Skip to content

chore(release): appwrite 2.0.0 #23

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
levivannoort merged 2 commits into from
Oct 14, 2026
Merged

chore(release): appwrite 2.0.0 #23

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
cc81d9e
chore(release): appwrite 2.0.0
levivannoort Oct 14, 2026
02daebb
Merge pull request #22 from appwrite/release/2.0.0
levivannoort Oct 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,11 @@ annotation in `charts/appwrite/Chart.yaml`.

## [Unreleased]

## [2.0.0] - 2026-10-14

Appwrite 2.5.0, with Functions and Sites on by default. Upgrading from 1.0.0:
see [docs/upgrading.md](docs/upgrading.md#to-200).

### Changed

- Functions and Sites are on by default: `compute.enabled` and
Expand Down
48 changes: 27 additions & 21 deletions charts/appwrite/Chart.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ apiVersion: v2
name: appwrite
description: Appwrite, the open-source backend platform, on Kubernetes. Deploys the API, console, realtime, workers and schedulers with optional built-in PostgreSQL, Redis and ClickHouse.
type: application
version: 1.0.0
version: 2.0.0
appVersion: "2.5.0"
kubeVersion: ">=1.29.0-0"
home: https://github.com/appwrite/helm-chart
Expand Down Expand Up @@ -37,28 +37,34 @@ annotations:
- name: support
url: https://github.com/appwrite/helm-chart/issues
artifacthub.io/changes: |
- kind: changed
description: 'Functions and Sites are on by default: `compute.enabled` and `compute.executor.privileged` default to `true`, so a plain install runs the executor as a privileged pod in a namespace of its own. Set `compute.enabled: false` on clusters that forbid privileged pods.'
- kind: changed
description: 'Files are stored in object storage by default: `storage.device` defaults to `s3`, served by the built-in SeaweedFS. To keep 1.0.0''s behaviour, set `storage.device: local` and `compute.enabled: false`.'
- kind: changed
description: Appwrite 2.5.0, with console 1.2.74, executor 1.1.2, browser 0.3.6 and geo 0.3.2, and the new trusted-proxy, internal-address and DNS settings in the environment defaults (networking.md).
links:
- name: networking.md
url: https://github.com/appwrite/helm-chart/blob/main/docs/networking.md#tls-and-forcehttps
- kind: changed
description: 'External S3 settings move to `storage.s3.external.endpoint` and `storage.s3.external.region`, with `storage.s3.mode: external`. Setting the old keys fails with where they went.'
- kind: changed
description: ClickHouse drops its per-second metric, trace and text logs and gives tables left behind by a config change a TTL, as Appwrite 2.4.0 does.
- kind: changed
description: CI upgrades from the published chart 1.0.0 with default values.
- kind: added
description: The API, console, realtime, workers (combined, separate or grouped), schedulers, maintenance and interval tasks, and geo, all passing the `restricted` Pod Security Standard.
description: 'Built-in object storage: SeaweedFS as a single-replica StatefulSet (`storage.s3.mode: builtin`), with generated keys, the bucket created on start, and a NetworkPolicy that admits only Appwrite, the orchestrator, builds and the executor (storage.md).'
