Upgrading to the latest 10.0.1.x-eus online

Perform an online upgrade of IBM® API Connect to the latest version of 10.0.1.x-eus on OpenShift.

Before you begin

  • If you are upgrading an air-gapped (disconnected from the internet) installation, see Deprecated: Air-gapped upgrade using cloudctl.
  • Review the supported upgrade paths and upgrade requirements in Upgrade considerations on OpenShift and Cloud Pak for Integration.

    Your deployment must be at or later and running on OpenShift 4.10 before you can upgrade to the newest version of API Connect 10.0.1.x-eus.

    Restriction: Cloud Pak for Integration 2020.4 is now End of Support and the API Management component cannot be upgraded to a version later than API Connect
  • If you are upgrading to a version of API Connect that supports a newer version of Red Hat OpenShift, complete the API Connect upgrade before upgrading Red Hat OpenShift.
  • The Gateway subsystem remains available during the upgrade of the Management, Portal, and Analytics subsystems.


  1. Ensure that you have completed all of the steps in Preparing to upgrade on OpenShift and Cloud Pak for Integration.

    Do not attempt an upgrade until you have reviewed the considerations and prepared your deployment.

    Attention: In the next step, the operators for DataPower, Cloud Pak common services, API Connect must be upgraded as close in time as possible to ensure that dependencies are satisfied.
  2. Use the OCP Operator Hub to update the operator channels, which upgrades the operators.

    When you update operators, the behavior depends on whether you enabled automatic or manual subscriptions for the operator channel:

    • If you enabled Automatic subscriptions, the operator version will automatically upgrade to if needed.
    • If you enabled Manual subscriptions, and if operator channel is already at the required version, then OpenShift UI (OLM) will notify you that an upgrade is available. You must manually approve the upgrade.
    1. If your DataPower operator channel is not at v1.6, update it to v1.6 now, and then wait for the operator to update, for the pods to restart, and for a Ready status.

      For information on troubleshooting the DataPower operator, see Operator not removed in the DataPower operator documentation.

    2. If needed, update the Cloud Pak common services operator channel to v3.
    3. Update the API Connect operator channel to v2.1.11-eus.
  3. Ensure that the operators and operands are healthy before proceeding.
    • Operators: The OpenShift web console indicates that all operators are in Succeeded state without any warnings.

    • Operands: To verify whether operands are healthy, run the following command: oc get apic

      Check the status of the apiconnectcluster custom resource. All subsystems should report as READY.

  4. Use the latest version of apicops to validate the certificates.
    1. Run the following command:
      apicops upgrade:stale-certs -n <APIC_namespace>
    2. Delete any stale certificates that are managed by cert-manager.
      If a certificate failed the validation and it is managed by cert-manager, you can delete the stale certificate secret, and let cert-manager regenerate it. Run the following command:
      kubectl delete secret <stale-secret> -n <APIC_namespace>
    3. Restart the corresponding so that it can pick up the new secret.
      To determine which pod to restart, see the following topics:

    For information on the apicops tool, see The API Connect operations tool: apicops.

  5. Update the operand version:
    1. Run the following command to ensure that the operands are healthy:
      oc get apic --all-namespaces
    2. Edit the top-level apiconnectcluster CR by running the following command:
      oc -n <APIC_namespace> edit apiconnectcluster
    3. Change the version setting to
    4. In the spec.gateway section of the top-level CR, remove the template override section, if it exists.

      You cannot perform an upgrade if the CR contains an override.

    5. Save and close the CR.
  6. Verify that the upgraded subsystems report as Running.

    Run the following command:

    oc get apic --all-namespaces

    All subsystems should report as Running.

    Example response:

    NAME                                                READY   STATUS    VERSION              RECONCILED VERSION      AGE
    analyticscluster.analytics.apiconnect.ibm.com/analytics      8/8     Running   121m
    NAME                                     PHASE     READY   SUMMARY                           VERSION    AGE
    datapowerservice.datapower.ibm.com/gw1   Running   True    StatefulSet replicas ready: 1/1   100m
    NAME                                     PHASE     LAST EVENT   WORK PENDING   WORK IN-PROGRESS   AGE
    datapowermonitor.datapower.ibm.com/gw1   Running                false          false              100m
    NAME                                            READY   STATUS    VERSION              RECONCILED VERSION      AGE
    gatewaycluster.gateway.apiconnect.ibm.com/gw1   2/2     Running  100m
    NAME                                                 READY   STATUS    VERSION              RECONCILED VERSION      AGE
    managementcluster.management.apiconnect.ibm.com/m1   16/16   Running   162m
    NAME                                             READY   STATUS    VERSION              RECONCILED VERSION      AGE
    portalcluster.portal.apiconnect.ibm.com/portal   3/3     Running   139m
  7. Optional: Install the latest version of the API Connect Toolkit and the API Connect Local Test Environment.
  8. If you are upgrading from API Connect or earlier, upgrade to Red Hat OpenShift Container Platform 4.12 if you have not already done so.
    Red Hat OpenShift requires you to upgrade in stages, so that you install every version between your starting point and your ending point. For example, to upgrade from 4.10 to 4.12, you must complete 2 upgrades:
    1. Upgrade to 4.11
    2. Upgrade to 4.12
    For upgrade instructions, see the Red Hat OpenShift documentation.