This is unreleased documentation for Admission Controller 1.37-dev.

Kubewarden Admission Controller 1.36 to 1.37

Starting from Kubewarden 1.37, a single helm chart is used to manage the stack.

If you are running the legacy three-chart setup (kubewarden-crds, kubewarden-controller, kubewarden-defaults), you can migrate by backing up your policies, uninstalling the old charts, and installing the new single chart. This involves a short window during which your cluster is not protected by policies. You can use the Audit Scanner after the migration completes to identify any resources that entered the cluster during that window.

Remember that, as described at upgrade path documentation, version jumping isn’t allowed. You must migrate from Admission Controller v1.36 to v1.37

Manual reinstallation

This is the simplest approach. It consists of:

  1. Doing a backup of your policies

  2. Uninstall the old helm charts

  3. Install the new single helm chart

  4. Restore all your policies

After step #2 your cluster won’t be protected. It will be protected again once all your policies are restored.

You can then use Audit Scanner to find the non-compliant resources that might have slipped into the cluster during this short window.

Prerequisites

  • Helm v3 or v4

  • kubectl with access to your cluster

  • yq v4 (github.com/mikefarah/yq) for filtering resources

  • The three legacy helm charts releases must be installed in your cluster at appVersion v1.36.0

  • The unified admission-controller chart must be available at appVersion v1.37.0

Reinstalling the Kubewarden admissions controller stack

To migrate away from the 3 legacy Helm charts, the steps are:

  1. Back up your policies and policy servers:

    # Fields that are not needed for restore, will be generated by kubernetes
FILTER_YQ='del(.items[].metadata.uid, .items[].metadata.resourceVersion, .items[].metadata.creationTimestamp, .items[].metadata.generation, .items[].metadata.managedFields, .items[].status)'
# Resources managed by kubewarden-defaults chart, will be created by helm
FILTER_LBL='-l app.kubernetes.io/instance!=kubewarden-defaults -l app.kubernetes.io/name!=kubewarden-defaults'

kubectl get clusteradmissionpolicies $FILTER_LBL -o yaml | yq "$FILTER_YQ" > clusteradmissionpolicies-backup.yaml
kubectl get admissionpolicies -A -o yaml | yq "$FILTER_YQ" > admissionpolicies-backup.yaml
kubectl get clusteradmissionpolicygroups -o yaml | yq "$FILTER_YQ" > clusteradmissionpolicygroups-backup.yaml
kubectl get admissionpolicygroups -A -o yaml | yq "$FILTER_YQ" > admissionpolicygroups-backup.yaml
kubectl get policyservers $FILTER_LBL -o yaml | yq "$FILTER_YQ" > policyservers-backup.yaml

  2. Save the values of the three legacy Helm releases so you can reuse your configuration with the unified chart:

    helm get values kubewarden-crds -n kubewarden -o yaml > kubewarden-crds-values.yaml
helm get values kubewarden-controller -n kubewarden -o yaml > kubewarden-controller-values.yaml
helm get values kubewarden-defaults -n kubewarden -o yaml > kubewarden-defaults-values.yaml

  3. Uninstall the old Helm charts:

    helm uninstall kubewarden-defaults -n kubewarden --wait
helm uninstall kubewarden-controller -n kubewarden --wait
helm uninstall kubewarden-crds -n kubewarden --wait

  4. Install the unified Helm chart. The new single Helm chart consolidates the three previous values files into one. Your existing configuration settings remain valid; provide the three original values files during installation and Helm will merge them for you:

    helm install admission-controller kubewarden/admission-controller -n kubewarden --wait \
  --values kubewarden-controller-values.yaml \
  --values kubewarden-defaults-values.yaml \
  --values kubewarden-crds-values.yaml

    When multiple --values files are provided, Helm merges them in order and the last file takes precedence for any overlapping keys. The three legacy charts share some fields, notably global and its children, which are normally identical across the charts. If any of these values were set differently by mistake, the value from the last file wins. Review the resulting configuration to make sure everything looks correct before proceeding.

  5. Restore policies and policy servers:

    kubectl create -f policyservers-backup.yaml
kubectl create -f clusteradmissionpolicies-backup.yaml
kubectl create -f admissionpolicies-backup.yaml
kubectl create -f clusteradmissionpolicygroups-backup.yaml
kubectl create -f admissionpolicygroups-backup.yaml

Now you just have to wait for the reconciliation of these resources to finish. You’re cluster has been successfully migrated.