Compatibility

Supported Kubernetes versions, distributions, and dependency versions for the Vantage 3.0 operator.

The Vantage operator runs on standard Kubernetes APIs. The matrices below capture which Kubernetes versions, distributions, and dependency versions are supported and tested for Vantage 3.0 self-hosted.

For the install-time checklist (services to provision, secrets to create), see Prerequisites.

Supported Kubernetes versions

The operator targets the standard Kubernetes API surface. Version compatibility is bounded by ArgoCD’s own Kubernetes support matrix.

Kubernetes	Support
1.33	Tested (AKS 1.33.6)
1.36	Tested (self-managed Kubernetes 1.36.1)

Other Kubernetes versions within ArgoCD’s support matrix may work but are not validated. Confirm with your ABBYY account team before running on a Kubernetes version that is not listed here.

Supported Kubernetes distributions

Distribution	Support level	Notes
Azure Kubernetes Service (AKS)	Supported	Validated end-to-end on AKS 1.33.6 with the AKS Istio Add-on (asm-1-28). See Install on Azure.
Self-managed Kubernetes	Supported	Validated with customer-managed networking, Linkerd, Traefik, native Kubernetes Secrets, PostgreSQL, and a custom StorageClass. See Self-Managed Kubernetes.

Use a Kubernetes version listed above. Kubernetes distributions and component substitutions that are not listed have not been validated; confirm them with your ABBYY account team before production use.

Dependency versions

The operator depends on the following components in the cluster.

Component	Required	Tested	Notes
ArgoCD	>= 2.6.0	v3.3.2 on AKS; v3.4.3 on self-managed Kubernetes	The ApplicationSet Progressive Syncs feature must be enabled. A repository connection to your OCI registry is also required.
Helm	>= 3.0.0	v4.2.0 on AKS; v3.21.1 on self-managed Kubernetes	Used to install the operator and vantage-selfhosted charts.
Istio	any	AKS Istio Add-on asm-1-28	Tested service mesh and built-in ingress path on AKS. STRICT mTLS is enforced on application traffic. An external ingress gateway is required on AKS.
Linkerd	any compatible release	edge-26.6.1	Tested service mesh for self-managed Kubernetes. Enable injection in the Vantage namespace before installing Vantage.
Traefik	v3	Helm chart 39.x	Tested ingress controller for self-managed Kubernetes. Disable the chart’s built-in Istio ingress and implement the documented Vantage route contract.
Secrets Store CSI Driver (Azure provider)	>= 1.0.0	1.7.2 (Helm chart 1.7.2)	Required when using the Azure Key Vault secrets provider. Not required when using the Kubernetes Secrets provider.
External Secrets Operator	any compatible release	Helm chart 2.6.0	Optional example for materializing native Kubernetes Secrets from an external store. Vantage consumes the Kubernetes Secrets, not External Secrets or the external store directly.
csi-driver-nfs	any compatible release	Helm chart 4.13.4	Optional example NFS provisioner for spec.storage.custom on self-managed Kubernetes. Set mountPermissions: "0777" on the StorageClass; provisioned volumes must be writable by non-root.
KEDA (optional, recommended)	>= 2.17.0, < 2.18.0	2.17.3; AKS add-on 2.17.3-5	Required for KEDA autoscaling support. KEDA 2.18 and later removed a scaler field used by the current Vantage workload charts.
Prometheus Operator (required with KEDA)	any compatible release	kube-prometheus-stack 87.3.0	Provide a Prometheus instance at prometheus-operated.observability.svc.cluster.local:9090 and discover the Vantage ServiceMonitor.

Supporting service versions

These are external dependencies provisioned outside the cluster. The table combines the versions and implementations tested across the supported deployment paths:

Service	Tested version	Notes
SQL Server	Azure SQL 12.0.2000.8 (compatibility level 170, General Purpose Serverless Gen 5)	One database per connection-string alias listed in Secrets and Key Vault (23 today). The reporting database must support Columnstore Indexing.
PostgreSQL	Provider support validated with the self-managed deployment	Set vantage.databaseProvider: PostgreSQL. Use a distinct logical database per service; each service’s migrator creates its database on first run. Reporting is not supported with PostgreSQL.
Redis	Azure Managed Redis 7.4 (EnterpriseCluster); Redis 7.4 on self-managed Kubernetes
SendGrid	n/a	Default mail provider. Supply sendgridApiKey via your secrets provider.
SMTP server	MailHog v1.0.1 (Helm chart 5.8.0)	Optional alternative to SendGrid. Only basic auth or no auth is supported. Used only when spec.smtp is set.
OCI registry	Azure Container Registry	Migration auth: no auth, basic auth, or Azure Workload Identity + Azure RBAC. Image pulls: Kubernetes pull secrets or, on Azure, AcrPull granted to the AKS managed identity. See Image pull access.
Storage	Azure StorageV2 (general purpose v2); customer-provided Kubernetes StorageClass	Azure Blob is the default backend. A custom StorageClass-backed backend can be used via spec.storage.custom.
Secret backend	Azure Key Vault; HashiCorp Vault chart 0.33.0 as a self-managed example	Azure Key Vault is read through the CSI provider. Other stores must materialize native Kubernetes Secrets for the Kubernetes provider.

Vantage application versions

The operator pins the Vantage application version through spec.vantageVersion on the Vantage custom resource. Install matching versions of the vantage-operator and vantage-selfhosted charts; the current self-managed guide uses 0.70.13. See Upgrading.

What’s next

Architecture

How the operator + ArgoCD + CRD pattern works.

Prerequisites

Provisioning checklist for cluster, secrets, and certificates.