Please supply a valid client secret for Optimize

[ziansari]

Hi,
I am trying to install Camunda 8.6 on AKS Cluster. Identity pod is failing to start due to below error.
I have verified the the optimize secret is setup correctly and being set as env variable in identity pod (KEYCLOAK_INIT_OPTIMIZE_SECRET).
Unable to identify what may cause this. Can someone please help on this .

Please supply a valid client secret for Optimize.

. ____ _ __ _ _
/\ / ’ __ _ () __ __ _ \ \ \
( ( )__ | '_ | '| | ’ / ` | \ \ \
\/ )| |)| | | | | || (| | ) ) ) )
’ || .__|| ||| |_, | / / / /
=========||==============|/=////

:: Spring Boot :: (v3.3.9)

2025-05-07 18:14:52.472 INFO 1 — [ main] i.c.i.Application : Starting Application using Java 17.0.14 with PID 1 (/app/identity.jar started by camunda in /app)
2025-05-07 18:14:52.482 INFO 1 — [ main] i.c.i.Application : The following 1 profile is active: “keycloak”
2025-05-07 18:14:54.887 WARN 1 — [ main trationDelegate$BeanPostProcessorChecker : Bean ‘globalMethodSecurityConfig’ of type [io.camunda.identity.security.config.GlobalMethodSecurityConfig$$SpringCGLIB$$0] is not eligible for getting processed by all BeanPostProcessors (for example: not eligible for auto-proxying). Is this bean getting eagerly injected/applied to a currently created BeanPostProcessor [healthEndpointGroupsBeanPostProcessor]? Check the corresponding BeanPostProcessor declaration and its dependencies/advisors. If this bean does not have to be post-processed, declare it with ROLE_INFRASTRUCTURE.
Standard Commons Logging discovery in action with spring-jcl: please remove commons-logging.jar from classpath in order to avoid potential conflicts
Standard Commons Logging discovery in action with spring-jcl: please remove commons-logging.jar from classpath in order to avoid potential conflicts
2025-05-07 18:14:58.173 INFO 1 — [ main] i.c.i.Application : Started Application in 6.879 seconds (process running for 8.428)
2025-05-07 18:15:01.688 ERROR 1 — [ main] .c.i.i.k.i.s.ClientInitializationService : Please supply a valid client secret for Optimize

[cpbpm]

Would you please share the chart file you are trying to deploy the Camunda. Are you deploying with default values or any customized values?

[ziansari]

values-latest.yaml (3.8 KB)

PFA Values files. I am using customized values file.

[cpbpm]

How did you create secrets, i see all the places you mentioned same secret name, how object key is created?

you can check the environment variables to make sure all the variables are set.

https://docs.camunda.io/docs/next/self-managed/identity/deployment/configuration-variables/?_gl=1*19urzyb*_gcl_au*ODUxNTQ5NjQ4LjE3NDI4Mzc0OTIuOTA5MDIxNDMyLjE3NDY3MTkyMDcuMTc0NjcxOTY2Mg…FPAUODUxNTQ5NjQ4LjE3NDI4Mzc0OTI._gaMTE2NDc4NzczNC4xNzQyODM3MTgw*_ga_4EYN8X5FNR*czE3NDY3MTcwNjAkbzEwNSRnMSR0MTc0NjcxOTY2MiRqMCRsMCRoMTg4MjQ1NDY5NQ…#component-configuration

Also you can refer the old thread,

Camunda-8 Identity is failing to connect keycloak

Hello @yogeshwer , just one more thing to consider: Do you have setup valid pairs of KEYCLOAK_INIT_*_ROOT_URL and KEYCLOAK_INIT_*_SECRET? Config for reference: If there is a client secret entered but no root url, this could cause the issue. Jonathan

[ziansari]

I have created the secrets as below -

apiVersion: v1
kind: Secret
metadata:
name: camunda-secret-for-components
type: Opaque
data:
connectors-secret: <base64_secret>
console-secret: <base64_secret>
operate-secret: <base64_secret>
optimize-secret: <base64_secret>
tasklist-secret: <base64_secret>
zeebe-secret: <base64_secret>
admin-password: <base64_secret>
postgres-password: <base64_secret>
password: <base64_secret>
smtp-password: <base64_secret>

I have verified below environment variables are being set , I will check for the remaining ones -

KEYCLOAK_INIT_CONSOLE_SECRET=<secret_value>
KEYCLOAK_INIT_OPERATE_SECRET=<secret_value>
KEYCLOAK_INIT_OPTIMIZE_SECRET=<secret_value>
KEYCLOAK_INIT_TASKLIST_SECRET=<secret_value>