Upgrading Streaming and Governance Charts from 2025.2 LTS to 2026.2 LTS

General prerequisites

Before you upgrade to 2025.6 LTS, please make sure you are:

  • performing the deployment with any of the following Axual Streaming 2025.2 LTS versions

    • Axual Streaming Charts 1.3.x series

  • performing the deployment with any of the following Axual Governance 2025.2 LTS versions

    • Axual Governance Charts 1.1.x series

  • running kubernetes version 1.24.x or later

  • not overriding any components' versions (search for tag: overrides in your values.yaml)

You can upgrade each part of the Axual Platform independently, we suggest starting from the Axual Streaming and then moving to the Axual Governance.

Performing the upgrade

Use the general upgrade steps for upgrading best-practice.

Axual Streaming Charts Prerequisites

  • Be sure that you have migrated your Confluent Schema Registry to Apicurio Schema Registry.

If not done, please follow this guide before proceeding.

Axual Governance Charts Prerequisites

  • Be sure to have set the connectionCollation=utf8mb4_unicode_ci parameter to the Platform Manager’s spring.datasource.url to connect to your database.

platform-manager:
  config:
    spring:
      datasource:
        url: "[YOUR_EXISTING_JDBC_URL]&connectionCollation=utf8mb4_unicode_ci"

Axual Streaming Charts Upgrade

Start with Axual Streaming 2025.2 LTS being installed using Axual Streaming Charts 1.3.x series.

Axual Streaming Charts 2.0.0 ship with Apicurio Registry enabled by default (global.apicurio.enabled=true), unlike previous chart versions where it was disabled by default. If you do not want Apicurio Registry deployed, explicitly disable it in your values.yaml:

global:
  apicurio:
    enabled: false

  1. Update the Axual helm repository to download the latest charts available

    helm repo update

  2. Upgrade the Axual Streaming installation

    helm upgrade --install streaming oci://registry.axual.io/axual-charts/axual-streaming --version=2.0.0 -n kafka
    This command will restart all streaming pods.

Once restarted, verify everything is running fine before considering the upgrade done.

Axual Governance Charts Upgrade

Start from Axual Governance 2025.2 LTS installed using Axual Governance Charts 1.1.x series.

  1. Update the Axual helm repository to download the latest charts available

    helm repo update

  2. Upgrade the Axual Governance installation

    helm upgrade --install governance oci://registry.axual.io/axual-charts/axual-governance --version=1.5.0 -n kafka
    This command will restart all governance pods.

Once restarted, verify everything is running fine before considering the upgrade done.

Post Upgrade

Upgrade to Apicurio Registry v3

Axual Streaming 2.0.0 makes Apicurio Registry v3 the default, while Apicurio Registry v2 remains supported for this release. Upgrading the registry from v2 to v3 — export/import, traffic cutover, rollback and troubleshooting — is a self-contained procedure documented on its own page:

Apicurio v2 is supported in 2026.2 and will be removed in 2026.3, so you are encouraged to complete the upgrade during this release.

Configure the KSML Provisioner

To run KSML with all features available, you need to configure the following:

  • the available Kafka bootstrap endpoints for each cluster via the Kafka Authentications, this allows the KSML application to run with the correct Kafka bootstrap endpoint based on the configuration application authentication.

  • the Schema Registry endpoints (e.g., Apicurio, Confluent) for each KSML Provisioner, which are automatically passed to all KSML applications started with that KSML Provisioner.

  • your KSML Provisioner deployment with available KSML notations, these notations will be then used by your KSML definitions.

ksml-provisioner:
  customValues:
    # KSML Runner Configuration
    ksmlRunnerConfig:
      # -- KSML Notations
      notations:
        avro:
          type: confluent_avro
          schemaRegistry: confluent
          config:
            normalize.schemas: true
            auto.register.schemas: false

        jsonschema:
          type: apicurio_jsonschema
          schemaRegistry: apicurio
          config:
            apicurio.registry.auto-register: true
            apicurio.registry.auto-register.if-exists: "RETURN"

        protobuf:
          type: apicurio_protobuf
          schemaRegistry: apicurio

Migrate OTel configuration to Spring Boot 4.x keys

With the Axual Platform 2026.2 we have completed the upgrade of all our Spring Boot projects to Spring Boot 4.

This applies to the following components which are built using Spring Boot:

This major Spring Boot update comes with integrated OpenTelemetry support.

The OpenTelemetry configuration for Spring Boot 3.5.x is still valid, but we advise migrating them to the new property keys.

Here is the table showing the mapping between Spring Boot 3.5.x and Spring Boot 4.x keys:

Spring Boot 3.5.x Property Key Spring Boot 4.x Property Key

management.tracing.enabled

management.tracing.export.enabled

management.otlp.tracing.compression

management.opentelemetry.tracing.export.otlp.compression

management.otlp.tracing.connect-timeout

management.opentelemetry.tracing.export.otlp.connect-timeout

management.otlp.tracing.endpoint

management.opentelemetry.tracing.export.otlp.endpoint

management.otlp.tracing.export.enabled

management.tracing.export.otlp.enabled

management.otlp.tracing.headers

management.opentelemetry.tracing.export.otlp.headers

management.otlp.tracing.timeout

management.opentelemetry.tracing.export.otlp.timeout

management.otlp.tracing.transport

management.opentelemetry.tracing.export.otlp.transport
We are going to drop support for OTel Spring Boot 3.5.x property-key support in Axual Platform 2026.3

Schema Registry Read-Only Access (sr-readonly)

Starting from Axual Platform 2026.1, we have introduced support for a read-only role (sr-readonly) for applications that are not based on Kafka Streams (e.g., standard Producers and Consumers).

Previously, such applications were relying on anonymous read access. With this change:

  • Authenticated Read: It is now possible to disable anonymous read access in Apicurio, ensuring that only authenticated applications can read from the Schema Registry.

  • Role Management: The Platform Manager will automatically assign the sr-readonly role to non-Kafka Streams applications when generating their Schema Registry credentials. Kafka Streams based applications (including KSML) will continue to receive the sr-developer role to allow schema management. For more details on how Application owners can generate these credentials, see Generating Schema Registry Credentials.

Configuration Prerequisites

To ensure this feature works correctly after the upgrade:

  1. Keycloak Realm Check: Verify that the sr-readonly role exists in your Apicurio Keycloak realm.

  2. Add Role if Missing: If the sr-readonly role is not present, you must add it manually as a realm-level role before applications can be successfully configured with read-only access.

  3. Disable Anonymous Read (Optional): Once the role is configured and applications are updated with the new credentials, you can safely remove the anonymous read configuration from your Apicurio instance to enhance security. For more information on configuring Apicurio, see Configuring Apicurio.

New Optional configurations

There are a few things that can be configured with the new release for which there are default configurations.

Those include: