v1.1.0 Release

This release introduces dedicated microservices for database migration workflows—Migration API (bhmigrateapi) and Migration Worker (bhmigrateworker)—decoupling migration tasks from the AI Agent service into dedicated, horizontally scalable components.

Additionally, this release introduces external routing via Envoy Gateway HTTPRoute and Ingress (migapi.<domain>), adds a dedicated PostgreSQL schema (migrate_db) with comprehensive dual-role RBAC permissions, and updates environment configurations across Azure deployments.

Published Chart & Download Instructions

Customers entitled to BigHammer on Azure can obtain the published chart using any of the following methods.

Prerequisites

Kubernetes: AKS 1.28+
Helm: v3.10+ (v3.17+ recommended)
Ingress / Gateway: Envoy Gateway (Gateway API CRDs v1.1+) or NGINX Ingress Controller
Secrets Management: External Secrets Operator (ESO) v0.18.x with Azure Key Vault Workload Identity
Database: Azure Database for PostgreSQL Flexible Server with pgvector enabled

Option 1: Download from Customer Mirrored ACR (Recommended)

In production enterprise environments, pull the chart from your mirrored Azure Container Registry (see Release Manifest & Distribution):

# Authenticate to your Azure Container Registry
az acr login --name <your-acr-name>

# Pull and download the packaged Helm chart
helm pull oci://<your-acr-name>.azurecr.io/bh-helm-release/bighammer \
  --version 1.1.0

# Extract the chart archive
tar -xzf bighammer-1.1.0.tgz
cd bighammer

Option 2: Pull Directly from BigHammer ECR Catalog

If your CI/CD runner is configured with the BigHammer IAM Reader role (bh-artifact-reader-<customer-id>):

# Log in to BigHammer ECR OCI registry
aws ecr get-login-password --region <bh-catalog-aws-region> | \
  helm registry login \
    --username AWS \
    --password-stdin <bh-aws-account-id>.dkr.ecr.<bh-catalog-aws-region>.amazonaws.com

# Download the chart package
helm pull oci://<bh-aws-account-id>.dkr.ecr.<bh-catalog-aws-region>.amazonaws.com/azure/bh-helm-release/bighammer \
  --version 1.1.0

# Extract the chart
tar -xzf bighammer-1.1.0.tgz
cd bighammer

Option 3: Source Checkout via Git Release Tag

# Clone the repository at tag v1.1.0-bighammer-azure
git clone --depth 1 --branch v1.1.0-bighammer-azure https://github.com/bh-ai/bh-helm-charts.git
cd bh-helm-charts/incubator/bighammer-azure

# Vendor dependencies
helm dependency build .

Summary of Changes

Migration API Microservice (bhmigrateapi):
- Added a dedicated FastAPI microservice subchart (charts/bhmigrateapi/) to serve migration endpoints, schema analysis, and DDL orchestration.
- Configured with zero-downtime rolling update strategy (maxUnavailable: 0, maxSurge: 1).
- Configured liveness and readiness health probes against /api/v1/health on container port 8090.
- Configured with Azure Workload Identity annotations for Key Vault secret access.
Migration Worker Service (bhmigrateworker):
- Introduced a unified Celery worker subchart (charts/bhmigrateworker/) dedicated to asynchronous migration execution.
- Listens to and processes tasks from multiple queues: migrate2-queue,migrate-queue.
- Configured with Horizontal Pod Autoscaler (HPA) and KEDA ScaledObject scaling based on RabbitMQ queue depth.
- Replaces legacy bhaimigrateworker configuration with consistent naming and dedicated secrets.
Envoy Gateway & Ingress Routing:
- Added an Envoy Gateway HTTPRoute definition in gateway-httproutes.yaml routing migapi.<domain> (e.g. migapi.az.dev.bighammer.ai) directly to the bhmigrateapi service.
- Added ingress rule for migapi under charts/bhui/templates/ingress.yaml.
Database Schema & Dual-Role RBAC (migrate_db):
- Added migrate_db schema to PostgreSQL database setup (bighammer_db_setup.sql).
- Assigned bh_dev_user as the schema owner.
- Granted bh_app_user full DDL/DML permissions (CREATE, USAGE, ALL PRIVILEGES on tables/sequences) to support dynamic migration target table creation.
- Configured bidirectional DEFAULT PRIVILEGES between bh_dev_user and bh_app_user for seamless schema migrations and runtime operations.
Cross-Service Environment Enhancements:
- BigHammer UI (bhui): Injected VITE_MIGRATE_REMOTE_URL into ConfigMap and Deployment templates.
- Catalog & AI Agent Services: Injected AUDIT_API_BASE_URL into bhcatalogapi, bhcatalogworker, bhaiagent, and bhaiagentworker to unify audit trail reporting.
Container Images:
- Released Migration API and Worker container image: <bh-aws-account-id>.dkr.ecr.<bh-catalog-aws-region>.amazonaws.com/bh-docker-public/bh-migrate-api:1.0.0-44-rc (mirrored to <your-acr-name>.azurecr.io/bh-docker-public/bh-migrate-api:1.0.0-44-rc).

