Settings View Source Upgrade v26.5.x-v26.7.x

This page describes the required steps to upgrade your Astarte cluster from v26.5.x to v26.7.x. The Astarte Operator v26.7.x introduces support for Astarte 1.4.0, which includes mandatory FDO and Vault configuration. See the Astarte CHANGELOG to inspect what's changed in Astarte itself.

[!WARNING] To use Astarte v1.4.x, you must upgrade your Astarte Operator to v26.7.x.

• Starting from Astarte v1.4.0, FDO (FIDO Device Onboard) is mandatory and can no longer be disabled. If your Astarte CR explicitly sets spec.fdo.enable: false, you must remove or change it before upgrading.
• Starting from Astarte v1.4.0, a Vault configuration must be provided through the spec.vault field in the Astarte CR.

fdo-mandatory-enforcement

FDO mandatory enforcement

In Astarte 1.3, FDO was an opt-in feature controlled via the spec.fdo.enable field. Starting from Astarte 1.4.0, FDO is always enabled and cannot be turned off.

The operator enforces this requirement through multiple layers, ensuring no Astarte 1.4+ instance runs without FDO:

• Defaulting webhook: when spec.fdo is not set at all on an Astarte version >= 1.4.0, the mutating webhook automatically sets spec.fdo.enable: true. If you leave the field unset, the operator handles it for you.
• Validating webhook: explicitly setting spec.fdo.enable: false on an Astarte version >= 1.4.0 is rejected at admission time. You will see an error like "FDO must be enabled for Astarte version 1.4.0 and above" when applying the CR.

The spec.fdo.enable field is kept for backward compatibility with Astarte 1.3.x, where FDO remains optional. If you are running Astarte 1.4.0 or later, simply ensure the field is either unset or explicitly set to true.

Along with FDO, a spec.fdo.rendezvousServer block is now required. The webhook validates this at admission time and will reject a CR that enables FDO without providing rendezvous server configuration.

[!WARNING] The Rendezvous Servers is now an external prerequisites. Its deployment is NOT handled by the Astarte Operator itself.

vault-configuration-requirement

Vault configuration requirement

Starting from Astarte 1.4.0, the spec.vault field is required in the Astarte CR. The validating webhook rejects any CR with version >= 1.4.0 that does not include a Vault configuration block. Ensure you have a HashiCorp Vault or OpenBao instance running and provide the connection details in your Astarte CR before upgrading to v1.4.x.

[!WARNING] An HashiCorp Vault or OpenBao instance is now an external prerequisites. Its deployment is NOT handled by the Astarte Operator itself.

metrics-configuration-support

Metrics configuration support

Starting from Astarte Operator v26.7.0, the operator can expose Prometheus metrics. Metrics are disabled by default and can be enabled through Helm values:

• metrics.enable: set to true to enable the metrics endpoint (default false).
• metrics.port: the port to expose metrics on (default 8443).
• metrics.secure: whether to serve metrics over HTTPS (default true). Set to false to use HTTP.

When metrics are enabled, the operator exposes a /metrics endpoint on the configured port, ready to be scraped by Prometheus.

upgrade-astarte-operator

Upgrade Astarte Operator

The Astarte Operator upgrade procedure is handled by Helm.

The current section assumes that the Operator's chart landing version is v26.7.x. It is your responsibility referencing the proper v26.7.x chart using the --version flag when running helm commands.