This article outlines the procedure for upgrading the Cequence Unified API Protection (UAP) platform to release 8.5.0 and rolling back if necessary. The 8.5.0 release includes an Elasticsearch upgrade from version 8.18.4 to 8.18.8.
Pre-upgrade checklist
Verify the following conditions before proceeding with the upgrade.
- Current system is on Cequence UAP platform release 8.3.0 or later.
- Defender is on release 5.9.0 or 5.9.1.
Upgrade procedure
Export configuration
Export all current configurations before starting the upgrade.
Upgrade UAP to 8.5.0
Run the Helm upgrade command to deploy release 8.5.0. Monitor the upgrade process as pods are recreated and monitor Elasticsearch cluster health during the upgrade. Verify that all components complete successfully.
The airflow-webserver pod sometimes enters CrashLoopBackOff status. If this occurs, delete the pod to allow it to restart automatically.
Post-upgrade verification
After the upgrade completes, verify the following.
- All pods are running properly.
- The Cequence UAP platform version has updated correctly.
- The Elasticsearch version is now 8.18.8.
- The Elasticsearch cluster health status is green.
- System logs contain no errors or warnings.
Monitoring period
Monitor system performance for several hours after the upgrade completes. Check for error logs or unusual behavior and verify that all components function correctly.
Observations after upgrade
The reporting feature enables you to generate reports that include Threat Protection metrics fetched from Transaction Counts. These counts are calculated by a scheduled workflow that runs at 12:15 AM UTC. Following an upgrade, this workflow does not trigger immediately, so any reports generated before its first scheduled post-upgrade run display Transaction Counts as 0. Transaction Count data is expected to reflect correctly within two days of upgrade completion.
Rollback procedure
If issues are detected during or after the upgrade, follow the steps in this section to roll back to release 8.3.5-ES8.
About release 8.3.5-ES8
Elasticsearch does not support direct downgrade paths between patch versions once data has been written in the newer format. This creates a challenge for rollback scenarios after upgrading to UAP 8.5.0, which uses Elasticsearch 8.18.8.
Release 8.3.5-ES8 is a dedicated rollback target with the following characteristics.
- Built on the stable 8.3.5 UAP release.
- Uses Elasticsearch 8.18.8 rather than the original 8.18.4.
- Maintains the same UAP functionality as release 8.3.5.
- Serves as the rollback target regardless of which 8.3.x release was running before the upgrade to 8.5.0.
Rolling back to 8.3.5-ES8 reverts UAP functionality to the 8.3.5 level while keeping Elasticsearch on version 8.18.8.
Downgrade to 8.3.5-ES8
Run the Helm upgrade command with the version specification set to 8.3.5-ES8. Monitor the downgrade process and verify that all components complete successfully. Elasticsearch remains on version 8.18.8 after the downgrade.
The airflow-webserver pod sometimes enters CrashLoopBackOff status. If this occurs, delete the pod to allow it to restart automatically.
Post-rollback verification
After the downgrade completes, verify the following.
- All pods are running properly.
- The Cequence UAP platform version has downgraded correctly to 8.3.5-ES8.
- Elasticsearch is on version 8.18.8 and functioning correctly.
- System logs contain no errors or warnings.
Import exported configuration
Import the configuration exported before starting the upgrade.