Skip to main content
Version: v3.9.3

Upgrading to v3.9.3

Platform train v3.9.3 supports an in-place upgrade from v3.9.2, v3.9.1, v3.9.0, and v3.8.0. You keep the same Controller database. Startup adds the microservice supplemental groups column on sqlite, mysql, and postgres.

From v3.9.2 this release is a tag bump plus that column. No Control Plane YAML key was removed. container.supplementalGroups is optional. Existing microservices keep an empty group list until you set it.

From v3.9.1 or v3.9.0 you use the same v3.9.3 tags. If the external issuer uses a private CA, set auth.issuerCa before you roll the operator. A public CA needs no new field. On Kubernetes, rewrite a Helm values file from chart 3.9.1 to the flat keys before helm upgrade. Chart 3.9.2 values stay valid. See Kubernetes with Helm.

From v3.8.0 you use the same tags, and you also apply the v3.9 registry and catalog changes below.

If a NATS leaf relied on an implicit allow for $MQTT.>, add an explicit MQTT permission before you roll image 2.15.2.

Not supported: v3.7 or older → v3.9.3

There is no direct upgrade from v3.7.x, v1.6.x, or legacy Java Agent deployments to v3.9.3. Move to v3.8.0 first with a greenfield Control Plane and Edgelet-only nodes. See Migrating to v3.8.0 and the Documentation archive.

Before you start​

  1. Read What's New.
  2. Export or commit your control plane YAML, Agent manifests, and application YAML.
  3. Plan a maintenance window. Upgrade the control plane first, then fleet Edgelet nodes.
  4. Air-gapped sites: stage wrapper images before you bump tags. See Airgap deployment and Offline images.
  5. If leafnode ACLs depended on an implicit $MQTT.> allow, add an explicit MQTT permission first.

Default pins are on Control plane.

Componentv3.9.3 pin
iofogctlv3.9.3
Controllerimage 3.9.3
Operator (Kubernetes)image 3.9.3 (Helm chart 3.9.3)
Routerimage 3.9.3
NATSimage 2.15.2 (embedded NATS Server 2.15.2)
Edgeletv1.1.3 (image 1.1.3)
EdgeOps Consolev1.1.2, embedded in the Controller image
Go SDKv3.9.3

Container image tags omit the v prefix. The CLI binary and the Edgelet binary keep the v.

Supported upgrade path​

You are onAction
v3.9.2Tag bump below. Skip the v3.8 workload review.
v3.9.1 or v3.9.0Same tag bump. Set auth.issuerCa only when the issuer uses a private CA. Rewrite Helm values if they still use chart 3.9.1.
v3.8.0Same tag bump, then the v3.8 review.
v3.7.x or olderGreenfield to v3.8.0 first. See Migrating to v3.8.0.
New installDeploy v3.9.3 directly. See Getting started or Platform deployment.

Keep Controller, Operator (Kubernetes), Router, NATS, system Edgelet on Controller hosts, fleet Edgelet nodes, and iofogctl on v3.9.3.

  1. Upgrade iofogctl on your workstation to v3.9.3.
  2. Bump image tags and the Edgelet pin in control plane YAML (Controller, Router, NATS, spec.systemAgent). Use the table above. Replace a NATS tag of 2.15.1-1 with 2.15.2.
  3. Re-apply control plane YAML:
iofogctl deploy -f controlplane.yaml

On Kubernetes, upgrade the operator or Helm chart to 3.9.3, then apply the updated KubernetesControlPlane manifest. A Helm values file from chart 3.9.1 will not apply. Rewrite it to the flat keys in Kubernetes with Helm first. If you want the old chart's private NATS Service, set services.nats.type: ClusterIP in the new file.

If external OIDC uses a private CA, set auth.issuerCa in that manifest or values file in this step.

  1. Upgrade fleet Edgelet nodes to v1.1.3 after the control plane is healthy. See Upgrade and rollback Edgelet.
sudo sh /usr/share/edgelet/install.sh --upgrade --version=v1.1.3

That host upgrade stays on the CLI flavor's Edgelet repository. Controller hosts pick up the system Edgelet pin in step 3.

  1. If you started on v3.8.0, do the review in the next section. If you started on v3.9.2, v3.9.1, or v3.9.0, skip it.

container.supplementalGroups is optional on every path. Leave the key out and the stored list stays empty for services that never set it. Set [] when you want a later apply to clear a list you already stored. A changed list recreates that container. See Supplemental groups.

If you are on v3.8.0​

v3.9 removed registry fields requiresCert, certificate, and isSecure. Use type (oci or hf), optional ca, and insecure.

Agent YAML no longer has deviceScanFrequency, bluetoothEnabled, or abstractedHardwareEnabled. Use edgeGuardFrequency when you need attestation.

Deploy Model and Knowledge catalog rows before you bind them in microservices. New spec.container fields, including supplementalGroups, are optional.

Details: What's New, Registries, Microservices.

Verify​

iofogctl describe controlplane
iofogctl describe controller CONTROLLER_NAME
iofogctl get agents

The console Overview shows control plane status. The API tab loads Scalar for the Controller API. Microservice describe includes container.supplementalGroups, including an empty list.

Rollback​

Redeploy the previous control plane tags and Edgelet pin, then downgrade fleet nodes with upgrade agent aimed at the prior Edgelet version. From v3.9.3 that prior pin is v1.1.2 if you came from v3.9.2, v1.1.1 if you came from v3.9.1, v1.1.0 if you came from v3.9.0, or v1.0.0 if you came from v3.8.0. Test rollback in a lab ECN before you change production.

Group 3See anything wrong with the document? Help us improve it!

Edit this page on GitHub!