links:
- name: storage.md
url: https://github.com/appwrite/helm-chart/blob/main/docs/storage.md#built-in-object-storage
- kind: added
description: Built-in single-replica PostgreSQL, Redis and ClickHouse, or external services (PostgreSQL, MariaDB, MySQL, MongoDB; Redis; ClickHouse over HTTP or TLS). Each backing service (`database`, `redis`, `clickhouse`, `storage`, `smtp`, `documentsDb`, `vectorsDb`) has a `mode` switch, and every credential takes the same `{value, secretName, secretKey}` shape.
- kind: added
description: Storage on a volume or in S3-compatible object storage.
- kind: added
description: 'Opt-in Functions and Sites in the cluster: builds run as Kubernetes Jobs through the open-runtimes orchestrator, in their own `baseline` namespace; executions run on the open-runtimes executor on Docker-in-Docker, a privileged pod you accept with `compute.executor.privileged` (or Sysbox through `runtimeClassName`), in its own namespace behind NetworkPolicies.'
- kind: added
description: Ingress and Gateway API HTTPRoutes for the API, console, realtime, function and site previews, and custom domains.
- kind: added
description: Optional browser, assistant, autogravity, embedding and MQTT components.
- kind: added
description: PodDisruptionBudgets and topology spread by default; opt-in NetworkPolicies, HorizontalPodAutoscalers, and metrics for the built-in datastores (exporters, ServiceMonitors and a PrometheusRule).
- kind: added
description: Credentials generated once and kept across upgrades and uninstalls, with guards against changing the encryption key or regenerating datastore passwords. Pods restart when a Secret value they read changes.
- kind: added
description: Data migrations on upgrade, a downgrade guard, and a guard against an `image.tag` of another Appwrite major version.
- kind: added
description: The same extension keys on every component, the built-in datastores included (`extraEnv`, `extraVolumes`, `extraVolumeMounts`, `extraInitContainers`, `extraContainers`), pod-wide `defaults`, and `extraObjects` for your own manifests.
- kind: added
description: '`values.schema.json`, `helm test` pods, documentation from getting started to backups, GitOps and troubleshooting, and example values files for local, production, external services, AWS, GCP, Azure, and Functions and Sites installs.'
description: Troubleshooting for deployments that fail with an internal error while Functions and Sites are off.
- kind: removed
description: 'The assistant: Appwrite removed it in 2.4.0. Setting `assistant.*` fails with that message.'
- kind: fixed
description: 'Site screenshots: the browser gets the API Service in `ALLOWED_HOSTS`, as browser 0.3.5 and later require for private addresses.'
- kind: fixed
description: '`make env-defaults` works with Appwrite 2.4.0 and later, and no longer leaves an error message in `files/env-defaults.yaml` when it fails.'
artifacthub.io/images: |
- name: appwrite
image: docker.io/appwrite/appwrite:2.5.0
Expand Down
2 changes: 1 addition & 1 deletion charts/appwrite/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# Appwrite Helm chart

