Skip to main content

Upgrade Helm Charts

The Contrast Agent Operator follows semantic versioning.

  • MAJOR versions may include breaking changes to the operator API. Care should be taken when upgrading between MAJOR versions, as manifests may have changed or existing Custom Resource Definitions (CRDs) may need to be updated.

  • MINOR versions contain new features and are fully backwards compatible, and are safe to apply to an existing cluster. Optional manifest changes may be needed to use new functionality.

  • Patch versions contain security and bug fixes, are fully backwards compatible, and are safe to apply to an existing cluster. No manifest changes are required.

Contrast publishes image tags in the following format:

:2
:2.1
:2.1.10
:latest

Where :2 represents the latest release in the 2.X.X semantic version branch. To simplify upgrades, prefix versions may be used based on your risk tolerance (ensure imagePullPolicy is set to Always).

Note

While the Contrast Agent Operator supports high-availability setups using multiple replicas and leader leases, Contrast only supports deployments where all operator instances are running the same version for extended periods. The option imagePullPolicy should not be relied on to keep multiple instances on the same version. Using an operator, such as Keel , to facilitate safe upgrades is recommended if automatic upgrades are desired.

Minor and patch upgrades

Upgrading to new versions follows the same steps as installing into a fresh cluster. Executing as a cluster administrator, apply the helm chart using helm upgrade.

helm repo update contrast
helm upgrade --namespace contrast-agent-operator -f contrast-agent-operator.yaml contrast-agent-operator contrast/contrast-agent-operator

Major upgrades

Major upgrades may include additional manifest changes. Replacing the CRDs with kubectl keeps all existing CustomResources (and by extension any cluster configurations).

helm repo update contrast
kubectl replace -f https://github.com/Contrast-Security-OSS/agent-operator/releases/latest/download/crds.yaml
helm upgrade --namespace contrast-agent-operator -f contrast-agent-operator.yaml contrast-agent-operator contrast/contrast-agent-operator

While these generic steps may work in most major upgrades, care should be taken to follow the migration steps provided in the release notes, if any, to ensure the major upgrade is successful.

Note

To clarify:

  • helm repo update contrast fetches new Helm chart versions

  • helm upgrade applies the newest Helm chart to your cluster

For major upgrades, you must also execute: kubectl replace -f https://github.com/Contrast-Security-OSS/agent-operator/releases/latest/download/crds.yaml. This extra step is required because of a limitation in how Helm processes CRDs. See icon-external-link.svgHelm Chart documentation for more information.

See also

In this section: