> ## Documentation Index
> Fetch the complete documentation index at: https://docs.flowx.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Deployment guidelines v6.0.0

> Component versions, Kafka topics, environment variables, and Helm chart changes for FlowX.AI 6.0.0, with the steps a self-hosted upgrade needs.

> [!NOTE]
>
> After upgrading to a new platform version, always ensure that your installed component versions match the versions specified in the release notes. To verify this, navigate to **FlowX.AI Designer → Platform Status**.

## Upgrade overview

FlowX.AI 6.0 is a feature release. On SaaS, FlowX applies every change on this page. Self-hosted deployments usually follow LTS releases and receive these changes with the next LTS release family. If you upgrade a self-hosted installation to 6.0.0, apply the changes below in the order given in [Migrating from v5.9.x to v6.0.0](https://docs.flowx.ai/release-notes/v6.x/v6.0.0-october-2026/migrating-from-v5.9-to-v6.0/migration-overview.md).

### Before you upgrade a self-hosted installation

* Set every AI service group flag explicitly. See [AI service groups in the Helm chart](#ai-service-groups-in-the-helm-chart).
* Create the new database users and secrets, including the four new keys in `keycloak-flowx-realm-clients`. See [New databases and secrets](#new-databases-and-secrets).
* Give process-engine read access to the integration-designer bucket. See [New databases and secrets](#new-databases-and-secrets).
* Create the new Kafka topics, including the ones added in 5.10 to 5.13. See [New Kafka topics](#new-kafka-topics).
* Set `FLOWX_PII_ENCRYPTION_MASTER_KEY` on integration-designer, required since 5.12. See [personal-data encryption master key](https://docs.flowx.ai/release-notes/v5.x/v5.12.0-september-2026/deployment-guidelines-v5.12.md#new-required-secret-personal-data-encryption-master-key).
* Choose how Elasticsearch replicates new indices, changed in 5.13. See [Elasticsearch replica auto-expansion](https://docs.flowx.ai/release-notes/v5.x/v5.13.0-september-2026/deployment-guidelines-v5.13.md#changed-default-elasticsearch-replica-auto-expansion).
* Add the MongoDB hosts on your private network that data sources use to `FLOWX_SSRFALLOWEDHOSTS`. See [nosql-db-runner host restrictions](#changed-behavior-nosql-db-runner-host-restrictions-cover-mongodb).
* Trust the certificates of the IMAP servers your email triggers read from. See [IMAPS certificate verification](#changed-default-imaps-certificate-verification-in-email-gateway).
* Keep the advancing-controller management port, `8081`, off any public ingress. See [Removed environment variables](#removed-environment-variables).

Upgrading from 5.9.5 or earlier? After the upgrade, re-publish builds that were waiting for a deployment retry. See [Failed deployments retry from PostgreSQL](#changed-behavior-failed-deployments-retry-from-postgresql).

## Component versions

The versions below are the component versions that make up FlowX.AI 6.0.0. On SaaS, FlowX manages these versions.

### Core components

| Component | 6.0.0 |
| - | - |
| **admin** | 11.132.0 |
| **advancing-controller** | 11.86.0 |
| **application-manager** | 11.143.0 |
| **audit-core** | 11.92.0 |
| **authorization-system** | 11.102.0 |
| **cms-core** | 11.114.0 |
| **data-search** | 11.87.0 |
| **data-sync** | 11.94.0 |
| **designer** | 11.251.0 |
| **designer-user** | 11.31.0 |
| **document-plugin** | 11.122.0 |
| **email-gateway** | 11.110.0 |
| **events-gateway** | 11.93.0 |
| **file-gateway** | 11.105.0 |
| **integration-designer** | 11.158.0 |
| **license** | 11.94.0 |
| **nosql-db-runner** | 11.98.0 |
| **notification-plugin** | 11.113.0 |
| **organization-manager** | 11.101.0 |
| **process-engine** | 11.137.0 |
| **runtime-manager** | 11.143.0 |
| **scheduler-core** | 11.89.0 |
| **task-management-plugin** | 11.109.0 |
| **webhook-gateway** | 11.102.0 |

### AI base components

| Component | 6.0.0 |
| - | - |
| **ai-gateway** | 11.118.1 |
| **embedder** | 11.7.0-main-317-b4973f3 |
| **knowledgebase-indexer-v2** | 11.7.0-main-317-b4973f3 |
| **knowledgebase-rag** | 11.7.0-main-317-b4973f3 |
| **doc-parser** | 11.7.0-main-317-b4973f3 |

