Settings

Manage your cluster settings using authorizations, automatic cluster updates, and user task restrictions, or permanently delete the cluster.

Manage cluster settings

To manage your cluster settings:

1. Navigate to Camunda Hub, and select the Clusters tab.
2. Select the cluster you want to manage, and select the Settings tab.
3. Enable/disable cluster settings as required, or delete the cluster.

Authorizations

You can enable authorizations on a per-cluster basis to control the level of access users and clients have over Orchestration Cluster resources.

• Enable this setting to use authorizations in the cluster.
• Disable this setting if you do not want to use authorizations in the cluster. You can still configure authorizations in the Orchestration Cluster Admin, but they are only applied to the cluster when you enable this setting.

tip

Learn more about resource-based authorizations.

Multi-tenancy

You can enable multi-tenancy checks on a per-cluster basis to enforce tenant-level authorization for Orchestration Cluster resources.

note

This setting applies to Camunda 8 SaaS. In Self-Managed, multi-tenancy checks are not configured through this UI — set them using configuration properties at startup.

• Enable this setting to enforce tenant-level authorization checks. Users, groups, and roles not assigned to a tenant lose access to any resources scoped to that tenant.
• Disable this setting to allow tenants to be created and principals assigned without enforcing checks. All data maps to the <default> tenant.

This setting is disabled by default. Only organization admins can change it, and it is available for clusters running generation 8.8 and later. The setting is reversible: disabling it restores the implicit <default>-tenant behavior.

For details on creating tenants and managing assignments, see tenant management.

warning

Before you enable multi-tenancy checks, assign all users, groups, and roles that need access to their tenants and to the <default> tenant. Once checks are enforced, any principal not assigned to a tenant loses access to the resources scoped to that tenant.

Secret filter mode

You can change the connector secret filter mode on a per-cluster basis to control which secrets outbound and inbound connectors are allowed to resolve.

note

This setting applies to Camunda 8 SaaS. In Self-Managed, configure the mode using configuration properties.

• STRICT (default): a connector can only resolve secrets that are present for a given field in the actually deployed BPMN XML.
• LAX: for outbound connectors, falls back to DISABLED behavior (resolving all secrets) if the BPMN XML cannot be fetched. Inbound connectors behave the same as under STRICT, since their allow-list doesn't require a lookup.
• DISABLED: all secrets resolve freely, matching the behavior before this feature was introduced.

This setting is available for clusters running a version where STRICT is the shipped default: 8.6.28+, 8.7.25+, 8.8.19+, 8.9.10+, and 8.10.0-alpha5+. Only organization admins can change it.

For details on each mode, see secret filter.

Enable app integrations extensions

You can allow a cluster to exchange events with App Integrations, such as Camunda for Microsoft Teams, so App Integrations can deliver task notifications to your collaboration tool.

• Enable this setting to deliver user task notifications to Microsoft Teams based on your notification rules. Notification cards also update as the task is assigned, completed, or canceled.
• Disable this setting if you do not want the cluster to exchange events. App Integrations then work with reduced functionality: the cluster delivers no notifications, but you can still use Camunda for Microsoft Teams to browse tasks, start processes, and act on tasks.

This setting is disabled by default. It is available for clusters running generation 8.9 gen13 or later, and organization admins can change it.

Data filters

You can configure data filters on a per-cluster basis to control which process definitions and variables the Optimize exporter processes.

note

This setting applies to Camunda 8 SaaS. On Self-Managed, configure export filters using Helm values or configuration properties.

Enable the Enable data filters toggle to activate filtering. When enabled, the Optimize exporter only processes data matching the configured filters.

Enter one pattern per line, or separate values with spaces, in any of the four fields:

• Include process definitions: process definitions to include, matched by exact bpmnProcessId. Leave empty to include all process definitions.
• Exclude process definitions: process definitions to exclude, matched by exact bpmnProcessId. Exclusion takes precedence over inclusion.
• Include variable names: variable names to include, matched by prefix. For example, entering business_ includes all variables whose names start with business_. Leave empty to include all variables.
• Exclude variable names: variable names to exclude, matched by prefix. Exclusion takes precedence over inclusion.

New SaaS clusters include a default business_ variable include filter, which limits Optimize to variables whose names start with business_. For existing clusters, data filters are disabled by default and can be enabled with one click. No automatic migration occurs. On Self-Managed, no default filter is applied; configure filters manually using Helm values or configuration properties.

warning

Filtered records are permanently excluded from Optimize. Optimize cannot import data that was never exported, and dropped records cannot be recovered even if you change the filters later. For details, see Optimize export filtering.

Clicking Save filters restarts the cluster. Your cluster is briefly unavailable while it restarts.

For sizing guidance on variable filtering and its impact on Optimize, see impact of Optimize.

Automatic cluster updates

You can set the cluster to automatically update to newer versions of Camunda 8 when they are released.

• Enable this setting to automatically update the cluster when a new patch release is available. During an update, the cluster may be unavailable for a short time. You can still manually update the cluster.
• Disable this setting if you do not want the cluster to automatically update. You must manually update the cluster.

tip

For more information on updating clusters, see update your cluster.

Enforce user task restrictions

Starting with Camunda 8.10, this cluster setting is no longer available because user task access restrictions were removed together with Tasklist V1.

note

Use authorization-based access control and user task authorization to control task visibility and operations in current Tasklist deployments.

Delete this cluster

You can permanently delete the selected cluster. See delete your cluster.

caution

Deleting a cluster is permanent. You cannot reuse a cluster after it has been deleted.