Upgrading Connectware from 1.x to 1.5.0 (Kubernetes)
This Cybus Kubernetes guide provides a detailed procedure to help admins adjust the persistent volume content permissions to ensure a smooth upgrade to Connectware 1.5.0 in Kubernetes environments.
Disclaimer
Some Connectware upgrades require you to follow a few additional steps when upgrading Connectware to a newer version.
When upgrading your Connectware instance, follow the required upgrade path based on your current version:
If you are running Connectware version 1.4.1 or below:
First upgrade to version 1.5.0
Then upgrade to version 1.7.0
Finally upgrade to version 2.0.0
If you are running Connectware version between 1.5.0 and 1.6.2:
First upgrade to version 1.7.0
Then upgrade to version 2.0.0
If you are running Connectware version 1.7.0 or later:
You can directly upgrade to version 2.0.0
For detailed instructions on each upgrade step, refer to:
Prerequisites
Connectware version 1.3.0 or higher is installed on Kubernetes
Administrative rights to run privileged workloads in your Kubernetes cluster
kubectl
configured with access to the target installationHelm version 3 installed on your system
Cybus Helm repository added for access to:
Connectware Helm chart
connectware
in version1.5.0
.Connectware Agent Helm chart
connectware-agent
in version1.1.0
.
Access to the values.yaml file specific to your installation
Knowledge of the name and namespace of your Connectware installation
Overview of the Upgrade
Before you begin the upgrade process, ensure that you have made the necessary preparations and that all relevant stakeholders are involved.
The following steps give you an overview of what you need to do. See below for detailed step-by-step instructions.
Create the YAML snippets: Create YAML snippets for each PersistentVolumeClaim used by Connectware. This step is essential for identifying the volumes that need permission adjustments.
Filter volumes: Carefully review the created snippets to ensure that only related volumes are included. This is critical to avoid unnecessary modifications and potential disruptions.
Update the Kubernetes job file: Integrate the snippets into the kubernetes-job.yml file as described.
Shutdown Connectware: Securely shut down all Connectware and agent pods to prevent any access conflicts during the permissions update. This step is crucial to ensure that the permissions changes are applied without interference.
Run the Kubernetes job: Run the job to adjust permissions on all relevant volumes. This action addresses the core challenge posed by the upgrade and ensures that the new, non-root containers can access the files they need.
Delete Kubernetes services: Remove all services used by Connectware in preparation for the new version. This step is necessary to accommodate updates that are incompatible with the existing service configurations.
Apply Helm upgrade: Proceed with the Helm upgrade to Connectware version 1.5.0. This step completes the upgrade process and implements the new security measures and permissions model.
Important Notes
Permissions on NFS-based storage: NFS-based storage, such as EKS, may not allow permission changes directly through Kubernetes. For such storages, adjust permissions directly on the storage device if needed. This ensures that the required volumes are accessible to the new container users. The permissions are as follows:
For all volumes besides postgresql set ownership to
1000:0
and permissions to770
.For postgresql set ownership to
70:0
and permissions to770
.
Downtime for Connectware services: This process involves downtime for Connectware services. Schedule the upgrade accordingly to minimize the impact on your operations.
Deleting Kubernetes services: Deleting Kubernetes services before the upgrade is critical. This is necessary in order to update our existing headless services to ClusterIP services. Transitioning to ClusterIP services enables port translation, allowing you to continue to connect to the pre-upgrade service ports (80,443) while also being able to connect to the new service ports (8080, 8443). This ensures uninterrupted service access and compatibility after the upgrade.
Upgrading Procedure
Here are the complete instructions for upgrading your Connectware installation to version 1.5.0.
Functionality of Provided Files
create-pvc-yaml.sh
This script is designed to automatically generate Kubernetes resource lists, specifically volumeMounts
and volumes
, for Connectware deployments on Kubernetes. It simplifies the preparation process for upgrading Connectware by:
Identifying PersistentVolumeClaims (PVCs) used by Connectware and optionally by external agents.
Creating the YAML snippets required for mounting these volumes into the Kubernetes job designed to fix permissions.
Allowing customization through parameters such as
--kubeconfig
,--context
,--namespace
, to specify the Kubernetes cluster and namespace.Providing options to exclude volumes related to Connectware or external agents, if necessary.
The script outputs sections that can be directly copied and pasted into the kubernetes-job.yml
file, ensuring that the correct volumes are mounted with the appropriate permissions for the upgrade process.
kubernetes-job.yml
This YAML file defines a Kubernetes job responsible for adjusting the permissions of the volumes identified by the create-pvc-yaml.sh
script. The job is tailored to run with root privileges, enabling it to modify ownership and permissions of files and directories within PVCs that are otherwise inaccessible due to the permission changes introduced in Connectware 1.5.0.
The job’s purpose is to ensure that all persistent volumes used by Connectware are accessible by the new, non-root container user, addressing the core upgrade challenge without compromising on security by avoiding the use of root containers in the Connectware deployment itself.
Last updated
Was this helpful?