chore(release): Camunda Platform Helm Chart 13.1.0 - Camunda 8.8 (#4576)

Author: distro-ci[bot]

.github/config/release-please/.release-please-manifest.json

@@ -4,6 +4,6 @@
     "charts/camunda-platform-8.5": "10.11.3",
     "charts/camunda-platform-8.6": "11.10.2",
     "charts/camunda-platform-8.7": "12.6.3",
-    "charts/camunda-platform-8.8": "13.0.0",
+    "charts/camunda-platform-8.8": "13.1.0",
     "charts/camunda-platform-8.9": "14.0.0-alpha0"
 }

.github/config/release-please/release-please-config.json

@@ -8,7 +8,7 @@
       "pull-request-title-pattern": "chore(release): Camunda Platform Helm Chart ${version} - Camunda 8.9",
       "release-type": "helm",
       "extra-label": "version/alpha,version/8.9,automation/release-please,release/pr,kind/chore,chart/camunda-platform",
-      "component": "camunda-platform-8.8",
+      "component": "camunda-platform-8.9",
       "include-v-in-tag": false
     },
     "charts/camunda-platform-8.8": {

.github/workflows/chart-release-chores.yaml

@@ -71,10 +71,13 @@ jobs:
         env:
           GH_TOKEN: "${{ steps.generate-github-token.outputs.token }}"
         run: |
+          set -euo pipefail
+
           git fetch origin main:main
-          pr_nubmer="$(echo $GITHUB_REF | awk 'BEGIN { FS = "/" }; { print $3 }')"
-          # Set PR project.
-          gh pr edit "${pr_nubmer}" --add-project "Distribution Team"
+
+          pr_number="$(echo "$GITHUB_REF" | awk 'BEGIN { FS = "/" } { print $3 }')"
+          gh project item-add --owner camunda --number 33 \
+            --url "https://github.com/camunda/camunda-platform-helm/pull/$pr_number" >/dev/null || true
       - name: Update golden files
         run: |
           chartPath="${CHANGED_CHARTS}" \

.github/workflows/chart-release.yaml

@@ -50,7 +50,7 @@ jobs:
           # Create a tmp file and ensure it's empty.
           echo "" > "${matrix_file}"
 
-          echo '${{ steps.generate-chart-versions.outputs.matrix }}' | jq -cr '.include.[0].version' | while read -r dir_id; do
+          echo '${{ steps.generate-chart-versions.outputs.matrix }}' | jq -cr '.include.[5].version' | while read -r dir_id; do
             chart_file="charts/camunda-platform-${dir_id}/Chart.yaml"
 
