Upgrade to v1.63¶

Move from v1.62 to v1.63: one process and one service document. History is in the CHANGELOG.

Before you start¶

Run v1.62 (v1.62 first if older). Apply binary and library 1.63 together.
Admit the one role in the policy before the function runs, or controller passes are refused.
On Lambda the default FunctionName (sluis) replaces the function, role, policy and log group, and the old log events go. FunctionName: "<prefix>-http" keeps them.
A function that sets SLUIS_ROLE does not start.
Read the preview: the controller resources are destroyed. Delete nothing by hand.

1. Admit the one role in the policy and the audit installation¶

Ship this first. On Lambda the aws matcher names <FunctionName>. On Kubernetes, exchange and the audit installation's workloadIdentity admit system:serviceaccount:<ns>:<release>. To roll back, revert it.

2. Merge the documents into one v3 document¶

Keep the serve keys at the top. Move each controller's consoleURL, console.auth.aws.audience, tokenFile, recordsDir, appsDir or credentialsDir, and interval under controllers.github or controllers.slack. Drop the controllers' copies of ports, adapters, audit, secrets, policy, log and probes. An absent controller is off.

apiVersion: sluis.truvity.github.io/sluis/v3   # was the serve document, v2
issuerURL: https://access.example
publicURL: https://access.example/console
policy: {file: /etc/sluis/policy.yaml}
secrets: {source: ssm, root: /sluis/example}
ports: {adapter: dynamodb, dynamodb: {table: sluis}}
audit: {tokenFile: /var/run/audit/token}
controllers:
  github: {consoleURL: "http://sluis.access.svc:8080/console", interval: 15m}
  slack: {consoleURL: "http://sluis.access.svc:8080/console"}

Check sluis serve --config <file> reaches ready. To roll back, restore the v2 documents.

3. Lambda: change the Pulumi arguments and apply¶

Change	Detail
`Config`	the one v3 document
removed	`GitHubConfig`, `SlackConfig`, `HTTP`, `GitHub`, `Slack`, `Exports.Function`
`Function`	`MemoryMB` 512 and `TimeoutSeconds` 300 by default
outputs	`FunctionArn`, `FunctionName`, `RoleArn`, `RoleName` replace the `HTTP\\|GitHub\\|Slack` outputs
events	API Gateway, `{"kind":"tick"\\|"run","target":"<id>"}`, `{"kind":"refresh"}`, `{"kind":"exports"}`

The one role <FunctionName> holds the HTTP policy plus the controllers' needs. Check aws lambda list-functions shows one function and a tick invoke returns "outcome":"ran". To roll back, apply the v1.62 library and zip.

4. EKS identity: one role for the one pod¶

Change	Detail
args	`ServiceAccount` (required), `Description`; `Serve`, `GitHub`, `Slack`, `ProcessArgs` removed
role	`<prefix>-sluis`, one Pod Identity association
outputs	`RoleArn`, `RoleName`
policy	the serve policy, plus the SSM grants under `/sluis/<instance>/` when `Instance`, `Region` and `ParameterKeyArn` are set

Apply in a quiet window: Pulumi replaces the serve role and destroys the controller roles. To roll back, apply the v1.62 library.

5. Kubernetes: helm upgrade to one Deployment¶

Move each controller's values as below and delete controllerGithub and controllerSlack: the render refuses them. Run helm upgrade.

Value	Replacement
`controller{Github,Slack}.enabled`, `.config`	`config.controllers.github`, `config.controllers.slack`
`controller{Github,Slack}.config.{policy,release,log,ports,platform,preset,adapters,audit,probes}`	the service document's own keys
`controller{Github,Slack}.{replicas,strategy,minReadySeconds,podDisruptionBudget,resources}`	`replicaCount`, `strategy`, `minReadySeconds`, `podDisruptionBudget`, `resources`

The upgrade deletes the controllers' Deployments, ServiceAccounts, ConfigMaps and PodDisruptionBudgets. The render refuses a controller without exchange.clusters, console.mount or the console Service as consoleURL, and replicas above 1 without config.ports.adapter: dynamodb.

Check kubectl get deploy shows one Deployment and /readyz is ready. To roll back, run helm rollback.

Clean up¶

Point dashboards and alerts at the one process's service name. Next: v1.64.

Decided in¶

ADR 0037.