Upgrade & Migration

$ helm upgrade --install ruleset-upgrade <chart-reference>  \
    --set crds.updateEnabled=true \
    --set crds.storageVersion=<old-crd-schema> \
    -n <namespace-controller-heimdall-should-be-installed-into> \
    -f <path/to/your/values.yaml> \
    -f <path/to/your/heimdall/config.yaml> \
    --take-ownership

$ helm upgrade --install <your-release-name> <chart-reference>  \
    -n <namespace-heimdall-is-installed-into> \
    -f <path/to/your/values.yaml> \
    -f <path/to/your/heimdall/config.yaml>

$ helm upgrade --install ruleset-upgrade <chart-reference>  \
    --set crds.updateEnabled=true \
    -n <namespace-controller-heimdall-is-installed-into> \
    -f <path/to/your/values.yaml> \
    -f <path/to/your/heimdall/config.yaml>

$ helm upgrade --install <your-release-name> <chart-reference>  \
    --set crds.updateEnabled=true \
    --set crds.storageVersion=<old-crd-schema> \
    -n <namespace-heimdall-is-installed-into> \
    -f <path/to/your/values.yaml> \
    -f <path/to/your/heimdall/config.yaml> \
    --take-ownership

$ helm upgrade --install <your-release-name> <chart-reference>  \
    --set crds.updateEnabled=true \
    -n <namespace-heimdall-is-installed-into> \
    -f <path/to/your/values.yaml> \
    -f <path/to/your/heimdall/config.yaml>

$ kubectl get -A rulesets.heimdall.dadrus.github.com -o yaml > allrulesets.yaml

$ kubectl apply -f allrulesets.yaml

$ kubectl get -A rulesets.heimdall.dadrus.github.com -o yaml > allrulesets.yaml

#!/usr/bin/env bash

# Converts all RuleSets from a Kubernetes export (a List resource) into individual file-based RuleSets.
#
# The output files will be written to the specified directory, one file per RuleSet.
#
# Usage:
#   ./convert-k8s-rulesets.sh --ruleset-list <path-to-exported-rulesets.yaml> --out-dir <output-directory>
#
# Example:
#   ./convert-k8s-rulesets.sh --ruleset-list allrulesets.yaml --out-dir ./converted-rulesets
#
# Options:
#   --ruleset-list   Path to the YAML file containing the exported RuleSets (required)
#   --out-dir        Directory to write the converted RuleSets to (required)
#   -h, --help       Show this help message and exit
#
# Requirements:
#   - yq (https://github.com/kislyuk/yq) must be available in PATH. If not installed, you can install it with e.g. sudo apt install yq on Debian based Linux distributions.
#

set -euo pipefail

# Print help text (only the leading comment block after the optional shebang)
usage() {
  awk '
    # skip shebang on line 1 if present
    NR==1 { if ($0 ~ /^#!/) { next } }
    # while lines start with "#", strip the "# " (or "#") and print
    /^#/ {
      sub(/^#\s?/, "")
      print
      started=1
      next
    }
    # once we have printed at least one comment block line, stop at first non-# line
    started==1 { exit }
  ' "$0"
  exit 0
}

# Default values
RULESET_LIST=""
OUT_DIR=""

# Parse arguments
while [[ $# -gt 0 ]]; do
  case "$1" in
    --ruleset-list)
      RULESET_LIST="$2"
      shift 2
      ;;
    --out-dir)
      OUT_DIR="$2"
      shift 2
      ;;
    -h|--help)
      usage
      ;;
    *)
      echo "Unknown argument: $1"
      echo "Use --help for usage information."
      exit 1
      ;;
  esac
done

# Validate required arguments
if [[ -z "${RULESET_LIST}" || -z "${OUT_DIR}" ]]; then
  echo "Error: both --ruleset-list and --out-dir must be provided."
  echo "Use --help for usage information."
  exit 1
fi

if [[ ! -f "${RULESET_LIST}" ]]; then
  echo "Error: file '${RULESET_LIST}' not found."
  exit 1
fi

mkdir -p "${OUT_DIR}"

echo "Converting RuleSets from '${RULESET_LIST}' into '${OUT_DIR}'..."
echo

# Extract each RuleSet and convert
yq -r '.items[].metadata.name' "${RULESET_LIST}" | while IFS= read -r name; do
  file_name=$(echo "${name}" | tr '[:space:]' '_')

  version=$(yq -r '.items[] | select(.metadata.name == "'${name}'") | .apiVersion' "${RULESET_LIST}" | sed 's/.*v//')

  echo "→ Converting RuleSet: ${name} (schema ${version})"

  # Extract matching object and format as YAML
  yq -r '.items[] | select(.metadata.name == "'${name}'")' "${RULESET_LIST}" \
    | jq -r --arg version "${version}" '
      {
        version: $version,
        name: .metadata.name,
        rules: .spec.rules
      }
    ' \
    | yq -y '.' > "${OUT_DIR}/${file_name}.yaml"
done

echo
echo "Conversion complete. All RuleSets written to '${OUT_DIR}'."

providers:
  file_system:
    src: /rules

$ kubectl create configmap heimdall-rules \
   --from-file=<converted-rulesets-directory> \
   -n <namespace-heimdall-is-installed-into>

# your values file
deployment:
  # other settings
  volumes:
    # other volumes
    - name: rules
      configMap:
        name: heimdall-rules
  volumeMounts:
    # other volume mounts
    - name: rules
      readOnly: true
      mountPath: "/rules"

$ helm upgrade --install <your-release-name> <chart-reference>  \
    -n <namespace-heimdall-is-installed-into> \
    -f <path/to/your/values.yaml> \
    -f <path/to/your/heimdall/config.yaml>

$ kubectl apply -f allrulesets.yaml

$ helm upgrade --install <your-release-name> <chart-reference>  \
    -n <namespace-heimdall-is-installed-into> \
    -f <path/to/your/values.yaml> \
    -f <path/to/your/heimdall/config.yaml>

$ kubectl delete configmap heimdall-rules -n <namespace-heimdall-is-installed-into>