External OIDC setup docs is confusing for customers

[zalanszak]

On this page: https://docs.camunda.io/docs/self-managed/setup/guides/connect-to-an-oidc-provider/

At the configuration section there are environment variables and Helm values offered. However, it is not explicitly specified that they are in a XOR relation - i.e. the customer should not use both at the same time, but either the helm values or the environment variables. This confusion lead to incorrect setups in customer environments, e.g.: https://jira.camunda.com/browse/SUPPORT-24589

Please append an additional note that only one of these options should be used: either helm values or env variables, but not both!

[akeller]

@conceptualshark can you please review and PR?

[conceptualshark]

Left an open question with distribution on how to best handle this, as it seems related to either updating the Connectors docs for a better experience, or may need additional info on how/when env vars do not override Helm values. I think the ultimate impact may need to be in the Connectors config guide vs the OIDC docs.

[garima-camunda]

This came up again while discussing this support ticket. None of the support engineers were sure how to interpret the Connectors config (as shown in the screenshot).

• Do they need to specify all the configs or would it vary depending on env variable?
• The ones specified in "For inbound mode," do they belong to Operate?

@alessandrocavalli, please add/update if I missed something or anything is not correct.

[hisImminence]

Thanks @akeller for reaching out!

1. To resolve the first issues mentioned by @zalanszak in the ticket:

At the configuration section there are environment variables and Helm values offered. However, it is not explicitly specified that they are in a XOR relation

--> Please review this PR (adds a simple or in the statement).

2. For the two questions about connectors by @garima-camunda:

Do they need to specify all the configs or would it vary depending on env variable?
The ones specified in "For inbound mode," do they belong to Operate?

--> @sbuettner do you have the context to answer these and could clarify it in the doc section 🙏 ?

[sbuettner]

The ones specified in "For inbound mode," do they belong to Operate?

The Connectors act as a Client for Operate and would need this configuration.