[unionai-docsy-agent]

What changed in the product

Dataplane chart 2026.10.1 changes the default of zero_trust.enabled to true. In 2026.9.4 it was false. The same release adds enable-feature=auto-gomemlimit to Prometheus's default flags. It also changes how the configChecksum stamp is computed, so the Union workloads restart once on any upgrade that crosses 2026.10.1. Self-managed customers are already upgrading to this chart. The October 2026 release notes cover the change, but Upgrade the data plane said nothing about zero trust.

Signal: DOC-1579, "Upgrade the data plane: cover chart 2026.10.1's zero-trust default and its upgrade prerequisites".

Changes

content/deployment/selfmanaged/upgrade.md:

• Before you upgrade, step 2: added a pointer to the new subsection. It applies to anyone upgrading from a version before 2026.10.1 to 2026.10.1 or later.
• Moving off the knative-operator path: after the knative-migration install, the page now says to set gateway.enabled: true and knative-operator.enabled: false. It also says that switching to the built-in gateway without running the migration deadlocks the upgrade, and that from 2026.10.1 zero trust requires that switch.
• New subsection "Upgrade to 2026.10.1 or later" under One-time migrations. It covers:
  • the zero_trust.enabled: true default and what it installs: the Envoy gateway, the dataproxy, the tunnel-service ingress, and Prometheus forwarding to the control plane, with a link to Monitoring;
  • self-hosted control planes must set zero_trust.enabled: false;
  • zero trust needs gateway.enabled: true, with the exact render error you get otherwise;
  • zero trust needs secrets.admin.enable: true while Prometheus is on, with the exact render error;
  • anyone overriding prometheus.server.extraFlags must include all three flags, or use prometheus.server.extraArgs instead;
  • the one-time workload restart when upgrading from a version before 2026.10.1 to 2026.10.1 or later (including a direct jump such as 2026.9.4 → 2026.11.3). From 2026.10.1, configChecksum is a hash of the ConfigMap's data, so only data changes restart the pods.

Evidence

I downloaded the published dataplane charts (2026.9.4, 2026.10.1 and 2026.11.3) from https://unionai.github.io/helm-charts/ and rendered them with helm template (Helm v3.16.4):

• Default: zero_trust.enabled is false in the 2026.9.4 values.yaml and true in 2026.10.1 and 2026.11.3. With default values, both 2026.10.1 and 2026.11.3 render the dataproxy, a Prometheus remote_write, and the auto-gomemlimit flag.
• gateway.enabled=false: fails to render in 2026.10.1 and 2026.11.3, with or without knative-operator.enabled=true. The error is zero_trust.enabled requires the vendored gateway: set gateway.enabled=true (knative-operator delivery is not supported with zero trust), and the page quotes it word for word. So from 2026.10.1, a data plane that keeps zero trust on has to switch to the built-in gateway.
• secrets.admin.enable=false: fails to render in both versions with the zero_trust metrics remote_write requires secrets.admin.enable=true … error, which the page quotes. It renders when zero_trust.enabled=false is also set, and when prometheus.enabled=false is set. That is why the page scopes the failure to "Prometheus on (the default)".
• zero_trust.enabled=false: renders, with no remote_write.
• Restart: configChecksum values in the 2026.9.4 render differ from the 2026.10.1 render. The 2026.10.1 chart's RELEASE.md explains why: the stamp is now the hash of the ConfigMap's data, so "each of those workloads rolls once". Because the change is in how the stamp is computed, any upgrade from a pre-2026.10.1 chart to 2026.10.1 or later changes it, not only the upgrade to 2026.10.1 itself; the page states it that way.
• Prometheus flags: the 2026.10.1 values.yaml comment on prometheus.server.extraFlags and the chart's RELEASE.md ("Prometheus enables auto-gomemlimit by default").
• Self-hosted control plane: "Zero trust is not supported for self-hosted control planes" comes from the 2026.10.1 chart's RELEASE.md and the zero_trust comment in values.yaml. This is a stated policy, so a render can't confirm it.
• Deadlock: comes from the 2026.10.1 chart's RELEASE.md and the October 2026 release notes ("If your data plane still uses the knative-operator path, run the knative-migration chart before upgrading; skipping it deadlocks the upgrade"). Reproducing it would need a live cluster still on the knative-operator path, so I didn't. The page ties the deadlock to the switch to the built-in gateway. Without that switch, the chart fails to render (see above), so the upgrade never reaches a deadlock. The existing migration bullet already says to run the migration before any release that uses the built-in gateway.

Open questions for the reviewer

• Is the deadlock specific to 2026.10.1, or does it happen on any switch from the knative-operator path to the built-in gateway without the migration? The page now states the second, broader reading. Nothing on the page says it began in 2026.10.1.
• A self-hosted control plane can set zero_trust.enabled: false while its data plane is still on the knative-operator path. Is that path still supported on 2026.10.1 or later? The chart reference says gateway.enabled: false falls back to it. If it is supported, those readers don't need to run the migration or switch to the gateway, and the page could say so. As written, the page doesn't claim either way.
• I left the page's example VERSION=2026.9.7 unchanged. The October release notes tell readers to upgrade to 2026.11.0 or later. Let me know if you'd like the example bumped.

Pre-flight review

Docsy's reviewer read this draft before it was opened and found 7 problems to fix. The draft was amended twice for them (1 declined, with evidence the check accepted), and a check of the amendment found nothing left to fix.

Its optional suggestions, which the page doesn't need to be right; take them or not:

• content/deployment/selfmanaged/upgrade.md line 213: "Keep" assumes the value is already true. Readers still on the knative-operator path have gateway.enabled: false, and lines 220–221 address them. "Set" works for both groups of readers.

---

Docsy case 3591: https://docsy.apps.demo.hosted.unionai.cloud/cases/3591

_{Drafted by Docsy, Union.ai's documentation agent, from the product changes and requests in this case. Review it like any PR; close it if it's not wanted.}

[github-actions]

GHA build & deploy preview

Built by .github/workflows/build-pr.yml and deployed to the docs CF Pages project by .github/workflows/deploy-pr-preview.yml.

Branch alias	https://pr-1941-docsy-case-3591.docs-dog.pages.dev
This commit	https://05de7c7e.docs-dog.pages.dev
Commit SHA	742655f7016166e178265b8be285fff0b701977e

Updated automatically on every push.