Operations

Operate the sidecar as part of the application rollout. Track process health, cache behavior, and recoverable state separately.

Upgrades and credential changes

Pin the operator chart and workload images to the release you intend to run. Charts are released independently from swytchdb/swytch-helm as OCI artifacts. Fetch the exact target chart and update its CRD before upgrading Helm:

chart_dir="$(mktemp -d)"
helm pull oci://ghcr.io/swytchdb/charts/swytch-operator \
  --version 1.5.2 --untar --untardir "$chart_dir"
kubectl apply -f "$chart_dir/swytch-operator/crds/"
helm upgrade swytch "$chart_dir/swytch-operator" \
  -n swytch-system --reuse-values \
  --set-string image.tag=1.5.2 \
  --set-string swytch.image=ghcr.io/swytchdb/swytch:1.5.2 --wait

Review reused Helm values, especially image pins: --reuse-values retains previous overrides. Set the intended operator image and swytch.image explicitly when upgrading them.

Keep registry overrides when using private mirrors. A profile’s spec.image overrides the chart’s workload image. Existing installations of the chart formerly in swytchdb/swytch can upgrade in place: retain the Helm release name and namespace. Helm does not upgrade CRDs automatically or undo CRD changes during rollback. Publishing a new chart version does not automatically upgrade existing installations.

Server profile changes reconcile a Deployment. Sidecar profile and Secret changes only affect new Pods. Plan an application rollout after confirming the data recovery path.

Discovery and admission failures

DNS profiles create swytch-PROFILE-peers, a headless Service that publishes Pod addresses before readiness. Peers advertise Pod IPs on UDP 7379. Check DNS, network policy, matching credentials, and peer reachability when a node cannot join.

The injection webhook fails closed for annotated Pod creates. If those Pods cannot be created, inspect the operator and webhook certificate before retrying. Unannotated Pods do not depend on injection.

Health and observability

kubectl -n YOUR_NAMESPACE get swytch
kubectl -n YOUR_NAMESPACE describe swytch YOUR_PROFILE
kubectl -n YOUR_NAMESPACE logs YOUR_POD -c swytch

status.observedGeneration and Ready describe reconciliation and server Deployment availability. /health reports process health, not data presence or subscription availability. Metrics are exposed at Pod port 9090 under /metrics.

Monitor hit rate, errors, latency, and memory alongside peer health. See observability and sizing.

Webhook certificates

The chart generates a one-year serving certificate and a ten-year CA. Renewal is manual. Before the serving certificate expires, increment webhook.certificateRevision through Helm:

helm upgrade swytch oci://ghcr.io/swytchdb/charts/swytch-operator \
  --version 1.5.2 -n swytch-system --reuse-values \
  --set-string webhook.certificateRevision=2 --wait

Use the currently installed chart version for certificate-only renewal and a new revision value for each renewal. Helm reuses the CA and rolls the operator. Use Helm against the cluster; repeatedly applying offline renders is not a supported renewal workflow. Plan CA replacement before its expiry. See the operator lifecycle reference.