Skip to content

Upgrade to v1.75

v1.75 removes secrets layout v3, transition and sluis migrate secrets-layout. Run secrets.layout: v4 first; an installation on v3 or transition moves on v1.74.x (steps).

The Pulumi library

The first v1.75 apply adopts the v4 copies sluis migrate wrote at /sluis/<instance>/internal/config/issuer/state-secret and .../recovery/password. It deletes the private/config ones after the function is updated, and the roles lose their grants on private/*. Values stay.

Read the preview first: two parameters created, two deleted, no replacement.

Move to layout v5

Layout v5 splits storage by module (layout). Writes freeze 10 to 15 minutes.

Before you start:

  • Run v1.75 with the Pulumi library on Layout: "v4".
  • controllers.github.appRefs is optional.
  • Give no catalogue App the id link or runner-....

  • Keep the KMS key, alias and instance name.

  • Add the v5 tables and apply.

Layout: "v4+v5",

Expect 2 parameters created and role updates (layouts).

The plan refuses v5 parameters an older library wrote as plain values: apply this release first.

  1. Plan. Nothing may be refused.
sluis migrate v5 plan --from v4.yaml --to v5.yaml
  1. Copy live, dry run first.
sluis migrate v5 copy --skip issuer --dry-run --from v4.yaml --to v5.yaml
sluis migrate v5 copy --skip issuer --from v4.yaml --to v5.yaml
  1. Freeze the source; keep the issuer up and Lambda concurrency as is (how).
sluis maintenance on --reason "layout v5" --config v4.yaml
  1. Copy the changes and the issuer, then verify.
sluis migrate v5 copy --overwrite --from v4.yaml --to v5.yaml
sluis migrate v5 verify --from v4.yaml --to v5.yaml
  1. Rename a blob credential: internal/blobs/<name> is internal/google/blobs-<name> on v5. Set CredentialsRef to that: every process reads it there; copied ones stay. Then set the layout and apply (document).
Layout: "v5",
  1. Sign in, compare the kid set, and check.
curl -s https://login.example/keys | jq -r '.keys[].kid'
sluis check --config v5.yaml
sluis maintenance off --config v4.yaml

Roll back

  • Never start the v1.75 issuer on v5 before the copy; if it started, copy with --overwrite.
  • Within 7 days, a return to v4 loses v5's refresh rotations.
  • Run sluis maintenance off before restarting v4.

After 7 days

  1. Prune the v4 parameters. The dry run lists what goes and stays, with a plan hash, and refuses unless every v4 item is same on v5.
sluis migrate v5 prune --dry-run --from v4.yaml --to v5.yaml
sluis migrate v5 prune --confirm-plan <hash> --from v4.yaml --to v5.yaml

  1. Apply on Layout: v5. The 2 Pulumi-owned v4 parameters are deleted.

  2. Add RetireLegacyTable to Compat on StatesArgs and the function, and apply. The legacy table is exported for 30 days (legacyTableBackupArn) and unprotected.

  3. Remove Legacy from StatesArgs and apply. The table is deleted.

  4. aws ssm get-parameters-by-path --recursive on the v4 prefixes must list only the kept ones.