Upgrade Guide: 8.35 to 8.47

This page lists all breaking changes, required actions, and important behavioral changes accumulated across releases 8.36 through 8.47. Items are grouped by topic and ordered by impact.

JWT Authentication Migration

Introduced in 8.46

The Core UI service now handles JWT issuing, replacing Switchboard for this functionality. Switchboard token and JWKS endpoints are deprecated.

Core UI Configuration

Enable JWT issuing in Core UI with the following Helm values:

jwt:
  enabled: true
  hostname: "your-appsuite-domain.example.com"
appsuite:
  api: "http://main-core-mw-http-api/<appRoot>/api"

Middleware Configuration

The middleware property com.openexchange.tokenlogin.applications must include core-ui as an additional application.

Custom VirtualService Route

If you are using a custom VirtualService, add a new route for the Core UI service:

- match:
  - uri:
      prefix: /<appRoot>/ui
  name: core-ui
  rewrite:
    uri: /ui  # only needed when appRoot is set
  route:
  - destination:
      host: main-core-ui.<namespace>.svc.cluster.local
      port:
        number: 80

Service JWT Configuration

All services that consume JWTs must include the appRoot in their oidc.issuer configuration:

Component	Configuration
Core UI	`jwt.enabled: true`, `jwt.hostname`, `appsuite.api`
AI Service	`oidc.issuer: "https://<hostname>/<appRoot>"` (renamed from `jwks.domain`)
Switchboard	`oidc.issuer: "https://<hostname>/<appRoot>"`

Multiple issuers can be comma-separated. Services automatically discover JWKS endpoints via OpenID Configuration. For detailed migration steps, see the migration guide.

Core UI Architecture Change

Introduced in 8.46

The Core UI has migrated from a static nginx-based container to a dynamic Node.js service. This requires resource adjustments:

Memory: Default is 256Mi for both request and limit (up from the nginx defaults).
CPU: A CPU request is defined, but no CPU limit is set. This allows the service to handle short CPU bursts without being throttled. Set a limit (commonly 1 CPU) if required by cluster policies.
Instance count: The Helm chart defaults to two instances. For just serving static files, you can reduce to one.
BIMI: When the BIMI feature is enabled, Core UI requires a database to cache BIMI records and logos.

Istio Configuration Update

Introduced in 8.45

The Istio configuration has been updated. Ensure you have a supported version of Istio installed before upgrading. See requirements and Istio configuration details.

Ingress NGINX Deprecation

Announced in 8.45, reiterated in 8.46 and 8.47

Upstream support for Ingress NGINX ceased at the end of March 2026, and the project has been retired. OX App Suite v8 support for Ingress NGINX is also discontinued. See the Kubernetes blog post for background.

Redis Connection Pool Default Change

Introduced in 8.37

The Redis connector now defaults to shared connection mode (com.openexchange.redis.connection.pool.mode = shared), where a single connection is used concurrently by multiple threads. This leverages NIO and asynchronous capabilities of the underlying Lettuce client for better performance and lower I/O overhead. The previous behavior used dedicated connections (one per thread).

If you experience unexpected Redis behavior after upgrading, you can revert to the previous mode:

com.openexchange.redis.connection.pool.mode: dedicated

The number of shared connections is controlled by com.openexchange.redis.connection.pool.numSharedConnections (default 8).