​
Coverage Matrix

Chkk Curated Release Notesv1.5.1 to latest
Private RegistrySupported
Custom Built ImagesSupported
Safety, Health, and Readiness Checksv1.9.0 to latest
Supported PackagesHelm, Kustomize, Kube
EOL InformationAvailable
Version Incompatibility InformationAvailable
Upgrade TemplatesIn-Place, Blue-Green
PreverificationAvailable

​
Ory Hydra Overview

Ory Hydra is an open-source OAuth 2.0 and OpenID Connect server designed for cloud-native, containerized environments. It securely handles authentication flows by issuing and validating access, refresh, and ID tokens, integrating seamlessly with external identity providers via login and consent applications. This decoupling allows platform teams to enforce consistent security policies across microservices without modifying application code. Proven in high-scale production setups, Hydra emphasizes security and scalability, capable of handling thousands of token requests per second efficiently.

​
Chkk Coverage

​
Curated Release Notes

Chkk curates Hydra release notes, highlighting impactful changes such as stricter compliance requirements, critical database schema updates, or new API endpoints. Platform teams receive targeted summaries explaining how updates directly affect operational deployments, ensuring critical modifications—like mandatory configuration changes—aren’t overlooked. This approach simplifies staying current without sifting through extensive changelogs.

​
Preflight & Postflight Checks

Chkk performs detailed preflight checks ensuring your Kubernetes deployment is within supported Hydra upgrade paths and meets necessary prerequisites like database compatibility and configuration correctness. It alerts you about deprecated settings or potential database migration issues upfront. Postflight checks confirm successful upgrades by validating pod health, endpoint reachability, migration outcomes, and consistent versions across instances, promptly identifying any rollout issues.

​
Version Recommendations

Chkk monitors Hydra’s version lifecycles, alerting teams when deployed versions fall behind the project’s release cadence or pose security risks due to lack of maintenance. Recommendations clearly identify stable upgrade targets based on Hydra community insights, known issues, and patch histories. This proactive guidance helps maintain compliance, avoid vulnerabilities, and balance new features with operational stability.

​
Upgrade Templates

Chkk provides proven Upgrade Templates for in-place and blue-green upgrades. Templates detail steps such as database backups, schema migrations, dual deployments, and traffic cutovers, clearly outlining rollback procedures. Designed for easy integration with GitOps and CI/CD workflows, these templates enable teams to execute Hydra upgrades confidently with minimal downtime and risk.

​
Preverification

Chkk’s Preverification creates a “digital twin” of your Hydra environment, rehearsing upgrades to detect potential problems such as migration failures or resource issues before production deployment. It validates each upgrade step against a representative snapshot of your setup, identifying complications early. This approach ensures smoother live upgrades by enabling teams to address issues proactively.

​
Supported Packages

Chkk supports Hydra deployments via Helm charts, Kustomize, YAML manifests, and custom images or registries. It directly integrates with existing GitOps-managed environments, accurately identifying and recommending configuration updates and minimal required changes. Platform teams retain their preferred deployment tools and workflows, with Chkk providing precise, actionable upgrade insights.

​
Common Operational Considerations

  • Schema Migrations: Avoid concurrent migrations by performing database schema updates through a single controlled process. Always back up databases and upgrade sequentially without skipping major Hydra versions to ensure compatibility.
  • Admin API Security: Hydra’s admin API lacks built-in authentication; restrict access strictly via network policies or API gateways. Regularly audit endpoint accessibility to prevent unauthorized administrative control.
  • Persistent Secrets: Maintain consistent SECRETS_SYSTEM environment variables securely stored in Kubernetes secrets or vaults. Changes or losses to this secret invalidate existing sessions and tokens irrecoverably.
  • Expired Token Cleanup: Hydra open-source editions require manual cleanup of expired OAuth2 tokens and consents using periodic Kubernetes CronJobs. Without regular cleanup, database performance and storage efficiency degrade significantly.
  • Database Performance: Hydra’s performance depends heavily on database efficiency; insufficient DB resources or inadequate indexing can create request bottlenecks. Monitor DB metrics, implement recommended tuning, and proactively address contention issues by regularly archiving old data.
  • Login/Consent Endpoint Alignment: Hydra relies on external login and consent apps; misalignment of endpoint URLs causes authentication failures. Ensure consistent domain names, correct environment variables (URLS_LOGIN, URLS_CONSENT, URLS_SELF_ISSUER), and operational monitoring of these critical components.

​
Additional Resources