Skip to Content
RigFabTech docs
Operate

Upgrade

Upgrade the base chart and each product with Helm, using the same values files you installed with. The base chart and each product release on their own, so check that they fit before you upgrade.

How versions fit together

What a product asks of the base chart, such as its sign-in client, generated secrets and bucket, is numbered as a platform level. It's a whole number that goes up by one only when products can ask the base for something new.

  • Each product release needs one platform level: the highest of the features it uses.
  • Each base chart release serves a range of levels, such as 1 to 3.
  • A product runs on a base chart that serves its level.

rft check --base and the release notes name both. The release notes also say when a release is required or changes the database.

Before you begin

  • Back up each product's database, with CloudNativePG's Backup. A product migrates its database when its new version starts, and a migration marked contract can't be rolled back.
  • Have the site.yaml and product values files you installed with. If one is lost, see Keep your values files.

Check site.yaml

After you change site.yaml, check it with the base chart before you upgrade anything. Only the base chart refuses a name under global.rigfab it doesn't know.

rft check --chart oci://registry.rigfab.com/rft/apps/rft-base/charts/rft-base --version <VERSION> --values site.yaml

Check the base chart against your products

Before you upgrade the base chart, check that it supports every installed product:

rft check --base <VERSION>

It reads from the registry which platform levels the new base chart serves. It fails each installed product whose level it doesn't serve.

Upgrade in the right order

  • A product needs a newer platform level: upgrade the base first, to a release that serves that level. Then upgrade the product.
  • The new base no longer serves a product's level: upgrade the product first, to a release whose level both bases serve. A base stops serving a level only after products have had releases that don't need it.

Upgrade the base chart:

helm upgrade rft-base oci://registry.rigfab.com/rft/apps/rft-base/charts/rft-base --version <VERSION> --namespace rft-system -f site.yaml --wait --timeout 15m

Upgrade each product:

helm upgrade <PRODUCT> oci://registry.rigfab.com/rft/apps/<PRODUCT>/charts/<PRODUCT> --version <VERSION> --namespace rft-app-<PRODUCT> -f site.yaml -f <PRODUCT>.yaml --wait --timeout 15m

Always pass your files with -f, and never use --reuse-values. With it, Helm renders the new chart with the old chart's defaults, so a default the new release changes is never applied. See Helm's upgrade reference.

If the installed base doesn't serve a product's level, the product shows as not ready, with reason ContractUnsupported, in kubectl get platformapps --all-namespaces. The reason's message names the level and which one to upgrade. The base leaves the product alone until the two fit.

Upgrade rft

Run the install command again.

From rft-base 0.1 to 0.2

rft-base 0.2 removes Keycloak: people sign in with your own identity provider.

Products can't sign anyone in between the upgrade and step 3, so do steps 1 and 2 first.

  1. Register a client for each product at your provider and keep it in a Secret in the product's namespace, as Sign-in says. The product's redirect URI is https://<product>.<domain>/auth/callback.

  2. In site.yaml, add signIn.issuer, and signIn.existingSecret for the products. Remove the old signIn.identityProvider, signIn.realm, signIn.breakGlass, keycloak and networkPolicy.keycloakFrom.

  3. Upgrade rft-base, then each product to a version that requires rft-base 0.2.

  4. Delete what 0.1 left behind, which Helm doesn't delete:

    kubectl --namespace rft-system delete secret keycloak-bootstrap rft-controller-keycloak rft-break-glass

  5. Delete the sso.<domain> DNS record.

  6. At your provider, delete the redirect URI https://sso.<domain>/realms/rft/broker/corporate/endpoint, or the whole app registration Keycloak used.

Next steps