Hey i have integrated the hydra in my application to manage login sessions. When i have upgraded hydra version from v2.2.0 to v25.4.0 i have noticed that my logged in session got logout after the upgrade is completed and pods were up with new version. Is this expected ?

Hello Upen, we would need a lot more information to understand what changes happened to lead to that. I would say, it really depends on how you did the migration and other settings you have in your environment.

i have just changes the docker image from v2.2.0 to v25.4.0 and we have created the yaml file in order to deploy hydra instance in our Kubernetes We are using the below configuration in our yaml file in order to deploy hydra. 1. We have .Values.hydraV25Upgrade.enabled toggle enabled 2. We have .Values.migration.enabled is true

apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ .Values.name }}
  labels:
    app: {{ .Values.name }}
spec:
  {{- if eq .Values.hpa.enabled true }}
  replicas: {{ .Values.hpa.minReplicas }}
  {{- else }}
  replicas: {{ .Values.replicaCount }}
  {{- end }}
  selector:
    matchLabels:
      app: {{ .Values.name }}
  template:
    metadata:
      labels:
        app: {{ .Values.name }}
      annotations:         
          {{ if .Values.CONFIG_HASH }}
          checksum/CONFIG_HASH: {{ .Values.CONFIG_HASH }}
          {{ end }}
          {{ if .Values.SECRET_HASH }}
          checksum/SECRET_HASH: {{ .Values.SECRET_HASH }}
          {{ end }}
          {{ if .Values.CONFIG_HASH_SHARED_USER }}
          checksum/CONFIG_HASH_SHARED_USER: {{ .Values.CONFIG_HASH_SHARED_USER }}
          {{ end }}
          {{ if .Values.CONFIG_HASH_SHARED_CUSTOMER }}
          checksum/CONFIG_HASH_SHARED_CUSTOMER: {{ .Values.CONFIG_HASH_SHARED_CUSTOMER }}
          {{ end }}
          {{ if .Values.SECRET_HASH_SHARED_USER }}
          checksum/SECRET_HASH_SHARED_USER: {{ .Values.SECRET_HASH_SHARED_USER }}
          {{ end -}}
          {{ if .Values.SECRET_HASH_SHARED_CUSTOMER }}
          checksum/SECRET_HASH_SHARED_CUSTOMER: {{ .Values.SECRET_HASH_SHARED_CUSTOMER }}             
          {{ end }}
          {{ if .Values.IMAGE_DIGEST }}
          checksum/IMAGE_DIGEST: {{ .Values.IMAGE_DIGEST }}             
          {{ end }}    
    spec:
    {{ if .Values.migration.enabled }}
      initContainers:
        - name: {{ .Values.name }}-automigrate
          {{ if .Values.hydraV25Upgrade.enabled }}
          image: "{{ .Values.dockerRegistry }}/{{ .Values.image.repository }}:{{ .Values.hydraV25Upgrade.imageTag }}"
          {{ else if .Values.hydraV2Upgrade.enabled }}
          image: "{{ .Values.dockerRegistry }}/{{ .Values.image.repository }}:{{ .Values.hydraV2Upgrade.imageTag }}"
          {{ else }}
          image: "{{ .Values.dockerRegistry }}/{{ .Values.image.repository }}:{{ .Values.image.imageTag }}"
          {{ end }}
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          env:
          - name: SECRETS_SYSTEM
            valueFrom: 
                secretKeyRef:
                  name: {{ .Values.SECRETNAME }}
                  key: SYSTEM_SECRET
          {{ if .Values.hydraV25Upgrade.enabled }}
          - name: DSN
            valueFrom:
                secretKeyRef:
                  name: {{ .Values.SECRETNAME }}
                  key: DATABASE_URL_HYDRA_V25
          {{ else if .Values.hydraV2Upgrade.enabled }}
          - name: DSN
            valueFrom:
                secretKeyRef:
                  name: {{ .Values.SECRETNAME }}
                  key: DATABASE_URL_HYDRA_V2
          {{ else }}
          - name: DSN
            valueFrom:
                secretKeyRef:
                  name: {{ .Values.SECRETNAME }}
                  key: DATABASE_URL_HYDRA
          {{ end }}
          command: ["hydra"]
          args: ["migrate", "sql", "-e","--yes"]
    {{ end }}
      containers:
        - name: {{ .Values.name }}
          {{ if .Values.hydraV25Upgrade.enabled }}
