docs(identity): add keycloak upgrade to the announcements for 8.7 and…

… 8.8 (#5141)
camunda · Mar 6, 2025 · ceffd12 · ceffd12
1 parent 62583d2
commit ceffd12
Show file tree

Hide file tree

Showing 6 changed files with 74 additions and 0 deletions.
diff --git a/docs/reference/announcements.md b/docs/reference/announcements.md
@@ -50,6 +50,7 @@ Camunda 8.7 is scheduled for release on 8 April 2025.
 - [Southeast Asia region for SaaS customers](/reference/announcements/870.md#southeast-asia-region-for-saas-customers-saas)
 - [Breaking changes in Camunda Process Test](/reference/announcements/870.md#breaking-changes-in-camunda-process-test)
 - [API updates](/reference/announcements/870.md#api-updates-saasself-managed)
+- [Identity Keycloak now requires v25 or v26](/reference/announcements/870.md#identity-keycloak-now-requires-v25-or-v26-self-managed)
 
 </div>
 </div>

diff --git a/docs/reference/announcements/870.md b/docs/reference/announcements/870.md
@@ -23,6 +23,7 @@ Important changes and updates for the Camunda 8.7 release are summarized below.
 - [Southeast Asia region for SaaS customers](#southeast-asia-region-for-saas-customers-saas)
 - [Breaking changes in Camunda Process Test](#breaking-changes-in-camunda-process-test)
 - [API updates](#api-updates-saasself-managed)
+- [Identity Keycloak now requires v25 or v26](#identity-keycloak-now-requires-v25-or-v26-self-managed)
 
 ## Amazon Web Services (AWS) region support <span class="badge badge--long" title="This feature affects SaaS">SaaS</span>
 
@@ -89,3 +90,7 @@ This is part of a transition where API entity keys change from type `integer (in
 See the [overview about API Key Attributes][camunda8-api-overview] for more details.
 
 [camunda8-api-overview]: /versioned_docs/version-8.7/apis-tools/camunda-api-rest/camunda-api-rest-overview.md#api-key-attributes
+
+## Identity Keycloak now requires v25 or v26 <span class="badge badge--long" title="This feature affects Self-Managed">Self-Managed</span>
+
+Identity 8.7 now requires Keycloak v25 or v26, and Keycloak versions must be updated to match. This update also includes changes to the Camunda Helm chart. For more information on configuration changes, see the Self-Managed [update guide](/self-managed/operational-guides/update-guide/860-to-870.md#identity).
diff --git a/docs/self-managed/operational-guides/update-guide/860-to-870.md b/docs/self-managed/operational-guides/update-guide/860-to-870.md
@@ -33,3 +33,34 @@ If you are using an 8.6 or 8.5 Java Client, the C8 API will recognize this and a
 attributes as `integer (int64)`. You don't need to add the extra content-type header to your client requests.
 
 [camunda8-api-overview]: ../../../apis-tools/camunda-api-rest/camunda-api-rest-overview.md#api-key-attributes
+
+## Identity
+
+### Keycloak now requires v25 or v26
+
+Identity 8.7 now requires Keycloak v25 or v26, and Keycloak versions must be updated to match. The following changes to the Helm chart have been made to support this upgrade.
+
+#### Increase container resources
+
+Keycloak containers require an increase in resources from the default. To set this increase, configure the following in the Camunda Helm chart:
+
+```yaml
+resources:
+  requests:
+    cpu: 1000m
+    memory: 1Gi
+  limits:
+    cpu: 2000m
+    memory: 2Gi
+```
+
+#### Allow insecure images
+
+As we repackage the Bitnami distribution with our Identity login page, `allowInsecureImages` must be set to `true`. This can be configured in the Camunda helm chart via the following:
+
+```yaml
+identityKeycloak:
+  global:
+    security:
+      allowInsecureImages: true
+```
diff --git a/versioned_docs/version-8.7/reference/announcements.md b/versioned_docs/version-8.7/reference/announcements.md
@@ -29,6 +29,7 @@ Camunda 8.7 is scheduled for release on 8 April 2025.
 - [Southeast Asia region for SaaS customers](/reference/announcements/870.md#southeast-asia-region-for-saas-customers-saas)
 - [Breaking changes in Camunda Process Test](/reference/announcements/870.md#breaking-changes-in-camunda-process-test)
 - [API updates](/reference/announcements/870.md#api-updates-saasself-managed)
+- [Identity Keycloak now requires v25 or v26](/reference/announcements/870.md#identity-keycloak-now-requires-v25-or-v26-self-managed)
 
 </div>
 </div>

diff --git a/versioned_docs/version-8.7/reference/announcements/870.md b/versioned_docs/version-8.7/reference/announcements/870.md
@@ -23,6 +23,7 @@ Important changes and updates for the Camunda 8.7 release are summarized below.
 - [Southeast Asia region for SaaS customers](#southeast-asia-region-for-saas-customers-saas)
 - [Breaking changes in Camunda Process Test](#breaking-changes-in-camunda-process-test)
 - [API updates](#api-updates-saasself-managed)
+- [Identity Keycloak now requires v25 or v26](#identity-keycloak-now-requires-v25-or-v26-self-managed)
 
 ## Amazon Web Services (AWS) region support <span class="badge badge--long" title="This feature affects SaaS">SaaS</span>
 
@@ -89,3 +90,7 @@ This is part of a transition where API entity keys change from type `integer (in
 See the [overview about API Key Attributes][camunda8-api-overview] for more details.
 
 [camunda8-api-overview]: /versioned_docs/version-8.7/apis-tools/camunda-api-rest/camunda-api-rest-overview.md#api-key-attributes
+
+## Identity Keycloak now requires v25 or v26 <span class="badge badge--long" title="This feature affects Self-Managed">Self-Managed</span>
+
+Identity 8.7 now requires Keycloak v25 or v26, and Keycloak versions must be updated to match. This update also includes changes to the Camunda Helm chart. For more information on configuration changes, see the Self-Managed [update guide](/self-managed/operational-guides/update-guide/860-to-870.md#identity).
diff --git a/...ned_docs/version-8.7/self-managed/operational-guides/update-guide/860-to-870.md b/...ned_docs/version-8.7/self-managed/operational-guides/update-guide/860-to-870.md
@@ -33,3 +33,34 @@ If you are using an 8.6 or 8.5 Java Client, the C8 API will recognize this and a
 attributes as `integer (int64)`. You don't need to add the extra content-type header to your client requests.
 
 [camunda8-api-overview]: ../../../apis-tools/camunda-api-rest/camunda-api-rest-overview.md#api-key-attributes
+
+## Identity
+
+### Keycloak now requires v25 or v26
+
+Identity 8.7 now requires Keycloak v25 or v26, and Keycloak versions must be updated to match. The following changes to the Helm chart have been made to support this upgrade.
+
+#### Increase container resources
+
+Keycloak containers require an increase in resources from the default. To set this increase, configure the following in the Camunda Helm chart:
+
+```yaml
+resources:
+  requests:
+    cpu: 1000m
+    memory: 1Gi
+  limits:
+    cpu: 2000m
+    memory: 2Gi
+```
+
+#### Allow insecure images
+
+As we repackage the Bitnami distribution with our Identity login page, `allowInsecureImages` must be set to `true`. This can be configured in the Camunda helm chart via the following:
+
+```yaml
+identityKeycloak:
+  global:
+    security:
+      allowInsecureImages: true
+```