Camunda STACKIT Deployment

Provision of reference configurations and examples for deploying Camunda 8 on STACKIT. This repository builds up on the official Camunda Deployment References with specific instructions, infrastructure templates, and best practices for STACKIT.

Camunda versions

Camunda	Where
8.10	main (current)
8.9	tag camunda-8.9
8.8	tag camunda-8.8

Table of Contents

• Local requirements
  • Terraform Installation
  • STACKIT CLI Installation
• STACKIT Access & Project Configuration
• Service accounts
  • Create a service account for Terraform
  • Create a service account for cert-manager (DNS-01)
• Terraform Backend (STACKIT Object Storage / S3)
  • Credentials Group for Terraform State
  • Create S3 Credentials
  • Configure Terraform Backend
• Terraform Infrastructure Deployment
  • Terraform apply
  • Destroy / Ressourcen cleanup:
• Kubernetes Access
• Accessing Camunda Hub
• Public endpoints
• References for later extensions

Local requirements

Terraform Installation

Documentation: Install Terraform

Required version: "1.16.3"

STACKIT CLI Installation

Documentation: STACKIT CLI

---

STACKIT Access & Project Configuration

# Login to STACKIT
stackit auth login

# Select project
stackit project list
stackit config set --project-id <PROJECT-ID>

---

Service accounts

The deployment uses two service accounts:

Service account	Used by	Role	Key file	Variable
terraform	Terraform, to provision all resources	editor	sa_key.json	sa_key_file_name
cert-manager	STACKIT cert-manager webhook in the cluster, for DNS-01	dns.admin	sa_key_cert_manager.json	cert_manager_sa_key_file_name

The cert-manager key is stored in the cluster. A separate service account ensures that this key can only manage DNS records.

Warning

If these service accounts already exist in the team, do not create new ones. Copy their existing key files into environments/<environment>/ instead; if a file name differs, set the corresponding variable from the table above.

Key files are matched by .gitignore (sa_key*.json). Never commit them.

Note

On Windows, run these commands in PowerShell 7 (pwsh) or a Bash shell. Windows PowerShell 5.1 writes redirected output (>) as UTF-16, which Terraform's file() function rejects as invalid UTF-8.

Documentation: Create a Service Account

Create a service account for Terraform

Create a new service account:

stackit service-account create --name <SERVICE_ACCOUNT_NAME>

Add the service account to the project:

stackit project member add <SERVICE_ACCOUNT_NAME>@sa.stackit.cloud --role editor

Create a key for the service account:

cd environments/<environment>/
stackit service-account key create --email <SERVICE_ACCOUNT_NAME>@sa.stackit.cloud > sa_key.json

Create a service account for cert-manager (DNS-01)

TLS certificates are issued through the STACKIT cert-manager webhook using ACME DNS-01, which only needs the STACKIT DNS API.

Create a new service account:

stackit service-account create --name <CERT_MANAGER_SA_NAME>

Add the service account to the project with DNS permissions only:

stackit project member add <CERT_MANAGER_SA_NAME>@sa.stackit.cloud --role dns.admin

Create a key for the service account:

cd environments/<environment>/
stackit service-account key create --email <CERT_MANAGER_SA_NAME>@sa.stackit.cloud > sa_key_cert_manager.json

---

Terraform Backend (STACKIT Object Storage / S3)

Warning

If the object storage, bucket, and credentials group already exist for this project, these steps do not need to be performed again.
In this case, the existing configuration can be used directly for the Terraform backend.

Prerequisites:

• Access to existing bucket and credential data
• Local file config.s3.tfbackend exists or can be created using existing keys
• All sensitive data is entered in .gitignore

# Enable object storage
stackit object-storage enable

# Create Bucket for Terraform State
stackit object-storage bucket create tfstate-bucket-camunda-ske-deployment

---

Credentials Group for Terraform State

stackit object-storage credentials-group create --name terraform-state

Result:

• Credentials Group ID
• URN

---

Create S3 Credentials

Use CREDENTIAL_GROUP_ID generated in previous step.

stackit object-storage credentials create --credentials-group-id <CREDENTIAL_GROUP_ID>

Generates:

• Access Key
• Secret Access Key
• Expiration Date: Never

---

Configure Terraform Backend

Note

Replace <environment> with the target environment directory (e.g. single-region).

Configure S3 Bucket

cp environments/<environment>/config.s3.example.tfbackend environments/<environment>/config.s3.tfbackend

Adjust secret_key and access_key:

access_key = "<S3_ACCESS_KEY>"
secret_key = "<S3_SECRET_KEY>"
bucket     = "tfstate-bucket-camunda-ske-deployment"
key        = "camunda_ske_deployment.tfstate"

Configure the remaining Terraform variables by copying terraform.tfvars.example to terraform.tfvars (cp environments/<environment>/terraform.tfvars.example environments/<environment>/terraform.tfvars) and replacing the placeholders.

---

Terraform Infrastructure Deployment

Terraform apply

cd environments/<environment>/
terraform init --backend-config=./config.s3.tfbackend
terraform plan
terraform apply

Result:

Running instances of:

• SKE Cluster
• Postgres
• OpenSearch
• Secrets Manager
• Keycloak
• Camunda 8

Destroy / Ressourcen cleanup:

terraform destroy

Important

terraform destroy deletes all instances listed above and cannot be undone.

---

Kubernetes Access

# View Cluster
stackit ske cluster list

# Create kubeconfig
stackit ske kubeconfig create <environment> --login

---

Accessing Camunda Hub

1. Access Camunda Hub via https://<dns_name>/hub. Since 8.10, Hub serves both Web Modeler and Console. https://<dns_name> redirects there as well.

   dns_name is a variable of the environment, set in its terraform.tfvars.

2. Log in with the initial Camunda user defined by the camunda_initial_user variable.
   The login username is taken from the username field of that input variable (camunda_initial_user.username).

   The password is generated automatically and can be viewed in the STACKIT Secrets Manager portal:

   • Secret: camunda-passwords
   • Key: firstUser

   How to view secrets: STACKIT – View, create and delete secrets

---

Public endpoints

Hostname	Served by	Gateway / listener
<dns_name>	Camunda web applications and REST API (/operate, /tasklist, /optimize, /hub, /managementidentity, ...)	camunda-gateway / https
zeebe.<dns_name>	Zeebe gRPC API	camunda-gateway / grpcs
keycloak.<dns_name>	Keycloak	keycloak-gateway / https

The hostnames are built once, in the locals of environments/single-region/main.tf.

---

References for later extensions

• Identity Secret: https://github.com/camunda/camunda-deployment-references/blob/stable/8.9/generic/openshift/single-region/procedure/create-identity-secret.sh
• Docs: https://docs.camunda.io/docs/self-managed/deployment/helm/configure/authentication-and-authorization/internal-keycloak/

---