Technical Details

Chart Hierarchy & Dependencies

Chart Name: bighammer
Chart Version: 1.1.0
Application Version: 1.0.0
Subcharts added/updated in Chart.yaml:
- bhmigrateapi (v1.0.0, file: charts/bhmigrateapi) — enabled via global.bhmigrateapi.enabled
- bhmigrateworker (v1.0.0, file: charts/bhmigrateworker) — enabled via global.bhmigrateworker.enabled

Database Schema Bootstrap (`migrate_db`)

For existing database clusters, execute the following SQL script as a database administrator prior to upgrading the Helm chart:

-- Connect to your application database: bighammer_db_<env>
\c bighammer_db_<env>

-- 1. Create schema and assign ownership
CREATE SCHEMA IF NOT EXISTS migrate_db;
ALTER SCHEMA migrate_db OWNER TO bh_dev_user;

-- 2. Schema-level privileges
GRANT USAGE, CREATE ON SCHEMA migrate_db TO bh_dev_user;
GRANT USAGE, CREATE ON SCHEMA migrate_db TO bh_app_user;

-- 3. Existing objects privileges
GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA migrate_db TO bh_dev_user;
GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA migrate_db TO bh_app_user;
GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA migrate_db TO bh_dev_user;
GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA migrate_db TO bh_app_user;

-- 4. Default privileges for future objects created by bh_dev_user
ALTER DEFAULT PRIVILEGES FOR ROLE bh_dev_user IN SCHEMA migrate_db
  GRANT ALL PRIVILEGES ON TABLES TO bh_app_user;
ALTER DEFAULT PRIVILEGES FOR ROLE bh_dev_user IN SCHEMA migrate_db
  GRANT ALL PRIVILEGES ON SEQUENCES TO bh_app_user;

-- 5. Default privileges for future objects created by bh_app_user
ALTER DEFAULT PRIVILEGES FOR ROLE bh_app_user IN SCHEMA migrate_db
  GRANT ALL PRIVILEGES ON TABLES TO bh_dev_user;
ALTER DEFAULT PRIVILEGES FOR ROLE bh_app_user IN SCHEMA migrate_db
  GRANT ALL PRIVILEGES ON SEQUENCES TO bh_dev_user;

External Secrets & Key Vault Mapping

bhmigrateapi and bhmigrateworker fetch credentials dynamically from Azure Key Vault via ExternalSecret manifests:

Key Vault Secret Name	Container Environment Variable	Purpose
`azure-postgres-master-password`	`POSTGRES_PASSWORD`	PostgreSQL credentials (`bh_dev_user`)
`bh-app-user-password`	`BH_APP_USER_PASSWORD`	PostgreSQL runtime user (`bh_app_user`)
`bh-redis-password`	`REDIS_PASSWORD`	Redis cache & Celery result backend
`rabbitmq-password`	`RABBITMQ_PASSWORD`	RabbitMQ broker authentication
`azure-client-secret`	`AZURE_CLIENT_SECRET`	Azure SP / Managed Identity fallback
`langchain-api-key`	`LANGCHAIN_API_KEY`	LLM observability / tracing
`decryption-key`	`DECRYPTION_KEY`	Data encryption / decryption key

