# Helm chart releases

## 0.1.20

*Adds the GCP deployment path across the Helm chart and example Terraform, publishes Crypto Vault 0.4.0, and updates NATS to 2.14.4.*

**Chart summary**

* Publishes chart `0.1.20` with `appVersion: 0.4.0`, Vault UI `0.3.1`, and [API v0.3](/releases/api).
* First ships the GCP Helm path and GCP Terraform building-block, three-cluster example, VPC peering, network, and Private Service Connect modules.
* Provisions regional GKE Standard clusters with N2D SEV-SNP Confidential Nodes for the Key Store, per-workload Cloud SQL Auth Proxy sidecars and Workload Identities, Cloud HSM keys, and private cross-project PSC paths.
* Updates the Orchestrator, Policy Server, AWS and non-AWS MPC Key Store, prebuilt EIF, and enclave support image defaults to `0.4.0`. Vault UI remains `0.3.1`.
* Upgrades the NATS subchart from `2.14.2` to `2.14.4`. Relay `3.5.0` and the common subchart `0.1.1` are unchanged.

**Required customer action**

* For a new GCP deployment, follow the [GCP provisioning guide](/deploy/provision-gcp) and preserve one independently administered project, Terraform state, and deployment identity per MPC party. The combined three-cluster example is for integration and proof-of-concept use.
* Existing AWS deployments on chart `0.1.19` should update the matching Terraform module or example and chart pins to `0.1.20`, then apply the normal upgrade flow. No values schema or data migration is required; chart-default installs need no manual value changes.

**Configuration changes**

* `cloudProvider: gcp` selects the GKE Confidential Node Key Store path. Supply the complete Cloud KMS CryptoKey resource name through `gcp.kmsKey`.
* GCP database workloads use distinct Kubernetes and Google service accounts with colocated Cloud SQL Auth Proxy sidecars. The Key Store, Policy Server reader, Policy Server writer, and hub Orchestrator receive separate database identities.
* `networkPolicies.gcpPscIngressCidrs.*` supplies role-specific PSC source ranges to the chart's workload NetworkPolicies. The GCP example Terraform pre-creates and owns all five PSC producer LoadBalancer Services: Key Store, Policy Server reader, Policy Server writer, NATS, and relay. It applies the matching source ranges and `externalTrafficPolicy: Local`; the Services select the Pods that Helm installs.

**Operational changes**

* The GCP deployment retains the two-stage Helm flow: activate the Key Store and Policy Server on all parties first, then enable the Orchestrator, NATS, relay, and UI on the hub.
* Before production handoff, Sodot verifies the regional GKE and N2D SEV-SNP profile, Workload Identities, PSC Services and NetworkPolicies, private and encrypted Cloud SQL posture, and HSM-backed KMS key.
* The supported GCP recovery path restores Cloud SQL within the same party project and `us-central1` while retaining the original application KMS key.
* AWS Terraform now applies ownership tags synchronously to EBS CSI volumes so retained NATS volumes can be identified safely during orphan cleanup. No new AWS input is required.

**Upgrade path**

For an existing AWS deployment on chart `0.1.19`, update the matching Terraform module or example to `0.1.20` and apply it, then upgrade the spokes before the hub with the normal Helm flow. No values schema or data migration is required; chart-default installs need no manual value changes. GCP first ships in chart `0.1.20`; provision each party as a new deployment with the [GCP provisioning guide](/deploy/provision-gcp) rather than following an upgrade path.

**Bundled versions**

| Component | Version |
|---|---|
| Chart | `0.1.20` |
| Terraform AWS building-block module | `0.1.20` |
| Terraform GCP building-block module | `0.1.20` |
| Terraform AWS and GCP example modules | `0.1.20` |
| Chart app version | `0.4.0` |
| OpenAPI release | `v0.3` |
| Orchestrator image | `0.4.0` |
| Policy Server image | `0.4.0` |
| AWS MPC Key Store image | `0.4.0` |
| Non-AWS MPC Key Store image | `0.4.0` |
| Prebuilt EIF | `0.4.0` |
| AWS enclave support images | `0.4.0` |
| Vault UI | `0.3.1` |
| NATS subchart | `2.14.4` |
| Relay subchart | `3.5.0` |
| Common subchart | `0.1.1` |

**Chart artifact**

* Chart: `oci://repo.sodot.dev/sodot-helm-charts/crypto-vault --version 0.1.20`
* App bundle: `0.4.0`
* Related API release: [v0.3](/releases/api)

## 0.1.19

*Deploys Crypto Vault 0.3.0 with Vault UI 0.3.1 and publishes the matching Helm chart and AWS Terraform modules as 0.1.19.*

