Skip to main content
Version: main

Upgrading to v0.10.0

v0.10.0 replaces the engine that reconciles ResourceGraphDefinition instances with a new composition engine shared with the new Graph API. The migration is automatic and requires no changes to existing ResourceGraphDefinitions, with the exceptions below.

Before You Upgrade​

Apply the Updated CRDs​

Three CRDs change in this release. Apply them before upgrading the controller:

kubectl apply --server-side -f https://raw.githubusercontent.com/kubernetes-sigs/kro/v0.10.0/helm/crds/kro.run_resourcegraphdefinitions.yaml
kubectl apply --server-side -f https://raw.githubusercontent.com/kubernetes-sigs/kro/v0.10.0/helm/crds/internal.kro.run_graphrevisions.yaml
kubectl apply --server-side -f https://raw.githubusercontent.com/kubernetes-sigs/kro/v0.10.0/helm/crds/kro.run_graphs.yaml
  • graphs.kro.run is new. It must exist before the GraphKind feature gate is enabled. If the gate is on and the CRD is missing, the controller cannot start its Graph watch and exits about two minutes after startup, which also stops ResourceGraphDefinition reconciliation until the CRD is applied. Installing it with the gate off is harmless.
  • resourcegraphdefinitions.kro.run and graphrevisions.internal.kro.run mark status.conditions as a map keyed on type. This changes how server-side apply merges the list and makes the API server reject a status write that contains two conditions with the same type.

Check ResourceGraphDefinitions for Unterminated Expressions​

Expression parsing is stricter. A ${ that is never closed with } was previously passed through as literal text; it is now an error, and an RGD that contains one anywhere in its resource templates, status fields, or externalRef selectors will fail to build and become Inactive on its first reconcile after the upgrade.

Find candidates with:

kubectl get rgd -o yaml | grep -n '\${[^}]*$'

Fix the expression, or if the text is meant literally, escape it as described in Escaping ${VAR} Syntax.

The resource ID graphengine is also newly reserved. An RGD using it as a resource id is rejected.

Check Aggregation-Mode RBAC for Status Subresources​

If you run with rbac.mode: aggregation, confirm that each aggregated ClusterRole grants the controller get, update, and patch on the <resource>/status subresource of every generated kind, in addition to the resource itself. The controller now writes instance status with server-side apply, which requires patch.

- apiGroups: ["kro.run"]
  resources: ["applications", "applications/status"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]

The examples in Access Control and the Quick Start have been updated to include the subresource. rbac.mode: unrestricted is not affected.

After You Upgrade​

No further action is needed for existing ResourceGraphDefinitions or their instances. Resources managed by kro keep the same server-side apply field manager (kro.run/applyset), so the new engine adopts them in place and continues to add, update, and remove fields exactly as before. Instance condition types, reasons, and state values, all kro.run/* labels on managed resources, and all metric names are unchanged.

Enabling the Graph API​

The Graph API is alpha and off by default. The upgrade does not enable it. When you are ready, follow Enabling Graphs; it covers the feature gate, the RBAC the controller and the applier ServiceAccounts need, and how to grant users access to the new resource.

Next Steps​

Brought to you with ♥ by SIG Cloud Provider