[ENHANCEMENT] Selectively configure the authentication for each component

[rb83]

The helm charts currently do not allow for selective toggling of authentication for individual subcharts. In our example,
we don't expose zeebe(-gateway) outside the cluster and only use internal communication, plus the occasional port-forward to deploy processes or use zbctl. Hence, we do not use authentication nor TLS there.

However, we do expose Operate, but without identity, one is stuck with the default users in elasticsearch (demo/demo...) and can't use keycloak to define users. Enabling it allows to use keycloak, but will for example require a Bearer Token with zbctl.

Actual behavior:
The setting zeebe.gateway.security of zeebe gateway's application.yaml (line 147) is only exposed through the helm chart by the global setting global.identity.auth.enabled ( File gateway-deployment.yaml (line 74) ).

Expected behavior:
Possible to disable security on zeebe-gateway exlusively and use keycloak/identity on other products such as Operate, Tasklist, etc.

How to reproduce:

• global.identity.auth.enabled=true, identity.enabled=true: Operate can be used with custom defined users in keycloak, gateway requires authentication
• global.identity.auth.enabled=false, identity.enabled=true: Operate uses default users, gateway requires no authentication

Logs:
N/A

Environment:

• Platform: Self-Managed k8s
• Helm CLI version: v3.11.3
• Chart version: 8.2.12
• Values file:

[aabouzaid]

@rb83 thanks for the suggestion 👍
I will add it to our roadmap. But since that, you can disable each component by overriding the auth env var.

For example, for ZeebeGateway you can set the following var to disable the auth (please note the value should upper case as written here).

  env:
  - name: ZEEBE_GATEWAY_SECURITY_AUTHENTICATION_MODE
    value: "NONE"

[rb83]

Thanks @aabouzaid ! Previous to your reply, I've solved it by patching the gateway-deployment.yaml. I will use your workaround next time when I upgrade to a recent helm chart & camunda version.

[jessesimpson36]

Closing as newer camunda helm charts do not use subcharts at all.