**Chart summary**

* Publishes chart `0.1.19` with `appVersion: 0.3.1`, Crypto Vault `0.3.0` services, Vault UI `0.3.1`, and [API v0.3](/releases/api).
* Publishes the AWS building-block module `repo.sodot.dev/sodot-terraform-modules__sodot/crypto-vault/aws` and the three-cluster example `repo.sodot.dev/sodot-terraform-modules__sodot/crypto-vault-example/aws` at version `0.1.19`. The building-block package also contains the `//peering-aws` and `//privatelink-aws` add-ons.
* Replaces the Orchestrator, Policy Server, MPC Key Store, prebuilt EIF, and enclave support image defaults from `0.2.0` with `0.3.0`, and upgrades Vault UI from `0.1.5` to `0.3.1`.
* The Terraform example can adopt existing Route 53 aliases for the UI and API hosts instead of failing when either configured record already exists.
* Upgrades the AWS Load Balancer Controller chart from `3.4.1` to `3.5.0`, Cluster Autoscaler from `9.58.0` to `9.59.0`, and the resolved AWS provider from `6.54.0` to `6.57.1`.
* Supersedes the mistakenly numbered `v0.19.0` deployment release. Use `v0.1.19` for the release tag and `0.1.19` in Helm and Terraform version fields.

**Required customer action**

* Before upgrading, update clients that use strict response decoding or exhaustive enum handling for the [API v0.3 breaking changes](/releases/api): `SystemInfo` now requires `supported_blockchain_networks`, and `AdminPolicyType` adds `modify_system_settings`.
* Change Helm and Terraform release pins to `0.1.19`. Do not use `0.19.0`. Terraform version constraints use the bare version: `version = "0.1.19"`.
* If you override first-party image tags, update the backend and enclave tags to `0.3.0`. Update Helm `ui.image.tag`, Terraform `ui_image_tag`, or the higher-priority `image_tags.ui` override to `0.3.1`. Default installs receive the new tags automatically.

**Configuration changes**

* Helm values are unchanged. The Terraform building-block module adds `ui_image_tag`, which defaults to `0.3.1` and is used when `image_tags.ui` is null.
* The Orchestrator, Policy Server, MPC Key Store, prebuilt EIF, enclave runner, enclaver, resource server, and enclave OTLP exporter now default to image tag `0.3.0`.
* `ui.image.tag` now defaults to `0.3.1` (was `0.1.5`).
* `aws.nitroEnclave.credentialFetcher.image.tag` now defaults to `2.36.15` (was `2.35.21`).
* The Terraform module and example use the same `0.3.0` backend and enclave defaults as the chart. Vault UI defaults to `ui_image_tag = "0.3.1"`, which must be non-empty, while `image_tags.ui` remains the higher-priority override.
* NATS `2.14.2`, relay `3.5.0`, and the common subchart `0.1.1` are unchanged.

**Operational changes**

* A Helm upgrade rolls the Orchestrator, Policy Server, and Key Store workloads onto `0.3.0` images and Vault UI onto `0.3.1`.
* For Terraform example users, the next `terraform apply` upgrades the AWS Load Balancer Controller and Cluster Autoscaler in place. It also adopts matching UI and API Route 53 aliases into the managed deployment.
* No intermediate chart version or Helm values migration is required between `0.1.18` and `0.1.19`.

**Upgrade path**

From chart `0.1.18`, first update strict API clients for v0.3, then point the Terraform building-block or example module at `0.1.19` and apply the infrastructure changes. Upgrade the chart to `0.1.19` with the normal Helm flow. Existing values and module inputs remain valid.

**Bundled versions**

| Component | Version |
|---|---|
| Chart | `0.1.19` |
| Terraform building-block module | `0.1.19` |
| Terraform AWS example module | `0.1.19` |
| Chart app version | `0.3.1` |
| OpenAPI release | `v0.3` |
| Orchestrator image | `0.3.0` |
| Policy Server image | `0.3.0` |
| MPC Key Store image | `0.3.0` |
| Prebuilt EIF | `0.3.0` |
| Vault UI | `0.3.1` |
| AWS Load Balancer Controller | `3.5.0` |
| Cluster Autoscaler | `9.59.0` |
| NATS subchart | `2.14.2` |
| Relay subchart | `3.5.0` |
| Common subchart | `0.1.1` |

**Chart artifact**

* Chart: `oci://repo.sodot.dev/sodot-helm-charts/crypto-vault --version 0.1.19`
* App bundle: `0.3.1`
* Related API release: [v0.3](/releases/api)

