v1.25 → v1.27 upgrader preserves legacy ClickHouse port semantics and breaks migration hook

Describe the issue

Upgrading an existing self-hosted installation from v1.25.0 to v1.27.0 can preserve the old ClickHouse port values with their former semantic names and make the databases-migrate pre-upgrade hook fail.

The shipped values changed between the two tags:

# v1.25.0
clickhouse:
  service:
    webPort: 9000
    dataPort: 8123

# v1.27.0
clickhouse:
  service:
    webPort: 8123
    dataPort: 9000

The v1.27 upgrader overlays every scalar from the old vars.yaml onto the new defaults. It therefore restores dataPort: 8123 and webPort: 9000. The v1.27 migration Job correctly uses dataPort for clickhouse-client, so it connects the native client to the HTTP port and fails with:

Code: 102. DB::NetException: Unexpected packet from server
Clickhouse server version ... is not within the allowed range

The atomic Helm upgrade then rolls back the application release.

Reproduction

1. Install v1.25.0 with its default vars.yaml ClickHouse ports.
2. Run the documented release upgrade pinned to v1.27.0.
3. Inspect the merged /var/lib/openreplay/vars.yaml and the databases-migrate Job.
4. Observe that the old scalar values override the corrected v1.27 semantics and that clickhouse-client is invoked on port 8123.

Changing only both ClickHouse port mappings in clickhouse.service and global.clickhouse.service to dataPort: 9000, webPort: 8123, then rerunning the exact upgrade succeeded in the affected installation.

Expected behavior

The upgrader should migrate configuration whose meaning changed between releases instead of treating every old scalar as an immutable user preference. At minimum it should detect the known legacy pair and stop with an actionable preflight message before Helm starts.

Proposed fix

1. Add a versioned config migration before the generic old-values overlay: when upgrading from a version with the legacy port semantics and the pair is webPort=9000,dataPort=8123, rewrite both local and global mappings to webPort=8123,dataPort=9000.
2. Validate that dataPort speaks the ClickHouse native protocol and webPort speaks HTTP before installing the migration Job.
3. Add an upgrade integration test that starts with the v1.25 vars.yaml, runs the real merge, renders the Job and executes its version check.
4. Keep an explicit escape hatch for genuinely customized ports, but require users to label which protocol each custom port serves.

Relevant sources

• v1.25.0 vars.yaml
• v1.27.0 vars.yaml
• generic old-value overlay
• migration Job native/HTTP port wiring

Environment

• From: OpenReplay v1.25.0
• To: OpenReplay v1.27.0
• Kubernetes: k3s v1.31.5, single node
• Existing databases release retained during the application upgrade