Menu
Safely upgrade an app's image or chart version, checking for breaking changes and updating the HelmRelease
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
| name | upgrade-app |
| description | Safely upgrade an app's image or chart version, checking for breaking changes and updating the HelmRelease |
| argument-hint | [namespace/app] [new-version] - e.g. media/jellyfin 10.11.0 |
MISSION: Safely upgrade an application's image or Helm chart version with minimal disruption.
SCOPE: $ARGUMENTS
Provide namespace/app and optionally the target version. If no version given, find the latest.
# Read the current helmrelease
cat kubernetes/apps/<namespace>/<app>/app/helmrelease.yaml | grep -A3 "image:\|tag:\|chartRef"
For container images:
# Check GitHub releases or container registry
crane ls ghcr.io/<org>/<image> 2>/dev/null | grep -E "^v?[0-9]+\.[0-9]+" | sort -V | tail -5
# Get digest for pinning
crane digest ghcr.io/<org>/<image>:<tag>
For Helm charts (OCIRepository):
crane ls ghcr.io/bjw-s-labs/helm/app-template | sort -V | tail -5
Before upgrading, check the changelog:
readOnlyRootFilesystem compatibility changedUpdate tag: with both version AND digest:
image:
repository: ghcr.io/example/app
tag: 1.2.3@sha256:abc123...
For app-template chart version (OCIRepository):
# In ocirepository.yaml
ref:
tag: 5.0.1
If the app runs DB migrations on startup, ensure:
strategy: Recreate (not RollingUpdate) so old pod stops before new one startsfailureThreshold (30+ for slow migrations)/health, /healthz, or /api/health still works in new versiongit add kubernetes/apps/<namespace>/<app>/app/helmrelease.yaml
git commit -m "chore(<app>): upgrade to <version>"
git push
flux reconcile hr <app> -n <namespace> --force
kubectl get pods -n <namespace> -l app.kubernetes.io/name=<app>
kubectl logs -n <namespace> -l app.kubernetes.io/name=<app> --tail=20
flux get hr <app> -n <namespace>
5.0.1 (shared OCIRepository in kubernetes/components/repos/app-template/)kubernetes/apps/media/jellyfin/app/ocirepository.yaml)gpu.intel.com/i915) is currently broken due to CDI injection issue — do not add GPU requestsEnforces staged execution discipline on large tasks: a written stage plan, delegation to named fable agents where the runtime supports it, a failable verification check at each stage, and a skeptical self-review before delivery. Trigger when the user explicitly asks ("do this thoroughly", "be systematic", "deep work mode") OR when the task objectively spans multiple files, multiple sources, or multiple sessions. Do NOT trigger on ordinary multi-step requests that a direct attempt handles fine. For a run pinned to a specific model, use fable-opus, fable-sonnet, or fable-haiku instead. Always-on guardrails (verify-before-flag, warning batching, sed safety) live in the companion execution-guardrails skill.
Run Kopiur S3 backups alongside VolSync NFS, verify over days, then cutover with full restore from S3
Migrate an app's PVC backup from VolSync to Kopiur with zero data loss
Scaffold a new app-template application for this home-ops repository
Systematically investigate cluster issues starting from events, following the Flux pipeline down to pod logs
Analyze GitOps repo structure for ordering issues, broken references, missing dependencies, and anti-patterns