Hi,
I’m currently installing Camunda 8.8 in a Kubernetes Cluster with Entra ID Authentication and ElasticSearch for data and Cloudnative-pg Postgres database for configuration database.
I used my working Camunda 8.7 config yaml files for the Helm installation and migrated them to 8.8 values.
Zeebe and Optimize pods are running but Identity is constnatly rebooting due to the following error:
2025-11-14 09:47:39.274 INFO 1 — [ main] i.c.i.Application : Starting Application using Java 17.0.16 with PID 1 (/app/identity.jar started by camunda in /app)
2025-11-14 09:47:39.293 INFO 1 — [ main] i.c.i.Application : The following 1 profile is active: “oidc”
2025-11-14 09:47:46.719 WARN 1 — [ main] trationDelegate$BeanPostProcessorChecker : Bean ‘globalMethodSecurityConfig’ of type [io.camunda.identity.security.config.GlobalMethodSecurityConfig$$SpringCGLIB$$0] is not eligible for getting processed by all BeanPostProcessors (for example: not eligible for auto-proxying). Is this bean getting eagerly injected/applied to a currently created BeanPostProcessor [healthEndpointGroupsBeanPostProcessor]? Check the corresponding BeanPostProcessor declaration and its dependencies/advisors. If this bean does not have to be post-processed, declare it with ROLE_INFRASTRUCTURE.
2025-11-14 09:47:49.096 WARN 1 — [ main] JpaBaseConfiguration$JpaWebConfiguration : spring.jpa.open-in-view is enabled by default. Therefore, database queries may be performed during view rendering. Explicitly configure spring.jpa.open-in-view to disable this warning
2025-11-14 09:48:01.834 WARN 1 — [ main] i.c.i.c.AppConfig : Expected a valid license but encountered an invalid one instead. Please check the license key and try again.
2025-11-14 09:48:09.229 INFO 1 — [ main] i.c.i.Application : Started Application in 33.227 seconds (process running for 37.245)
2025-11-14 09:48:10.194 ERROR 1 — [ main] o.s.b.SpringApplication : Application run failed
java.lang.IllegalArgumentException: permission.notFound
at io.camunda.identity.impl.oidc.OidcRoleServiceImpl.lambda$assignPermission$3(OidcRoleServiceImpl.java:84) ~[!/:?]at java.base/java.util.Optional.orElseThrow(Unknown Source) ~[?:?]at io.camunda.identity.impl.oidc.OidcRoleServiceImpl.lambda$assignPermission$4(OidcRoleServiceImpl.java:84) ~[!/:?]at java.base/java.util.Optional.ifPresentOrElse(Unknown Source) ~[?:?]at io.camunda.identity.impl.oidc.OidcRoleServiceImpl.assignPermission(OidcRoleServiceImpl.java:78) ~[!/:?]at io.camunda.identity.impl.oidc.initializer.service.RoleInitializerService.lambda$initialize$0(RoleInitializerService.java:38) ~[!/:?]at java.base/java.lang.Iterable.forEach(Unknown Source) ~[?:?]at io.camunda.identity.impl.oidc.initializer.service.RoleInitializerService.lambda$initialize$1(RoleInitializerService.java:35) ~[!/:?]at java.base/java.util.ArrayList.forEach(Unknown Source) ~[?:?]
I couldn’t find any solution to this error, I built the config with the official documentation, here is my code:
global:
identity:
auth:
enabled: true
# Docu for Entra ID: https://docs.camunda.io/docs/self-managed/identity/configuration/connect-to-an-oidc-provider/?authPlatform=microsoftEntraId&optionsType=helm
issuer: "https://login.microsoftonline.com/${microsoft_tenant_id}/v2.0"
# this is used for container to container communication.
issuerBackendUrl: "https://login.microsoftonline.com/${microsoft_tenant_id}/v2.0"
tokenUrl: "https://login.microsoftonline.com/${microsoft_tenant_id}/oauth2/v2.0/token"
authUrl: https://login.microsoftonline.com/${microsoft_tenant_id}/oauth2/v2.0/authorize
jwksUrl: "https://login.microsoftonline.com/${microsoft_tenant_id}/discovery/v2.0/keys"
type: "MICROSOFT"
publicIssuerUrl: "https://login.microsoftonline.com/${microsoft_tenant_id}/v2.0"
identity:
clientId: ${microsoft_client_id_identity}
audience: ${microsoft_client_id_identity}
secret:
existingSecret: ${namespace_name}
existingSecretKey: "identity-secret"
redirectUrl: "https://${namespace_name}.${service_uri}${stage_uri}${domain}/identity"
initialClaimName: preferred_username
initialClaimValue: "mail@mail.com"
identityKeycloak:
enabled: false
identity:
enabled: true
fullURL: "https://${namespace_name}.${service_uri}${stage_uri}${domain}/identity"
contextPath: "/identity"
nodeSelector:
k8s-nodepool: ${nodepool_name}
env:
- name: LOGGING_LEVEL_ROOT
value: warn # info debug
- name: PATH
value: "/opt/java/openjdk/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
- name: JAVA_HOME
value: "/opt/java/openjdk"
- name: SERVER_TOMCAT_MAXHTTPRESPONSEHEADERSIZE
value: "32KB"
command: ["java","-jar","identity.jar"]
extraVolumes:
- downwardAPI:
defaultMode: 420
items:
- fieldRef:
apiVersion: v1
fieldPath: metadata.annotations
path: annotations
name: podinfo
externalDatabase:
enabled: true
host: "${postgresql_service_url}"
port: ${postgresql_service_port}
username: "${identity_database_username}"
database: "${identity_database}?sslmode=require"
existingSecret: ${namespace_name}
existingSecretPasswordKey: identity-db-secret
identityPostgresql:
enabled: false
nodeSelector:
k8s-nodepool: ${nodepool_name}
I have no clue where this error is coming from, database in postgres SQL is created and filled with values, Entra ID app registration has user permissions.
Kind Regards!
Important: According to the 