test: add registry-camunda-cloud pull secret to camunda component integration values#6449
Merged
Merged
Conversation
…n values
The connectors component in the chart-full-setup integration scenario only
resolved imagePullSecrets [index-docker-io] (the global fallback), so deploys
that override connectors.image to a registry.camunda.cloud build hit the
registry anonymously and failed with ImagePullBackOff
("no basic auth credentials").
camundaPlatform.subChartImagePullSecrets is else-if, not a merge: a
component-level image.pullSecrets fully replaces global.image.pullSecrets.
webModeler already carries both secrets inline in base.yaml; connectors was
missed. Mirror the webModeler pattern across 8.7-8.10 so connectors gets both
index-docker-io and registry-camunda-cloud.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
github-actions
Bot
added
version/8.7
6 tasks
eamonnmoloney
requested review from
bkenez and
Copilot
and removed request for
a team
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the chart-full-setup integration scenario base values so the Connectors pod template renders with both Docker Hub (index-docker-io) and Camunda Cloud registry (registry-camunda-cloud) imagePullSecrets when Connectors images are overridden to registry.camunda.cloud.
Changes:
- Add
connectors.image.pullSecretsentries forindex-docker-ioandregistry-camunda-cloudin thechart-full-setupbase values. - Apply the same change consistently across chart versions 8.7, 8.8, 8.9, and 8.10.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| charts/camunda-platform-8.7/test/integration/scenarios/chart-full-setup/values/base.yaml | Adds Connectors image.pullSecrets for Docker Hub + Camunda Cloud registry in chart-full-setup base values. |
| charts/camunda-platform-8.8/test/integration/scenarios/chart-full-setup/values/base.yaml | Same Connectors pull secret addition for 8.8 chart-full-setup base values. |
| charts/camunda-platform-8.9/test/integration/scenarios/chart-full-setup/values/base.yaml | Same Connectors pull secret addition for 8.9 chart-full-setup base values. |
| charts/camunda-platform-8.10/test/integration/scenarios/chart-full-setup/values/base.yaml | Same Connectors pull secret addition for 8.10 chart-full-setup base values. |
…ents The connectors fix addressed only one of several camunda-image components that hit ImagePullBackOff when their image is overridden to a registry.camunda.cloud build. Because camundaPlatform.subChartImagePullSecrets replaces (not merges) global.image.pullSecrets, every component without an explicit registry-camunda-cloud entry authenticates to the Camunda registry anonymously and fails to pull. Mirror the connectors/webModeler/console pattern for the remaining camunda components in chart-full-setup/values/base.yaml: - 8.8-8.10: identity, optimize, orchestration - 8.7 (pre-unified): identity, operate, optimize, tasklist, zeebe, zeebeGateway Values-file-only change; no chart templates touched, so no golden snapshots are affected. Verified: helm lint passes for all four versions and helm template renders both index-docker-io and registry-camunda-cloud on every camunda workload. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
eamonnmoloney
changed the title
bkenez
approved these changes
Jun 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Which problem does the PR fix?
Camunda-image pods in
chart-full-setupintegration/nightly deploys fail with ImagePullBackOff whenever a component image is overridden to aregistry.camunda.cloudbuild (e.g.registry.camunda.cloud/team-connectors/connectors-bundle:8.8.14-stable-8.8-run<id>). The kubelet reportspull access denied … no basic auth credentials.Root cause:
camundaPlatform.subChartImagePullSecrets(templates/common/_helpers.tpl) is anelse if, not a merge — a component-levelimage.pullSecretsfully replacesglobal.image.pullSecrets. The global camunda default is onlyindex-docker-io, so any component whose image is overridden to the Camunda registry but lacks an explicitregistry-camunda-cloudentry authenticates anonymously and fails to pull. First observed on connectors (namespacecamunda-id-connectors-int-…): in the same pod set,web-modeler-restapigot both secrets (inline in base.yaml) while connectors got only the global one. The same gap exists for every other camunda component that has no inlineimage.pullSecrets.What's in this PR?
Mirror the
webModeler/consolepattern for the remaining camunda components in each version'schart-full-setup/values/base.yaml, adding bothindex-docker-ioandregistry-camunda-cloudtoimage.pullSecrets:connectors,identity,optimize,orchestrationconnectors,identity,operate,optimize,tasklist,zeebe,zeebeGateway(
index-docker-iois repeated because component-level pull secrets replace rather than merge with global, so the Docker-Hub default pull must stay covered. A global fix is not viable uniformly — 8.9/8.10 have noglobal.image.pullSecretskey at all.)Values-file-only change — no chart templates touched, so no golden snapshots are affected.
Verified:
helm lintpasses for all four versions, andhelm template … -f base.yamlnow renders every camunda workload (identity,optimize,connectors,console,web-modeler-*,orchestration/zeebe, plus 8.7operate/tasklist/zeebe-gateway) with bothindex-docker-ioandregistry-camunda-cloud.Checklist
Before opening the PR:
make go.update-golden-only.After opening the PR: