Upgrade Astra Control Center

11/01/2023 Contributors

To upgrade Astra Control Center, download the installation bundle from the NetApp Support Site and complete these instructions. You can use this procedure to upgrade Astra Control Center in internet-connected or air-gapped environments.

Before you begin

Before you upgrade, ensure your environment still meets the minimum requirements for Astra Control Center deployment. Your environment should have the following:

A supported Astra Trident version
Details
Determine the Trident version you are running:
kubectl get tridentversion -n trident
Refer to Astra Trident documentation to upgrade from an older version.

You must upgrade to Astra Trident 22.10 PRIOR to upgrading to Kubernetes 1.25.
A supported Kubernetes distribution
Details
Determine the Kubernetes version you are running:
kubectl get nodes -o wide
Sufficient cluster resources
Details
Determine available cluster resources:
kubectl describe node <node name>
A registry you can use to push and upload Astra Control Center images
A default storage class
Details
Determine your default storage class:
kubectl get storageclass
Healthy and available API services
Details
Ensure all API services are in a healthy state and available:
kubectl get apiservices
(OpenShift only) Healthy and available cluster operators
Details
Ensure all cluster operators are in a healthy state and available.
kubectl get clusteroperators

As part of this procedure, you will need to install the latest operator (acc-operator) if you are upgrading Astra Control Center. You cannot upgrade to earlier versions of Astra Control Center using this updated operator.

About this task

The Astra Control Center upgrade process guides you through the following high-level steps:

Log out of your Astra Control Center UI before you begin the upgrade.

Download and extract Astra Control Center
Remove the NetApp Astra kubectl plugin and install it again
Add the images to your local registry
Install the updated Astra Control Center operator
Upgrade Astra Control Center
Verify system status

Do not delete the Astra Control Center operator (for example, kubectl delete -f astra_control_center_operator_deploy.yaml) at any time during the Astra Control Center upgrade or operation to avoid deleting pods.

Perform upgrades in a maintenance window when schedules, backups, and snapshots are not running.

Download and extract Astra Control Center

Go to the Astra Control Center product downloads page on the NetApp Support Site. You can select the latest version or another version you want from the drop-down menu.
(Recommended but optional) Download the certificates and signatures bundle for Astra Control Center (astra-control-center-certs-[version].tar.gz) to verify the signature of the bundle.
Expand for details
tar -vxzf astra-control-center-certs-[version].tar.gz
openssl dgst -sha256 -verify certs/AstraControlCenter-public.pub -signature certs/astra-control-center-[version].tar.gz.sig astra-control-center-[version].tar.gz
The output will show Verified OK after successful verification.
Extract the images from the Astra Control Center bundle:
```
tar -vxzf astra-control-center-[version].tar.gz
```

Remove the NetApp Astra kubectl plugin and install it again

You can use the NetApp Astra kubectl command line plugin to push images to a local Docker repository.

Determine if you have the plug-in installed:
```
kubectl astra
```
Take one of these actions:
- If the plugin is installed, the command should return the kubectl plugin help and you can remove the existing version of kubectl-astra: delete /usr/local/bin/kubectl-astra.
- If the command returns an error, the plugin is not installed and you can proceed to the next step to install it.
Install the plugin:
1. List the available NetApp Astra kubectl plugin binaries, and note the name of the file you need for your operating system and CPU architecture:
  
  The kubectl plugin library is part of the tar bundle and is extracted into the folder kubectl-astra.
  ls kubectl-astra/
2. Move the correct binary into the current path and rename it to kubectl-astra:
  cp kubectl-astra/<binary-name> /usr/local/bin/kubectl-astra

Add the images to your local registry

Complete the appropriate step sequence for your container engine:

Docker

Change to the root directory of the tarball. You should see the acc.manifest.bundle.yaml file and these directories:

acc/
kubectl-astra/
acc.manifest.bundle.yaml
Push the package images in the Astra Control Center image directory to your local registry. Make the following substitutions before running the push-images command:
- Replace <BUNDLE_FILE> with the name of the Astra Control bundle file (acc.manifest.bundle.yaml).
- Replace <MY_FULL_REGISTRY_PATH> with the URL of the Docker repository; for example, "https://<docker-registry>".
- Replace <MY_REGISTRY_USER> with the user name.
- Replace <MY_REGISTRY_TOKEN> with an authorized token for the registry.
  kubectl astra packages push-images -m <BUNDLE_FILE> -r <MY_FULL_REGISTRY_PATH> -u <MY_REGISTRY_USER> -p <MY_REGISTRY_TOKEN>

Podman

Change to the root directory of the tarball. You should see this file and directory:

acc.manifest.bundle.yaml
acc/
Log in to your registry:
```
podman login <YOUR_REGISTRY>
```

Prepare and run one of the following scripts that is customized for the version of Podman you use. Substitute <MY_FULL_REGISTRY_PATH> with the URL of your repository that includes any sub-directories.