             # Extract version info.

charts/camunda-platform-8.8/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v2
 name: camunda-platform
-version: 13.0.0
+version: 13.1.0
 appVersion: 8.8.x
 description: |
   Camunda 8 Self-Managed Helm charts.
@@ -62,7 +62,7 @@ maintainers:
   - name: jessesimpson36
     email: [email protected]
 annotations:
-  camunda.io/helmCLIVersion: "3.18.6"
+  camunda.io/helmCLIVersion: "3.19.0"
   artifacthub.io/links: |
     - name: Camunda 8 docs
       url: https://docs.camunda.io/
@@ -73,145 +73,20 @@ annotations:
   artifacthub.io/containsSecurityUpdates: "false"
   artifacthub.io/changes: |
     - kind: added
-      description: "Support legacy retention age"
-    - kind: added
-      description: "Support issuer backend url in the orchestration config"
-    - kind: added
-      description: "Opensearch aws enabled config now affects usage of AWS credentials"
-    - kind: added
-      description: "Add the document store scenario to the qa scenario list"
-    - kind: added
-      description: "Introduce authenticationRefreshInterval config parameter"
-    - kind: added
-      description: "Add resource authorizations flag to identity migration"
-    - kind: added
-      description: "Add default roles for initial users"
-    - kind: added
-      description: "Add extra mapping for initial client for identity OIDC migration"
-    - kind: changed
-      description: "Upgrade keycloak image from 26.3.1 to 26.3.3"
-    - kind: changed
-      description: "Streamline OIDC and Microsoft Entra auth"
-    - kind: changed
-      description: "Rename zeebe/orchestration labels"
-    - kind: changed
-      description: "Differentiate between orchestration services"
-    - kind: changed
-      description: "Move orchestration oidc from global to component"
-    - kind: changed
-      description: "Move connectors oidc from global to component"
-    - kind: changed
-      description: "Support auth values in components"
-    - kind: changed
-      description: "Use the main config in migrations"
-    - kind: changed
-      description: "Use postgresql 14 for web modeler"
-    - kind: changed
-      description: "Use postgres 14 for web modeler"
-    - kind: changed
-      description: "Add nodeSelector, affinity, and tolerations to orchestration extra resources"
-    - kind: changed
-      description: "Set default replicas to 1 for secondary storage"
-    - kind: changed
-      description: "Run orchestration cluster from unified config"
-    - kind: fixed
-      description: "No default backwardsCompatibleAudiences"
-    - kind: fixed
-      description: "Remove duplicate servicemonitor"
-    - kind: fixed
-      description: "Release-please should create a non-alpha release for 8.8.0"
-    - kind: fixed
-      description: "Correct 13.0.0 version number"
-    - kind: fixed
-      description: "Undo part of the release notes thats wrong version"
-    - kind: fixed
-      description: "Fix doc links for 8.8"
-    - kind: fixed
-      description: "NoSecondaryStorage constraint no longer breaks unit tests"
-    - kind: fixed
-      description: "Wrong openshift compatibilty helper elasticsearch commonLabels usage"
-    - kind: fixed
-      description: "Operate opensearch access in the unified config"
-    - kind: fixed
-      description: "2 issues.. the configmap for optimize was using the elasticsearch prefix value for opensearch and the QA scenarios where reusing the global prefix to shared OS failed CI"
-    - kind: fixed
-      description: "Add the oidc group claim to opensearch"
-    - kind: fixed
-      description: "Simplify oidc mappings in 8.8"
-    - kind: fixed
-      description: "Firstuser defaults should not fire constraint"
-    - kind: fixed
-      description: "Partition-count typo in 8.8 chart"
-    - kind: fixed
-      description: "Identity migration inital contactPoint port number"
-    - kind: fixed
-      description: "Revert orchestration service name for backward compatibility"
-    - kind: fixed
-      description: "Comment in values.yaml for enabling management identity auth"
-    - kind: fixed
-      description: "Comment for identity existing secret"
-    - kind: fixed
-      description: "Add conditional properties for management components in manageme…"
-    - kind: fixed
-      description: "Revert tls secret placeholders"
-    - kind: fixed
-      description: "Add missing opensearch fields in templates"
-    - kind: fixed
-      description: "Reintroduce capability to disable all exporters again"
-    - kind: fixed
-      description: "Add security config to webmodeler"
-    - kind: fixed
-      description: "Data migration and importer config"
-    - kind: fixed
-      description: "Opensearch config and index replica placement"
-    - kind: fixed
-      description: "Use correct upgrade strategy for importer deployment"
-    - kind: fixed
-      description: "Data and identity migraiton accept orchestration env"
-    - kind: fixed
-      description: "Es/os exporter inherit index replicas"
-    - kind: fixed
-      description: "Clean up redundant secret templates"
-    - kind: fixed
-      description: "This PR is enabling Entra for testing"
-    - kind: fixed
-      description: "Correctly configure data migration"
-    - kind: fixed
-      description: "Define importer node id based on regionId"
-    - kind: fixed
-      description: "Adjust autogenerated secret detection patterns"
-    - kind: fixed
-      description: "Fix configurations of identity migration"
-    - kind: fixed
-      description: "Remove importer affinity in 8.8"
-    - kind: fixed
-      description: "Unique importer ids for swim"
-    - kind: fixed
-      description: "Add audiences for backward compatibility"
-    - kind: fixed
-      description: "Correct sysctlImage structure in values-enterprise.yaml"
-    - kind: fixed
-      description: "Web modeler extraConfiguration uses subcomponent subkey"
-    - kind: fixed
-      description: "Should be using 8.8 instead of 8.9 connectors"
-    - kind: fixed
-      description: "Couple importer deployment with migration"
-    - kind: fixed
-      description: "In optimize cm, set the zeebe name to be equal to prefix"
+      description: "Data injection during testing"
     - kind: fixed
-      description: "Set correct value for identity migration configmap"
+      description: "Consistent naming for migrations and importer"
     - kind: fixed
-      description: "Set client secret based on what it's bound to on identity-side"
+      description: "Changing pod anti-affinity rules for migration jobs and importer"
     - kind: fixed
-      description: "Update QA 8.8 opensearch values file"
+      description: "Allows cpu to be set as either string or number"
     - kind: fixed
-      description: "Update migration job labels so requests are not routed to them"
+      description: "Delete the migrator from 8.9"
     - kind: fixed
-      description: "Enable exporters when data migration is enabled"
+      description: "The oidc scenario was always running the upgrade. Removing here …"
     - kind: fixed
-      description: "Add constraints for ES and Basic auth in noSecondaryStorage mode"
+      description: "Use joinPath helper to fix double slash issues in console configmap"
     - kind: fixed
-      description: "Adjust secret constraint to reflect new secrets management"
+      description: "Apply dual-region exclusion logic to opensearch exporter as well"
     - kind: fixed
-      description: "Add missing global.identity.auth.identity.secret configuration"
-
+      description: "Add back mapping rules in the orchestration cluster"