## 0.1.18

*Deploys Crypto Vault app bundle `v0.2.0`, serving API v0.2, and enables structured JSON logging and extra environment variables for stateless pods.*

**Chart summary**

* Publishes chart `0.1.18` for app bundle `v0.2.0`, serving [API v0.2](/releases/api).
* Adds `logFormat` values to the Orchestrator, Policy Server (reader and writer), and Key Store: you can now choose between `json` (default, one JSON object per line) and `text` (human-readable tracing lines) for console (stdout) logs. The chart validates these values and fails rendering if invalid.
* Introduces `extraEnv` values for the Orchestrator, Policy Server (both reader and writer roles), and UI: supply a list of native Kubernetes `EnvVar` objects to append custom environment variables to these containers.
* Adds `observability.consoleColor` (default `false`): disables ANSI color codes in Orchestrator and Policy Server logs by setting `NO_COLOR=1`, so log aggregators parse clean log levels. Set `true` to restore colored output for color-aware viewers.
* Defaults the Key Store log sidecar (`aws.nitroEnclave.otlpExporter.format`) to `json` for structured log pipelines.
* Bumps supporting images: fetch-EIF `oras` CLI from `v1.2.0` to `v1.3.3`, credential-fetcher `amazon/aws-cli` from `2.35.9` to `2.35.21`, and Helm-test curl image from `8.20.0` to `8.21.0`.
* Terraform example: upgrades AWS Load Balancer Controller chart from `3.4.0` to `3.4.1`, Nitro Enclaves device plugin chart from `0.3.1` to `0.4.1`, and refreshes provider lock files (AWS provider `6.54.0`, Kubernetes provider `3.2.1`).

**Required customer action**

None required to upgrade. If you parse log output from Orchestrator, Policy Server, or Key Store, review the new JSON defaults and adjust your log pipeline if needed:

* To keep previous text-format logs, set the relevant `logFormat` values to `"text"` and `aws.nitroEnclave.otlpExporter.format` to `"text"`.
* If your log pipeline handled ANSI escape codes, you can remove those workarounds after upgrade. To restore colored output, set `observability.consoleColor: true`.

**Configuration changes**

* New: `observability.consoleColor` (default `false`). When `false`, disables ANSI color codes in Orchestrator and Policy Server logs for clean log level parsing. Set `true` to restore colored output.
* New: `orchestrator.logFormat`, `policyServer.readerLogFormat`, `policyServer.writerLogFormat`, and `keyStore.logFormat` (all default `"json"`). Choose between `json` and `text` for console log output. Invalid values fail chart rendering.
* New: `orchestrator.extraEnv`, `policyServer.extraEnv`, and `ui.extraEnv` (all default `[]`). Append custom environment variables to the respective containers using native Kubernetes `EnvVar` objects.
* Default changed: `aws.nitroEnclave.otlpExporter.format` is now `"json"` (was `"text"`).
* Image tag defaults: `aws.nitroEnclave.prebuiltEif.orasImage.tag` is `v1.3.3`, `aws.nitroEnclave.credentialFetcher.image.tag` is `2.35.21`, `tests.image.tag` is `8.21.0`.

**Operational changes**

* On upgrade, Orchestrator and Policy Server pods roll (env ConfigMaps and log format changes), Key Store pods roll (sidecar format and supporting-image changes), and UI rolls if you set `ui.extraEnv`.
* Log output changes are visible immediately after pods restart: console logs default to JSON, and ANSI codes are removed unless explicitly enabled.
* Terraform example users: next `terraform apply` upgrades AWS Load Balancer Controller and Nitro device-plugin charts in place. Controller pods roll (existing load balancers keep serving traffic), device-plugin DaemonSet rolls without evicting running Key Store pods.
* No chart dependency versions changed. No data migration required.

**Upgrade path**

From chart `0.1.17`, upgrade to chart `0.1.18` with the normal Helm upgrade flow. No values changes required unless you want to override log format or console color. Existing explicit settings are preserved.

**Bundled versions**

| Component              | Version    |
|------------------------|------------|
| Chart                  | `0.1.18`   |
| App bundle             | `v0.2.0`   |
| OpenAPI release        | `v0.2`     |
| Orchestrator image     | `0.2.0`    |
| Policy Server image    | `0.2.0`    |
| MPC Key Store image    | `0.2.0`    |
| Prebuilt EIF           | `0.2.0`    |
| Vault UI               | `0.1.5`    |
| NATS subchart          | `2.14.2`   |
| Relay subchart         | `3.5.0`    |
| Common subchart        | `0.1.1`    |

**Chart artifact**

* Chart: `oci://repo.sodot.dev/sodot-helm-charts/crypto-vault --version 0.1.18`
* App bundle: `v0.2.0`
* Related API release: [v0.2](/releases/api)

## 0.1.17

*Removes the UI's `VAULT_API_KEY` machine API key and all of its configuration.*

**Chart summary**

* Publishes chart `0.1.17` for app bundle `v0.1.15` (no application image changes).
* Removes the Vault UI's `VAULT_API_KEY` environment variable and the chart-rendered `-ui` Secret that carried it. The UI no longer authenticates to the Orchestrator with a machine API key.
* Keeps all image tags and subchart versions unchanged from `0.1.16`.

