1. Prerequisites
Please install the following software on the machine that will be used to deploy VeridiumID:
-
Helm 3. Please check your installed version by running
helm version
2. Download docker images
The download links for the Docker images are provided in the VeridiumID_images.md file.
3. Change directory to the folder where veridium-containers folder is located
4. Download required files
wget --user <NEXUS_USER> --password <NEXUS_PASSWORD> https://veridium-repo.veridium-dev.com/repository/helm-releases/veridiumid-containers/3.9.1/veridiumid-saas-3.9.1.zip
unzip -o veridiumid-saas-3.9.1.zip -d 3.9.1
4.1. Check RBAC (only when the cluster administrators create the RBAC rules)
If you upgrade the charts with rbac.create=false and serviceAccount.create=false, Helm does not change the ServiceAccounts, Roles and RoleBindings. A new release can need new permissions, so check them before you upgrade:
NAMESPACE=<NAMESPACE> KUBECTL=oc CHART_DIR=./3.9.1/helm VALUES_DIR=veridiumid-containers \
./3.9.1/scripts/rbac-preflight.sh
Exit codes: 0 correct, 1 a permission or object is missing (MISSING lines), 3 the check did not complete (UNKNOWN lines).
Send the MISSING lines to the cluster administrators, then run the script again. Continue only when the result is OK.
5. Upgrade VeridiumID
The NAMESPACE, ENV_NO and VOLUME_CLASS variables should be set according to your existing installation.
Add the following in veridiumid-values.yaml:
global:
elasticSearchSecret: elasticsearch-<ENV_NO>-es-elastic-user
elasticSearchHost: elasticsearch-<ENV_NO>
vid-maintenance:
backup:
volumeStorageClassName: <VOLUME_CLASS>
vid-setupagent:
imagePullSecrets:
- name: vid-credentials-ecr
image:
repository: <DOCKER_REGISTRY_URL>/veridiumid/vid-setupagent
waitContainer:
image:
repository: <DOCKER_REGISTRY_URL>/veridiumid/vid-setupagent
resources:
requests:
cpu: 200m
memory: 256Mi
limits:
cpu: 500m
memory: 512Mi
Execute the following commands in order to assign the backup PVC to the veridiumid release:
kubectl label pvc efs-pvc-veridium-backups-<NAMESPACE> -n <NAMESPACE> "app.kubernetes.io/managed-by=Helm" --overwrite
kubectl annotate pvc efs-pvc-veridium-backups-<NAMESPACE> -n <NAMESPACE> "meta.helm.sh/release-name=veridiumid" --overwrite
kubectl annotate pvc efs-pvc-veridium-backups-<NAMESPACE> -n <NAMESPACE> "meta.helm.sh/release-namespace=<NAMESPACE>" --overwrite
helm upgrade --install -n <NAMESPACE> -f veridiumid-containers/veridiumid-values.yaml veridiumid ./3.9.1/helm/veridiumid-1.0.4.tgz --timeout 20m
5.1. Cassandra
helm upgrade --install -n <NAMESPACE> -f values/k8ssandra-values.yaml --timeout 60m k8ssandra-<ENV_NO> ./3.9.1/helm/vid-k8ssandra-1.0.4.tgz
5.2. Elasticsearch and Kibana
In elasticsearch-values.yaml, replace the image parameters with repository, and remove the tag. The chart adds the correct tag:
elasticsearch:
repository: <DOCKER_REGISTRY_URL>/dependencies/elasticsearch
kibana:
repository: <DOCKER_REGISTRY_URL>/dependencies/kibana
Then upgrade the chart:
helm upgrade --install -n <NAMESPACE> -f veridiumid-containers/elasticsearch-values.yaml elasticsearch-<ENV_NO> ./3.9.1/helm/elasticsearch-0.4.1.tgz
If a pod still runs the old image after the upgrade, delete it to force a recreate.
5.3. Zookeeper
helm upgrade --install -n <NAMESPACE> -f values/zookeeper-values.yaml zookeeper-<ENV_NO> ./3.9.1/helm/zookeeper-0.2.16.tgz
6. Post upgrade configuration
In the vid-maintenance pod, execute the following:
bash /scripts/migrate_to_elk.sh
7. Update API definitions
If the /api folder of the bundle holds dmz-api.3.9.json and websec-api.3.9.json, apply them. If the folder does not hold them, skip this step.