[OpenShift] Add CloudNativePG RDBMS as alternative secondary datastore for ROSA HCP

[Copilot]

Camunda 8.9+ supports PostgreSQL (RDBMS) as a secondary storage alternative to Elasticsearch/OpenSearch. This adds a CloudNativePG-based RDBMS variant to the OpenShift ROSA HCP single-region reference architecture.

CloudNativePG cluster

Added pg-operate CNPG cluster to postgresql-clusters.yml — serves as the Operate/Tasklist secondary datastore. Secrets wired in set-secrets.sh alongside the existing identity/keycloak/webmodeler entries.

Helm values overlay

New generic/kubernetes/operator-based/postgresql/camunda-rdbms-values.yml:

optimize:
    enabled: false  # Optimize does not support RDBMS

orchestration:
    data:
        secondaryStorage:
            type: rdbms
            rdbms:
                host: pg-operate-rw
                port: 5432
                database: operate
                username: '' # set by CNPG from existingSecret
                secret:
                    existingSecret: pg-operate-secret
                    existingSecretKey: password

elasticsearch:
    enabled: false

CI test matrix & workflow

Added rosa-hcp-single-region-rdbms scenario to the test matrix with:

• secondary_storage: rdbms — drives conditional logic in the workflow
• ref_arch_dir: rosa-hcp-single-region — reuses the same ROSA cluster Terraform infrastructure instead of provisioning a dedicated cluster

Workflow changes in aws_openshift_rosa_hcp_single_region_tests.yml:

• Job-level IS_RDBMS_SCENARIO env var centralises the condition (matrix.scenario.secondary_storage == 'rdbms')
• Skips ECK Elasticsearch deploy/cleanup; deploys pg-operate CNPG cluster instead
• Applies camunda-rdbms-values.yml overlay in place of camunda-elastic-values.yml
• Passes optimize-enabled: false, elasticsearch-enabled: false, and clears elasticsearch-service-name in the chart test step
• Directory path references use matrix.scenario.ref_arch_dir || matrix.scenario.name so the RDBMS scenario correctly resolves to the rosa-hcp-single-region procedure/Terraform directories

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[OpenShift] Add CloudNativePG RDBMS as alternative secondary datastore option</issue_title>
<issue_description>Implement camunda/team-infrastructure-experience#1065

Context

Camunda 8.9 supports RDBMS (PostgreSQL) as an alternative secondary storage. We need a CloudNativePG-based variant for the OpenShift (ROSA HCP) reference architecture.

What to implement in this repo

1. CloudNativePG configuration

• Create a new variant or configuration in aws/openshift/rosa-hcp-single-region/ and/or generic/openshift/ that deploys CloudNativePG as secondary datastore instead of Elasticsearch/OpenSearch.
• Reuse the existing generic/kubernetes/operator-based/postgresql/ CloudNativePG manifests — they already deploy CNPG clusters for Keycloak/Identity. Add a second CNPG cluster (or database) for the RDBMS secondary datastore.
• Validate that CloudNativePG SecurityContextConstraints (SCC) work correctly on OpenShift.

2. Helm values

• Create new Helm values file(s) (e.g. helm-values/values-rdbms.yml) that:
  • Set global.elasticsearch.enabled: false
  • Enable RDBMS mode for Operate and Tasklist (configure their PostgreSQL connection)
  • Disable Optimize (optimize.enabled: false) since it does not support RDBMS
  • Connect to the CloudNativePG instance for secondary storage

3. CI workflow

• Add or update a CI workflow to test the CNPG RDBMS variant on ROSA HCP (deploy + basic pod health check).

References

• Current OpenShift setup: aws/openshift/rosa-hcp-single-region/
• Generic OpenShift configs: generic/openshift/
• CloudNativePG manifests: generic/kubernetes/operator-based/postgresql/
• Helm chart RDBMS config: global.elasticsearch.enabled: false, Operate/Tasklist RDBMS settings
• Parent epic: camunda/team-infrastructure-experience#953</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes [OpenShift] Add CloudNativePG RDBMS as alternative secondary datastore option #2081

---

💬 Send tasks to Copilot coding agent from Slack and Teams to turn conversations into code. Copilot posts an update in your thread when it's finished.

[github-actions]

🔀 Skip Workflow Checklist

Check the boxes below to skip specific workflows for this PR.

Global options

• skip_all - Skip all workflows

Individual workflows

• skip_aws_cognito_daily_cleanup
• skip_aws_common_procedure_s3_bucket
• skip_aws_compute_ec2_single_region_daily_cleanup
• skip_aws_compute_ec2_single_region_golden
• skip_aws_compute_ec2_single_region_tests
• skip_aws_ecs_single_region_fargate_daily_cleanup
• skip_aws_ecs_single_region_fargate_golden
• skip_aws_ecs_single_region_fargate_tests
• skip_aws_eks_single_region_daily_cleanup
• skip_aws_kubernetes_eks_dual_region_daily_cleanup
• skip_aws_kubernetes_eks_dual_region_golden
• skip_aws_kubernetes_eks_dual_region_teleport_tests
• skip_aws_kubernetes_eks_dual_region_tests
• skip_aws_kubernetes_eks_single_region_golden
• skip_aws_kubernetes_eks_single_region_tests
• skip_aws_modules_eks_rds_os_create_destruct_tests
• skip_aws_modules_eks_rds_os_daily_cleanup
• skip_aws_modules_eks_rds_os_tests
• skip_aws_openshift_rosa_hcp_dual_region_golden
• skip_aws_openshift_rosa_hcp_dual_region_tests
• skip_aws_openshift_rosa_hcp_single_region_golden
• skip_aws_openshift_rosa_hcp_single_region_tests
• skip_aws_rosa_hcp_dual_region_daily_cleanup
• skip_aws_rosa_hcp_single_region_daily_cleanup
• skip_azure_aks_single_region_daily_cleanup
• skip_azure_common_procedure_storageaccount_test
• skip_azure_kubernetes_aks_single_region_golden
• skip_azure_kubernetes_aks_single_region_tests
• skip_generic_kubernetes_migration_test
• skip_generic_kubernetes_operator_based_test
• skip_internal_global_pr_todo_checker
• skip_local_kubernetes_kind_single_region_tests

---

This checklist is automatically managed. Checked items will skip the corresponding workflow.