**Required customer action**

* If you set `ui.vaultApiKey` or `ui.vaultApiKeySecret` in your Helm values, remove them — the chart no longer reads them.
* If you provision infrastructure with the Terraform module, remove the `ui_vault_api_key` input and any `TF_VAR_ui_vault_api_key` / `UI_VAULT_API_KEY` secret wiring — the variable has been deleted, and passing it now fails `terraform plan` with an unsupported-argument error.

**Configuration changes**

* Removed: `ui.vaultApiKey`.
* Removed: `ui.vaultApiKeySecret.existingSecret`, `ui.vaultApiKeySecret.key`.
* The chart-rendered `-ui` Secret is no longer created — it carried only `VAULT_API_KEY` — and the UI Deployment no longer loads it via `envFrom`. The UI ConfigMap (`VAULT_API_URL`, feature flags, `REDIRECT_URI`) and the Google OAuth client-secret reference (`ui.clientSecretRef`) are unchanged.
* Terraform module: the `ui_vault_api_key` input variable is removed (both the hub module and the `examples/aws` example).

**Operational changes**

* No chart dependency versions changed.
* No data migration is required.
* On upgrade, the `-ui` Secret is deleted and the UI pods roll to drop the `VAULT_API_KEY` env — a normal rolling update, no downtime.

**Upgrade path**

From chart `0.1.16`, upgrade to chart `0.1.17` with the normal Helm upgrade flow. Remove `ui.vaultApiKey` / `ui.vaultApiKeySecret` from your values first; leaving them set is harmless (they are ignored) but misleading.

**Bundled versions**

| Component | Version |
|---|---|
| Chart | `0.1.17` |
| App bundle | `v0.1.15` |
| OpenAPI release | `v0.1` |
| Orchestrator image | `v0.1.15` |
| Policy Server image | `v0.1.15` |
| MPC Key Store image | `v0.1.15` |
| Prebuilt EIF | `v0.1.15` |
| Vault UI | `0.1.5` |
| NATS subchart | `2.14.2` |
| Relay subchart | `3.5.0` |
| Common subchart | `0.1.1` |

**Chart artifact**

* Chart: `oci://repo.sodot.dev/sodot-helm-charts/crypto-vault --version 0.1.17`
* App bundle: `v0.1.15`
* Related API release: [v0.1](/releases/api)

## 0.1.16

*Adds optional node placement controls to the Orchestrator, Policy Server, and UI.*

**Chart summary**

* Publishes chart `0.1.16` for app bundle `v0.1.15` (no application image changes).
* Adds `nodeAffinity`, `nodeSelector`, and `tolerations` values to the Orchestrator, Policy Server, and UI. This brings node placement to the first-party services in line with the relay service, which exposes `nodeAffinity` and `tolerations`, and NATS, which is scheduled through its `podTemplate`.
* Keeps all image tags and subchart versions unchanged from `0.1.15`.

**Required customer action**

None. Upgrading to chart `0.1.16` is optional and changes nothing for existing installs: the new values default to no constraint.

**Configuration changes**

* New: `orchestrator.nodeAffinity`, `orchestrator.nodeSelector`, `orchestrator.tolerations`.
* New: `policyServer.nodeAffinity`, `policyServer.nodeSelector`, `policyServer.tolerations`. These apply to both the reader and writer, on every shard.
* New: `ui.nodeAffinity`, `ui.nodeSelector`, `ui.tolerations`.
* All new values default to no constraint. When set, `nodeAffinity` merges with the built-in soft anti-affinity that spreads replicas across availability zones and nodes. See the [Helm values reference](/deploy/helm/values-reference).

**Operational changes**

* No chart dependency versions changed.
* No Helm values migration is required.
* The Key Store keeps its Nitro node placement (`aws.nitroEnclave.nodeSelector`) and is unaffected.

**Upgrade path**

From chart `0.1.15`, upgrade to chart `0.1.16` with the normal Helm upgrade flow. No values changes are required. Optionally, set the new node placement values to pin the Orchestrator, Policy Server, or UI onto a dedicated node group.