### AI dev-time components

| Component | 6.0.0 |
| - | - |
| **ai-analyst** | 11.7.0-main-317-b4973f3 |
| **ai-architect** | 11.7.0-main-317-b4973f3 |
| **ai-assistant** | 11.7.0-main-317-b4973f3 |
| **ai-designer** | 11.7.0-main-317-b4973f3 |
| **ai-developer** | 11.7.0-main-317-b4973f3 |
| **harness** | 11.7.0-main-317-b4973f3 |
| **kb-enrichment** | 11.7.0-main-317-b4973f3 |
| **planner** | 11.7.0-main-317-b4973f3 |
| **ui-driver** | 11.251.0 |

### AI runtime components

| Component | 6.0.0 |
| - | - |
| **agent-builder** | 11.7.0-main-317-b4973f3 |
| **cee-pii** | 11.7.0-main-317-b4973f3 |
| **data-privacy** | 11.7.0-main-317-b4973f3 |
| **doc-converter** | 11.7.0-main-317-b4973f3 |
| **dynamic-classifier** | 11.7.0-main-317-b4973f3 |
| **evals-judge** | 11.7.0-main-317-b4973f3 |
| **speech-to-text** | 11.7.0-main-317-b4973f3 |
| **web-crawler** | 11.7.0-main-317-b4973f3 |

### AI extensions

| Component | 6.0.0 |
| - | - |
| **modpod** | 11.0.1 |
| **observatory-api** | 11.29.4 |
| **observatory-platform** | 11.29.4 |
| **observatory-web** | 11.29.4 |

In FlowX.AI 6.0, the Observatory components run on environments operated by FlowX. They aren't included in client deployments in this release.

### Embedded components

* **SpiceDB:** see the [5.9.0 deployment guidelines](https://docs.flowx.ai/release-notes/v5.x/v5.9.0-june-2026/deployment-guidelines-v5.9.md) for details.
* **Qdrant** (vector database): bundled in the `flowx-ai` Helm chart and deployed with the AI base group (see [AI service groups in the Helm chart](#ai-service-groups-in-the-helm-chart)). Its version is managed by the chart and not pinned here. See the [Qdrant setup guide](https://docs.flowx.ai/6.x/setup-guides/qdrant.md) for deployment and configuration.

### Renderers

The web SDKs ship at the **designer** version (`11.251.0` for FlowX.AI 6.0.0). The native iOS and Android renderers version independently.

| Component | 6.0.0 |
| - | - |
| **@flowx/angular-sdk** | 11.251.0 |
| **@flowx/angular-theme** | 11.251.0 |
| **@flowx/angular-ui-toolkit** | 11.251.0 |
| **@flowx/react-sdk** | 11.251.0 |
| **@flowx/react-theme** | 11.251.0 |
| **@flowx/react-ui-toolkit** | 11.251.0 |
| **@flowx/react-native-sdk** | 11.251.0 |
| **@flowx/react-native-theme** | 11.251.0 |
| **@flowx/react-native-ui-toolkit** | 11.251.0 |
| **@flowx/core-sdk** | 11.251.0 |
| **@flowx/core-theme** | 11.251.0 |
| **solution-portal** | 11.251.0 |
| **iOS renderer** | 11.6.0 |
| **Android renderer** | 11.18.0 |

The **solution-portal** container app tracks the designer version.

***

## Configuration changes

This section compares environment variables and Kafka topics with FlowX.AI 5.13, and Helm chart changes with the `flowx-ai` chart in 5.9.6. Upgrading a self-hosted installation from 5.9.x? The configuration changes in the [5.10](https://docs.flowx.ai/release-notes/v5.x/v5.10.0-july-2026/deployment-guidelines-v5.10.md), [5.11](https://docs.flowx.ai/release-notes/v5.x/v5.11.0-august-2026/deployment-guidelines-v5.11.md), [5.12](https://docs.flowx.ai/release-notes/v5.x/v5.12.0-september-2026/deployment-guidelines-v5.12.md), and [5.13](https://docs.flowx.ai/release-notes/v5.x/v5.13.0-september-2026/deployment-guidelines-v5.13.md) deployment guidelines also reach you with this upgrade, although those pages describe them for SaaS. The ones you act on are in [Before you upgrade a self-hosted installation](#before-you-upgrade-a-self-hosted-installation): the Kafka topics, the personal-data encryption key, and Elasticsearch replica auto-expansion.

### New Kafka topics

These topics back new 6.0 capabilities. On SaaS they are created and managed automatically.

