This guide covers migrating from Ambassador Edge Stack 2.0.5 to Ambassador Edge Stack 2.5.1. If this is not your exact situation, see the migration matrix.
This guide is written for upgrading an installation made without using Helm. If you originally installed with Helm, see the Helm-based upgrade instructions.
Upgrading from Ambassador Edge Stack 2.0.5 to Ambassador Edge Stack 2.5.1 typically requires downtime.In some situations, Ambassador Labs Support may be able to assist with a zero-downtime migration; contact support with questions.
Migrating from Ambassador Edge Stack 2.0.5 to Ambassador Edge Stack 2.5.1 is a three-step process:
Install new CRDs.
Before installing Ambassador Edge Stack 2.5.1 itself, you need to update the CRDs in
your cluster. This is mandatory during any upgrade of Ambassador Edge Stack.
Ambassador Edge Stack 2.5.1 includes a Deployment in the `emissary-system` namespace called emissary-apiext. This is the APIserver extension that supports converting Ambassador Edge Stack CRDs between getambassador.io/v2and getambassador.io/v3alpha1. This Deployment needs to be running at all times.
If the emissary-apiext Deployment's Pods all stop running, you will not be able to use getambassador.io/v3alpha1 CRDs until restarting the emissary-apiext Deployment.
There is a known issue with the emissary-apiext service that impacts all Ambassador Edge Stack 2.x and 3.x users. Specifically, the TLS certificate used by apiext expires one year after creation and does not auto-renew. All users who are running Ambassador Edge Stack/Emissary-ingress 2.x or 3.x with the apiext service should proactively renew their certificate as soon as practical by running kubectl delete --all secrets --namespace=emissary-system to delete the existing certificate, and then restart the emissary-apiext deployment with kubectl rollout restart deploy/emissary-apiext -n emissary-system. This will create a new certificate with a one year expiration. We will issue a software patch to address this issue well before the one year expiration. Note that certificate renewal will not cause any downtime.
Delete Ambassador Edge Stack 2.0.5 Deployment.
Delete only the Deployment for Ambassador Edge Stack 2.0.5 in order to preserve all of your existing configuration.
Use kubectl to delete the Deployment for Ambassador Edge Stack 2.0.5. Typically, this will be found
in the ambassador namespace.
Install Ambassador Edge Stack 2.5.1.
After installing the new CRDs, use Helm to install Ambassador Edge Stack 2.5.1. This will install
in the ambassador namespace. If necessary for your installation (e.g. if you were
running with AMBASSADOR_SINGLE_NAMESPACE set), you can download aes.yaml and edit as
needed.
Edge Stack