Updating 3rd Party Applications

Overview

Third-party applications are infrastructure components deployed via Helm charts, things like traefik, cert-manager, external-secrets, and ArgoCD itself. This page covers how to update their versions and configurations.

Infrastructure Components

The kit includes these third-party components in kubernetes/src/infrastructure/:

Component	Chart Source	Purpose
argocd	argoproj.github.io	GitOps controller
cert-manager	quay.io/jetstack	TLS certificate automation
cloudnative-pg	cloudnative-pg.github.io	PostgreSQL operator
external-dns	kubernetes-sigs.github.io	DNS record management
external-secrets	charts.external-secrets.io	Secret synchronization
traefik	ghcr.io/traefik/helm	Ingress controller
karpenter	public.ecr.aws/karpenter	Node autoscaling
reloader	stakater.github.io	Pod restart on config changes
signoz-k8s-infra	charts.signoz.io	Observability collectors

Update Chart Versions

Each component uses a “wrapper chart” pattern: a local Helm chart that includes the upstream chart as a dependency.

Find the current version

Check the current version in the component’s values.yaml:

cat kubernetes/src/infrastructure/traefik/values.yaml

Look for the chartVersions section:

chartVersions:
  traefik: "38.0.1"

Check for new versions

Find the latest version from the chart repository:

# Search for versions using OCI registry
helm search repo traefik/traefik --versions | head -10

Update the version

Edit the values file to update the version:

vim kubernetes/src/infrastructure/traefik/values.yaml

chartVersions:
  traefik: "38.1.0"  # Updated version

For environment-specific versions, edit values.staging.yaml or values.production.yaml. Setting these independently allows for testing upgrades in lower environments before rolling out to production.

Update Chart.lock

Regenerate the lock file with the new dependency:

cd kubernetes/src/infrastructure/traefik
helm dependency update

Render and commit

mise run //kubernetes/src/infrastructure:render-all "<CLUSTER>"

git add .
git commit -m "chore: update traefik to 38.1.0"
git push origin main

Update Configuration

To change component settings without upgrading versions:

Edit the values file

Modify values.yaml for base configuration or values.{environment}.yaml for environment-specific settings:

vim kubernetes/src/infrastructure/traefik/values.yaml

For example, increase controller replicas:

traefik:
  deployment:
    replicas: 3

Render manifests

mise run //kubernetes/src/infrastructure:render-all "<CLUSTER>"

Review and commit

git diff kubernetes/rendered/
git add .
git commit -m "chore: increase traefik replicas to 3"
git push origin main

ArgoCD automatically syncs the changes.

Add Additional Manifests

Many components need additional manifests beyond the upstream chart (ClusterIssuers, StorageClasses, etc.). Add these in the wrapper chart’s templates/ directory:

kubernetes/src/infrastructure/cert-manager/
├── Chart.yaml
├── Chart.yaml.tmpl
├── values.yaml
├── values.staging.yaml
└── templates/
    ├── ClusterIssuer.letsencrypt-production.yaml
    ├── ClusterIssuer.letsencrypt-staging.yaml
    └── ClusterIssuer.selfsigned.yaml

These templates are rendered alongside the upstream chart resources.

Environment-Specific Configuration

Use values overlay files for environment differences:

# values.yaml (base)
traefik:
  deployment:
    replicas: 2

# values.staging.yaml
traefik:
  deployment:
    replicas: 1  # Smaller for staging

# values.production.yaml
traefik:
  deployment:
    replicas: 3  # Larger for production

The render process merges base values with environment-specific overrides.

Enable/Disable Components

Components are enabled/disabled in the ArgoCD infrastructure app-of-apps:

vim kubernetes/src/argocd/infrastructure/values.yaml

applications:
  argocd:
    enabled: true
  cert-manager:
    enabled: true
  envoy-gateway:
    enabled: false  # Disabled
  istio:
    enabled: false  # Disabled

After changing, render and push:

mise run //kubernetes/src/infrastructure:render-all "<CLUSTER>"
git add . && git commit -m "chore: disable envoy-gateway"
git push origin main

Upgrade Strategies

Minor/Patch Updates

For minor and patch version updates (e.g., 4.12.2 → 4.12.3):

Update the version in values.yaml
Run helm dependency update
Render, commit, and push
ArgoCD syncs automatically

Major Updates

For major version updates (e.g., 4.x → 5.x):

Read the changelog for breaking changes
Test in staging first before production
Update values if configuration schema changed
Have a rollback plan if the component is critical

Major version upgrades may require CRD updates. Check the component’s upgrade guide and apply CRD changes before upgrading the chart.

CRD Updates

Some components (cert-manager, ArgoCD, Karpenter) use CRDs that may need manual updates:

# Example: Update cert-manager CRDs
kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.17.0/cert-manager.crds.yaml

Check the component’s documentation for CRD upgrade procedures.

Best Practices

Test in staging first - Always upgrade staging before production
Read changelogs - Especially for major versions
Update one component at a time - Easier to isolate issues
Keep versions consistent - Use the same version across environments when possible
Monitor after upgrades - Watch metrics and logs for regressions

Next Steps

Adding K8s Infrastructure - Add new infrastructure components
Managing Secrets - Configure External Secrets

About

Usage

Updating 3rd Party Applications

Overview

Infrastructure Components

Update Chart Versions

Update Configuration

Add Additional Manifests

Environment-Specific Configuration

Enable/Disable Components

Upgrade Strategies

Minor/Patch Updates

Major Updates

CRD Updates

Best Practices

Next Steps

​Overview

​Infrastructure Components

​Update Chart Versions

​Update Configuration

​Add Additional Manifests

​Environment-Specific Configuration

​Enable/Disable Components

​Upgrade Strategies

​Minor/Patch Updates

​Major Updates

​CRD Updates

​Best Practices

​Next Steps

Overview

Infrastructure Components

Update Chart Versions

Update Configuration

Add Additional Manifests

Environment-Specific Configuration

Enable/Disable Components

Upgrade Strategies

Minor/Patch Updates

Major Updates

CRD Updates

Best Practices

Next Steps