**AI nodes as durable jobs:**

| Topic | Producer → Consumer |
| - | - |
| `ai.flowx.ai-platform.agent-node.job.request.v1` | integration-designer → agent-builder |
| `ai.flowx.ai-platform.agent-node.job.response.v1` | agent-builder → integration-designer |
| `ai.flowx.ai-platform.agent-node.job.progress.v1` | agent-builder → integration-designer |
| `ai.flowx.ai-platform.agent-node.job.cancel.v1` | integration-designer → agent-builder |
| `ai.flowx.ai-platform.agent-node.job.dlq.v1` | agent-builder → none (dead-letter topic) |

**Validation findings:**

| Topic | Producer → Consumer |
| - | - |
| `ai.flowx.application-version.validation-findings.request-admin.v1` | application-manager → admin |
| `ai.flowx.application-version.validation-findings.request-cms.v1` | application-manager → cms-core |
| `ai.flowx.application-version.validation-findings.request-document-plugin.v1` | application-manager → document-plugin |
| `ai.flowx.application-version.validation-findings.request-integration.v1` | application-manager → integration-designer |
| `ai.flowx.application-version.validation-findings.request-notification-plugin.v1` | application-manager → notification-plugin |
| `ai.flowx.application-version.validation-findings.request-application-manager.v1` | application-manager → application-manager |
| `ai.flowx.application-version.validation-findings.response.v1` | admin, cms-core, document-plugin, integration-designer, notification-plugin → application-manager |
| `ai.flowx.application-version.validation-findings.job-completed.v1` | application-manager → harness |

**Failed deployments retried:**

| Topic | Producer → Consumer |
| - | - |
| `ai.flowx.build.deployment-failed.v1` | runtime-manager → application-manager |

**Workflow schedules:**

| Topic | Producer → Consumer |
| - | - |
| `ai.flowx.build.workflow-schedules.updates.in.v1` | integration-designer → runtime-manager |
| `ai.flowx.core.notify.timer-event-schedule.state.v1` | scheduler-core → runtime-manager |

**Last-used workspace:**

| Topic | Producer → Consumer |
| - | - |
| `ai.flowx.designer-user.user-preferences.v1` | designer-user → designer-user |

### New services

The **ui-driver** service replaces **ai-render-host** in the AI dev-time group. It renders UI flows in the background for the Developer Agentic Harness and adds no new dependencies. On SaaS it is provisioned and managed by FlowX.

### AI service groups in the Helm chart

The `flowx-ai` Helm chart groups the services into four groups:

| Group flag | Services |
| - | - |
| `groups.core.enabled` | Core platform services |
| `groups.base.enabled` | The AI base: ai-gateway, doc-parser, embedder, knowledgebase-indexer-v2, knowledgebase-rag, and the bundled Qdrant |
| `groups.devtime.enabled` | ai-analyst, ai-architect, ai-assistant, ai-designer, ai-developer, harness, kb-enrichment, planner, ui-driver |
| `groups.runtime.enabled` | agent-builder, data-privacy, doc-converter, dynamic-classifier, evals-judge, speech-to-text, web-crawler. cee-pii is in this group but needs `services.cee-pii.enabled: true` as well |

The groups are the same as in 5.9.6. The 6.0.0 chart adds designer-user to `core`, harness and ui-driver to `devtime`, and cee-pii and dynamic-classifier to `runtime`. The `base` group is unchanged.

Set all four flags in your values, using one of these combinations:

| To install | `core` | `base` | `devtime` | `runtime` |
| - | - | - | - | - |
| Core services only | `true` | `false` | `false` | `false` |
| Core, base, and devtime services | `true` | `true` | `true` | `false` |
| Core, base, and runtime services | `true` | `true` | `false` | `true` |
| All services | `true` | `true` | `true` | `true` |

> [!WARNING]
>
> **Set every group flag explicitly for self-hosted upgrades.** Don't rely on the chart's group defaults. The `devtime` and `runtime` services call the AI base services, so turn `base` on whenever either of them is on. The chart doesn't check this for you.

### New databases and secrets

Compared with the `flowx-ai` Helm chart in 5.9.6, these services need new databases:

| Database user | Type | Service | Secret |
| - | - | - | - |
| `agent_builder` | PostgreSQL | agent-builder | `flowx-postgres-agent-builder` |
| `dynamic_classifier` | PostgreSQL | dynamic-classifier | `flowx-postgres-dynamic-classifier` |
| `harness` | PostgreSQL | harness | `flowx-postgres-harness` |
| `designer-user` | MongoDB | designer-user | `mongodb-designer-user-designer-user` |

Each database has the same name as its user. Each secret holds the user's password under the key `password`.