Values Configuration Reference

To enable the migration microservices in your overlay (values-<env>.yaml):

global:
  # Enable Migration API
  bhmigrateapi:
    enabled: true
    name: bhmigrateapi
    replicaCount: 1
    image:
      repository: <your-acr-name>.azurecr.io/bh-docker-public/bh-migrate-api
      tag: 1.0.0-44-rc
      pullPolicy: Always
    resources:
      requests:
        cpu: "500m"
        memory: "1Gi"
      limits:
        cpu: "2"
        memory: "4Gi"
    service:
      type: ClusterIP
      port: 80
      targetPort: 8090
    env:
      DB_NAME: "bighammer_db_<env>"
      DB_SCHEMA: "migrate_db"
      APPLICATION_PORT: 8090
      API_V1_STR: "/api/v1"
      PROJECT_NAME: "BigHammer-Migrate-API"

  # Enable Migration Worker
  bhmigrateworker:
    enabled: true
    name: bhmigrateworker
    replicaCount: 1
    image:
      repository: <your-acr-name>.azurecr.io/bh-docker-public/bh-migrate-api
      tag: 1.0.0-44-rc
      pullPolicy: Always
    resources:
      requests:
        cpu: "1"
        memory: "2Gi"
      limits:
        cpu: "4"
        memory: "8Gi"
    env:
      DB_NAME: "bighammer_db_<env>"
      DB_SCHEMA: "migrate_db"
      CELERY_WORKER_QUEUES: "migrate2-queue,migrate-queue"
      CELERY_WORKER_CONCURRENCY: "4"

  # UI Remote URL configuration
  bhui:
    env:
      VITE_MIGRATE_REMOTE_URL: "https://migapi.<your-domain>"

  # Gateway HTTPRoute configuration
  gateway:
    enabled: true
    migrateApiHostname: "migapi.<your-domain>"

Upgrade Runbook

Follow these steps to upgrade an existing AKS deployment to v1.1.0:

Step 1: Pre-Upgrade Database Verification

Verify that the migrate_db schema is created and permissions are granted:

psql "host=<postgres-host> dbname=bighammer_db_<env> user=<admin-user> sslmode=require" \
  -c "SELECT nspname, rolname FROM pg_namespace n JOIN pg_roles r ON r.oid = n.nspowner WHERE nspname = 'migrate_db';"

Expected output:

  nspname   |   rolname   
------------+-------------
 migrate_db | bh_dev_user

Step 2: Prepare Values Overlay

Ensure your values-<env>.yaml includes:

global.bhmigrateapi.enabled: true
global.bhmigrateworker.enabled: true
global.bhui.env.VITE_MIGRATE_REMOTE_URL: "https://migapi.<domain>"
Updated image repository URLs if pulling from customer mirrored ACR.

Step 3: Execute Helm Upgrade

helm upgrade --install bighammer ./bighammer \
  -f values.yaml \
  -f values-<env>.yaml \
  -n bh-control-plane \
  --create-namespace \
  --wait --timeout 15m

Step 4: Post-Upgrade Health Validation

Verify that pods are running healthy:

# Check pod rollout status
kubectl rollout status deployment/bhmigrateapi -n bh-control-plane
kubectl rollout status deployment/bhmigrateworker -n bh-control-plane

# Query API health endpoint via ingress / gateway
curl -k -f https://migapi.<your-domain>/api/v1/health

Published Chart & Download Instructions​

Prerequisites​

Option 1: Download from Customer Mirrored ACR (Recommended)​

Option 2: Pull Directly from BigHammer ECR Catalog​

Option 3: Source Checkout via Git Release Tag​

Summary of Changes​

Technical Details​

Chart Hierarchy & Dependencies​

Database Schema Bootstrap (migrate_db)​

External Secrets & Key Vault Mapping​

Values Configuration Reference​

Upgrade Runbook​

Step 1: Pre-Upgrade Database Verification​

Step 2: Prepare Values Overlay​

Step 3: Execute Helm Upgrade​

Step 4: Post-Upgrade Health Validation​

Related Documentation​