Migration Guide

Read this page before every upgrade, and work through each section between the version you have installed and the version you are moving to. Everything here must be done before helm upgrade runs: a pod whose Deployment references a Secret key that does not exist yet never starts, and a values file carrying a removed key fails schema validation before Helm applies anything.

To check which version you are on:

helm list -n boltmcp

Set Variables

Export the Helm release name and namespace so the commands below can be pasted verbatim. Both default to boltmcp — adjust if you installed under different names.

export RELEASE=boltmcp
export NAMESPACE=boltmcp

0.4.x

Two additional keys are now required in the boltmcp-auth Secret:

Generate both values into shell variables first, then patch. A merge patch against stringData leaves the keys already in the Secret untouched:

INSPECTOR_TOKEN=$(openssl rand -hex 32)
UPSTREAM_OAUTH_SECRET=$(openssl rand -hex 32)

kubectl patch secret ${RELEASE}-auth -n ${NAMESPACE} --type merge -p "{
  \"stringData\": {
    \"mcp-inspector-api-token\": \"${INSPECTOR_TOKEN:?not generated}\",
    \"mcp-server-upstream-oauth-secret\": \"${UPSTREAM_OAUTH_SECRET:?not generated}\"
  }
}"

Confirm both keys are present and non-empty before upgrading:

kubectl get secret ${RELEASE}-auth -n ${NAMESPACE} \
  -o go-template='{{range $k, $v := .data}}{{$k}}={{len $v}}{{"\n"}}{{end}}'

The upgrade rolls the pods that consume these keys, so there is no separate restart to run afterwards.