Skip to content

docs(migration): warn against secrets metadata migration in read-only mode #5462

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
nkwiatkowski wants to merge 2 commits into
base: main
Choose a base branch
from
+8 −0
Open

docs(migration): warn against secrets metadata migration in read-only mode #5462

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d576dea
docs(migration): warn against secrets metadata migration in read-only…
Sep 1, 2026
55a76af
docs(migration): note read-only namespaces are auto-skipped during se…
Sep 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions src/contents/docs/11.migration-guide/v1.1.0/kv-secrets-metadata-migration/index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,10 @@ kestra:
Secrets metadata migration is only necessary for Enterprise users. Open-source users will see an exception error: `❌ Secrets Metadata migration failed: Secret migration is not needed in the OSS version`.
:::

:::alert{type="info"}
The secrets metadata migration automatically **skips any tenant or namespace whose secret manager is in read-only mode** — read-only secret managers do not use the secrets metadata store, so nothing needs to be migrated for them, and each skipped namespace is logged. Writable tenants and namespaces are migrated as usual, so a setup that mixes read-only and writable secret managers still migrates correctly. Skipped read-only namespaces are unaffected: their secrets keep resolving at runtime and remain listed in the UI.
:::

Once the migration is complete, the container will stop automatically. You can then move back to the usual command to run the server:

```yaml
Expand Down
4 changes: 4 additions & 0 deletions src/contents/docs/11.migration-guide/v1.3.0/lts-migration/index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,10 @@ Three migration commands must be run — **all three are required** for a comple
The `secrets` migration applies only to **Enterprise Edition** users. Open-source users can skip it — running it on OSS will produce an exception that can be safely ignored.
:::

:::alert{type="info"}
The `secrets` migration automatically **skips any tenant or namespace whose secret manager is in read-only mode** — read-only secret managers do not use the secrets metadata store, so nothing needs to be migrated for them, and each skipped namespace is logged. Writable tenants and namespaces are migrated as usual, so a setup that mixes read-only and writable secret managers still migrates correctly. Skipped read-only namespaces are unaffected: their secrets keep resolving at runtime and remain listed in the UI.
:::

## Order of operations

1. **Stop Kestra** — shut down all running Kestra server components to avoid inconsistent reads/writes during migration.
Expand Down
Loading