![Version: 1.0.0](https://img.shields.io/badge/Version-1.0.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 2.5.0](https://img.shields.io/badge/AppVersion-2.5.0-informational?style=flat-square)
![Version: 2.0.0](https://img.shields.io/badge/Version-2.0.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 2.5.0](https://img.shields.io/badge/AppVersion-2.5.0-informational?style=flat-square)

Appwrite, the open-source backend platform, on Kubernetes. Deploys the API, console, realtime, workers and schedulers with optional built-in PostgreSQL, Redis and ClickHouse.

Expand Down
4 changes: 2 additions & 2 deletions docs/gitops.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -280,7 +280,7 @@ spec:
source:
repoURL: ghcr.io/appwrite/charts
chart: appwrite
targetRevision: 1.0.0
targetRevision: 2.0.0

@hansi-codes hansi-codes Bot Oct 14, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Argo CD example omits secrets required by 2.0 defaults

With this revision, Functions/Sites and built-in S3 are enabled by default, but the example sets appwrite.secrets.generate: false without supplying the compute and S3 credentials those defaults require. Argo CD rendering therefore fails; please update the example with the managed secrets and references needed for these defaults, or disable/configure the affected features.

Prompt To Fix With AI 
This is a comment left during a code review.
Path: docs/gitops.md
Line: 283

Comment:
**Argo CD example omits secrets required by 2.0 defaults**

With this revision, Functions/Sites and built-in S3 are enabled by default, but the example sets `appwrite.secrets.generate: false` without supplying the compute and S3 credentials those defaults require. Argo CD rendering therefore fails; please update the example with the managed secrets and references needed for these defaults, or disable/configure the affected features.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

🟡 Minor · documentation · Reply if this doesn't apply.

helm:
valuesObject:
appwrite:
Expand Down Expand Up @@ -350,7 +350,7 @@ Things that differ from the Helm CLI:
dry run, which doesn't touch the cluster:

```console
helm install appwrite oci://ghcr.io/appwrite/charts/appwrite --version 1.0.0 \
helm install appwrite oci://ghcr.io/appwrite/charts/appwrite --version 2.0.0 \
-n appwrite -f values.yaml --dry-run=client | sed -n '/^NOTES:/,$p'
```
- **No `ignoreDifferences` needed.** With the values above, two renders are
Expand Down
78 changes: 78 additions & 0 deletions docs/upgrading.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@ the chart upgrades Appwrite. You can pin a different Appwrite version with
| Chart | Appwrite |
| --- | --- |
| 1.0.0 | 2.3.0 |
| 2.0.0 | 2.5.0 |

The [changelog](../CHANGELOG.md) lists what changed in each chart version,
and [version notes](#version-notes) what you have to do about it.
Expand Down Expand Up @@ -181,6 +182,83 @@ and after. A release without an entry needs nothing beyond `helm upgrade`.
When you skip versions, apply the entries of every version in between,
oldest first.

### To 2.0.0

Appwrite 2.5.0, with Functions and Sites on by default. The data migration
runs (2.3.0 to 2.5.0 is one step), so back up first.

**Decide about storage before you upgrade.** 2.0.0 stores files in the
built-in object storage and runs Functions and Sites by default. An install
that took 1.0.0's defaults keeps its files on the `/storage` volume, where
Appwrite would no longer look. To keep 1.0.0's behaviour, set:

```yaml
storage:
device: local
compute:
enabled: false
```

An install that holds no files yet can take the new defaults as they are.
Moving files from the volume into a bucket is a migration of its own (the
paths Appwrite stores change with the device), so plan it separately.

**Functions and Sites run a privileged pod.** With the defaults, the chart
creates the namespaces `<release>-builds` and `<release>-executor` and runs
the executor in the second as a privileged pod. Where privileged pods aren't
allowed, set `compute.enabled: false`
([executor.md](executor.md#without-a-privileged-container) has the Sysbox
alternative).

**Your own S3 store:** its settings moved under `storage.s3.external`, with
`storage.s3.mode: external`. Before:

```yaml
storage:
device: s3
s3:
endpoint: https://s3.example.com
region: us-east-1
bucket: appwrite
```

After:

```yaml
storage:
device: s3
s3:
mode: external
external:
endpoint: https://s3.example.com
region: us-east-1
bucket: appwrite
```

When the S3 keys come from your own Secret, Functions and Sites also need
the executor's Secret (`compute.executor.existingSecret`,
[executor.md](executor.md#existing-secrets)); otherwise set
`compute.enabled: false`. The render fails with what's missing.

**The assistant is gone:** Appwrite removed it in 2.4.0. Delete the
`assistant` block from your values.

**What Appwrite 2.4.0 and 2.5.0 change** for self-hosters (release notes:
[2.4.0](https://github.com/appwrite/appwrite/releases/tag/2.4.0),
[2.5.0](https://github.com/appwrite/appwrite/releases/tag/2.5.0)):

- Client IPs come from `X-Forwarded-For` only behind a trusted proxy
(`_APP_TRUSTED_PROXIES`). The default covers most pod networks; IPv6 pod
networks or a CDN in front of the controller need it set
([networking.md](networking.md#tls-and-forcehttps)).
- OAuth2 and OIDC providers, webhooks and migration sources on private
addresses are refused unless listed in `_APP_ALLOWED_INTERNAL_ADDRESSES`
([networking.md](networking.md#requests-to-private-addresses)).
- GitHub deployments need `_APP_VCS_GITHUB_WEBHOOK_SECRET`
([integrations.md](integrations.md)).
- Sign-ins in progress during the upgrade fail once, and function templates
need `node-18.0` or later.

### To 1.0.0

The first release. Nothing to do.