          image: "{{ .Values.dockerRegistry }}/{{ .Values.image.repository }}:{{ .Values.hydraV25Upgrade.imageTag }}"
          {{ else if .Values.hydraV2Upgrade.enabled }}
          image: "{{ .Values.dockerRegistry }}/{{ .Values.image.repository }}:{{ .Values.hydraV2Upgrade.imageTag }}"
          {{ else }}
          image: "{{ .Values.dockerRegistry }}/{{ .Values.image.repository }}:{{ .Values.image.imageTag }}"
          {{ end }}
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          livenessProbe:
            failureThreshold: 3
            httpGet:
              path: /health/alive
              port: 4445
              scheme: HTTP
            initialDelaySeconds: {{ .Values.livenessProbe.initialDelaySeconds }}
            periodSeconds: {{ .Values.livenessProbe.periodSeconds }}
            successThreshold: {{ .Values.livenessProbe.successThreshold }}
            timeoutSeconds: {{ .Values.livenessProbe.timeoutSeconds }}
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: /health/ready
              port: 4445
              scheme: HTTP
            initialDelaySeconds: {{ .Values.livenessProbe.initialDelaySeconds }}
            periodSeconds: {{ .Values.livenessProbe.periodSeconds }}
            successThreshold: {{ .Values.livenessProbe.successThreshold }}
            timeoutSeconds: {{ .Values.livenessProbe.timeoutSeconds }}
          resources:
            requests:
              cpu: {{ .Values.resources.requests.cpu }}
              memory: {{ .Values.resources.requests.memory }}
            limits:
              cpu: {{ .Values.resources.limits.cpu }}
              memory: {{ .Values.resources.limits.memory }}
          ports:
          - containerPort: 4444
          - containerPort: 4445
          env:
          - name: SECRETS_SYSTEM
            valueFrom: 
              secretKeyRef:
                name: {{ .Values.SECRETNAME }}
                key: SYSTEM_SECRET
          {{ if .Values.hydraV25Upgrade.enabled }}
          - name: DSN
            valueFrom:
              secretKeyRef:
                name: {{ .Values.SECRETNAME }}
                key: DATABASE_URL_HYDRA_V25
          {{ else if .Values.hydraV2Upgrade.enabled }}
          - name: DSN
            valueFrom:
              secretKeyRef:
                name: {{ .Values.SECRETNAME }}
                key: DATABASE_URL_HYDRA_V2
          {{ else }}
          - name: DSN
            valueFrom:
              secretKeyRef:
                name: {{ .Values.SECRETNAME }}
                key: DATABASE_URL_HYDRA
          {{ end }}
          - name: URLS_SELF_ISSUER
            valueFrom:
              configMapKeyRef:
                name: {{ .Values.CONFIGMAP }}
                key: OAUTH2_ISSUER_URL
          # - name: SERVE_TLS_ALLOW_TERMINATION_FROM
          #   valueFrom:
          #     configMapKeyRef:
          #       name: {{ .Values.CONFIGMAP }}
          #       key: SERVE_TLS_ALLOW_TERMINATION_FROM
          - name: URLS_CONSENT
            valueFrom:
              configMapKeyRef:
                name: {{ .Values.CONFIGMAP }}
                key: OAUTH2_CONSENT_URL
          - name: URLS_LOGIN 
            valueFrom:
              configMapKeyRef:
                name: {{ .Values.CONFIGMAP }}
                key: OAUTH2_LOGIN_URL
          - name: LOG_LEVEL
            valueFrom:
              configMapKeyRef:
                name: {{ .Values.CONFIGMAP }}
                key: HYDRA_LOG_LEVEL
          - name: LOG_FORMAT
            valueFrom:
              configMapKeyRef:
                name: {{ .Values.CONFIGMAP }}
                key: HYDRA_LOG_FORMAT
          - name: REFRESH_TOKEN
            valueFrom:
              configMapKeyRef:
                name: {{ .Values.SHARED_CONFIGMAP }}
                key: REFRESH_TOKEN_LIFESPAN
          - name: ACCESS_TOKEN
            valueFrom:
              configMapKeyRef:
                name: {{ .Values.SHARED_CONFIGMAP }}
