Migration Guide
Breaking changes to apply before upgrading BoltMCP, listed by chart version.
Read this page before every upgrade, and work through each section between the version you have installed and the version you are moving to. Everything here must be done before helm upgrade runs: a pod whose Deployment references a Secret key that does not exist yet never starts, and a values file carrying a removed key fails schema validation before Helm applies anything.
To check which version you are on:
helm list -n boltmcpSet Variables
Export the Helm release name and namespace so the commands below can be pasted verbatim. Adjust the values if you installed under non-default names.
export RELEASE=boltmcp
export NAMESPACE=boltmcp0.5.x
Before upgrading, patch the boltmcp-oidc Secret to add two new keys and remove one old key:
REST_API_CLIENT_SECRET=$(openssl rand -hex 32)
RECONCILE_CLIENT_SECRET=$(openssl rand -hex 32)
kubectl patch secret ${RELEASE}-oidc -n ${NAMESPACE} --type merge -p "{
\"stringData\": {
\"keycloak-reconcile-client-secret\": \"${RECONCILE_CLIENT_SECRET:?not generated}\",
\"rest-api-to-keycloak-client-secret\": \"${REST_API_CLIENT_SECRET:?not generated}\"
},
\"data\": {
\"rest-api-resource-server-client-secret\": null
}
}"Confirm the two new keys are present and non-empty:
kubectl get secret ${RELEASE}-oidc -n ${NAMESPACE} \
-o go-template='{{range $k, $v := .data}}{{$k}}={{len $v}}{{"\n"}}{{end}}'The old boltmcp-rest-api Keycloak client is now redundant. It's harmless, but you may wish to delete it from your Keycloak Admin Console.
0.4.x
Before upgrading, patch the boltmcp-auth Secret to add two new keys:
INSPECTOR_TOKEN=$(openssl rand -hex 32)
UPSTREAM_OAUTH_SECRET=$(openssl rand -hex 32)
kubectl patch secret ${RELEASE}-auth -n ${NAMESPACE} --type merge -p "{
\"stringData\": {
\"mcp-inspector-api-token\": \"${INSPECTOR_TOKEN:?not generated}\",
\"mcp-server-upstream-oauth-secret\": \"${UPSTREAM_OAUTH_SECRET:?not generated}\"
}
}"Confirm the two new keys are present and non-empty:
kubectl get secret ${RELEASE}-auth -n ${NAMESPACE} \
-o go-template='{{range $k, $v := .data}}{{$k}}={{len $v}}{{"\n"}}{{end}}'