feat: add resource authorizations flag to identity migration (#4197)

Author: megglos

charts/camunda-platform-8.8/README.md

@@ -1364,6 +1364,7 @@ Please see the corresponding [release guide](../../docs/release.md) to find out
 | `orchestration.migration.data.tasks.retry.retryDelayMultiplier`       | can be used to define the delay multiplier.                                                                                                                                                                                                                                                                 | `2`                                                                                                                                                              |
 | `orchestration.migration.identity.enabled`                            | if true, the migration of Management Identity data to the orchestration clusters Identity occurs                                                                                                                                                                                                            | `false`                                                                                                                                                          |
 | `orchestration.migration.identity.backoffLimit`                       | can be used to specify the backoffLimit for the job https://kubernetes.io/docs/concepts/workloads/controllers/job/#pod-backoff-failure-policy                                                                                                                                                               | `6`                                                                                                                                                              |
+| `orchestration.migration.identity.resourceAuthorizationsEnabled`      | if true, the migration of Management Identity data to the orchestration cluster will not create wildcard resource access for roles, this is required to be true if Resource Based Access was used with 8.7                                                                                                  | `false`                                                                                                                                                          |
 | `orchestration.importer`                                              | configuration for the external tasklist and operate importer deployment for the orchestration cluster                                                                                                                                                                                                       |                                                                                                                                                                  |
 | `orchestration.importer.enabled`                                      | if true, the orchestration cluster deployment and its related resources are deployed via a helm release                                                                                                                                                                                                     | `false`                                                                                                                                                          |
 | `orchestration.importer.envFrom`                                      | list of environment variables to import from configMapRef and secretRef                                                                                                                                                                                                                                     | `[]`                                                                                                                                                             |

charts/camunda-platform-8.8/templates/orchestration/migration-identity-configmap.yaml

@@ -9,6 +9,7 @@ data:
       migration:
         identity:
           mode: {{ .Values.global.identity.auth.type }}
+          resource-authorizations-enabled: {{ .Values.orchestration.migration.identity.resourceAuthorizationsEnabled }}
           {{- if not ( eq .Values.global.identity.auth.type "KEYCLOAK" ) }}
           oidc:
             audiences:

charts/camunda-platform-8.8/values.yaml

@@ -2525,6 +2525,8 @@ orchestration:
       enabled: false
       ## @param orchestration.migration.identity.backoffLimit can be used to specify the backoffLimit for the job https://kubernetes.io/docs/concepts/workloads/controllers/job/#pod-backoff-failure-policy
       backoffLimit: 6
+      ## @param orchestration.migration.identity.resourceAuthorizationsEnabled if true, the migration of Management Identity data to the orchestration cluster will not create wildcard resource access for roles, this is required to be true if Resource Based Access was used with 8.7
+      resourceAuthorizationsEnabled: false
 
   ## @extra orchestration.importer configuration for the external tasklist and operate importer deployment for the orchestration cluster
   importer: