Upgrading notes for v.2026.6.1 in Kubernetes environment

Access certification — the certification configurations, campaigns, access review items, and the campaign compute (initialization and scope filtering, report generation, review completion and revocation handling, and review-complete notification data) — has been pulled out of openiam-esb and into a new standalone microservice, certification-manager, with its own database (certification). Separating certification from the ESB lets large certification campaigns be scaled and tuned independently, reduces memory pressure on the ESB, and isolates failures so certification jobs can't impact API traffic. The Activiti review workflow itself stays in the workflow service; its certification steps delegate the compute to certification-manager over RabbitMQ.

Upgrade notes for v2026.6.1

Provision the new `certification` database

Before upgrading, create a new certification database/schema on your existing database server (MySQL/MariaDB, MSSQL, Oracle, or PostgreSQL). The certification manager applies its own migrations on first start.

New configuration properties

Configure the following properties (and matching Vault secrets) in datasource.properties:

jdbc.certification.url=<jdbc URL for the new certification DB>
vault.secret.certification.jdbc.username=<username>
vault.secret.certification.jdbc.password=<password>
certification.databaseSchema.name=certification

In Kubernetes, the certification-manager statefulset reads the database and schema names from the openiam.database.jdbc.certification block of its Helm values.yaml and injects them as the JDBC_CERTIFICATION_DATABASE_NAME / JDBC_CERTIFICATION_SCHEMA_NAME environment variables:

openiam:
  database:
    jdbc:
      certification:
        host: ""
        port: ""
        databaseName: ""
        schemaName: ""

Deploy the new microservice — migration runs automatically

Deploy the certification-manager Helm chart (helmcharts/certification-manager) alongside openiam-esb, the same way batch-task-manager is deployed.

To copy the existing certification data forward from the legacy openiam database, start the service once with the migration flag enabled:

org.openiam.certification.migrate-from-openiam=true

On the first start of the new service with that flag set:

The schema migrations create the certification tables (CERTIFICATION*, ACCESS_REVIEW_ITEM*, and the new CERTIFICATION_REVIEWER / CERTIFICATION_REVIEWER_ESCALATION tables).
The migration runner copies the certification data set out of openiam, preserving primary keys (in-flight Activiti workflows store reviewer and campaign ids as process variables, so ids must not change). The legacy ACCESS_CERTIFICATION* tables become CERTIFICATION*, and the CERTIFICATION-typed rows of the shared APPROVER_ASSOC / ESCALATION tables become the certification-owned CERTIFICATION_REVIEWER / CERTIFICATION_REVIEWER_ESCALATION tables.
The runner short-circuits if the target CERTIFICATION table already has rows, so subsequent starts and restarts are no-ops.

After verifying the migrated row counts, set the flag back to false (leaving it on is safe — it is a no-op once the target tables are populated).

Notes for developers maintaining custom Groovy scripts

The base class that customer certification Groovy scripts extend (CustomCertificationHelper) moved again as part of this extraction. Any customer-customized Groovy scripts that reference the old package will fail to compile until imports are updated.

Package move to apply in customer Groovy scripts:

org.openiam.batch.manager.initializer.AccessCertificationHelper (base class for CustomCertificationHelper) → org.openiam.certification.initializer.CertificationHelper

If you upgraded through v2026.5.2, this class was previously at org.openiam.esb.core.batch.tasks.AccessCertificationHelper and then org.openiam.batch.manager.initializer.AccessCertificationHelper. It now lives in certification-manager as org.openiam.certification.initializer.CertificationHelper.

More broadly, the certification entity / repository / service / report / initializer / MQ-listener packages have moved from org.openiam.esb.* (and org.openiam.batch.manager.initializer.*) to org.openiam.certification.* (domain, repository, service, converter, report, initializer, review, mq). The shared DTO contract (Certification, ApproverAssociation, Escalation, and the AccessReviewItem* DTOs) is unchanged.

Out-of-the-box scripts shipped in conf/iamscripts/bpm/certification/ have already been updated to the new packages.

Terminology

Throughout the product, a certification is the configuration of a review (scope, reviewers, schedule) and a campaign is one run of that certification. Earlier releases referred to this feature as "access certification" and used the UAR (User Access Review) abbreviation; both refer to the same feature. The persisted AssociationType.CERTIFICATION enum value and all @Enumerated(STRING) values are unchanged — only table names changed (ACCESS_CERTIFICATION* → CERTIFICATION*), handled by the migration above.

Upgrading notes for v.2026.5.2 in Kubernetes environment

Kubernetes Platforms