Podman 4

export REGISTRY=<MY_FULL_REGISTRY_PATH>
export PACKAGENAME=acc
export PACKAGEVERSION=23.07.0-25
export DIRECTORYNAME=acc
for astraImageFile in $(ls ${DIRECTORYNAME}/images/*.tar) ; do
astraImage=$(podman load --input ${astraImageFile} | sed 's/Loaded image: //')
astraImageNoPath=$(echo ${astraImage} | sed 's:.*/::')
podman tag ${astraImageNoPath} ${REGISTRY}/netapp/astra/${PACKAGENAME}/${PACKAGEVERSION}/${astraImageNoPath}
podman push ${REGISTRY}/netapp/astra/${PACKAGENAME}/${PACKAGEVERSION}/${astraImageNoPath}
done

Podman 3

export REGISTRY=<MY_FULL_REGISTRY_PATH>
export PACKAGENAME=acc
export PACKAGEVERSION=23.07.0-25
export DIRECTORYNAME=acc
for astraImageFile in $(ls ${DIRECTORYNAME}/images/*.tar) ; do
astraImage=$(podman load --input ${astraImageFile} | sed 's/Loaded image: //')
astraImageNoPath=$(echo ${astraImage} | sed 's:.*/::')
podman tag ${astraImageNoPath} ${REGISTRY}/netapp/astra/${PACKAGENAME}/${PACKAGEVERSION}/${astraImageNoPath}
podman push ${REGISTRY}/netapp/astra/${PACKAGENAME}/${PACKAGEVERSION}/${astraImageNoPath}
done

The image path the script creates should resemble the following, depending on your registry configuration:

https://netappdownloads.jfrog.io/docker-astra-control-prod/netapp/astra/acc/23.07.0-25/image:version

Install the updated Astra Control Center operator

Change the directory:
```
cd manifests
```

Edit the Astra Control Center operator deployment yaml (astra_control_center_operator_deploy.yaml) to refer to your local registry and secret.

vim astra_control_center_operator_deploy.yaml

If you use a registry that requires authentication, replace or edit the default line of imagePullSecrets: [] with the following:
```
imagePullSecrets: [{name: astra-registry-cred}]
```
Change ASTRA_IMAGE_REGISTRY for the kube-rbac-proxy image to the registry path where you pushed the images in a previous step.
Change ASTRA_IMAGE_REGISTRY for the acc-operator image to the registry path where you pushed the images in a previous step.

Add the following values to the env section:

- name: ACCOP_HELM_UPGRADETIMEOUT
  value: 300m

Sample astra_control_center_operator_deploy.yaml:

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    control-plane: controller-manager
  name: acc-operator-controller-manager
  namespace: netapp-acc-operator
spec:
  replicas: 1
  selector:
    matchLabels:
      control-plane: controller-manager
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        control-plane: controller-manager
    spec:
      containers:
      - args:
        - --secure-listen-address=0.0.0.0:8443
        - --upstream=http://127.0.0.1:8080/
        - --logtostderr=true
        - --v=10
        image: ASTRA_IMAGE_REGISTRY/kube-rbac-proxy:v4.8.0
        name: kube-rbac-proxy
        ports:
        - containerPort: 8443
          name: https
      - args:
        - --health-probe-bind-address=:8081
        - --metrics-bind-address=127.0.0.1:8080
        - --leader-elect
        env:
        - name: ACCOP_LOG_LEVEL
          value: "2"
        - name: ACCOP_HELM_UPGRADETIMEOUT
          value: 300m
        image: ASTRA_IMAGE_REGISTRY/acc-operator:23.07.25
        imagePullPolicy: IfNotPresent
        livenessProbe:
          httpGet:
            path: /healthz
            port: 8081
          initialDelaySeconds: 15
          periodSeconds: 20
        name: manager
        readinessProbe:
          httpGet:
            path: /readyz
            port: 8081
          initialDelaySeconds: 5
          periodSeconds: 10
        resources:
          limits:
            cpu: 300m
            memory: 750Mi
          requests:
            cpu: 100m
            memory: 75Mi
        securityContext:
          allowPrivilegeEscalation: false
      imagePullSecrets: []
      securityContext:
        runAsUser: 65532
      terminationGracePeriodSeconds: 10

Install the updated Astra Control Center operator:

kubectl apply -f astra_control_center_operator_deploy.yaml

Sample response:

namespace/netapp-acc-operator unchanged
customresourcedefinition.apiextensions.k8s.io/astracontrolcenters.astra.netapp.io configured
role.rbac.authorization.k8s.io/acc-operator-leader-election-role unchanged
clusterrole.rbac.authorization.k8s.io/acc-operator-manager-role configured
clusterrole.rbac.authorization.k8s.io/acc-operator-metrics-reader unchanged
clusterrole.rbac.authorization.k8s.io/acc-operator-proxy-role unchanged
rolebinding.rbac.authorization.k8s.io/acc-operator-leader-election-rolebinding unchanged
clusterrolebinding.rbac.authorization.k8s.io/acc-operator-manager-rolebinding configured
clusterrolebinding.rbac.authorization.k8s.io/acc-operator-proxy-rolebinding unchanged
configmap/acc-operator-manager-config unchanged
service/acc-operator-controller-manager-metrics-service unchanged
deployment.apps/acc-operator-controller-manager configured

Verify pods are running:
```
kubectl get pods -n netapp-acc-operator
```