Skip to main content

Airbyte 2.2

A Helm chart walks into a cluster. The API server asks, “Do you have a reservation?” The Helm chart says “No, but I have a release.” Airbyte version 2.2 was released on August 10, 2026.

Self-Managed Enterprise

If you still use Self-Managed Enterprise, do not upgrade. Speak to your Airbyte representative about switching to one of Airbyte's Cloud plans, which always have the latest capabilities and security improvements. Private Link is available if you require it.

Action required before upgrading

This upgrade is one-way. The 2.2.0 migrations drop tables that 2.1.x depends on, so a database that has run the 2.2.0 migration cannot serve 2.1.x images; syncs stop if you try. Nothing dropped is recoverable. Take a database backup before upgrading; rolling back to 2.1.x is not supported.

If your Helm values set global.jobs.resources, check them before upgrading. These values were ignored by chart V2 in Airbyte 2.1.x but now take effect in 2.2.0 as a per-key fallback for main-container resources. Remove global.jobs.resources or move each value to global.workloads.resources.mainContainer before upgrading.

If your Helm values set global.workloads.resources.replication.*, check them before upgrading as well. These values were previously inert but now size the replication orchestrator. Remove them or confirm that the resulting resources are intended.

The upgrade also creates indexes concurrently, outside a transaction. On a large jobs table, this can keep startup in that step for a long time, so plan for it before upgrading.

Community deployments no longer accept HTTP Basic credentials on the API. Scripts or integrations that use curl -u break after upgrading even when you make no change to your Helm values. Switch those callers to an access token from /api/v1/applications/token, using instance-admin-client-id and instance-admin-client-secret from the auth secret.

If you mirror or pin bundled images, make sure manifest-server image tag 7.23.7 is available before upgrading, or those pods won't start.

Helm chart improvements​

  • Namespace override: Both the main chart and the data plane chart accept a top-level namespaceOverride value, which controls the namespace written onto the resources the chart creates and used for internal service discovery. Rendered manifests now always carry an explicit metadata.namespace (the release namespace unless namespaceOverride is set), so render Helm templates with a matching --namespace before applying them with kubectl -n <other-namespace>.

  • Storage and service configuration for bundled components: The bundled PostgreSQL and MinIO deployments and the server service accept more configuration: postgresql.storage.volumeClaimValue sizes the database volume, minio.storage.volumeClaimValue (available before 2.2) sizes the MinIO volume, minio.storage.storageClassName selects its storage class, and server.service.nodePort sets an explicit NodePort when the server service type is NodePort or LoadBalancer. The volume values apply when the release is first installed; changing them on an existing release has no effect. Expand an existing PersistentVolumeClaim to increase its size. With storageClassName: "", dynamic provisioning is off and the PVC remains Pending.

  • Bootloader annotations: You can annotate the bootloader with airbyteBootloader.annotations and airbyteBootloader.podAnnotations, which is useful for service meshes and job-scraping tools that need to ignore or special-case it.

  • Legacy job resource values still apply: global.jobs.resources is deprecated in favor of global.workloads.resources.mainContainer.{cpu,memory}.{request,limit}. In 2.1.x, the V2 chart ignored the legacy values; in 2.2.0, each newer value takes precedence and an unset key falls back to the matching legacy value for JOB_MAIN_CONTAINER_CPU_LIMIT, JOB_MAIN_CONTAINER_CPU_REQUEST, JOB_MAIN_CONTAINER_MEMORY_LIMIT, and JOB_MAIN_CONTAINER_MEMORY_REQUEST. Check for global.jobs.resources before upgrading, then remove it or move its values to global.workloads.resources.mainContainer; this fallback covers main-container resources only.

  • Chart renders cleanly through Kustomize: The chart no longer emits duplicate DATAPLANE_CLIENT_ID_SECRET_KEY and DATAPLANE_CLIENT_SECRET_SECRET_KEY keys, and the Temporal UI deployment's resource and security context blocks are indented correctly. Duplicate keys and malformed indentation caused failures when piping helm template output into Kustomize.

  • Orchestrator resources sized separately from jobs: The server now reads global.workloads.resources.replication.{cpu,memory}.{request,limit} for the replication orchestrator. Values already set in 2.1.x begin affecting resources after you upgrade; they render as REPLICATION_ORCHESTRATOR_CPU_LIMIT, REPLICATION_ORCHESTRATOR_CPU_REQUEST, REPLICATION_ORCHESTRATOR_MEMORY_LIMIT, and REPLICATION_ORCHESTRATOR_MEMORY_REQUEST.