                key: ACCESS_TOKEN_LIFESPAN
          - name: OAUTH2_ERROR_URL
            valueFrom:
              configMapKeyRef:
                name: {{ .Values.CONFIGMAP }}
                key: OAUTH2_LOGIN_URL
          {{- if eq .Values.tracingEnabled true }}
          - name: TRACING_SERVICE_NAME
            value: {{ .Values.namespace }}-{{ .Values.name }}
          - name: TRACING_PROVIDER
            value: "otel"
          - name: TRACING_PROVIDERS_OTLP_SERVER_URL
            value: otel-collector.monitoring.svc.cluster.local:4318
          - name: TRACING_PROVIDERS_OTLP_SAMPLING_SAMPLING_RATIO
            value: "0.5"
          - name: TRACING_PROVIDERS_OTLP_INSECURE
            value: "true"
          {{- end }}
          {{- if or .Values.hydraV2Upgrade.enabled .Values.hydraV25Upgrade.enabled }}
          - name: SERVE_COOKIES_NAMES_LOGIN_CSRF
            value: "oauth2_authentication_csrf"
          - name: SERVE_COOKIES_NAMES_CONSENT_CSRF
            value: "oauth2_consent_csrf"
          - name: SERVE_COOKIES_NAMES_SESSION
            value: "oauth2_authentication_session"
          {{- end }}
          {{- if .Values.hydraV25Upgrade.enabled }}
          - name: WEBFINGER_OIDC_DISCOVERY_CLIENT_REGISTRATION_URL
            valueFrom:
              configMapKeyRef:
                name: {{ .Values.CONFIGMAP }}
                key: OAUTH2_REGISTRATION_URL
          - name: OIDC_SUBJECT_IDENTIFIERS_SUPPORTED_TYPES
            value: "public,pairwise"
          - name: OIDC_SUBJECT_IDENTIFIERS_PAIRWISE_SALT
            valueFrom:
              secretKeyRef:
                name: {{ .Values.SECRETNAME }}
                key: OIDC_SUBJECT_IDENTIFIERS_PAIRWISE_SALT
          - name: OIDC_DYNAMIC_CLIENT_REGISTRATION_ENABLED
            value: "true"
          - name: SERVE_COOKIES_SAME_SITE_MODE
            value: "None"
            # value: "Lax"
          - name: SERVE_COOKIES_SECURE
            value: "true"
          - name: SERVE_COOKIES_DOMAIN
            value: "<http://staticso2.com|staticso2.com>"
          # - name: SERVE_TLS_ALLOW_TERMINATION_FROM
          #   value: "0.0.0.0/0"
          - name: SERVE_PUBLIC_CORS_ENABLED
            value: "true"
          - name: CORS_ALLOWED_ORIGINS
            value: "*"
          - name: CORS_ALLOWED_METHODS
            value: "POST, GET, PUT, PATCH, DELETE, CONNECT, HEAD, OPTIONS, TRACE"
          - name: CORS_ALLOWED_HEADERS
            value: "Authorization, Accept, Content-Type, Content-Length, Accept-Language, Content-Language"
          - name: CORS_EXPOSED_HEADERS
            value: "Content-Type, Cache-Control, Expires, Last-Modified, Pragma, Content-Length, Content-Language"
          {{- else if .Values.hydraV2Upgrade.enabled }}
          - name: SERVE_COOKIES_SAME_SITE_MODE
            value: "Lax"
          {{- end }}
          command: 
            - "hydra"
          {{- if or .Values.hydraV2Upgrade.enabled .Values.hydraV25Upgrade.enabled }}
          args: [
            "serve",
            "all"
          ]
          {{- else }}
          args: [
            "serve",
            "all",
            "--dangerous-force-http"
          ]
          {{- end }}
      imagePullSecrets:
          - name: {{ .Values.image.pullSecret }}

You should not have skipped the intermediary versions.

How will it impact if we skip it and directly upgrade from v2.2.0 to v25.4.0? Won't it (v25.4.0) apply the db migration changes of v2.3.0 when i upgrade it to this latest version ?

I misread the symptom, it might not be related to the skipped version. Generally speaking you should not skip versions, as the code might not be able to handle the old data during the migration, but only after. Hydra has some security measures where it automatically invalidates stuff on certain error conditions, so maybe it is related that they got invalidated because there were transient errors during the migration.