charts/camunda-platform-8.8/RELEASE-NOTES.md

@@ -1,111 +1,26 @@
 The changelog is automatically generated and it follows [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/) format.
 
-## [camunda-platform-13.0.0](https://github.com/camunda/camunda-platform-helm/releases/tag/camunda-platform-13.0.0) (2025-10-13)
-
-### Refactor
-
-- Upgrade keycloak image from 26.3.1 to 26.3.3 (#4386)
-- Streamline OIDC and Microsoft Entra auth (#4416)
-- Rename zeebe/orchestration labels (#4430)
-
-### Fixes
-
-- No default backwardsCompatibleAudiences (#4421)
-- Remove duplicate servicemonitor (#4428)
-- Release-please should create a non-alpha release for 8.8.0 (#4439)
-- Correct 13.0.0 version number
-- Undo part of the release notes thats wrong version
-- Fix doc links for 8.8 (#4453)
-
-
-## [camunda-platform-8.5-10.11.3](https://github.com/camunda/camunda-platform-helm/releases/tag/camunda-platform-8.5-10.11.3) (2025-10-08)
+## [camunda-platform-13.1.0](https://github.com/camunda/camunda-platform-helm/releases/tag/camunda-platform-13.1.0) (2025-10-27)
 
 ### Features
 
-- Support legacy retention age (#4179)
-- Support issuer backend url in the orchestration config (#4265)
-
-### Refactor
-
-- Differentiate between orchestration services (#4190)
-- Move orchestration oidc from global to component (#4233)
-- Move connectors oidc from global to component (#4234)
-- Support auth values in components (#4279)
-- Use the main config in migrations (#4235)
-- Use postgresql 14 for web modeler (#4287)
-- Use postgres 14 for web modeler (#4327)
-- Add nodeSelector, affinity, and tolerations to orchestration extra resources (#4366)
+- Data injection during testing (#4423)
 
