# Helm chart releases

## 0.1.17

*Removes the UI's `VAULT_API_KEY` machine API key and all of its configuration.*

**Chart summary**

* Publishes chart `0.1.17` for app bundle `v0.1.15` (no application image changes).
* Removes the Vault UI's `VAULT_API_KEY` environment variable and the chart-rendered `-ui` Secret that carried it. The UI no longer authenticates to the Orchestrator with a machine API key.
* Keeps all image tags and subchart versions unchanged from `0.1.16`.

**Required customer action**

* If you set `ui.vaultApiKey` or `ui.vaultApiKeySecret` in your Helm values, remove them — the chart no longer reads them.
* If you provision infrastructure with the Terraform module, remove the `ui_vault_api_key` input and any `TF_VAR_ui_vault_api_key` / `UI_VAULT_API_KEY` secret wiring — the variable has been deleted, and passing it now fails `terraform plan` with an unsupported-argument error.

**Configuration changes**

* Removed: `ui.vaultApiKey`.
* Removed: `ui.vaultApiKeySecret.existingSecret`, `ui.vaultApiKeySecret.key`.
* The chart-rendered `-ui` Secret is no longer created — it carried only `VAULT_API_KEY` — and the UI Deployment no longer loads it via `envFrom`. The UI ConfigMap (`VAULT_API_URL`, feature flags, `REDIRECT_URI`) and the Google OAuth client-secret reference (`ui.clientSecretRef`) are unchanged.
* Terraform module: the `ui_vault_api_key` input variable is removed (both the hub module and the `examples/aws` example).

**Operational changes**

* No chart dependency versions changed.
* No data migration is required.
* On upgrade, the `-ui` Secret is deleted and the UI pods roll to drop the `VAULT_API_KEY` env — a normal rolling update, no downtime.

**Upgrade path**

From chart `0.1.16`, upgrade to chart `0.1.17` with the normal Helm upgrade flow. Remove `ui.vaultApiKey` / `ui.vaultApiKeySecret` from your values first; leaving them set is harmless (they are ignored) but misleading.

**Bundled versions**

| Component | Version |
|---|---|
| Chart | `0.1.17` |
| App bundle | `v0.1.15` |
| OpenAPI release | `v0.1` |
| Orchestrator image | `v0.1.15` |
| Policy Server image | `v0.1.15` |
| MPC Key Store image | `v0.1.15` |
| Prebuilt EIF | `v0.1.15` |
| Vault UI | `0.1.5` |
| NATS subchart | `2.14.2` |
| Relay subchart | `3.5.0` |
| Common subchart | `0.1.1` |

**Chart artifact**

* Chart: `oci://repo.sodot.dev/sodot-helm-charts/crypto-vault --version 0.1.17`
* App bundle: `v0.1.15`
* Related API release: [v0.1](/releases/api)

## 0.1.16

*Adds optional node placement controls to the Orchestrator, Policy Server, and UI.*

**Chart summary**

* Publishes chart `0.1.16` for app bundle `v0.1.15` (no application image changes).
* Adds `nodeAffinity`, `nodeSelector`, and `tolerations` values to the Orchestrator, Policy Server, and UI. This brings node placement to the first-party services in line with the relay service, which exposes `nodeAffinity` and `tolerations`, and NATS, which is scheduled through its `podTemplate`.
* Keeps all image tags and subchart versions unchanged from `0.1.15`.

**Required customer action**

None. Upgrading to chart `0.1.16` is optional and changes nothing for existing installs: the new values default to no constraint.

**Configuration changes**

* New: `orchestrator.nodeAffinity`, `orchestrator.nodeSelector`, `orchestrator.tolerations`.
* New: `policyServer.nodeAffinity`, `policyServer.nodeSelector`, `policyServer.tolerations`. These apply to both the reader and writer, on every shard.
* New: `ui.nodeAffinity`, `ui.nodeSelector`, `ui.tolerations`.
* All new values default to no constraint. When set, `nodeAffinity` merges with the built-in soft anti-affinity that spreads replicas across availability zones and nodes. See the [Helm values reference](/deploy/helm/values-reference).

**Operational changes**

* No chart dependency versions changed.
* No Helm values migration is required.
* The Key Store keeps its Nitro node placement (`aws.nitroEnclave.nodeSelector`) and is unaffected.

**Upgrade path**

From chart `0.1.15`, upgrade to chart `0.1.16` with the normal Helm upgrade flow. No values changes are required. Optionally, set the new node placement values to pin the Orchestrator, Policy Server, or UI onto a dedicated node group.

