Skip to main content
Version: 8.4

Configuration

You can configure the Connector runtime environment in the following ways:

  • The Zeebe instance to connect to.
  • The Connector functions to run.
  • The secrets that should be available to the Connectors.

Connecting to Zeebe

In general, the Connector Runtime will respect all properties known to Spring Zeebe.

To use Camunda 8 SaaS specify the connection properties:

ZEEBE_CLIENT_CLOUD_CLUSTER-ID=xxx
ZEEBE_CLIENT_CLOUD_CLIENT-ID=xxx
ZEEBE_CLIENT_CLOUD_CLIENT-SECRET=xxx
ZEEBE_CLIENT_CLOUD_REGION=bru-2

You can further configure separate connection properties for Camunda Operate (otherwise it will use the properties configured for Zeebe above):

CAMUNDA_OPERATE_CLIENT_CLIENT-ID=xxx
CAMUNDA_OPERATE_CLIENT_CLIENT-SECRET=xxx

If you are connecting a local Connector runtime to a SaaS cluster, you may want to review our guide to using Connectors in hybrid mode.

Manual discovery of Connectors

By default, the Connector runtime picks up outbound Connectors available on the classpath automatically. To disable this behavior, use the following environment variables to configure Connectors and their configuration explicitly:

Environment variablePurpose
CONNECTOR_{NAME}_FUNCTION (required)Function to be registered as job worker with the given NAME
CONNECTOR_{NAME}_TYPE (optional)Job type to register for worker with NAME
CONNECTOR_{NAME}_INPUT_VARIABLES (optional)Variables to fetch for worker with NAME
CONNECTOR_{NAME}_TIMEOUT (optional)Timeout in milliseconds for worker with NAME

Through that configuration, you define all job workers to run.

Specifying optional values allow you to override @OutboundConnector-provided Connector configuration.

CONNECTOR_HTTPJSON_FUNCTION=io.camunda.connector.http.HttpJsonFunction
CONNECTOR_HTTPJSON_TYPE=non-default-httpjson-task-type

Secrets

Providing secrets to the runtime environment can be achieved in different ways, depending on your setup.

caution

By default, all environment variables can be used as Connector secrets.

To limit the environment that can be accessed by the default secret provider, configure a prefix. For example:

export CAMUNDA_CONNECTOR_SECRETPROVIDER_ENVIRONMENT_PREFIX='SUPER_SECRETS_'
export SUPER_SECRETS_MY_SECRET='foo' # This will be resolved by using {{ secrets.MY_SECRET }}

The following environment variables can be used to configure the default secret provider:

NameDescriptionDefault value
CAMUNDA_CONNECTOR_SECRETPROVIDER_ENVIRONMENT_ENABLEDWhether the default secret provider is enabled.true
CAMUNDA_CONNECTOR_SECRETPROVIDER_ENVIRONMENT_PREFIXThe prefix applied to the secret name before looking up the environment.""

Multi-tenancy

The Connector Runtime supports multiple tenants for inbound and outbound Connectors. A single Connector Runtime can serve a single tenant or can be configured to serve multiple tenants. By default, the runtime uses the <default> tenant id for all Zeebe related operations like handling Jobs and publishing Messages.

info

Support for outbound Connectors with multiple tenants requires a dedicated tenant job worker config (described below). Inbound Connectors will automatically work for all tenants the configured Connector Runtime client has access to. This can be configured in Identity via the application assignment.

Environment variables

The following environment variables are used by the Connector Runtime for the configuration of multi-tenancy.

NameDescriptionDefault value
ZEEBE_CLIENT_DEFAULT-TENANT-IDThe default tenant id used to communicate with Zeebe<default>
ZEEBE_CLIENT_DEFAULT-JOB-WORKER-TENANT-IDSThe default tenants ids (comma separated) used to activate jobs<default>

If you are using an embedded version of the Connector Runtime you can specify the tenant information in your Spring configuration like in this example application.properties file:

zeebe.client.default-tenant-id=<default>
zeebe.client.default-job-worker-tenant-ids=t1,<default>

Outbound Connector config

The Connector Runtime uses the <default> tenant for outbound Connector related features. If support for a different tenant or multiple tenants should be enabled, the tenants need to be configured individually using the following environment variables.

If you want to use outbound Connectors for a single tenant that is different from the <default> tenant you can specify a different default tenant id using:

ZEEBE_CLIENT_DEFAULT-TENANT-ID=tenant1

This will change the default tenant id used for fetching jobs and publishing messages to the tenant id tenant1.

note

Please keep in mind that inbound Connectors will still be enabled for all tenants that the Connector Runtime client has access to.

If you want to run the Connector Runtime in a setup where a single runtime serves multiple tenants you have to add each tenant id to the list of the default job workers:

ZEEBE_CLIENT_DEFAULT-JOB-WORKER-TENANT-IDS=tenant1, tenant2

In this case the ZEEBE_CLIENT_DEFAULT-TENANT-ID will not be used for the configuration of job workers.

Inbound Connector config

The Connector Runtime will fetch and execute all inbound Connectors it receives from Operate independently of the outbound Connector configuration without any additional configuration required from the user.

If you want to restrict the Connector Runtime inbound Connector feature to a single tenant or multiple tenants you have to use Identity and assign the tenants the Connector application should have access to.

Troubleshooting

To ensure seamless integration and functionality, the multi-tenancy feature must also be enabled across all associated components if not configured in Helm so users can view any data from tenants for which they have authorizations configured in Identity.

Find more information (including links to individual component configuration) on the multi-tenancy concepts page.

Logging

Google Stackdriver (JSON) logging

To enable Google Stackdriver compatible JSON logging, set the environment variable CONNECTORS_LOG_APPENDER=stackdriver on the Connector Runtime.