 ### Fixes
 
-- NoSecondaryStorage constraint no longer breaks unit tests (#4223)
-- Wrong openshift compatibilty helper elasticsearch commonLabels usage (#4180)
-- Operate opensearch access in the unified config (#4224)
-- 2 issues.. the configmap for optimize was using the elasticsearch prefix value for opensearch and the QA scenarios where reusing the global prefix to shared OS failed CI (#4238)
-- Add the oidc group claim to opensearch (#4244)
-- Simplify oidc mappings in 8.8 (#4229)
-- Firstuser defaults should not fire constraint (#4227)
-- Partition-count typo in 8.8 chart (#4245)
-- Identity migration inital contactPoint port number (#4260)
-- Revert orchestration service name for backward compatibility (#4264)
-- Comment in values.yaml for enabling management identity auth (#4273)
-- Comment for identity existing secret (#4275)
-- Add conditional properties for management components in manageme… (#4276)
-- Revert tls secret placeholders (#4239)
-- Add missing opensearch fields in templates (#4280)
-- Reintroduce capability to disable all exporters again (#4272)
-- Add security config to webmodeler (#4285)
-- Data migration and importer config (#4286)
-- Opensearch config and index replica placement (#4297)
-- Use correct upgrade strategy for importer deployment (#4310)
-- Data and identity migraiton accept orchestration env (#4291)
-- Es/os exporter inherit index replicas (#4309)
-- Clean up redundant secret templates (#4328)
-- This PR is enabling Entra for testing (#4294)
-- Correctly configure data migration (#4343)
-- Define importer node id based on regionId (#4349)
-- Adjust autogenerated secret detection patterns (#4342)
-- Fix configurations of identity migration (#4344)
-- Remove importer affinity in 8.8 (#4357)
-- Unique importer ids for swim (#4360)
-- Add audiences for backward compatibility (#4351)
-- Correct sysctlImage structure in values-enterprise.yaml (#4339)
-- Web modeler extraConfiguration uses subcomponent subkey (#4097)
-- Should be using 8.8 instead of 8.9 connectors (#4267)
-- Couple importer deployment with migration (#4346)
-- In optimize cm, set the zeebe name to be equal to prefix (#4382)
-- Set correct value for identity migration configmap (#4387)
-- Set client secret based on what it's bound to on identity-side (#4400)
-- Update QA 8.8 opensearch values file (#4405)
+- Consistent naming for migrations and importer (#4477)
+- Changing pod anti-affinity rules for migration jobs and importer (#4481)
+- Allows cpu to be set as either string or number (#4491)
+- Delete the migrator from 8.9 (#4503)
+- The oidc scenario was always running the upgrade. Removing here … (#4523)
+- Use joinPath helper to fix double slash issues in console configmap (#4562)
+- Apply dual-region exclusion logic to opensearch exporter as well (#4352)
+- Add back mapping rules in the orchestration cluster (#4545)
 
 ### Revert
 
-- "refactor: set default value for contextPath in all component… (#4221)
-
-
-## [camunda-platform-8.5-10.11.2](https://github.com/camunda/camunda-platform-helm/releases/tag/camunda-platform-8.5-10.11.2) (2025-09-18)
-
-### Features
-
-- Opensearch aws enabled config now affects usage of AWS credentials (#4163)
-- Add the document store scenario to the qa scenario list (#4117)
-- Introduce authenticationRefreshInterval config parameter (#3958)
-- Add resource authorizations flag to identity migration (#4197)
-- Add default roles for initial users (#4194)
-- Add extra mapping for initial client for identity OIDC migration (#4202)
-
-### Refactor
-
-- Set default replicas to 1 for secondary storage (#4150)
-- Run orchestration cluster from unified config (#4138)
-
-### Fixes
-
-- Update migration job labels so requests are not routed to them (#4143)
-- Enable exporters when data migration is enabled (#4196)
-- Add constraints for ES and Basic auth in noSecondaryStorage mode (#4170)
-- Adjust secret constraint to reflect new secrets management (#4182)
-- Add missing global.identity.auth.identity.secret configuration (#4222)
+- Update camunda-platform-8.8 major (#4461)
+- Install-tool-action part of feat - data injection during testing (#4467)
 
