Kubernetes upgrade and rollback

Upgrade planning, failed-upgrade recovery, and rollback for independent application and data releases.

Short glossary
  • Helm release: an installed and independently managed resource set from one chart.
  • Secret object: a Kubernetes resource referenced for sensitive values; the delivery charts do not own the values themselves.
  • PersistentVolumeClaim (PVC): a storage request used by a bundled data component.
  • NetworkPolicy: rules governing permitted network connections for application Pods.
  • Container Storage Interface (CSI) and Container Network Interface (CNI) capabilities are provided by the customer cluster.

Upgrade, failed-upgrade recovery, and rollback

Extract the new package and use upgrade.sh: without --apply it runs read-only checks and prints the plan; with --apply it prepares activation, renders values, upgrades the required releases, and verifies the result.

  • Before applying, retain a compatible backup and verify the exact namespace, package version, and upgrade plan
  • When switching to all-external stores, upgrade.sh removes a remaining massaccess-data release but retains PVCs, PVs, Secrets, and backups
  • Helm rollback changes controllers and images only; it does not reverse schema or data mutations
  • Roll back massaccess-data only when the storage format is backward compatible; otherwise use a verified forward migration or restore

Upgrade and rollback procedure

  1. 1. Review the upgrade plan

    Without --apply the command runs read-only checks and prints the actions. Resolve every FAIL; this step does not change the cluster.

    bash
    ./bin/upgrade.sh --namespace <namespace>

  2. 2. Apply the upgrade

    Allow writes only after reviewing the plan, backup, and exact namespace. The script upgrades only the required releases and then verifies their state.

    bash
    ./bin/upgrade.sh --namespace <namespace> --apply

  3. 3. Review a rollback plan when needed

    Rollback is an alternative recovery operation, not a required continuation of an upgrade. Print its plan without --apply first.

    bash
    ./bin/massaccess-k8s rollback-plan \
  --namespace <namespace>

  4. 4. Apply the approved application rollback

    Substitute a compatible previous revision from Helm history. --namespace-ack must exactly match the namespace; --apply permits changing only the application release.

    bash
    ./bin/massaccess-k8s rollback \
  --release application \
  --revision <previous-revision> \
  --namespace <namespace> \
  --namespace-ack <namespace> \
  --apply

  5. 5. Repeat the final verification

    After either an upgrade or a rollback, run healthcheck separately and investigate any non-zero exit code.

    bash
    ./bin/healthcheck.sh --namespace <namespace>