Upgrading the PPC

Before you begin

Before starting an upgrade, ensure the following conditions are met:

• Access to the jump box associated with the PPC v1.0.0 cluster is required. This must be the same jump box used during the PPC v1.0.0 installation.

• Maintain both, previous and current installation directories. Do not delete the original cluster deployment directory, as it contains the Terraform state files required for managing the deployment.

• Create a Velero backup and an OpenSearch snapshot to ensure data recovery is possible, in case of an upgrade failure.

• Maintain a backup of the state file in the AWS S3 backup bucket.

• If logs are forwarded to an external SIEM, then from the PPC CLI, run the insight delete syslog or the insight delete fluentd as per your configuration. After the upgrade is complete, re-configure the SIEM. For more information about SIEM configuration, refer to Sending logs to a SIEM.

• The context is set to the cluster where the upgrade operation is to be performed. Run the following command.

  kubectl config current-context
  

  The cluster name in the output must match the cluster installed with PPC v1.0.0.

Note: Before running the bootstrap or resiliency scripts as the root user on RHEL, ensure that /usr/local/bin, and the AWS CLI binary path, if applicable, is included in the $PATH. Alternatively, run the script using a non-root user, such as ec2-user where /usr/local/bin is already part of the default $PATH.

Upgrading PPC

To upgrade the PPC from v1.0.0 to v1.1.0, perform the following steps:

1. Create a deployment_110 directory on the jump box and navigate to it.

   mkdir deployment_110 && cd deployment_110
   

2. Log in to the My.Protegrity portal.

3. Navigate to Product Management > Explore Products > AI Team Edition > Platform & Features.

4. Navigate to Platform Installation.

5. From the Actions column for Protegrity Provisioned Cluster, click the Download Product icon and download the PPC 1.1 archive to the deployment_110 directory.

6. Extract the archive contents.

   tar -xvf PPC-K8S-ALL_1.1.0.97.tar
   

7. Copy the Terraform state file from the v1.0.0 cluster installation to the deployment_110 directory created for upgrade.

   cp /<v1.0.0-cluster-dir>/deployment/iac_setup/scripts/iac/terraform.tfstate /<v1.1.0-cluster-dir>/deployment_110/terraform.tfstate
   

   where <v1.0-cluster-dir> is the path to the original PPC v1.0.0 cluster installation directory on the jump box, and <v1.1.0-cluster-dir> is the path to the new directory created for upgrade.

8. Verify the active context points to the correct cluster using the following command.

    kubectl config current-context
   

9. Initiate the upgrade from the deployment_110 directory using the following command.

   bash upgrade.sh --cloud aws --v1.0-state-file /<v1.1.0-cluster-dir>/deployment_110/terraform.tfstate
   

   where /<v1.1.0-cluster-dir>/deployment/terraform.tfstate is the path to the Terraform state file copied in Step 6.

   After the upgrade is successful, a PPC upgrade completed successfully. message is displayed.

The cluster upgrade process can take 10–15 minutes approximately and may differ accordingly.

Post Upgrade Steps

Verify all nodes are Ready

To verify if all nodes are in the ready state, run the following command.

kubectl get nodes -o wide

Verify all pods are Running

To verify if all pods are in the running state, run the following command.

kubectl get pods -A

Verify Helm releases

To verify if the helm releases are in the deployed state, run the following command.

helm list -A

Password Policy After Upgrade

PPC v1.1.0 upgrade enforces the following behavior.

• If the minimum password length was set to a value less than 14 characters, or was not configured, the upgrade sets it to 14 characters.

• If the minimum password length was already set to 14 characters or greater, that value is preserved and remains unchanged after the upgrade.

For more information about the password policy, refer to Password Policy APIs or CLI reference for get password_policy.

Configuring SIEM

If logs were forwarded to an external SIEM before the upgrade, then SIEM log forwarding was disabled as part of the pre-upgrade prerequisites. After completing the upgrade, update the settings to resume sending logs to the external SIEM.

For more information about configuring SIEM, refer to Sending logs to an external security information and event management (SIEM).

Directory Maintenance after Upgrade

During upgrade, both the previous and the new PPC installation directories must be retained.

• The original directory contains Terraform state and deployment metadata.
• The new directory contains the updated configuration and binaries.

Both directories are required for proper management of the deployment.

Recovering from a Failed Upgrade

If the session is terminated during upgrade due to network issues, power outage, or any such issues, then the upgrade process stops. The ./upgrade.sh script resumes the upgrade.

To restart the process, run the following command:

   bash upgrade.sh --cloud aws --v1.0-state-file /<v1.1.0-cluster-dir>/deployment_110/terraform.tfstate

Warning: Do not install or manage multiple clusters from the same working directory. Each cluster deployment maintains its own Terraform or OpenTofu state, and reusing a directory can overwrite state files, causing loss of cluster tracking and unintended cleanup behavior.
Use a dedicated directory, and jump box, where possible, per cluster, and always verify the active kubectl context before running cleanup commands such as ./bootstrap.sh --cloud aws destroy.
To check the active kubectl context, run the following command:
kubectl config current-context

Reverting to a previous version of PPC

To revert to a previous version of PPC, restore the cluster using the steps in Restoring the PPC.