**Bundled versions**

| Component | Version |
|---|---|
| Chart | `0.1.16` |
| App bundle | `v0.1.15` |
| OpenAPI release | `v0.1` |
| Orchestrator image | `v0.1.15` |
| Policy Server image | `v0.1.15` |
| MPC Key Store image | `v0.1.15` |
| Prebuilt EIF | `v0.1.15` |
| Vault UI | `0.1.5` |
| NATS subchart | `2.14.2` |
| Relay subchart | `3.5.0` |
| Common subchart | `0.1.1` |

**Chart artifact**

* Chart: `oci://repo.sodot.dev/sodot-helm-charts/crypto-vault --version 0.1.16`
* App bundle: `v0.1.15`
* Related API release: [v0.1](/releases/api)

## 0.1.15

*Updates the Helm chart to deploy Crypto Vault app bundle `v0.1.15`.*

**Chart summary**

* Publishes chart `0.1.15` for app bundle `v0.1.15`.
* Updates the first-party service and enclave images from `v0.1.10` to `v0.1.15`.
* Updates Vault UI from `0.1.0` to `0.1.5`.
* Keeps the NATS, relay, and common subchart versions unchanged.

**Required customer action**

Upgrade to chart `0.1.15` to deploy app bundle `v0.1.15`.

If your deployment overrides first-party image tags or the prebuilt EIF reference, update those overrides to the new release tags. Default installs pick up the new image tags automatically.

**Configuration changes**

* `orchestrator.image.tag` now defaults to `v0.1.15`.
* `policyServer.writerImage.tag` and `policyServer.readerImage.tag` now default to `v0.1.15`.
* `mpcKeyStoreImage.tag` now defaults to `v0.1.15`.
* `aws.nitroEnclave.prebuiltEif.eifRef` now points to `repo.sodot.dev/sodot-docker-oci/mpc-key-store-eif:v0.1.15`.
* `aws.nitroEnclave.runner.image.tag`, `aws.nitroEnclave.enclaver.image.tag`, `aws.nitroEnclave.resourceServer.image.tag`, and `aws.nitroEnclave.otlpExporter.image.tag` now default to `v0.1.15`.
* `ui.image.tag` now defaults to `0.1.5`.

**Operational changes**

* No chart dependency versions changed.
* No Helm values migration is required for default installs.
* The release tag also includes E2E failure-inspection tooling; that has no runtime impact on customer deployments.

**Upgrade path**

From chart `0.1.14`, upgrade to chart `0.1.15` with the normal Helm upgrade flow after reviewing any image-tag overrides in your values files.

**Bundled versions**

| Component | Version |
|---|---|
| Chart | `0.1.15` |
| App bundle | `v0.1.15` |
| OpenAPI release | `v0.1` |
| Orchestrator image | `v0.1.15` |
| Policy Server image | `v0.1.15` |
| MPC Key Store image | `v0.1.15` |
| Prebuilt EIF | `v0.1.15` |
| Vault UI | `0.1.5` |
| NATS subchart | `2.14.2` |
| Relay subchart | `3.5.0` |
| Common subchart | `0.1.1` |

**Chart artifact**

* Chart: `oci://repo.sodot.dev/sodot-helm-charts/crypto-vault --version 0.1.15`
* App bundle: `v0.1.15`
* Related API release: [v0.1](/releases/api)

## 0.1.14

*First published Helm chart release documented here.*

**Chart summary**

* Installs the Crypto Vault as an atomic chart bundle for Key Store, Policy Server, Orchestrator, relay, NATS, and UI.
* Pins first-party service images through app bundle `v0.1.10`.
* Pins chart dependencies so every install uses the same NATS, relay, and common chart versions.

**Required customer action**

First documented chart release, so no upgrade action applies.

**Configuration changes**

First documented chart release, so there is no previous customer configuration to migrate.

**Operational changes**

* Uses the two-stage install flow: Key Store and Policy Server on all clusters first, then Orchestrator, NATS, relay, and UI on the hub.
* Persists the chart version in-cluster so future upgrades can enforce required migration versions.

**Upgrade path**

First documented chart release, so no upgrade path applies.

**Bundled versions**

| Component | Version |
|---|---|
| Chart | `0.1.14` |
| App bundle | `v0.1.10` |
| OpenAPI release | `v0.1` |
| NATS subchart | `2.14.2` |
| Relay subchart | `3.5.0` |
| Common subchart | `0.1.1` |

**Chart artifact**

* Chart: `oci://repo.sodot.dev/sodot-helm-charts/crypto-vault --version 0.1.14`
* App bundle: `v0.1.10`
* Related API release: [v0.1](/releases/api)