This is unreleased documentation for Admission Controller 1.37-dev.

Migration from three-chart setup

Starting from Kubewarden 1.37, a single helm chart is used to manage the stack.

If you are running the legacy three-chart setup (kubewarden-crds, kubewarden-controller, kubewarden-defaults), you can migrate by backing up your policies, uninstalling the old charts, and installing the new single chart. This involves a short window during which your cluster is not protected by policies. You can use the Audit Scanner after the migration completes to identify any resources that entered the cluster during that window.

Remember that, as described at upgrade path documentation, version jumping isn’t allowed. You must migrate from Admission Controller v1.36 to v1.37

Manual reinstallation

This is the simplest approach. It consists of:

  1. Doing a backup of your policies

  2. Uninstall the old helm charts

  3. Install the new single helm chart

  4. Restore all your policies

After step #2 your cluster won’t be protected. It will be protected again once all your policies are restored.

You can then use Audit Scanner to find the non-compliant resources that might have slipped into the cluster during this short window.

Prerequisites

  • Helm v3 or v4

  • kubectl with access to your cluster

  • yq v4 (github.com/mikefarah/yq) for filtering resources

  • The three legacy helm charts releases must be installed in your cluster at appVersion v1.36.0

  • The unified admission-controller chart must be available at appVersion v1.37.0

Reinstalling the Kubewarden admissions controller stack

To migrate away from the 3 legacy Helm charts, the steps are:

  1. Back up your policies and policy servers:

    FILTER='del(.items[].metadata.uid, .items[].metadata.resourceVersion, .items[].metadata.creationTimestamp, .items[].metadata.generation, .items[].metadata.managedFields, .items[].status)'

kubectl get clusteradmissionpolicies -A -o yaml | yq "$FILTER" > clusteradmissionpolicies-backup.yaml
kubectl get admissionpolicies -A -o yaml | yq "$FILTER" > admissionpolicies-backup.yaml
kubectl get clusteradmissionpolicygroups -A -o yaml | yq "$FILTER" > clusteradmissionpolicygroups-backup.yaml
kubectl get admissionpolicygroups -A -o yaml | yq "$FILTER" > admissionpolicygroups-backup.yaml
kubectl get policyservers -A -o yaml | yq "$FILTER" > policyservers-backup.yaml

  2. Uninstall the old Helm charts:

    helm uninstall kubewarden-defaults -n kubewarden
helm uninstall kubewarden-controller -n kubewarden
helm uninstall kubewarden-crds -n kubewarden

  3. Install the unified Helm chart:

    helm install kubewarden kubewarden/admission-controller -n kubewarden

    The new single Helm chart consolidates the three previous values files into one. Your existing configuration settings remain valid; simply combine the values from the three original files into a single file and provide it during installation:

    cat kubewarden-controller-values.yml kubewarden-default-values.yaml kubewarden-crds-values.yaml > admission-controller-values.yaml
helm install kubewarden kubewarden/admission-controller -n kubewarden --values admission-controller-values.yaml

  4. Restore policies and policy servers:

    kubectl apply -f policyservers-backup.yaml
kubectl apply -f clusteradmissionpolicies-backup.yaml
kubectl apply -f admissionpolicies-backup.yaml
kubectl apply -f clusteradmissionpolicygroups-backup.yaml
kubectl apply -f admissionpolicygroups-backup.yaml

Now you just have to wait for the reconciliation of these resources to finish. You’re cluster has been successfully migrated.