Upgrade to v1.77¶

Move a v1.76 installation to v1.77.0, on Lambda or Kubernetes. History is in the CHANGELOG.

Before you start¶

Run v1.76 on secrets layout v5 (v1.76 first if older).
Name the role that applies the stack in KeyAdmins or Breakglass before the first apply. The new key policy denies it the key's control plane otherwise.
Apply with a role that may change the archive bucket's lock configuration.

1. Update the Pulumi program¶

Each row is an argument the library now requires or refuses.

Argument	Action
`KeyPolicyOptions`, `RoleArgs.KeyPolicyStatements`, `LambdaArgs` with a created key	set `KeyAdmins` or `Breakglass`, role ARNs only
`LambdaArgs.Keys.Secrets` or `ParameterKeyArn`, `BackupCommon.ParameterKeyArn`	set the customer key every SecureString lives under
`Archive.BreakglassRoleArns`, `AuditArchiveArgs.BreakglassRoleArns`	set the roles that may bypass the lock; include the applying role
`ArchiveBucketArgs.Mode` with `Archive.Create`	set `GOVERNANCE` or `COMPLIANCE` with `AcknowledgeCompliance`
`Observe.TrustedPrincipalArn` from another account	set `Observe.ExternalID`
`auditpulumi.SealKeyPolicy`, `DigestKeyPolicy`	take the new `KeyAdmins` and return an error

2. Mirror the release signature¶

Release.ResolveChecksums verifies checksums.txt.sigstore.json before it trusts the digests. Copy that file beside checksums.txt in a mirror (deploy from a mirrored release).

3. Apply¶

Preview, then apply. The key policies change, so the applying role must already be an administrator.

pulumi preview --diff
pulumi up

4. Check the behaviour changes¶

Change	Who notices
`/logout` and `/end_session` ask before they sign anyone out	applications that redirect to them
`/revoke` ends only tokens the authenticated client was issued	clients that revoke another client's token
a repeated security parameter is refused with `invalid_request`	clients that repeat `scope` or `resource`
a Google sign-in needs `email_verified`; `google.oauthClient.hostedDomains` limits the domain	people with an unverified address
a client document that declares anything but `none` is refused	MCP clients that declare a secret
`sluisctl` refuses an `http://` issuer except on loopback	scripts that use a plain issuer

5. Kubernetes: move the dashboards and alerts¶

On Kubernetes, renders: dashboards renders grafana-operator objects and the AccessRoster... alerts are gone. Move every route, silence and inhibition to the Sluis... names, and install a dashboards and an alerts release (telemetry).

Verify¶

hack/release-verify.sh v1.77.0
sluisctl whoami
sluisctl backup status

Decided in: ADR 0071, ADR 0072.