Upgrade to v1.64¶
Move from v1.63 to v1.64. Only the preset change is required. History is in the CHANGELOG.
Before you start¶
-
Run v1.63 (v1.62 and v1.63 first if older). Documents mode needs
sluisctlof this version and an installation document. -
Read the preview before every apply.
| Change | Action |
|---|---|
presets server, k8s-minimal, k8s-openbao fail naming the missing adapters (adapters) |
name k8s-aws, or list every adapter |
aws-eks logs a warning |
rename to k8s-aws |
values mode (config, policy, exchange.clusters, exchange.aws, githubApps.catalogue, slackApps; Lambda Config, Policy, PolicyPath) works for one minor |
move to documents mode |
KMS signing renders no signing Certificate and refuses signingKey.additional and existingSecret |
set config.signingKey.file: null |
signingKey.verifyOnly keys are public only and need until |
rotate any private key that reached a ConfigMap |
the $id of sluis.schema.json says v3 |
follow it in tools that pin it |
Freeze before moving secrets to OpenBao or signing to KMS (cutover). Deleting keys follows v1.62 step 6.
1. Replace a refused preset¶
Apply the table above. Check sluis serve --config <file> reaches ready. k8s-aws with adapters.secrets: openbao needs no platform.openbao. To roll back, restore the document.
2. Upgrade the binary, chart and library¶
Run helm upgrade to the v1.64 chart and bump the Pulumi library. Check /readyz is ready and sign-in works. To roll back, run helm rollback and use the previous library.
3. Optional: render the documents¶
sluisctl render --installation installation.yaml --out rendered/
sluisctl render --installation installation.yaml --out rendered/ --check
This writes sluis.yaml (v3) and policy.yaml (v2). --check exits 1 on a difference: run it in CI. Never edit rendered documents. See sluisctl and the installation document.
4. Optional: pass the documents to the chart¶
Set documents.service and documents.policy to the rendered files and remove the values-mode keys. Check helm template ... | diff against the committed documents is empty. To roll back, restore the values.
5. Optional: Pulumi LambdaArgs.Installation¶
Replace Config, Policy and PolicyPath with LambdaArgs.Installation, rendered by github.com/truvity/sluis/config. The library fills the instance, region, account and function name when omitted. Check the deprecation warning is gone.
6. Optional: OpenBao Secrets adapter, verify-only keys¶
Set adapters.secrets: {adapter: openbao} with address (https only), caFile, mount, namespace, root and auth{method, mount, role, tokenFile}, and give the login its policy (adapter). Move existing credentials with sluis migrate (migrate state). A cas_required mount is refused. To roll back, point adapters.secrets at the previous adapter.
For a cutover to kmsWrapped, list the old public keys under signingKey.verifyOnly[] (kid and alg optional). Removing an entry stops its tokens verifying.
Clean up¶
Remove values mode before the next minor. With kms-wrapped signing, an unset maxAgeSeconds for signingKeyRotationStalled is rotateEvery plus two hours.