 <!-- generated by git-cliff -->
 ### Release Info
@@ -114,20 +29,20 @@ Supported versions:
 
 - Camunda applications: [8.8](https://github.com/camunda/camunda/releases?q=tag%3A8.8&expanded=true)
 - Camunda version matrix: [8.8](https://helm.camunda.io/camunda-platform/version-matrix/camunda-8.8)
-- Helm values: [13.0.0](https://artifacthub.io/packages/helm/camunda/camunda-platform/13.0.0#parameters)
-- Helm CLI: [3.18.6](https://github.com/helm/helm/releases/tag/v3.18.6)
+- Helm values: [13.1.0](https://artifacthub.io/packages/helm/camunda/camunda-platform/13.1.0#parameters)
+- Helm CLI: [3.19.0](https://github.com/helm/helm/releases/tag/v3.19.0)
 
 Camunda images:
 
-- docker.io/camunda/camunda:8.8.0
-- docker.io/camunda/connectors-bundle:8.8.0
-- docker.io/camunda/console:8.8.3
+- docker.io/camunda/camunda:8.8.1
+- docker.io/camunda/connectors-bundle:8.8.1
+- docker.io/camunda/console:8.8.17
 - docker.io/camunda/identity:8.8.0
 - docker.io/camunda/keycloak:26.3.3
 - docker.io/camunda/optimize:8.8.0
-- docker.io/camunda/web-modeler-restapi:8.8.0
-- docker.io/camunda/web-modeler-webapp:8.8.0
-- docker.io/camunda/web-modeler-websockets:8.8.0
+- docker.io/camunda/web-modeler-restapi:8.8.1
+- docker.io/camunda/web-modeler-webapp:8.8.1
+- docker.io/camunda/web-modeler-websockets:8.8.1
 
 Non-Camunda images:
 
@@ -141,10 +56,10 @@ Non-Camunda images:
 For quick verification of the Helm chart integrity using [Cosign](https://docs.sigstore.dev/signing/quickstart/):
 
 ```shell
-cosign verify-blob camunda-platform-13.0.0.tgz \
-  --bundle "camunda-platform-13.0.0-cosign-bundle.json" \
+cosign verify-blob camunda-platform-13.1.0.tgz \
+  --bundle "camunda-platform-13.1.0-cosign-bundle.json" \
   --certificate-identity-regex "https://github.com/camunda/camunda-platform-helm" \
   --certificate-oidc-issuer "https://token.actions.githubusercontent.com"
 ```
 
-For detailed verification instructions, check the steps in the `camunda-platform-13.0.0-cosign-verify.sh` file.
+For detailed verification instructions, check the steps in the `camunda-platform-13.1.0-cosign-verify.sh` file.

version-matrix/README.md

@@ -20,6 +20,7 @@ For the best experience, please remember:
 
 ## [Camunda 8.8](./camunda-8.8)
 
+### [Helm chart 13.1.0](./camunda-8.8/#helm-chart-1310)
 ### [Helm chart 13.0.0](./camunda-8.8/#helm-chart-1300)
 ### [Helm chart 13.0.0-alpha8](./camunda-8.8/#helm-chart-1300-alpha8)
 ### [Helm chart 13.0.0-alpha7](./camunda-8.8/#helm-chart-1300-alpha7)
@@ -33,6 +34,7 @@ For the best experience, please remember:
 
 ## [Camunda 8.7](./camunda-8.7)
 
+### [Helm chart 12.6.3](./camunda-8.7/#helm-chart-1263)
 ### [Helm chart 12.6.2](./camunda-8.7/#helm-chart-1262)
 ### [Helm chart 12.6.1](./camunda-8.7/#helm-chart-1261)
 ### [Helm chart 12.6.0](./camunda-8.7/#helm-chart-1260)