> ## Documentation Index
> Fetch the complete documentation index at: https://docs.thoras.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Upgrading

> How Thoras Helm chart versions map to upgrade effort, and what changed in chart 5.x.

Thoras ships continuously. Within a single major version (for example `5.x.x`),
minor and patch releases are routine and should not require any special steps.

A major chart version bump (for example `4.x.x` to `5.x.x`) signals a breaking
change that may need human intervention. Only one major version can be crossed
at a time (for example, `4.x.x` to `6.x.x` is not supported).

The authoritative, step-by-step migration notes for every major version live in
the chart repository:

<Card title="UPGRADE.md on GitHub" icon="github" href="https://github.com/thoras-ai/helm-charts/blob/main/charts/thoras/UPGRADE.md">
  Detailed upgrade procedures for each breaking chart release.
</Card>

## Chart 5.x at a glance

Chart `5.0` adds dashboard authentication and moves credential management into
the cluster. Most `4.x` installs upgrade with no changes to `values.yaml`.

* **The dashboard requires a login.** An oauth2-proxy sidecar now fronts the
  dashboard, using a generated username and password by default or your identity
  provider via OIDC. See [Dashboard authentication](/guides/dashboard-auth).
* **Credentials are managed in-cluster.** A new `thoras-config-controller`
  component seeds any credential you don't supply, migrates your existing 4.x
  credentials automatically, and restarts dependent workloads when a credential
  changes. See [Credentials](/installation/credentials).
* **`featureFlags.enableSimpleAuthSecret` is renamed** to
  `apiClientSecret.enabled`. The old name still works as an alias. See
  [Deprecations](/deprecations).

## Does anything apply to me?

Work through whichever of these match your deployment:

| Your 4.x setup                                                                   | What to do                                                                                                                                                                                                                                                                                                                                                             |
| -------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Dashboard reached via `kubectl port-forward` or an ingress with no auth in front | Nothing before upgrading. Afterwards, sign in with the generated credentials. See [Default (htpasswd) auth](/guides/dashboard-auth/htpasswd).                                                                                                                                                                                                                          |
| Your own oauth2-proxy under `thorasDashboard.extraContainers`                    | Move to the built-in sidecar. Your IdP app and Secret carry over. See [Migrating from a hand-rolled sidecar](/guides/dashboard-auth#migrating-from-a-hand-rolled-oauth2-proxy-sidecar).                                                                                                                                                                                |
| Auth already enforced at the ingress, gateway, or mesh                           | Set `thorasDashboard.auth.enabled: false`. See [Bring your own auth](/guides/dashboard-auth#bring-your-own-auth).                                                                                                                                                                                                                                                      |
| `featureFlags.enableSimpleAuthSecret` in `values.yaml`                           | Rename to `apiClientSecret.enabled`.                                                                                                                                                                                                                                                                                                                                   |
| Deployed with Argo CD, Flux, or `helm template`                                  | During the upgrade, keep `jsonPointers: [/data]` `ignoreDifferences` entries on the `api-client-secret` and `thoras-timescale-password` Secrets so Argo doesn't overwrite them before config-controller migrates their values. Once the pods are healthy, set `featureFlags.enableLegacySecretSeeding: false` and remove those entries. See [ArgoCD](/guides/argo-cd). |

<Note>
  If you use the chart's legacy secret seeding (the 4.x default), complete the
  upgrade with `featureFlags.enableLegacySecretSeeding` left at its default of
  `true` so the config-controller can migrate your existing credentials. Once
  all pods are healthy, set it to `false`.
</Note>