Skip to content

Commit 01eea65

Browse files
fix: remove references to autoGenerated secrets and add RDBMS secret in table
Signed-off-by: Jesse Simpson <jesse.simpson@camunda.com>
1 parent f94c03b commit 01eea65

File tree

1 file changed

+2
-30
lines changed

1 file changed

+2
-30
lines changed

docs/self-managed/deployment/helm/configure/secret-management.md

Lines changed: 2 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,7 @@ These secrets are used by Camunda applications and external integrations. Config
6060
| **SMTP Password** | `webModeler.restapi.mail.secret` | External | SMTP credentials for sending email notifications |
6161
| **External Elasticsearch Auth** | `global.elasticsearch.auth.secret` | External | Password for external Elasticsearch authentication (basic auth) |
6262
| **External OpenSearch Auth** | `global.opensearch.auth.secret` | External | Password for external OpenSearch authentication (basic auth) |
63+
| **RDBMS Auth** | `orchestration.data.secondaryStorage.rdbms.secret` | External | Password for external RDBMS authentication (basic auth) |
6364

6465
### Secrets using Bitnami subchart patterns
6566

@@ -174,35 +175,6 @@ webModelerPostgresql:
174175
userPasswordKey: web-modeler-postgresql-user-password
175176
```
176177

177-
### Auto-generated secrets
178-
179-
The Helm chart can automatically generate secrets with random passwords for both development and production environments. This removes the need to create secrets manually during initial setup. You can enable this feature during installation by setting `--set global.secrets.autoGenerated=true`.
180-
181-
### Important limitations
182-
183-
The auto-generated secret uses Helm hooks (`pre-install`) with a `keep` resource policy. This means:
184-
185-
- The secret is created before the main Helm release installation.
186-
- The secret is not managed by later Helm operations (upgrade, rollback, uninstall).
187-
- If you delete the secret, generated passwords are lost permanently.
188-
- The secret becomes orphaned from the Helm release lifecycle.
189-
190-
### Configuring components to use auto-generated secrets
191-
192-
Enabling `global.secrets.autoGenerated: true` only creates the secret with random values. You must configure each component to reference the auto-generated secret by name and key. The key can be custom, but the name must match the definition above.
193-
194-
```yaml
195-
connectors:
196-
security:
197-
authentication:
198-
oidc:
199-
secret:
200-
existingSecret: "camunda-credentials"
201-
existingSecretKey: "identity-connectors-client-token"
202-
```
203-
204-
For details on Identity secrets during installation, see the [installation guide](/self-managed/deployment/helm/install/quick-install.md#create-identity-secrets).
205-
206178
## Document Store secrets
207179

208180
Document Store secrets use the structured `secret:` pattern with separate secret configurations for each credential component.
@@ -292,7 +264,7 @@ You can use a single consolidated secret (e.g., app-credentials) or one secret p
292264

293265
### Find any plaintext secrets in your `values.yaml`
294266

295-
#### A - If the secrets already exist in Kubernetes (e.g. autogenerated via chart)
267+
#### A - If the secrets already exist in Kubernetes
296268

297269
You can read the current (base64-encoded) data from existing secrets and reuse it in your new consolidated secret.
298270

0 commit comments

Comments
 (0)