test(8.8): cover Zeebe TLS migration upgrade#6281
Open
eamonnmoloney wants to merge 2 commits into
Open
Conversation
github-actions
Bot
added
version/8.7
eamonnmoloney
requested review from
Copilot and
hamza-m-masood
and removed request for
a team and
Copilot
This was referenced Jun 3, 2026
hamza-m-masood
approved these changes
Jun 5, 2026
eamonnmoloney
force-pushed
the
inc-33081-intercluster-tls-test
branch
from
b5e6f65 to
dd95fbb
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
This pull request extends the integration-test upgrade coverage for the 8.7 → 8.8 elasticsearch-self-signed-upgrade scenario by enabling Zeebe internal TLS during the migration flow, and ensures the required TLS Secret exists prior to the 8.7 install step so it persists through the upgrade.
Changes:
- Adds a new
zeebe-tlsfeature to the 8.8 upgrade scenario registry (and snapshot) so the scenario runs with Zeebe internal TLS enabled. - Introduces 8.7 pre-setup scripts to create/reuse the
camunda-zeebe-tlsSecret ahead of the Step-1 (8.7) install. - Adds 8.7/8.8 feature values overlays to mount the TLS Secret and set the relevant Zeebe TLS environment variables for the components involved in the upgrade.
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| scripts/deploy-camunda/matrix/lifecycle_allowlist.go | Allowlists new pre-setup scripts used for the cross-version upgrade hook path. |
| charts/camunda-platform-8.8/test/integration/scenarios/chart-full-setup/values/features/zeebe-tls.yaml | Adds the 8.8-side feature overlay to mount Zeebe TLS Secret and set TLS env vars for orchestration/importer/migration. |
| charts/camunda-platform-8.8/test/ci/registry/scenarios/elasticsearch-self-signed-upgrade.yaml | Enables the zeebe-tls feature for the elasticsearch-self-signed-upgrade scenario. |
| charts/camunda-platform-8.8/test/ci/registry/hooks/elasticsearch-self-signed-upgrade.yaml | Updates hook description to reflect creation of the Zeebe TLS Secret as part of pre-install preparation. |
| charts/camunda-platform-8.8/test/ci/registry-snapshot.yaml | Regenerates the registry snapshot to include the zeebe-tls feature and updated hook description. |
| charts/camunda-platform-8.7/test/integration/scenarios/pre-setup-scripts/pre-install-elasticsearch-self-signed-upgrade.sh | Adds a dedicated pre-install wrapper for the upgrade scenario that provisions TLS secrets (ES + Zeebe). |
| charts/camunda-platform-8.7/test/integration/scenarios/pre-setup-scripts/create-zeebe-tls-secret.sh | Adds helper to generate a self-signed Zeebe TLS cert/key and create the camunda-zeebe-tls Secret. |
| charts/camunda-platform-8.7/test/integration/scenarios/chart-full-setup/values/features/zeebe-tls.yaml | Adds the 8.7-side feature overlay to mount the TLS Secret and set Zeebe broker/gateway TLS env vars for the source install. |
eamonnmoloney
force-pushed
the
inc-33081-intercluster-tls-test
branch
from
dd95fbb to
9321f5b
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
elasticsearch-self-signed-upgradescenario.camunda-zeebe-tlsSecret before the 8.7 source install so the Secret is reused through the upgrade instead of rotating mid-migration.Validation
go test ./matrixmake helm.dependency-update chartPath=charts/camunda-platform-8.7make helm.dependency-update chartPath=charts/camunda-platform-8.8bash -n charts/camunda-platform-8.7/test/integration/scenarios/pre-setup-scripts/create-zeebe-tls-secret.shplus local fake-kubectlrun confirmed the generated Zeebe cert includes DNS/IP SANsdeploy-camunda matrix listconfirmedfeatures=migrator,zeebe-tlsesssupgrade in 11m31sinc33081-h7-data-gke:tests/SM-8.7/smoke-tests.spec.ts/Most Common Flow User Flow With All Appsmigrator,zeebe-tlsoperate-import-position-8.3.0_ total=36 pending=0andtasklist-import-position-8.2.0_ total=19 pending=0using TLSLinks