EJBCA CE 9.3.7 helm chart deployment issue

[kuliktomas]

Hi, I am trying to upgrade from 9.1.1 to 9.3.7 using the helm chart, but I have noticed that either upgrade or install causes the same issue.

 Warning  UpgradeFailed  3m21s (x7 over 20h)  helm-controller  (combined from similar events): Helm upgrade failed for release ejbca-ce/ejbca-ce with chart ejbca-ce@9.3.7: error while running post render on files: map[string]interface {}(nil): yaml: unmarshal errors:
  line 111: mapping key "resources" already defined at line 33

Looking through the helm templates I can see that the deployment.yaml defines "resources" twice L185 and L266 and it is rendered twice. (See below snippet for resources being defined twice).

        - name: {{ .Chart.Name }}
          securityContext:
            {{- toYaml .Values.securityContext | nindent 12 }}
          image: {{ include "ejbca.imageRepository" . }}:{{ .Values.image.tag | default .Chart.AppVersion }}
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          resources:
            {{- toYaml .Values.resources | nindent 12 }}
          env: {{- include "ejbca.ejbcaDeploymentParameters" . | nindent 12 }}
            {{- if or (.Values.services.proxyAJP.enabled) (.Values.httpd.enabled) }}
            - name: PROXY_AJP_BIND
              value: {{ .Values.services.proxyAJP.bindIP }}
            {{- else if or (.Values.services.proxyHttp.enabled) (.Values.nginx.enabled) (.Values.ingress.enabled) }}
            - name: PROXY_HTTP_BIND
              value: {{ .Values.services.proxyHttp.bindIP }}
            {{- end }}
          {{- if hasKey .Values.ejbca "envFrom" }}
          envFrom:
            {{- toYaml .Values.ejbca.envFrom | nindent 12 }}
          {{- end }}
          {{- if or (not .Values.ejbca.importEjbcaConfFiles) (hasKey .Values.ejbca "superadminPasswordOverride") }}
          lifecycle:
            postStart:
              exec:
                command:
                  - "/bin/sh"
                  - "-c"
                  - |
                    {{- if not .Values.ejbca.importEjbcaConfFiles }}
                    sed -i s/https=443/https={{- include "ejbca.ejbcaHttpsPort" . -}}/g /opt/primekey/ejbca/conf/web.properties
                    sed -i s/pubhttp=80/pubhttp={{- include "ejbca.ejbcaPubhttpPort" . -}}/g /opt/primekey/ejbca/conf/web.properties
                    {{- end }}
                    {{- if and (hasKey .Values.ejbca "superadminPasswordOverride") (eq .Values.ejbca.env.TLS_SETUP_ENABLED "true") }}
                    until [ -f /opt/keyfactor/appserver/standalone/deployments/ejbca.ear.deployed ]; do sleep 5; done
                    until [[ $(/opt/keyfactor/bin/ejbca.sh roles listadmins --role "Super Administrator Role" | grep -v 'USERNAME TYPE_EQUALCASE "ejbca"') ]]; do sleep 5; done
                    sleep 5
                    /opt/keyfactor/bin/ejbca.sh ra setpwd 'superadmin' '{{ .Values.ejbca.superadminPasswordOverride }}'
                    {{- end }}
          {{- end }}
          ports:
            {{- if .Values.services.directHttp.enabled }}
            {{- if .Values.services.directHttp.httpPort }}
            - name: http
              containerPort: 8080
              protocol: TCP
            {{- end }}
            - name: https
              containerPort: 8443
              protocol: TCP
            {{- end }}
            {{- if or (.Values.services.proxyAJP.enabled) (.Values.httpd.enabled) }}
            - name: ajp
              containerPort: 8009
              protocol: TCP
            {{- else if or (.Values.services.proxyHttp.enabled) (.Values.nginx.enabled) (.Values.ingress.enabled) }}
            {{- if or (.Values.services.proxyHttp.httpPort) (.Values.nginx.httpPort) }}
            - name: proxy-http
              containerPort: 8081
              protocol: TCP
            {{- end }}
            - name: proxy-https
              containerPort: 8082
              protocol: TCP
            {{- end }}
          startupProbe:
            tcpSocket:
              {{- if .Values.services.directHttp.enabled }}
              port: 8443
              {{- end }}
              {{- if or (.Values.services.proxyAJP.enabled) (.Values.httpd.enabled) }}
              port: 8009
              {{- else if or (.Values.services.proxyHttp.enabled) (.Values.nginx.enabled) (.Values.ingress.enabled) }}
              port: 8082
              {{- end }}
            initialDelaySeconds: 15
            periodSeconds: 2
            failureThreshold: 500
          livenessProbe:
            tcpSocket:
              {{- if .Values.services.directHttp.enabled }}
              port: 8443
              {{- end }}
              {{- if or (.Values.services.proxyAJP.enabled) (.Values.httpd.enabled) }}
              port: 8009
              {{- else if or (.Values.services.proxyHttp.enabled) (.Values.nginx.enabled) (.Values.ingress.enabled) }}
              port: 8082
              {{- end }}
          resources:
            {{- toYaml .Values.resources | nindent 12 }}

I can see that in 9.1.1 this is only specified once in deployment.yam L204.

Any help is appreciated!

[primetomas]

Are you using the correct helm chart? I don't see that on L204.
https://github.com/Keyfactor/ejbca-ce/blob/main/charts/ejbca/templates/deployment.yaml

[kuliktomas]

Any ideas?

[kuliktomas]

To add more the aforementioned commit is from 21.12.2025, while the date modified on the deployment.yaml within the helm chart from the repo.keyfactor.com is 16.12.2025, seems the change was not packaged...

[dobicinaitis]

Hi! Yes, the issue was present in 9.3.7, which was released on Dec 16, 2025, and that’s why you see the resources block twice in the pulled Helm chart. You don’t see it in the codebase because @camillo found and fixed the bug in #1004, which was merged later on Jan 27, 2026. This means that the next release will include the fix, but the existing Helm chart for 9.3.7 on repo.keyfactor.com still contains the issue.

[kuliktomas]

super, thx. I am not fully familiar with the helm release, will there be a patch release or does it follow EJBCA releases? I would love to move to 9.3.7, will manage the deployment file locally for now. Thank you!

[dobicinaitis]

Helm chart releases follow EJBCA, so you get both a container and a Helm chart for the same version X whenever it is released. The next Community release is planned for the end of Q2, so if you can use a local chart, that is the best option for now.