Connect CRDs Helm Chart Migration

Starting with Connect 1.28.0, Connect Kubernetes Custom Resource Definitions (CRDs) are moving to a standalone connect-crds chart instead of being bundled in the connect chart. This change allows for better separation of concerns and more flexible management of CRDs.

Who is affected?

Existing clusters upgrading from Connect versions 1.24.0 through 1.27.0 to Connect 1.28.0 or above. CRD ownership must be transferred before upgrading the connect release.
Fresh installations on Connect 1.28.0+ — follow the installation instructions in Install Connect, which explain how to install CRDs with the connect-crds chart before installing the connect chart.

For existing clusters, the connect-crds release must be installed before upgrading the connect release. Failure to do so may result in permanent loss of ConnectDeploymentSet and ConnectServiceAccount resources.

Migration Procedure

Upgrading with Helm

In order to perform the migration with Helm, you must first install the connect-crds chart with the --take-ownership flag to adopt existing CRDs, and then upgrade the connect chart to the new version without bundled CRDs.

Install the Helm Deployment Template, then run the following commands from the appropriate directory:

export CONNECT_NS=<connect namespace>                   # e.g. "foundation-env-default"
export REPO=<repo>                                      # e.g. "connect-helm" or local Helm charts directory
export CONNECT_VERSION=<new-version>                    # Latest Connect version without bundled CRDs
export CLUSTER_EXTERNAL_DNS=<your-foundation-domain>

# 1. Install connect-crds and adopt existing CRDs
helm upgrade -i connect-crds $REPO/connect-crds \
  --namespace $CONNECT_NS \
  --take-ownership

# 2. Upgrade connect to the version without bundled CRDs
helm upgrade connect $REPO/connect \
  --namespace $CONNECT_NS \
  --version $CONNECT_VERSION \
  --values connect/values.yaml \
  --set "global.clusterExternalUrl=https://$CLUSTER_EXTERNAL_DNS" \
  --wait-for-jobs \
  --wait \
  --timeout=15m

On subsequent upgrades of connect-crds, the --take-ownership flag is no longer required.

The remaining Connect releases can be upgraded without special handling after the CRD ownership transfer is complete.

Upgrading with Helmfile

Upgrade GridOS Connect with Helmfile as described in Upgrade GridOS Connect. Install the provided Helm Deployment Template, then run helmfile apply:

export CONNECT_NS=<connect namespace>                   # e.g. "foundation-env-default"
export CLUSTER_EXTERNAL_DNS=<your-foundation-domain>
export KUBE_CONTEXT=<kube-context>

helmfile apply \
  --namespace $CONNECT_NS  \
  --kube-context $KUBE_CONTEXT \
  --set "global.clusterExternalUrl=https://$CLUSTER_EXTERNAL_DNS"

The helmfile configuration includes takeOwnership: true on the new connect-crds release, which instructs Helm to adopt the existing CRDs regardless of their current ownership annotations.

Verification

After migration, confirm CRD ownership:

kubectl get crd connectdeploymentsets.connect.gridos.com \
  -o jsonpath='{.metadata.annotations.meta\.helm\.sh/release-name}'
# Expected: connect-crds