  • External database requirements documented: If you set global.database.type to external, your PostgreSQL server must be version 13 or later. Airbyte tests through PostgreSQL 17. This requirement isn't new in 2.2.0; the chart now states it explicitly.

  • Chart metadata for Artifact Hub: The version 2 charts now carry license, source, documentation, and support annotations, so the chart listing links back to the right places.

  • Bundled manifest server image updated: The default manifest server image tag is now 7.23.7 instead of 7.10.0. If you mirror or pin bundled images, mirror the new tag.

Connector & sync management​

  • Syncs with no records no longer fail: The container orchestrator could terminate a destination before it shut down gracefully, and it missed exit-code files created through an atomic rename. Syncs that produce no records now complete normally.

  • Correct CPU parsing when sizing sockets: For connections that run over the socket transport, the workload launcher now resolves CPU limits expressed in millicores, such as 500m and 4000m, correctly instead of reading them as whole cores and inflating the computed socket count enormously.

  • Refreshed OAuth credentials persist immediately: When a source emits a CONTROL message with updated OAuth configuration, Airbyte persists it when the message is read instead of later in message processing. Cancelling or aborting a sync after the connector refreshes its token no longer loses the rotated refresh token.

  • Secret storage configuration is validated up front: Airbyte checks that an AWS, Azure, GCP, or Vault secret storage configuration has the fields its backend requires when you create secret storage through the API, instead of failing later during a secret operation.

  • Amazon Seller Partner supports the Ireland region: OAuth consent URLs are now generated for the IE region, so Irish sellers can authenticate.

  • Shopify OAuth errors are readable: A failed Shopify token exchange now reports the HTTP status and the error Shopify returned instead of a generic failure.

  • Custom sources report file transfer support correctly: For custom declarative sources, supportsFileTransfer is derived from the connector manifest when the connector is published or a version is activated, so republish the connector or activate a version before using file-based streams.

  • Google OAuth setup for Gmail and Google Calendar sources: Gmail and Google Calendar now show a Google-branded sign-in button, and the OSS OAuth factory registers DeclarativeOAuthFlow for both connectors. These platform registrations do not make OAuth complete; the connector version's specification determines whether OAuth is available.

  • Public API source name mappings: The public API recognizes gmail, google-calendar, and linear as source names.

  • Destinations shut down gracefully: Destination containers now have up to 60 seconds to exit on their own after input ends before Airbyte forcefully stops them.

New features​

  • Initial sync volume notice: The connection creation flow now reminds you that the first sync replicates all data in every enabled stream, so you can narrow stream and field selection before you start.

Security improvements​

  • Client-supplied authentication headers are stripped: Internal authentication headers are removed from incoming requests before the server derives the trusted workspace and organization identity headers it uses for authorization.

  • Invitation codes no longer exposed: Administrative invitation reads and cancellations reference invitations by ID and return a payload built for administrators. If you consume /v1/user_invitations/create, /v1/user_invitations/list_pending, or /v1/user_invitations/cancel, their responses no longer include inviteCode; cancel still accepts inviteCode.

Bug fixes​

  • No browser credential prompt on community deployments: Unauthenticated requests to a community-edition deployment no longer advertise an HTTP Basic authentication challenge, which caused browsers to pop up a native username and password dialog. HTTP Basic credentials are no longer accepted, so API callers must use an access token instead.

  • Connection pages load when schema discovery fails: A failed schema discovery on the refreshed-catalog path no longer prevents the connection page from loading, so you can reach the connection and fix the underlying problem.

  • Duplicate attempt creation returns a conflict: Creating an attempt for a job that's already running or already finished returns 409 Conflict, so the workflow fails fast instead of retrying.

  • Connector Builder stream testing isn't blocked by other streams: The stream test button validates the tested stream without reporting errors from unrelated streams.

  • Faster job history queries on large installations: Job pruning and connection-timeline event pruning use a ten-minute statement timeout. Attempt statistics now use bound array parameters and chunked queries, and migrations add indexes on jobs(created_at) and the commands workload lookup.

  • 404 error responses allow a missing message: The public API no longer requires message in NotFoundKnownExceptionInfo error responses; exceptionClassName remains required.

Was this page helpful?