Upgrade the Kubernetes Components

refresh the chart metadata first, then upgrade each release always capture the current values before upgrading helm repo update helm get values \<release name> n \<namespace> > \<release name> current values yaml upgrading the secrets management agent delete the existing agent secret before upgrading the chart doesn't merge the secret idempotently, and an upgrade performed without this step can leave newly introduced keys missing, causing the agent to fail at startup kubectl delete secret aapm agent secrets n ns agent helm upgrade kron aapm agent kron pam/kron aapm agent \\ \ namespace ns agent \\ \ set secrets installtoken="\<kron pam aapm agent installation token>" \\ \ set secrets address="\<kron pam server address>" \\ \ set config singleconnect agentname="\<agent name>" \\ \ set config singleconnect sslignored=false \\ \ set config singleconnect hostnameignored=false \\ \ set image pullpolicy=always registration is consumed at first install if the agent has to register again after the upgrade, a new installation token may be required add set image pullpolicy=always whenever a new build was pushed under the same image tag; otherwise kubernetes reuses the cached image and the upgrade has no effect upgrading aapm service helm upgrade aapm service kron pam/aapm service \\ \ namespace kron pam aapm \\ f service values yaml verify as described in the aapm service verification section note that any active kubectl port forward is terminated when the pod is recreated and must be restarted upgrading the injector helm upgrade kron aapm sidecar kron pam/kron aapm sidecar \\ \ namespace ns sidecar \\ \ reuse values \\ \ set sidecarimage tag="\<verified image tag>" kubectl rollout restart deployment/kron aapm sidecar n ns sidecar kubectl rollout status deployment/kron aapm sidecar n ns sidecar timeout=60s the kubectl rollout restart step is mandatory without it, the injector keeps serving the previous configmap and image reference from memory, and even newly created pods are injected with the old configuration upgrading the injector does not re inject pods that are already running existing workloads must be recreated to receive the new sidecar configuration, either with kubectl delete pod n \<target namespace> or with kubectl rollout restart deployment/ n \<target namespace> upgrade flags flag when to use it reuse values keep all previously set values and change only the ones passed explicitly on this command reset values discard previous values and fall back to chart defaults plus what is passed now f \<file> supply the full desired value set from a file (recommended) set image pullpolicy=always a new build was pushed under an unchanged image tag atomic timeout 5m roll back automatically if the upgrade does not become ready in time