For the complete documentation index, see llms.txt.
Skip to main content
Version: 8.10 (unreleased)

Enable additional Camunda components

The default Helm deployment includes the Orchestration ClusterOrchestration ClusterThe Orchestration Cluster is the core component of Camunda 8, powering the automation and orchestration of processes. An Orchestration Cluster includes: and Connectors. This page explains how to enable other Camunda components.

Default vs. additional components​

Enabled by default​

  • Orchestration Cluster (Zeebe, Zeebe Gateway, Operate, Tasklist, Orchestration Cluster Admin)
  • Connectors

Additional components (must be explicitly enabled)​

  • Camunda Hub
  • Management Identity
  • Optimize

Management Identity​

Identity management has two distinct scopes:

  • Orchestration Cluster Admin - Manages authentication and authorization for core orchestration components (Zeebe, Operate, Tasklist) and their APIs. This is built into the Orchestration Cluster and does not require Management Identity.
  • Management Identity - Controls access to Camunda Hub and Optimize. This is a separate component that must be explicitly enabled.

Management Identity must be enabled if you want to use any of the following components:

  • Camunda Hub
  • Optimize

Check the authentication and authorization guide for detailed steps on enabling and configuring Management Identity.

info

If you enable Camunda Hub or Optimize without enabling Management Identity, these components will not function properly, as they require authentication. The Orchestration Cluster (Zeebe, Operate, Tasklist, and Orchestration Cluster Admin) does not depend on Management Identity.

Camunda Hub​

Enable Camunda Hub with the following configuration options. If you're upgrading from Camunda 8.9, see the Camunda Hub consolidation migration steps.

  • Set camundaHub.enabled: true.
  • Enable Management Identity for authentication. See authentication and authorization.
  • Configure your SMTP server in camundaHub.restapi.extraConfiguration. Camunda Hub requires an SMTP server to send notification emails.
  • Configure an external PostgreSQL connection under camundaHub.restapi.externalDatabase. Provision PostgreSQL externally, such as with a managed service or the CloudNativePG operator.

We recommend specifying values in a YAML file and passing it to the helm install command.

Minimal configuration file:

camundaHub:
  enabled: true
  restapi:
    mail:
      secret:
        existingSecret: "camunda-credentials-webmodeler"
        existingSecretKey: "webmodeler-smtp-user-password"
    externalDatabase:
      url: jdbc:postgresql://postgres.example.com:5432/modeler-db
      username: modeler-user
      secret:
        existingSecret: "camunda-credentials-webmodeler"
        existingSecretKey: "webmodeler-postgresql-user-password"
    extraConfiguration:
      - file: mail.yaml
        content: |
          spring:
            mail:
              host: smtp.example.com
              port: 587
              username: user
          camunda:
            modeler:
              mail:
                from-address: no-reply@example.com

For more details, see the Camunda Hub Helm values.

note

When using kubectl port-forward to log in to Camunda Hub with Keycloak deployed via the Keycloak Operator, you must also port-forward the Keycloak service so the OpenID Connect (OIDC) redirect works:

kubectl port-forward svc/keycloak-service 18080:18080

Alternatively, configure Identity with Ingress. See the Ingress setup guide.

Optimize​

Optimize is disabled by default in the Camunda 8 Helm chart. To enable it:

optimize:
  enabled: true

For a full list of options, see the Optimize Helm values.

note

Disabling Optimize removes the legacy Elasticsearch/OpenSearch exporter from the broker's static configuration. However, it does not remove the exporter from the dynamic configuration, which prevents log compaction and increases disk usage. See Disable an exporter for the additional step required to fully disable it.