Upgrade to Apicurio Registry v3

global:
  apicurio:
    enabled: true              # your existing Apicurio v2, still running
  apicurio-registry-v3:
    enabled: true              # enable Apicurio v3 alongside v2

axual-streaming:
  apicurio-registry-v3:
    imagePullSecrets:
      - name: [same as configured for your apicurio-registry]

    apicurioKeycloak:
      enabled: false   # reuse the v2 Keycloak — do not deploy a new one
    apicurioKeycloakMysql:
      enabled: false

axual-streaming:
  apicurio-registry-v3:
    ui:
      config:
        registryApiUrl: "https://apicurio-v3.example.com/apis/registry/v3"

axual-streaming:
  apicurio-registry-v3:
    kafka:
      bootstrapServers: [same as configured for your apicurio-registry]
      journalTopic: "_<tenant>-<instance>-kafkasql-journal"
      snapshotsTopic: "_<tenant>-<instance>-kafkasql-snapshots"
      eventsTopic: "_<tenant>-<instance>-registry-events"

axual-streaming:
  apicurio-registry-v3:
    tls:
      clientKeypairSecretName: [same as configured for your apicurio-registry]
      serverKeypairSecretName: [same as configured for your apicurio-registry]
      truststoreCaSecretName: [same as configured for your apicurio-registry]

axual-streaming:
  apicurio-registry-v3:
    kafkaInitContainer:
      apicurioPrincipal: [same as configured for your apicurio-registry]
      replicationFactor: [same as configured for your apicurio-registry]
      minIsr: [same as configured for your apicurio-registry]
      tls:
        keypairSecretName: [same as configured for your apicurio-registry]
        keypairSecretKeyName: [same as configured for your apicurio-registry]
        keypairSecretCertName: [same as configured for your apicurio-registry]
        truststoreCaSecretName: [same as configured for your apicurio-registry]
        truststoreCaSecretCertName: [same as configured for your apicurio-registry]

axual-streaming:
  apicurio-registry-v3:
    security:
      authentication:
        enabled: true
        basicAuthEnabled: true
        keycloak:
          authUrl: [same as configured for your apicurio-registry]
          realm: [same as configured for your apicurio-registry]
          webClientId: [same as configured for your apicurio-registry]
          webRedirectUrl: "https://apicurio-v3.example.com"   # point to v3, not v2

axual-streaming:
  apicurio-registry-v3:
    ingress:
      backend:
        enabled: true
        className: [same as configured for your apicurio-registry]
        annotations: [same as configured for your apicurio-registry]
        host: "apicurio-v3.example.com"
        tls:
          - secretName: [same as configured for your apicurio-registry]
            hosts:
              - "apicurio-v3.example.com"
      ui:
        enabled: true
        className: [same as configured for your apicurio-registry]
        annotations: [same as configured for your apicurio-registry]
        host: "apicurio-v3.example.com"
        tls:
          - secretName: [same as configured for your apicurio-registry]
            hosts:
              - "apicurio-v3.example.com"

axual-streaming:
  apicurio-registry-v3:
    authProxy:
      enabled: true
      secrets:
        auth-proxy:
          client-secret-salt: not-too-salty
          clientSecretAlgorithm: HmacSHA256
      config:
        auth-proxy:
          valid-issuer-uri: [same as configured for your apicurio-registry]
          jwks-endpoint-uri: [same as configured for your apicurio-registry]
          client-id: [same as configured for your apicurio-registry]
          check-audience: [same as configured for your apicurio-registry]
      ingress:
        enabled: true
        className: [same as configured for your apicurio-registry]
        annotations: [same as configured for your apicurio-registry]
        hosts:
          - host: "apicurio-auth-proxy.example.com"
            paths:
              - path: "/apis"
                pathType: "Prefix"
        tls:
          - secretName: "<same TLS secret as your other ingresses>"
            hosts:
              - "apicurio-auth-proxy.example.com"

# --- Hosts ---
EXISTING_APICURIO_HOST="apicurio.example.com"        # current production Apicurio v2 host
NEW_APICURIO_HOST="apicurio-v3.example.com"          # temporary v3 host, until the Step 6 cutover
LEGACY_APICURIO_HOST="apicurio-legacy.example.com"   # where v2 moves after cutover (kept for rollback)
APICURIO_KEYCLOAK_HOST="apicurio.example.com"        # Keycloak host (often the same host, under /auth)
APICURIO_REALM="apicurio"

# --- Migration client (created in the prerequisites; holds the migration-admin role) ---
MIGRATION_CLIENT_ID="apicurio-migration"
MIGRATION_CLIENT_SECRET="<migration client secret from the Credentials tab>"

# --- Platform client (apicurio-api; used for the v3 import — keeps sr-admin throughout) ---
APICURIO_API_CLIENT_ID="apicurio-api"
APICURIO_API_CLIENT_SECRET="<apicurio-api client secret>"

apicurio-registry:
  config:
    # The chart sets registry.auth.admin-override.enabled=true (role: sr-admin); turn it off here.
    registry.auth.admin-override.enabled: "false"
  env:
    # No regular client resolves to a developer role any more (sr-developer / sr-admin match nothing);
    # only the dedicated `apicurio-migration` client (holding `migration-admin` role) keeps reading/registering subjects access.
    - name: REGISTRY_AUTH_ROLES_DEVELOPER
      value: "sr-developer-frozen"   # no token carries this name → apps registering subjects denied
    - name: REGISTRY_AUTH_ROLES_ADMIN
      value: "migration-admin"       # the admin role during the freeze; held ONLY by the migration client
    # Keep authenticated readers (Platform Manager, Topic Browse, your apps) able to read subjects during the freeze.
    - name: REGISTRY_AUTH_AUTHENTICATED_READS_ENABLED
      value: "true"

# Get an access token from the v2 Keycloak.
# Use the dedicated migration client that holds the migration-admin role — now the only admin role —
# so it keeps register/export access, while every other client is frozen to read-only.
TOKEN=$(curl -skv -X POST \
  "https://${APICURIO_KEYCLOAK_HOST}/auth/realms/${APICURIO_REALM}/protocol/openid-connect/token" \
  -d "grant_type=client_credentials&client_id=${MIGRATION_CLIENT_ID}&client_secret=${MIGRATION_CLIENT_SECRET}" \
  | jq -r '.access_token')

# Count the artifacts currently in v2 — record this number to verify the v3 import in Step 5.
curl -skv \
  "https://${EXISTING_APICURIO_HOST}/apis/registry/v2/search/artifacts" \
  -H "Authorization: Bearer $TOKEN" | jq '.count'

# Export all schemas and metadata.
curl -skv \
  "https://${EXISTING_APICURIO_HOST}/apis/registry/v2/admin/export" \
  -H "Authorization: Bearer $TOKEN" \
  -o apicurio-export.zip

ls -lh apicurio-export.zip   # should be > 0 bytes

apicurio-registry-v3:
  apicurioKeycloak:
    enabled: true
    realm: "apicurio"
    args: ['start']
    database:
      vendor: "mysql"
      hostname: "<keycloak-db-hostname>"   # the v3-owned MySQL from the previous sub-step, or your external database
      database: "apicurio-kc-db"
      username: "keycloak"

global:
  apicurio:
    enabled: false