fix: helm production guide OIDC update

[bkenez]

Description

This PR makes the production Helm installation guide IdP-agnostic for authentication by removing incorrect AWS Simple AD references and replacing inline OIDC configuration with links to the authoritative authentication guides. The other AWS specific services stay.

Problem: The original guide incorrectly claimed AWS Simple Active Directory supports OIDC authentication (it doesn't: Simple AD is Samba 4-based LDAP). It also included ~150 lines of hardcoded Microsoft Entra ID configuration that duplicated content from the dedicated authentication guides and could become outdated.

When should this change go live?

• This is a bug fix, security concern, or something that needs urgent release support. (add bug or support label)
• This is already available but undocumented and should be released within a week. (add available & undocumented label)
• This is on a specific schedule and the assignee will coordinate a release with the Documentation team. (create draft PR and/or add hold label)
• This is part of a scheduled alpha or minor. (add alpha or minor label)
• There is no urgency with this change (add low prio label)

PR Checklist

• The commit history of this PR is cleaned up, using {type}(scope): {description} commit message(s)

• My changes are for an upcoming minor release and are in the /docs directory (version 8.9).
• My changes are for an already released minor and are in a /versioned_docs directory.

• I added a DRI, team, or delegate as a reviewer for technical accuracy and grammar/style:
  • Engineering team review
  • Technical writer review via @camunda/tech-writers unless working with an embedded writer.

[ThorbenLindhauer]

Thanks for preparing the PR. The change in itself looks fine to me. However, I have two questions before I can approve:

• Can you please clarify the reason why we recommended AWS Simple Active Directory and said it's compatible with Entra (we discussed this already on slack, just to make it visible here, too)?
• With this change, we change the nature of this guide a bit: In the previous state, it's an opinionated guide regarding all technology choices (essentially saying "set up everything with AWS"); now we leave the choice of OIDC provider open to the user; I have two potential concerns here:
  • What is the goal of this guide? Should it show users how to set up C8 on AWS end-to-end? If yes, should we rather show how to set up concretely with an AWS OIDC provider (AWS Cognito as I understand)? I think PM would be the stakeholder here
  • We are not able to give the user a full values file anymore (we have the placeholders for the Identity config); I think that makes the guide more error-prone, especially for less experienced people

[bkenez]

• Can you please clarify the reason why we recommended AWS Simple Active Directory and said it's compatible with Entra (we discussed this already on slack, just to make it visible here, too)?

Original intention seems to be to stick to an AWS specific setup; however it seems to have been missed that AWS Simple AD is not actually compatible with OIDC.

• With this change, we change the nature of this guide a bit: In the previous state, it's an opinionated guide regarding all technology choices (essentially saying "set up everything with AWS"); now we leave the choice of OIDC provider open to the user; I have two potential concerns here:

  • What is the goal of this guide? Should it show users how to set up C8 on AWS end-to-end? If yes, should we rather show how to set up concretely with an AWS OIDC provider (AWS Cognito as I understand)? I think PM would be the stakeholder here
  • We are not able to give the user a full values file anymore (we have the placeholders for the Identity config); I think that makes the guide more error-prone, especially for less experienced people

This is sadly a compromise. However the previous state of the guide was just straight up wrong, the current scope of the epic is just to correct the OIDC parts. However we do not run tests at the moment with AWS specific OIDC solutions (e.g. Cognito) so recommending one without a nightly test I am not a big fan of. For now, I believe that this is better than supplying a config that does not actually work (current state).
Discussing with @hisImminence we decided to include links to OIDC docs instead.

Once merged, I will create a follow-up issue to re-visit the production guide, as we have received some other feedback to it too.

[ThorbenLindhauer]

Thanks for the clarification. Looks good to me then. Agree we should review this at some point then.