**Bundled versions**

| Component | Version |
|---|---|
| Chart | `0.1.16` |
| App bundle | `v0.1.15` |
| OpenAPI release | `v0.1` |
| Orchestrator image | `v0.1.15` |
| Policy Server image | `v0.1.15` |
| MPC Key Store image | `v0.1.15` |
| Prebuilt EIF | `v0.1.15` |
| Vault UI | `0.1.5` |
| NATS subchart | `2.14.2` |
| Relay subchart | `3.5.0` |
| Common subchart | `0.1.1` |

**Chart artifact**

* Chart: `oci://repo.sodot.dev/sodot-helm-charts/crypto-vault --version 0.1.16`
* App bundle: `v0.1.15`
* Related API release: [v0.1](/releases/api)

## 0.1.15

*Updates the Helm chart to deploy Crypto Vault app bundle `v0.1.15`.*

**Chart summary**

* Publishes chart `0.1.15` for app bundle `v0.1.15`.
* Updates the first-party service and enclave images from `v0.1.10` to `v0.1.15`.
* Updates Vault UI from `0.1.0` to `0.1.5`.
* Keeps the NATS, relay, and common subchart versions unchanged.

**Required customer action**

Upgrade to chart `0.1.15` to deploy app bundle `v0.1.15`.

If your deployment overrides first-party image tags or the prebuilt EIF reference, update those overrides to the new release tags. Default installs pick up the new image tags automatically.

**Configuration changes**

* `orchestrator.image.tag` now defaults to `v0.1.15`.
* `policyServer.writerImage.tag` and `policyServer.readerImage.tag` now default to `v0.1.15`.
* `mpcKeyStoreImage.tag` now defaults to `v0.1.15`.
* `aws.nitroEnclave.prebuiltEif.eifRef` now points to `repo.sodot.dev/sodot-docker-oci/mpc-key-store-eif:v0.1.15`.
* `aws.nitroEnclave.runner.image.tag`, `aws.nitroEnclave.enclaver.image.tag`, `aws.nitroEnclave.resourceServer.image.tag`, and `aws.nitroEnclave.otlpExporter.image.tag` now default to `v0.1.15`.
* `ui.image.tag` now defaults to `0.1.5`.

**Operational changes**

* No chart dependency versions changed.
* No Helm values migration is required for default installs.
* The release tag also includes E2E failure-inspection tooling; that has no runtime impact on customer deployments.

**Upgrade path**

From chart `0.1.14`, upgrade to chart `0.1.15` with the normal Helm upgrade flow after reviewing any image-tag overrides in your values files.

**Bundled versions**

| Component | Version |
|---|---|
| Chart | `0.1.15` |
| App bundle | `v0.1.15` |
| OpenAPI release | `v0.1` |
| Orchestrator image | `v0.1.15` |
| Policy Server image | `v0.1.15` |
| MPC Key Store image | `v0.1.15` |
| Prebuilt EIF | `v0.1.15` |
| Vault UI | `0.1.5` |
| NATS subchart | `2.14.2` |
| Relay subchart | `3.5.0` |
| Common subchart | `0.1.1` |

**Chart artifact**

* Chart: `oci://repo.sodot.dev/sodot-helm-charts/crypto-vault --version 0.1.15`
* App bundle: `v0.1.15`
* Related API release: [v0.1](/releases/api)

## 0.1.14

*First published Helm chart release documented here.*

**Chart summary**

* Installs the Crypto Vault as an atomic chart bundle for Key Store, Policy Server, Orchestrator, relay, NATS, and UI.
* Pins first-party service images through app bundle `v0.1.10`.
* Pins chart dependencies so every install uses the same NATS, relay, and common chart versions.

**Required customer action**

First documented chart release, so no upgrade action applies.

**Configuration changes**

First documented chart release, so there is no previous customer configuration to migrate.

**Operational changes**

* Uses the two-stage install flow: Key Store and Policy Server on all clusters first, then Orchestrator, NATS, relay, and UI on the hub.
* Persists the chart version in-cluster so future upgrades can enforce required migration versions.

**Upgrade path**

First documented chart release, so no upgrade path applies.

**Bundled versions**

| Component | Version |
|---|---|
| Chart | `0.1.14` |
| App bundle | `v0.1.10` |
| OpenAPI release | `v0.1` |
| NATS subchart | `2.14.2` |
| Relay subchart | `3.5.0` |
| Common subchart | `0.1.1` |

**Chart artifact**

* Chart: `oci://repo.sodot.dev/sodot-helm-charts/crypto-vault --version 0.1.14`
* App bundle: `v0.1.10`
* Related API release: [v0.1](/releases/api)