[{"data":1,"prerenderedAt":513},["ShallowReactive",2],{"navigation_docs":3,"-operate-upgrade":136,"-operate-upgrade-surround":508},[4,26,47,68,89,110,123],{"title":5,"path":6,"stem":7,"children":8,"page":25},"Getting Started","\u002Fgetting-started","1.getting-started",[9,13,17,21],{"title":10,"path":11,"stem":12},"What you are running","\u002Fgetting-started\u002Fwhat-you-are-running","1.getting-started\u002F1.what-you-are-running",{"title":14,"path":15,"stem":16},"Architecture","\u002Fgetting-started\u002Farchitecture","1.getting-started\u002F2.architecture",{"title":18,"path":19,"stem":20},"Prerequisites","\u002Fgetting-started\u002Fprerequisites","1.getting-started\u002F3.prerequisites",{"title":22,"path":23,"stem":24},"Quickstart","\u002Fgetting-started\u002Fquickstart","1.getting-started\u002F4.quickstart",false,{"title":27,"path":28,"stem":29,"children":30,"page":25},"Install","\u002Finstall","2.install",[31,35,39,43],{"title":32,"path":33,"stem":34},"Install the chart","\u002Finstall\u002Finstall-the-chart","2.install\u002F1.install-the-chart",{"title":36,"path":37,"stem":38},"Activation","\u002Finstall\u002Factivation","2.install\u002F2.activation",{"title":40,"path":41,"stem":42},"DNS and TLS","\u002Finstall\u002Fdns-and-tls","2.install\u002F3.dns-and-tls",{"title":44,"path":45,"stem":46},"Verify your install","\u002Finstall\u002Fverify-your-install","2.install\u002F4.verify-your-install",{"title":48,"path":49,"stem":50,"children":51,"page":25},"Configure","\u002Fconfigure","3.configure",[52,56,60,64],{"title":53,"path":54,"stem":55},"Data services","\u002Fconfigure\u002Fdata-services","3.configure\u002F1.data-services",{"title":57,"path":58,"stem":59},"Secrets","\u002Fconfigure\u002Fsecrets","3.configure\u002F2.secrets",{"title":61,"path":62,"stem":63},"Registry and air-gapped installs","\u002Fconfigure\u002Fregistry-and-airgap","3.configure\u002F3.registry-and-airgap",{"title":65,"path":66,"stem":67},"Integrations","\u002Fconfigure\u002Fintegrations","3.configure\u002F4.integrations",{"title":69,"path":70,"stem":71,"children":72,"page":25},"Licensing","\u002Flicensing","4.licensing",[73,77,81,85],{"title":74,"path":75,"stem":76},"How licensing works","\u002Flicensing\u002Fhow-licensing-works","4.licensing\u002F1.how-licensing-works",{"title":78,"path":79,"stem":80},"Your key never leaves","\u002Flicensing\u002Fyour-key-never-leaves","4.licensing\u002F2.your-key-never-leaves",{"title":82,"path":83,"stem":84},"What phones home","\u002Flicensing\u002Fwhat-phones-home","4.licensing\u002F3.what-phones-home",{"title":86,"path":87,"stem":88},"Revoke and recover","\u002Flicensing\u002Frevoke-and-recover","4.licensing\u002F4.revoke-and-recover",{"title":90,"path":91,"stem":92,"children":93,"page":25},"Operate","\u002Foperate","5.operate",[94,98,102,106],{"title":95,"path":96,"stem":97},"Upgrade","\u002Foperate\u002Fupgrade","5.operate\u002F1.upgrade",{"title":99,"path":100,"stem":101},"Backup and restore","\u002Foperate\u002Fbackup-and-restore","5.operate\u002F2.backup-and-restore",{"title":103,"path":104,"stem":105},"Observability","\u002Foperate\u002Fobservability","5.operate\u002F3.observability",{"title":107,"path":108,"stem":109},"High availability","\u002Foperate\u002Fhigh-availability","5.operate\u002F4.high-availability",{"title":111,"path":112,"stem":113,"children":114,"page":25},"Troubleshooting","\u002Ftroubleshooting","6.troubleshooting",[115,119],{"title":116,"path":117,"stem":118},"Install failures","\u002Ftroubleshooting\u002Finstall-failures","6.troubleshooting\u002F1.install-failures",{"title":120,"path":121,"stem":122},"Licensing failures","\u002Ftroubleshooting\u002Flicensing-failures","6.troubleshooting\u002F2.licensing-failures",{"title":124,"path":125,"stem":126,"children":127,"page":25},"Reference","\u002Freference","9.reference",[128,132],{"title":129,"path":130,"stem":131},"Helm values","\u002Freference\u002Fhelm-values","9.reference\u002F1.helm-values",{"title":133,"path":134,"stem":135},"Environment variables","\u002Freference\u002Fenvironment","9.reference\u002F2.environment",{"id":137,"title":95,"body":138,"description":501,"extension":502,"links":503,"meta":504,"navigation":505,"path":96,"seo":506,"stem":97,"__hash__":507},"docs\u002F5.operate\u002F1.upgrade.md",{"type":139,"value":140,"toc":495},"minimark",[141,145,149,154,162,234,256,259,302,309,313,324,330,348,355,359,366,438,441,449,468,478,482,491],[142,143,95],"h1",{"id":144},"upgrade",[146,147,148],"p",{},"An