

Other related issues

• The enhancement of the password auto-gen will also allow to support ArgoCD since it always syncs and cannot differentiate between install and upgrade (in case the Helm hooks are used)
• The existingSecret uses the actual values, not the secret name: [ISSUE] The comments explaining the use of existingSecret settings are incorrect #762

[aabouzaid]

I've found that the best way to deal with that issue is to use Helm hooks. Namely, using "helm.sh/hook": pre-install with the auto-generated secrets so they will only be executed in the installation but not in the upgrade.

[hisImminence]

Added the related support ticket ;)

[aabouzaid]

I've found that the best what we can do here is to remove the password auto-generation and leave that to the user, as there are many tools to do that and each user can use different things.

[jessesimpson36]

Closed because of related PR #1868 being closed.