camunda / camunda-platform-helm

Camunda Platform 8 Self-Managed Helm charts
https://docs.camunda.io/docs/self-managed/overview/
Apache License 2.0
74 stars 138 forks source link

[TASK] Refactor OpenShift values and remove post-rendering script #1989

Closed aabouzaid closed 3 months ago

aabouzaid commented 5 months ago

Related to

Epic: https://github.com/camunda/distribution/issues/189

Overview

Starting in March 2024 (thanks @leiicamundi for mentioning this :raised_hands:), many Bitnami charts introduced a new flag adaptSecurityContext which works as a workaround to the Helm CLI bug where it's not possible to null sub-charts values (hence we couldn't remove some security config that auto-added by OpenShift and we needed to use rendering script).

Actions

### Sub-tasks
- [ ] https://github.com/camunda/camunda-platform-helm/pull/2188
- [ ] https://github.com/camunda/camunda-docs/pull/4129
hamza-m-masood commented 3 months ago

This change only exists in the alpha version currently. This was because the PostgreSQL charts needed to be updated for identity and webModeler.

The global flag .global.openshift.restrictedSCC: true could not be added because of the initContainer copy-camunda-theme passed into the identityKeycloak subchart through the values.yaml. It is not possible to easily modify the runAsUser value on the initContainer. So instead I decided to completely overwrite the identityKeycloak.initContainers array through the OpenShift values.yaml

I will create a PR for the docs repo very soon.

hamza-m-masood commented 3 months ago

docs PR: https://github.com/camunda/camunda-docs/pull/4129