From cc81d9e7079ffad72ad6eaf6681aaf4f8a027f94 Mon Sep 17 00:00:00 2001 From: Levi van Noort <73097785+levivannoort@users.noreply.github.com> Date: Wed, 14 Oct 2026 12:11:09 +0200 Subject: [PATCH] chore(release): appwrite 2.0.0 - CHANGELOG.md: [Unreleased] becomes [2.0.0] - 2026-10-14, with a pointer to the upgrade notes. - Chart.yaml: version 2.0.0, and artifacthub.io/changes regenerated. - docs/upgrading.md: chart 2.0.0 deploys Appwrite 2.5.0, and "To 2.0.0" covers the storage decision, the privileged executor, the moved S3 keys, the removed assistant and what Appwrite 2.4.0 and 2.5.0 change. - docs/gitops.md names 2.0.0. --- CHANGELOG.md | 5 +++ charts/appwrite/Chart.yaml | 48 +++++++++++++---------- charts/appwrite/README.md | 2 +- docs/gitops.md | 4 +- docs/upgrading.md | 78 ++++++++++++++++++++++++++++++++++++++ 5 files changed, 113 insertions(+), 24 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 83a0c77..d11ead0 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,11 @@ annotation in `charts/appwrite/Chart.yaml`. ## [Unreleased] +## [2.0.0] - 2026-10-14 + +Appwrite 2.5.0, with Functions and Sites on by default. Upgrading from 1.0.0: +see [docs/upgrading.md](docs/upgrading.md#to-200). + ### Changed - Functions and Sites are on by default: `compute.enabled` and diff --git a/charts/appwrite/Chart.yaml b/charts/appwrite/Chart.yaml index dc2ab0b..005897e 100644 --- a/charts/appwrite/Chart.yaml +++ b/charts/appwrite/Chart.yaml @@ -2,7 +2,7 @@ apiVersion: v2 name: appwrite description: Appwrite, the open-source backend platform, on Kubernetes. Deploys the API, console, realtime, workers and schedulers with optional built-in PostgreSQL, Redis and ClickHouse. type: application -version: 1.0.0 +version: 2.0.0 appVersion: "2.5.0" kubeVersion: ">=1.29.0-0" home: https://github.com/appwrite/helm-chart @@ -37,28 +37,34 @@ annotations: - name: support url: https://github.com/appwrite/helm-chart/issues artifacthub.io/changes: | + - kind: changed + description: 'Functions and Sites are on by default: `compute.enabled` and `compute.executor.privileged` default to `true`, so a plain install runs the executor as a privileged pod in a namespace of its own. Set `compute.enabled: false` on clusters that forbid privileged pods.' + - kind: changed + description: 'Files are stored in object storage by default: `storage.device` defaults to `s3`, served by the built-in SeaweedFS. To keep 1.0.0''s behaviour, set `storage.device: local` and `compute.enabled: false`.' + - kind: changed + description: Appwrite 2.5.0, with console 1.2.74, executor 1.1.2, browser 0.3.6 and geo 0.3.2, and the new trusted-proxy, internal-address and DNS settings in the environment defaults (networking.md). + links: + - name: networking.md + url: https://github.com/appwrite/helm-chart/blob/main/docs/networking.md#tls-and-forcehttps + - kind: changed + description: 'External S3 settings move to `storage.s3.external.endpoint` and `storage.s3.external.region`, with `storage.s3.mode: external`. Setting the old keys fails with where they went.' + - kind: changed + description: ClickHouse drops its per-second metric, trace and text logs and gives tables left behind by a config change a TTL, as Appwrite 2.4.0 does. + - kind: changed + description: CI upgrades from the published chart 1.0.0 with default values. - kind: added - description: The API, console, realtime, workers (combined, separate or grouped), schedulers, maintenance and interval tasks, and geo, all passing the `restricted` Pod Security Standard. + description: 'Built-in object storage: SeaweedFS as a single-replica StatefulSet (`storage.s3.mode: builtin`), with generated keys, the bucket created on start, and a NetworkPolicy that admits only Appwrite, the orchestrator, builds and the executor (storage.md).' + links: + - name: storage.md + url: https://github.com/appwrite/helm-chart/blob/main/docs/storage.md#built-in-object-storage - kind: added - description: Built-in single-replica PostgreSQL, Redis and ClickHouse, or external services (PostgreSQL, MariaDB, MySQL, MongoDB; Redis; ClickHouse over HTTP or TLS). Each backing service (`database`, `redis`, `clickhouse`, `storage`, `smtp`, `documentsDb`, `vectorsDb`) has a `mode` switch, and every credential takes the same `{value, secretName, secretKey}` shape. - - kind: added - description: Storage on a volume or in S3-compatible object storage. - - kind: added - description: 'Opt-in Functions and Sites in the cluster: builds run as Kubernetes Jobs through the open-runtimes orchestrator, in their own `baseline` namespace; executions run on the open-runtimes executor on Docker-in-Docker, a privileged pod you accept with `compute.executor.privileged` (or Sysbox through `runtimeClassName`), in its own namespace behind NetworkPolicies.' - - kind: added - description: Ingress and Gateway API HTTPRoutes for the API, console, realtime, function and site previews, and custom domains. - - kind: added - description: Optional browser, assistant, autogravity, embedding and MQTT components. - - kind: added - description: PodDisruptionBudgets and topology spread by default; opt-in NetworkPolicies, HorizontalPodAutoscalers, and metrics for the built-in datastores (exporters, ServiceMonitors and a PrometheusRule). - - kind: added - description: Credentials generated once and kept across upgrades and uninstalls, with guards against changing the encryption key or regenerating datastore passwords. Pods restart when a Secret value they read changes. - - kind: added - description: Data migrations on upgrade, a downgrade guard, and a guard against an `image.tag` of another Appwrite major version. - - kind: added - description: The same extension keys on every component, the built-in datastores included (`extraEnv`, `extraVolumes`, `extraVolumeMounts`, `extraInitContainers`, `extraContainers`), pod-wide `defaults`, and `extraObjects` for your own manifests. - - kind: added - description: '`values.schema.json`, `helm test` pods, documentation from getting started to backups, GitOps and troubleshooting, and example values files for local, production, external services, AWS, GCP, Azure, and Functions and Sites installs.' + description: Troubleshooting for deployments that fail with an internal error while Functions and Sites are off. + - kind: removed + description: 'The assistant: Appwrite removed it in 2.4.0. Setting `assistant.*` fails with that message.' + - kind: fixed + description: 'Site screenshots: the browser gets the API Service in `ALLOWED_HOSTS`, as browser 0.3.5 and later require for private addresses.' + - kind: fixed + description: '`make env-defaults` works with Appwrite 2.4.0 and later, and no longer leaves an error message in `files/env-defaults.yaml` when it fails.' artifacthub.io/images: | - name: appwrite image: docker.io/appwrite/appwrite:2.5.0 diff --git a/charts/appwrite/README.md b/charts/appwrite/README.md index ec3c825..9580b7b 100644 --- a/charts/appwrite/README.md +++ b/charts/appwrite/README.md @@ -1,6 +1,6 @@ # Appwrite Helm chart -![Version: 1.0.0](https://img.shields.io/badge/Version-1.0.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 2.5.0](https://img.shields.io/badge/AppVersion-2.5.0-informational?style=flat-square) +![Version: 2.0.0](https://img.shields.io/badge/Version-2.0.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 2.5.0](https://img.shields.io/badge/AppVersion-2.5.0-informational?style=flat-square) Appwrite, the open-source backend platform, on Kubernetes. Deploys the API, console, realtime, workers and schedulers with optional built-in PostgreSQL, Redis and ClickHouse. diff --git a/docs/gitops.md b/docs/gitops.md index dbe7d42..14dc768 100644 --- a/docs/gitops.md +++ b/docs/gitops.md @@ -280,7 +280,7 @@ spec: source: repoURL: ghcr.io/appwrite/charts chart: appwrite - targetRevision: 1.0.0 + targetRevision: 2.0.0 helm: valuesObject: appwrite: @@ -350,7 +350,7 @@ Things that differ from the Helm CLI: dry run, which doesn't touch the cluster: ```console - helm install appwrite oci://ghcr.io/appwrite/charts/appwrite --version 1.0.0 \ + helm install appwrite oci://ghcr.io/appwrite/charts/appwrite --version 2.0.0 \ -n appwrite -f values.yaml --dry-run=client | sed -n '/^NOTES:/,$p' ``` - **No `ignoreDifferences` needed.