Cequence UAP platform 8.3.x to 8.5.x upgrade and rollback

This article outlines the procedure for upgrading the Cequence Unified API Protection (UAP) platform to release 8.5.0 and rolling back if necessary. The 8.5.0 release includes an Elasticsearch upgrade from version 8.18.4 to 8.18.8.

Pre-upgrade checklist

Verify the following conditions before proceeding with the upgrade.

Current system is on Cequence UAP platform release 8.3.0 or later.
Defender is on release 5.9.0 or 5.9.1.

Upgrade procedure

Export configuration

Export all current configurations before starting the upgrade.

Upgrade UAP to 8.5.0

Run the Helm upgrade command to deploy release 8.5.0. Monitor the upgrade process as pods are recreated and monitor Elasticsearch cluster health during the upgrade. Verify that all components complete successfully.

The airflow-webserver pod sometimes enters CrashLoopBackOff status. If this occurs, delete the pod to allow it to restart automatically.

Post-upgrade verification

After the upgrade completes, verify the following.

All pods are running properly.
The Cequence UAP platform version has updated correctly.
The Elasticsearch version is now 8.18.8.
The Elasticsearch cluster health status is green.
System logs contain no errors or warnings.

Monitoring period

Monitor system performance for several hours after the upgrade completes. Check for error logs or unusual behavior and verify that all components function correctly.

Observations after upgrade

The reporting feature enables you to generate reports that include Threat Protection metrics fetched from Transaction Counts. These counts are calculated by a scheduled workflow that runs at 12:15 AM UTC. Following an upgrade, this workflow does not trigger immediately, so any reports generated before its first scheduled post-upgrade run display Transaction Counts as 0. Transaction Count data is expected to reflect correctly within two days of upgrade completion.

Rollback procedure

If issues are detected during or after the upgrade, follow the steps in this section to roll back to release 8.3.5-ES8.

About release 8.3.5-ES8

Elasticsearch does not support direct downgrade paths between patch versions once data has been written in the newer format. This creates a challenge for rollback scenarios after upgrading to UAP 8.5.0, which uses Elasticsearch 8.18.8.

Release 8.3.5-ES8 is a dedicated rollback target with the following characteristics.

Built on the stable 8.3.5 UAP release.
Uses Elasticsearch 8.18.8 rather than the original 8.18.4.
Maintains the same UAP functionality as release 8.3.5.
Serves as the rollback target regardless of which 8.3.x release was running before the upgrade to 8.5.0.

Rolling back to 8.3.5-ES8 reverts UAP functionality to the 8.3.5 level while keeping Elasticsearch on version 8.18.8.

Downgrade to 8.3.5-ES8

Run the Helm upgrade command with the version specification set to 8.3.5-ES8. Monitor the downgrade process and verify that all components complete successfully. Elasticsearch remains on version 8.18.8 after the downgrade.