Supported Kubernetes versions
The operator targets the standard Kubernetes API surface. Version compatibility is bounded by ArgoCD’s own Kubernetes support matrix.| Kubernetes | Support |
|---|---|
| 1.33 | Tested (AKS 1.33.6) |
| 1.36 | Tested (self-managed Kubernetes 1.36.1) |
Other Kubernetes versions within ArgoCD’s support matrix may work but are not validated. Confirm with your ABBYY account team before running on a Kubernetes version that is not listed here.
Supported Kubernetes distributions
| Distribution | Support level | Notes |
|---|---|---|
| Azure Kubernetes Service (AKS) | Supported | Validated end-to-end on AKS 1.33.6 with the AKS Istio Add-on (asm-1-28). See Install on Azure. |
| Self-managed Kubernetes | Supported | Validated with customer-managed networking, Linkerd, Traefik, native Kubernetes Secrets, PostgreSQL, and a custom StorageClass. See Self-Managed Kubernetes. |
Use a Kubernetes version listed above. Kubernetes distributions and component substitutions that are not listed have not been validated; confirm them with your ABBYY account team before production use.
Dependency versions
The operator depends on the following components in the cluster.| Component | Required | Tested | Notes |
|---|---|---|---|
| ArgoCD | >= 2.6.0 | v3.3.2 on AKS; v3.4.3 on self-managed Kubernetes | The ApplicationSet Progressive Syncs feature must be enabled. A repository connection to your OCI registry is also required. |
| Helm | >= 3.0.0 | v4.2.0 on AKS; v3.21.1 on self-managed Kubernetes | Used to install the operator and vantage-selfhosted charts. |
| Istio | any | AKS Istio Add-on asm-1-28 | Tested service mesh and built-in ingress path on AKS. STRICT mTLS is enforced on application traffic. An external ingress gateway is required on AKS. |
| Linkerd | any compatible release | edge-26.6.1 | Tested service mesh for self-managed Kubernetes. Enable injection in the Vantage namespace before installing Vantage. |
| Traefik | v3 | Helm chart 39.x | Tested ingress controller for self-managed Kubernetes. Disable the chart’s built-in Istio ingress and implement the documented Vantage route contract. |
| Secrets Store CSI Driver (Azure provider) | >= 1.0.0 | 1.7.2 (Helm chart 1.7.2) | Required when using the Azure Key Vault secrets provider. Not required when using the Kubernetes Secrets provider. |
| External Secrets Operator | any compatible release | Helm chart 2.6.0 | Optional example for materializing native Kubernetes Secrets from an external store. Vantage consumes the Kubernetes Secrets, not External Secrets or the external store directly. |
| KEDA (optional, recommended) | >= 2.17.0, < 2.18.0 | 2.17.3; AKS add-on 2.17.3-5 | Required for KEDA autoscaling support. KEDA 2.18 and later removed a scaler field used by the current Vantage workload charts. |
| Prometheus Operator (required with KEDA) | any compatible release | kube-prometheus-stack 87.3.0 | Provide a Prometheus instance at prometheus-operated.observability.svc.cluster.local:9090 and discover the Vantage ServiceMonitor. |
Supporting service versions
These are external dependencies provisioned outside the cluster. The table combines the versions and implementations tested across the supported deployment paths:| Service | Tested version | Notes |
|---|---|---|
| SQL Server | Azure SQL 12.0.2000.8 (compatibility level 170, General Purpose Serverless Gen 5) | One database per connection-string alias listed in Secrets and Key Vault (23 today). The reporting database must support Columnstore Indexing. |
| PostgreSQL | Provider support validated with the self-managed deployment | Set vantage.databaseProvider: PostgreSQL. Use a distinct logical database per service; each service’s migrator creates its database on first run. Reporting is not supported with PostgreSQL. |
| Redis | Azure Managed Redis 7.4 (EnterpriseCluster); Redis 7.4 on self-managed Kubernetes | |
| SendGrid | n/a | Default mail provider. Supply sendgridApiKey via your secrets provider. |
| SMTP server | MailHog v1.0.1 (Helm chart 5.8.0) | Optional alternative to SendGrid. Only basic auth or no auth is supported. Used only when spec.smtp is set. |
| OCI registry | Azure Container Registry | Migration auth: no auth, basic auth, or Azure Workload Identity + Azure RBAC. Image pulls: Kubernetes pull secrets or, on Azure, AcrPull granted to the AKS managed identity. See Image pull access. |
| Storage | Azure StorageV2 (general purpose v2); customer-provided Kubernetes StorageClass | Azure Blob is the default backend. A custom StorageClass-backed backend can be used via spec.storage.custom. |
| Secret backend | Azure Key Vault; HashiCorp Vault chart 0.33.0 as a self-managed example | Azure Key Vault is read through the CSI provider. Other stores must materialize native Kubernetes Secrets for the Kubernetes provider. |
Vantage application versions
The operator pins the Vantage application version throughspec.vantageVersion on the Vantage custom resource. Install matching versions of the vantage-operator and vantage-selfhosted charts; the current self-managed guide uses 0.70.13. See Upgrading.
What’s next
Architecture
How the operator + ArgoCD + CRD pattern works.
Prerequisites
Provisioning checklist for cluster, secrets, and certificates.