This article describes how to upgrade an on-premises installation of Cequence App and API Protection (AAP) to release 9.4.x, and how to roll back the upgrade. The article is for administrators who manage AAP on Kubernetes using Helm. Cequence upgrades SaaS environments, so SaaS customers do not need to follow these procedures.

Before you upgrade, read the article about what changes when you upgrade to release 9.4.x. AAP release 9.4.x requires Cequence Defender release 6.5.0 or later. Upgrade Defender before you upgrade AAP, or together with the AAP upgrade.

Upgrade paths

The upgrade steps depend on the AAP release that you run now. Release 9.4.x uses Strimzi release 1.2.0. Release 9.3.x already uses Strimzi release 1.2.0, but release 9.2.x uses Strimzi release 0.51.0. For this reason, an upgrade from release 9.2.x has extra steps.

Upgrading from release 9.3.x

An upgrade from release 9.3.x does not need extra steps. Upgrade the cequence-asp Helm release to release 9.4.0 using your usual Helm upgrade procedure.

Rolling back to release 9.3.x

A rollback to release 9.3.x does not need extra steps. Downgrade the cequence-asp Helm release to the 9.3.x release that you ran before the upgrade, using your usual Helm upgrade procedure.

Upgrading from release 9.2.x

An upgrade from release 9.2.x has the following stages. Complete the stages in order.

1. Convert the Strimzi resources to the v1 API.
2. Update the Strimzi custom resource definitions (CRDs) and the Strimzi operator to release 1.2.0.
3. Upgrade AAP to release 9.4.0.

Before you upgrade from release 9.2.x

You have helm and kubectl access to the Kubernetes cluster that runs AAP.

You have the Helm override file that you use for AAP. This article calls the file override.yaml.

You have the Strimzi operator values file, strimzi-kafka-operator-values.yaml.

You have the Strimzi Helm repository configured as strimzi, and the AAP Helm repository configured as cequence.

Converting the Strimzi resources

Release 9.4.0 includes a job that converts the Kafka, KafkaTopic, KafkaUser, and KafkaConnect resources from API version v1beta2 to v1. Generate the job from the AAP Helm chart, and then run the job one time.

1. In override.yaml, add the following setting to enable the conversion job.

   strimziApiConversion:
     enabled: true

2. Generate the job file using the following command.

   helm template cequence cequence/cequence-asp --version 9.4.0 -f override.yaml -s templates/kafka/strimzi-v1-api-conversion.yaml > migrate.job

3. In override.yaml, set strimziApiConversion.enabled to false. This setting prevents the job from running again when you upgrade AAP.

4. Start the conversion by applying the job file. Replace <namespace> with the AAP namespace and <kubernetes context> with the context of the AAP cluster.

   kubectl apply -f migrate.job -n <namespace> --context <kubernetes context>

5. Wait for the conversion job to complete.

The Strimzi resources now use the v1 API.

Updating the Strimzi CRDs and operator

Update the Strimzi CRDs before you update the Strimzi operator. The CRDs are in the Strimzi operator Helm chart, release 1.2.0.

1. Download and extract the Strimzi operator Helm chart, release 1.2.0.

   helm pull strimzi/strimzi-kafka-operator --version 1.2.0 --untar --untardir strimzi-operator-helm-1.2.0

2. Apply the CRDs from the chart folder. Replace <kubernetes context> with the context of the AAP cluster.

   kubectl apply -f strimzi-operator-helm-1.2.0/strimzi-kafka-operator/crds/ --context <kubernetes context>

3. Upgrade the Strimzi operator to release 1.2.0. Replace <namespace> with the namespace of the Strimzi operator.

   helm upgrade --install strimzi strimzi/strimzi-kafka-operator --version 1.2.0 -n <namespace> --values strimzi-kafka-operator-values.yaml

The Strimzi CRDs and operator now run release 1.2.0.

Upgrading AAP

Upgrade the cequence-asp Helm release to release 9.4.0 using your usual Helm upgrade procedure. Use the override.yaml file with strimziApiConversion.enabled set to false.

Rolling back to release 9.2.x

A rollback to release 9.2.x restores the Strimzi CRDs and operator to release 0.51.0, and then downgrades AAP. Complete the steps in order.

1. Download and extract the Strimzi operator Helm chart, release 0.51.0.

   helm pull strimzi/strimzi-kafka-operator --version 0.51.0 --untar --untardir strimzi-operator-helm-0.51.0

2. Apply the release 0.51.0 CRDs. Replace <kubernetes context> with the context of the AAP cluster.

   kubectl apply -f strimzi-operator-helm-0.51.0/strimzi-kafka-operator/crds/ --context <kubernetes context>

3. Downgrade the Strimzi operator to release 0.51.0. Replace <namespace> with the namespace of the Strimzi operator.

   helm upgrade --install strimzi strimzi/strimzi-kafka-operator --version 0.51.0 -n <namespace> --values strimzi-kafka-operator-values.yaml

4. Downgrade the cequence-asp Helm release to the 9.2.x release that you ran before the upgrade, using your usual Helm upgrade procedure.

AAP and Strimzi now run the releases that you ran before the upgrade.