upgrade is a new chart version and the images that ship with it. There is no separate migration step to run: the platform API applies its own boot migrations when the new pod starts.",[150,151,153],"h2",{"id":152},"run-it","Run it",[146,155,156,157,161],{},"Keep your install values in a file rather than repeating ",[158,159,160],"code",{},"--set"," flags, so an upgrade is a one-line command that cannot accidentally drop a value:",[163,164,169],"pre",{"className":165,"code":166,"language":167,"meta":168,"style":168},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","helm upgrade my-mvno oci:\u002F\u002Fghcr.io\u002Fsolvegio\u002Fcharts\u002Fplatform \\\n  --version \u003Cnew-version> \\\n  --namespace my-mvno \\\n  -f my-values.yaml\n","bash","",[158,170,171,194,215,225],{"__ignoreMap":168},[172,173,176,180,184,187,190],"span",{"class":174,"line":175},"line",1,[172,177,179],{"class":178},"sBMFI","helm",[172,181,183],{"class":182},"sfazB"," upgrade",[172,185,186],{"class":182}," my-mvno",[172,188,189],{"class":182}," oci:\u002F\u002Fghcr.io\u002Fsolvegio\u002Fcharts\u002Fplatform",[172,191,193],{"class":192},"sTEyZ"," \\\n",[172,195,197,200,204,207,210,213],{"class":174,"line":196},2,[172,198,199],{"class":182},"  --version",[172,201,203],{"class":202},"sMK4o"," \u003C",[172,205,206],{"class":182},"new-versio",[172,208,209],{"class":192},"n",[172,211,212],{"class":202},">",[172,214,193],{"class":192},[172,216,218,221,223],{"class":174,"line":217},3,[172,219,220],{"class":182},"  --namespace",[172,222,186],{"class":182},[172,224,193],{"class":192},[172,226,228,231],{"class":174,"line":227},4,[172,229,230],{"class":182},"  -f",[172,232,233],{"class":182}," my-values.yaml\n",[146,235,236,237,239,240,243,244,247,248,251,252,255],{},"If you installed with ",[158,238,160],{}," flags instead, pass every one of them again, or use ",[158,241,242],{},"--reuse-values"," and add only what changes. A ",[158,245,246],{},"helm upgrade"," that omits ",[158,249,250],{},"platform.host"," or ",[158,253,254],{},"platform.kind"," re-renders the release without them and the install breaks.",[146,257,258],{},"For a production release, pin images by digest so an upgrade is reproducible and a re-pushed tag cannot change what runs:",[163,260,262],{"className":165,"code":261,"language":167,"meta":168,"style":168},"--set image.digest=sha256:\u003Capi-image-digest> \\\n--set images.licenseAgent=ghcr.io\u002Fsolvegio\u002Flicense-agent@sha256:\u003Cdigest>\n",[158,263,264,284],{"__ignoreMap":168},[172,265,266,268,271,274,277,280,282],{"class":174,"line":175},[172,267,160],{"class":178},[172,269,270],{"class":182}," image.digest=sha256:",[172,272,273],{"class":202},"\u003C",[172,275,276],{"class":182},"api-image-diges",[172,278,279],{"class":192},"t",[172,281,212],{"class":202},[172,283,193],{"class":192},[172,285,286,289,292,294,297,299],{"class":174,"line":196},[172,287,288],{"class":192},"--set ",[172,290,291],{"class":182},"images.licenseAgent=ghcr.io\u002Fsolvegio\u002Flicense-agent@sha256:",[172,293,273],{"class":202},[172,295,296],{"class":182},"diges",[172,298,279],{"class":192},[172,300,301],{"class":202},">\n",[146,303,304,305,308],{},"See ",[306,307,129],"a",{"href":130}," for the full set.",[150,310,312],{"id":311},"what-survives-an-upgrade","What survives an upgrade",[146,314,315,319,320,323],{},[316,317,318],"strong",{},"The secrets the chart generated for you."," The JWT secret, the age KEK keypair, the Postgres and Redis passwords, the session password, the downstream service key: all of these are looked up from the live Secret on every render and reused. An upgrade never rotates a value a running platform depends on. If you supply your own Secret through ",[158,321,322],{},"secrets.existingSecret",", the chart does not touch it at all.",[146,325,326,329],{},[316,327,328],{},"Your data."," The bundled Postgres, Redis and Kafka StatefulSets keep their PersistentVolumeClaims. An external or operator-mode database is not touched by Helm in the first place.",[146,331,332,335,336,339,340,343,344,347],{},[316,333,334],{},"Your license."," ",[158,337,338],{},"SIGNING_SEED",", ",[158,341,342],{},"POP_SIGNING_SEED"," and ",[158,345,346],{},"PARENT_LEASE_TOKEN"," live in the platform Secret and are written there by the license agent, not by Helm. The new agent pod reads the lease it already holds and carries on renewing from where the old one