** With the values above, two renders are diff --git a/docs/upgrading.md b/docs/upgrading.md index c1563ef..d28f23e 100644 --- a/docs/upgrading.md +++ b/docs/upgrading.md @@ -9,6 +9,7 @@ the chart upgrades Appwrite. You can pin a different Appwrite version with | Chart | Appwrite | | --- | --- | | 1.0.0 | 2.3.0 | +| 2.0.0 | 2.5.0 | The [changelog](../CHANGELOG.md) lists what changed in each chart version, and [version notes](#version-notes) what you have to do about it. @@ -181,6 +182,83 @@ and after. A release without an entry needs nothing beyond `helm upgrade`. When you skip versions, apply the entries of every version in between, oldest first. +### To 2.0.0 + +Appwrite 2.5.0, with Functions and Sites on by default. The data migration +runs (2.3.0 to 2.5.0 is one step), so back up first. + +**Decide about storage before you upgrade.** 2.0.0 stores files in the +built-in object storage and runs Functions and Sites by default. An install +that took 1.0.0's defaults keeps its files on the `/storage` volume, where +Appwrite would no longer look. To keep 1.0.0's behaviour, set: + +```yaml +storage: + device: local +compute: + enabled: false +``` + +An install that holds no files yet can take the new defaults as they are. +Moving files from the volume into a bucket is a migration of its own (the +paths Appwrite stores change with the device), so plan it separately. + +**Functions and Sites run a privileged pod.** With the defaults, the chart +creates the namespaces `-builds` and `-executor` and runs +the executor in the second as a privileged pod. Where privileged pods aren't +allowed, set `compute.enabled: false` +([executor.md](executor.md#without-a-privileged-container) has the Sysbox +alternative). + +**Your own S3 store:** its settings moved under `storage.s3.external`, with +`storage.s3.mode: external`. Before: + +```yaml +storage: + device: s3 + s3: + endpoint: https://s3.example.com + region: us-east-1 + bucket: appwrite +``` + +After: + +```yaml +storage: + device: s3 + s3: + mode: external + external: + endpoint: https://s3.example.com + region: us-east-1 + bucket: appwrite +``` + +When the S3 keys come from your own Secret, Functions and Sites also need +the executor's Secret (`compute.executor.existingSecret`, +[executor.md](executor.md#existing-secrets)); otherwise set +`compute.enabled: false`. The render fails with what's missing. + +**The assistant is gone:** Appwrite removed it in 2.4.0. Delete the +`assistant` block from your values. + +**What Appwrite 2.4.0 and 2.5.0 change** for self-hosters (release notes: +[2.4.0](https://github.com/appwrite/appwrite/releases/tag/2.4.0), +[2.5.0](https://github.com/appwrite/appwrite/releases/tag/2.5.0)): + +- Client IPs come from `X-Forwarded-For` only behind a trusted proxy + (`_APP_TRUSTED_PROXIES`). The default covers most pod networks; IPv6 pod + networks or a CDN in front of the controller need it set + ([networking.md](networking.md#tls-and-forcehttps)). +- OAuth2 and OIDC providers, webhooks and migration sources on private + addresses are refused unless listed in `_APP_ALLOWED_INTERNAL_ADDRESSES` + ([networking.md](networking.md#requests-to-private-addresses)). +- GitHub deployments need `_APP_VCS_GITHUB_WEBHOOK_SECRET` + ([integrations.md](integrations.md)). +- Sign-ins in progress during the upgrade fail once, and function templates + need `node-18.0` or later. + ### To 1.0.0 The first release. Nothing to do.