The webhook-gateway also connects to the existing `app-runtime` MongoDB database with the `app-runtime` user.

The `keycloak-flowx-realm-clients` secret needs four new keys, one for each new service account:

| Secret key | Keycloak client |
| - | - |
| `KEYCLOAK_DESIGNER_USER_CLIENT_SECRET` | `flowx-designer-user-sa` |
| `KEYCLOAK_AI_HARNESS_CLIENT_SECRET` | `flowx-ai-harness-sa` |
| `KEYCLOAK_NOTIFICATION_PLUGIN_CLIENT_SECRET` | `flowx-notification-plugin-sa` |
| `KEYCLOAK_DOCUMENT_PLUGIN_CLIENT_SECRET` | `flowx-document-plugin-sa` |

Other chart changes:

* **process-engine** needs read-only access (`s3:GetObject`) to the integration-designer bucket, to download the Kafka payloads that integration-designer stores there. The chart reads the access key ID from `global.flowx.s3.credentials.processEngine.accessKey` (default `flowx-process-engine-accesskey`) and the secret access key from the `flowx-process-engine-s3` secret, key `SecretAccessKey`.
* **dynamic-classifier** stores its data on a 20Gi `ReadWriteOnce` persistent volume claim, `dynamic-classifier-data`, and uses the `Recreate` deployment strategy, so an upgrade stops the old pod before the new one starts.
* **dynamic-classifier** reads an OpenAI API key for its LLM judge from the `dynamic-classifier-openai` secret, key `OPENAI_API_KEY`. The secret is optional: without it, the pod still starts and classification keeps working.
* The chart no longer creates an admin Ingress for doc-converter, data-privacy, speech-to-text, web-crawler, and dynamic-classifier. ai-gateway keeps its own.

### New service dependency: harness and Redis

The harness now uses Redis to stream a running turn to every open Designer session and to cancel a turn from any harness pod. It reuses the platform's existing Redis, so nothing new is provisioned. Without Redis, turns still run, but live progress and cancellation across pods don't work. On SaaS this connection is managed by FlowX.

### New service dependency: harness and Kafka

The harness now connects to Kafka and consumes the existing `ai.flowx.llm.config.changed.v1` topic, so a change to an organization's AI model settings reaches it right away. Without Kafka it picks up the change when its cache expires. No new topic is needed.

### Changed behavior: failed deployments retry from PostgreSQL

The queue of build deployments waiting for a retry moves from Redis to the application-manager PostgreSQL database, so a Redis flush no longer drops it. Runtime-manager reports a failed deployment on `ai.flowx.build.deployment-failed.v1` and application-manager stores and retries it. Self-hosted 5.9.6 already includes this change and the topic.

> [!WARNING]
>
> Upgrading from 5.9.5 or earlier? Deployments waiting for a retry in Redis when you upgrade aren't moved to the new queue. Re-publish those builds after the upgrade.

### Changed behavior: nosql-db-runner host restrictions cover MongoDB

The host restriction that relational data sources already had now applies to external MongoDB connections too. The nosql-db-runner checks every address a MongoDB host resolves to, including replica-set members and SRV targets, and rejects the connection if any of them is private. For FlowX Database and Unmanaged MongoDB data sources alike, it also rejects `UPDATE`, `UPDATE_MANY`, `DELETE`, and `DELETE_MANY` operations with a missing or empty filter. To match every document, pass `{"_id": {"$exists": true}}`.

| Environment Variable | Description | Default Value | Component |
| - | - | - | - |
| `FLOWX_SSRFALLOWEDHOSTS` | Hosts or CIDR blocks, separated by commas, that may connect even though they resolve to a private address. Addresses on the local machine or in a link-local range stay blocked | empty | nosql-db-runner |
| `FLOWX_SSRFPROTECTIONENABLED` | Turns the host restriction on or off | `true` | nosql-db-runner |

> [!WARNING]
>
> **Breaking change for self-hosted upgrades.** Unmanaged MongoDB data sources that point to a host on a private network stop connecting after the upgrade. Add those hosts to `FLOWX_SSRFALLOWEDHOSTS`.

### Changed behavior: name placeholders in data-privacy

When data-privacy masks a person's name, the placeholder now carries the gender, for example `<NAME_F_1>` or `<NAME_M_1>`. When the name doesn't show the gender, the placeholder stays `<NAME_1>`. Prompts or scripts that match the old placeholder form need updating.