left off. Nothing re-enrolls, and no activation code is spent.",[146,349,350,351,354],{},"Leaving the original (now consumed) ",[158,352,353],{},"activation.code"," in your values file is harmless. The agent recognises a code it has already used and does nothing with it.",[150,356,358],{"id":357},"what-to-check-afterwards","What to check afterwards",[146,360,361,362,365],{},"The license agent runs a ",[158,363,364],{},"Recreate"," rollout, so the old pod goes away before the new one arrives. A gap of a few seconds with no agent running is expected. The API keeps serving through it: it reads the lease from a mounted file and does not need the agent to be up in order to answer requests.",[163,367,369],{"className":165,"code":368,"language":167,"meta":168,"style":168},"kubectl -n my-mvno rollout status deploy\u002Fmy-mvno-platform-api --timeout=180s\nkubectl -n my-mvno rollout status deploy\u002Fmy-mvno-platform-license-agent --timeout=120s\nkubectl -n my-mvno logs deploy\u002Fmy-mvno-platform-license-agent --since=5m\ncurl -sf https:\u002F\u002Fapi.acme.com\u002Fhealth\n",[158,370,371,393,411,427],{"__ignoreMap":168},[172,372,373,376,379,381,384,387,390],{"class":174,"line":175},[172,374,375],{"class":178},"kubectl",[172,377,378],{"class":182}," -n",[172,380,186],{"class":182},[172,382,383],{"class":182}," rollout",[172,385,386],{"class":182}," status",[172,388,389],{"class":182}," deploy\u002Fmy-mvno-platform-api",[172,391,392],{"class":182}," --timeout=180s\n",[172,394,395,397,399,401,403,405,408],{"class":174,"line":196},[172,396,375],{"class":178},[172,398,378],{"class":182},[172,400,186],{"class":182},[172,402,383],{"class":182},[172,404,386],{"class":182},[172,406,407],{"class":182}," deploy\u002Fmy-mvno-platform-license-agent",[172,409,410],{"class":182}," --timeout=120s\n",[172,412,413,415,417,419,422,424],{"class":174,"line":217},[172,414,375],{"class":178},[172,416,378],{"class":182},[172,418,186],{"class":182},[172,420,421],{"class":182}," logs",[172,423,407],{"class":182},[172,425,426],{"class":182}," --since=5m\n",[172,428,429,432,435],{"class":174,"line":227},[172,430,431],{"class":178},"curl",[172,433,434],{"class":182}," -sf",[172,436,437],{"class":182}," https:\u002F\u002Fapi.acme.com\u002Fhealth\n",[146,439,440],{},"In the agent's log you want to see its state line reporting a healthy lease:",[163,442,447],{"className":443,"code":445,"language":446},[444],"language-text","level=INFO msg=\"agent: state\" state=licensed\n","text",[158,448,445],{"__ignoreMap":168},[146,450,451,251,454,457,458,460,461,464,465,467],{},[158,452,453],{},"state=unenrolled",[158,455,456],{},"state=renew_failing"," after an upgrade means something about the licensing path changed. ",[306,459,120],{"href":121}," has the specific log lines. If the API pod is stuck in ",[158,462,463],{},"Init",", start at ",[306,466,116],{"href":117}," instead.",[146,469,470,471,474,475,477],{},"Watch ",[158,472,473],{},"license_expiry_seconds"," for a few minutes after the rollout as well. It should keep counting down and then jump back up at the next renewal. See ",[306,476,103],{"href":104},".",[150,479,481],{"id":480},"if-the-upgrade-goes-wrong","If the upgrade goes wrong",[146,483,484,487,488,490],{},[158,485,486],{},"helm rollback my-mvno -n my-mvno"," puts the previous release back. Take a copy of the platform Secret before any upgrade you are nervous about. It is the one object in the namespace that the chart cannot regenerate for you, because it holds the deployment's signing key. ",[306,489,99],{"href":100}," covers the command and what to do if the Secret is gone.",[492,493,494],"style",{},"html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":168,"searchDepth":175,"depth":196,"links":496},[497,498,499,500],{"id":152,"depth":196,"text":153},{"id":311,"depth":196,"text":312},{"id":357,"depth":196,"text":358},{"id":480,"depth":196,"text":481},"Bump the chart version, run helm upgrade, and check that the platform came back licensed and serving.","md",null,{},true,{"title":95,"description":501},"ilWgpxDO_9sNRLqD_Pr6ED6c69rrG-jGGjG9gTcJ-34",[509,511],{"title":86,"path":87,"stem":88,"description":510,"children":-1},"What happens to a deployment whose license is revoked, and the single command that brings it back.",{"title":99,"path":100,"stem":101,"description":512,"children":-1},"Back up the database and the platform Secret, and know what to do if either one is gone.",1783967741116]