Skip to content
rise.Operator docs
GitHub

Deprecated and removed features

A planned default change and a feature’s removal are separate milestones. Planned milestones are not release guarantees.

Deprecated

These features still work under the conditions documented below. Follow the migration instructions before their planned default changes or removal.

Registry credentials in deployment-creation responses

Deprecated · still available

The credentials field in CreateDeploymentResponse still contains registry push credentials for build-from-source and push-image deployments. Deployments that do not need a push return empty credentials. No removal version or date is announced.

Introduced
Not establishedThe first release is not established.
Deprecated
0.22.0Release note ↗
Removed
Not scheduledNo version or date announced.

Migration

Use the deployment ID from the creation response to fetch credentials with GET /api/v1/projects/{project_name}/deployments/{deployment_id}/registry-credentials. Fetch them when needed for a registry operation rather than retaining the creation response’s credentials throughout a long build. This endpoint is available only while the deployment is Pending, Building, or Pushing. The current Rise CLI uses this endpoint; upgrade older CLI installations and update custom API clients. See #265.

Service-account authentication with raw external JWTs

Deprecated · still available

A project service account can still authenticate by presenting its external OIDC JWT directly while auth.allow_raw_external_tokens is true, its current default. With RISE_IDENTITY unset, the CLI sends the selected token as-is; the deprecated behavior is direct external-token presentation and implicit service-account resolution. Rise-issued access and session tokens remain valid without RISE_IDENTITY. No removal version or date is announced.

Introduced
Not establishedThe first release is not established.
Deprecated
UnreleasedMerged; not in a full release.First candidate: 0.23.0-rc5 · 2026-08-18Release note ↗
Disabled by default
Planned for 0.25.0Not yet merged; no release date announced.Release note ↗
Removed
Not scheduledNo version or date announced.

Migration

  1. Find the service account’s email with rise sa list or rise sa show (for example, my-app+0@sa.rise.local).
  2. Set RISE_IDENTITY to that email in CI. Keep the existing OIDC token source and its required audience and claims; the CLI exchanges the token for the selected service account before API calls. See Service-account token exchange.
  3. For clients outside the CLI, exchange the external token at POST /api/v1/auth/token and use the returned Rise-issued access token. See Authentication and token exchange.
  4. Aggregate accepted-request log events with target=rise::deprecation and metric=raw_external_token by issuer and subject to find remaining callers. After migrating them, set auth.allow_raw_external_tokens: false to verify that the compatibility path is no longer required.

Find raw external-token deprecation events and migrate affected workloads to token exchange.

Deployment status updates without a project in the URL

Deprecated · still available

PATCH /api/v1/deployments/{deployment_id}/status remains available to authorized callers when the deployment ID identifies a single deployment across projects. Ambiguous IDs return 409 Conflict. Scoped CLI sessions cannot use this route. No removal version or date is announced.

Introduced
Not establishedThe first release is not established.
Deprecated
0.19.0Release note ↗
Removed
Not scheduledNo version or date announced.

Migration

Update API clients to call PATCH /api/v1/projects/{project_name}/deployments/{deployment_id}/status with the same status payload. Include the intended project explicitly rather than assuming deployment IDs are unique across projects. The current Rise CLI uses this project-scoped route; upgrade older CLI installations and check backend logs for Deprecated endpoint called: PATCH /deployments/ to find remaining callers.

Removed

These features are unavailable in current releases. Migration instructions cover upgrades from affected versions.

OAuth client_secret_ref as a live credential source

Removed

OAuth runtime flows require client_secret_encrypted; client_secret_ref is not a usable credential source. New configurations require the encrypted field. The context-bound credential upgrade imports existing reference-only specs once during startup while their referenced global project variables remain available. After that import completes, newly submitted reference-only specs are not migrated. On versions before that upgrade, the OAuth reconciler performs the conversion instead.

Introduced
Not establishedThe first release is not established.
Deprecated
0.13.1Release note ↗
Removed
0.15.7Release note ↗

Migration

  1. Before the context-bound credential upgrade, check for stored OAuth specs containing only client_secret_ref. Keep each referenced global project environment variable available through the first upgraded startup.
  2. Startup imports the accepted baseline into context-bound client_secret_encrypted and removes client_secret_ref from the spec. It retains the source variable. If startup fails because a referenced variable is missing, restore the required baseline value before retrying; the upgraded API does not serve requests until migration succeeds.
  3. Verify that the stored spec contains client_secret_encrypted and test its OAuth flow. Remove a retained source variable only after checking that no other consumers need it.
  4. After startup import completes, use the extension editor or seal the secret for its target context for new configurations. Reference-only specs submitted later have no reconciler conversion path. See the credential migration instructions and OAuth configuration.

On releases before the context-bound upgrade, keep the variable available until the OAuth reconciler converts the spec. That reconciler attempts to delete the variable after conversion, so move other consumers to their own secret first. Those releases log Failed to migrate client_secret_ref on failure and allow correction through their extension editor.