Upgrade pages for APISIX major version changes, based on the project's own upgrade guides.
Moving an APISIX 2.x gateway to the 3.x line: stepping through 2.15 first, rebuilding etcd data, config file restructuring, Admin API response and endpoint changes, plugin and route field changes, and a parallel-cluster cutover plan.
Leaving the 3.2 LTS release for a current 3.x: the default router change in 3.3, OpenResty 1.21 from 3.5, removal of etcd gRPC and the conf server in 3.6, strict schema validation, and how to step through the later breaking changes.
Upgrading to APISIX 3.10: the auto-generated Admin API key, encryption of sensitive fields on by default, the CORS expose_headers change, header limits and core.request.header behavior that affects custom plugins.
The auth and AI plugin changes between 3.10 and 3.12: the jwt-auth signing endpoint removal, the hmac-auth rewrite, opentelemetry moving to plugin metadata, ai-content-moderation renamed, and system CA certificates by default.
Upgrading to APISIX 3.14: the Admin API no longer filling default values on write, required secrets for jwt-auth and openid-connect sessions, the deprecated server-info plugin, and checks for automation that relied on defaults.
The security defaults that changed in 3.16 and 3.17: openid-connect TLS verification on, stricter jwt-auth claims and algorithms, the removed jwe encrypt endpoint, admin key on schema validation, hmac signed headers and proxy-cache isolation.
Upgrading to APISIX 3.18: body buffering limits in plugins, logger backlog caps, X-Forwarded header sanitization, real LDAP TLS verification, openid-connect fail-closed introspection and the new LLM metric labels that break dashboards.
Upgrading to APISIX 3.19: upstream TLS verification for https and grpcs, issuer checks on token introspection, bounded batch-requests responses, empty basic-auth passwords rejected and WebSocket metric labels.
Moving the APISIX Ingress Controller to the 2.x line: removed mock-etcd mode and ApisixClusterConfig, the GatewayProxy CRD, standalone mode with APISIX 3.13, renamed config fields, Ingress v1 only and a blue-green switchover.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.