Upgrade to v1.77.3

Move a v1.77.2 installation to v1.77.3. History is in the CHANGELOG.

Before you start

• Run v1.77.2 (v1.77.2 first if older).
• Find secureCookies: false in every document of an https issuer.

1. Remove secureCookies: false when serving https

 issuerURL: https://issuer.example.com
-secureCookies: false

Document	v1.77.3
issuerURL or publicRootURL https, secureCookies: false	refused at load: secureCookies: false is refused when issuerURL is https
an installation document with issuer.secureCookies: false and an https URL	refused at render
https, secureCookies unset or true	unchanged
plain http with allowInsecure, secureCookies: false	unchanged

The chart already refused the value beside route.host (configuration).

2. Check the documents

sluisctl render --installation installation.yaml --out rendered/
pulumi preview --diff

Both fail while the value is there. In a cluster, sluis check --config <file> loads the service document the same way.

3. Audit: an archive bucket the estate owns

bucket, err := auditpulumi.NewArchiveBucket(ctx, "archive", &auditpulumi.ArchiveBucketArgs{BucketName: name, KeyArn: key, Profiles: profiles})

audit/deploy/pulumi gains NewArchiveBucket, which is additive (AWS Pulumi library).

4. Roll

hack/release-verify.sh v1.77.3

Roll the service and the modules together.

Verify

Sign in to the console. The session cookies carry the Secure flag.

Roll back

Roll back to v1.77.2 with the same documents.