### Changed behavior: Workspace operations editor role replaced

The upgrade replaces the Workspace operations editor role with the [Workspace corrective actions editor](https://docs.flowx.ai/6.x/setup-guides/access-management/roles-permissions-matrix.md#workspace-corrective-actions-editor-permission-matrix) role. Users and groups that had the old role get the new one automatically and keep access to process instance migration and move token. No action is needed.

### New environment variables: audit index retention

The Audit service can now delete old audit data and roll over by shard size. Both settings are off by default, so the Audit service doesn't delete data unless you set a retention period.

| Environment Variable | Description | Default Value | Component |
| - | - | - | - |
| `FLOWX_ELASTICSEARCH_INDEXRETENTIONDAYS` | Days after a backing index rolls over before it's deleted | Not set: indices are never deleted | audit-core |
| `FLOWX_ELASTICSEARCH_INDEXROLLOVERMAXPRIMARYSHARDSIZE` | Also roll over when a primary shard reaches this size, such as `50gb` | Not set: roll over by age only | audit-core |

> [!WARNING]
>
> When you first set `FLOWX_ELASTICSEARCH_INDEXRETENTIONDAYS`, the Audit service also deletes backing indices that rolled over more than that many days ago. See [Configuring Elasticsearch](https://docs.flowx.ai/6.x/setup-guides/audit-setup-guide.md#configuring-elasticsearch).

### Removed environment variables

| Environment Variable | Component | Notes |
| - | - | - |
| `MANAGEMENT_SECURITY_ENABLED` | advancing-controller | No longer read. Actuator endpoints on the management port, including Prometheus, don't require authentication. Keep the management port off public ingress |

> [!WARNING]
>
> Keep the advancing-controller management port, `8081`, off any public ingress. Its actuator endpoints, including Prometheus, answer without authentication.

### Changed default: IMAPS certificate verification in email-gateway

The email-gateway now verifies the certificate of every IMAPS server it connects to. A server must present a certificate signed by a trusted authority and matching its host name.

| Environment Variable | Description | Default Value | Component |
| - | - | - | - |
| `EMAILGATEWAY_IMAP_SSLTRUSTEDHOSTS` | Mail hosts that skip certificate verification, separated by spaces or commas. Use `*` to skip it for every host | empty | email-gateway |

> [!WARNING]
>
> **Breaking change for self-hosted upgrades.** Email triggers that read from an IMAP server with a self-signed, private-CA, or mismatched certificate stop connecting after the upgrade. Add the server's CA to the email-gateway trust store, or list the host in `EMAILGATEWAY_IMAP_SSLTRUSTEDHOSTS`.

### Changed default: AI node retry

AI nodes without retry settings of their own now retry when a dependency is temporarily unavailable, such as an LLM provider outage, a rate limit, or a lost connection. Permanent errors aren't retried, and deep research nodes never retry by default. A node's own retry settings replace the default.

| Environment Variable | Description | Default Value | Component |
| - | - | - | - |
| `FLOWX_WORKFLOW_AINODEDEFAULTRETRY_ENABLED` | Turns the default retry for AI nodes on or off | `true` | integration-designer |
| `FLOWX_WORKFLOW_AINODEDEFAULTRETRY_MAXATTEMPTS` | Maximum retry attempts | `10` | integration-designer |
| `FLOWX_WORKFLOW_AINODEDEFAULTRETRY_BACKOFFPERIOD` | Wait between attempts, as an ISO-8601 duration | `PT30S` | integration-designer |

> [!NOTE]
>
> For previous FlowX.AI releases, please refer to the [Release Notes overview](https://docs.flowx.ai/release-notes/overview.md).


## Related topics

- [FlowX.AI 6.0.0 Release Notes](https://docs.flowx.ai/release-notes/v6.x/v6.0.0-october-2026/v6.0.0-october-2026.md)
- [Helm chart](https://docs.flowx.ai/release-notes/v6.x/v6.0.0-october-2026/migrating-from-v5.9-to-v6.0/helm-chart.md)
- [iOS SDK](https://docs.flowx.ai/release-notes/v6.x/v6.0.0-october-2026/migrating-from-v5.9-to-v6.0/ios.md)
- [Overview](https://docs.flowx.ai/release-notes/v6.x/v6.0.0-october-2026/migrating-from-v5.9-to-v6.0/migration-overview.md)
- [Android SDK](https://docs.flowx.ai/release-notes/v6.x/v6.0.0-october-2026/migrating-from-v5.9-to-v6.0/android.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.