Upgrading to the latest 10.0.1.x-eus online

Perform an online upgrade of IBM® API Connect to the latest version of 10.0.1.x-eus on OpenShift.

1. Ensure that you have completed all of the steps in Preparing to upgrade on OpenShift and Cloud Pak for Integration.

   Do not attempt an upgrade until you have reviewed the considerations and prepared your deployment.

   Attention: In the next step, the operators for DataPower, Cloud Pak common services, API Connect must be upgraded as close in time as possible to ensure that dependencies are satisfied.
2. Use the OCP Operator Hub to update the operator channels, which upgrades the operators.

   When you update operators, the behavior depends on whether you enabled automatic or manual subscriptions for the operator channel:

   • If you enabled Automatic subscriptions, the operator version will automatically upgrade to if needed.
   • If you enabled Manual subscriptions, and if operator channel is already at the required version, then OpenShift UI (OLM) will notify you that an upgrade is available. You must manually approve the upgrade.
   1. If your DataPower operator channel is not at v1.6, update it to v1.6 now, and then wait for the operator to update, for the pods to restart, and for a Ready status.

      For information on troubleshooting the DataPower operator, see Operator not removed in the DataPower operator documentation.

   2. If needed, update the Cloud Pak common services operator channel to v3.
   3. Update the API Connect operator channel to v2.1.11-eus.
3. Ensure that the operators and operands are healthy before proceeding.
   • Operators: The OpenShift web console indicates that all operators are in Succeeded state without any warnings.

   • Operands: To verify whether operands are healthy, run the following command: oc get apic

     Check the status of the apiconnectcluster custom resource. All subsystems should report as READY.

4. Use the latest version of apicops to validate the certificates.
   1. Run the following command:

      apicops upgrade:stale-certs -n <APIC_namespace>

   2. Delete any stale certificates that are managed by cert-manager.
      If a certificate failed the validation and it is managed by cert-manager, you can delete the stale certificate secret, and let cert-manager regenerate it. Run the following command:

      kubectl delete secret <stale-secret> -n <APIC_namespace>

   3. Restart the corresponding so that it can pick up the new secret.
      To determine which pod to restart, see the following topics:

      • List of external certificates
      • List of internal certificates

   For information on the apicops tool, see The API Connect operations tool: apicops.

5. Update the operand version:
   1. Run the following command to ensure that the operands are healthy:

      oc get apic --all-namespaces

   2. Edit the top-level apiconnectcluster CR by running the following command:

      oc -n <APIC_namespace> edit apiconnectcluster

   3. Change the version setting to 10.0.1.12-eus
   4. In the spec.gateway section of the top-level CR, remove the template override section, if it exists.

      You cannot perform an upgrade if the CR contains an override.

   5. Save and close the CR.
6. Verify that the upgraded subsystems report as Running.

   Run the following command:

   oc get apic --all-namespaces

   All subsystems should report as Running.

   Example response:

   NAME                                                READY   STATUS    VERSION              RECONCILED VERSION      AGE
   analyticscluster.analytics.apiconnect.ibm.com/analytics      8/8     Running   10.0.1.12-eus   10.0.1.12-eus-1074   121m
   
   NAME                                     PHASE     READY   SUMMARY                           VERSION    AGE
   datapowerservice.datapower.ibm.com/gw1   Running   True    StatefulSet replicas ready: 1/1   10.0.1.12-eus   100m
   
   NAME                                     PHASE     LAST EVENT   WORK PENDING   WORK IN-PROGRESS   AGE
   datapowermonitor.datapower.ibm.com/gw1   Running                false          false              100m
   
   NAME                                            READY   STATUS    VERSION              RECONCILED VERSION      AGE
   gatewaycluster.gateway.apiconnect.ibm.com/gw1   2/2     Running   10.0.1.12-eus   10.0.1.12-eus-1074  100m
   
   NAME                                                 READY   STATUS    VERSION              RECONCILED VERSION      AGE
   managementcluster.management.apiconnect.ibm.com/m1   16/16   Running   10.0.1.12-eus   110.0.1.12-eus-1074   162m
   
   
   NAME                                             READY   STATUS    VERSION              RECONCILED VERSION      AGE
   portalcluster.portal.apiconnect.ibm.com/portal   3/3     Running   10.0.1.12-eus   10.0.1.12-eus-1074   139m

7. Optional: Install the latest version of the API Connect Toolkit and the API Connect Local Test Environment.
8. If you are upgrading from API Connect 10.0.1.9-eus or earlier, upgrade to Red Hat OpenShift Container Platform 4.12 if you have not already done so.
   Red Hat OpenShift requires you to upgrade in stages, so that you install every version between your starting point and your ending point. For example, to upgrade from 4.10 to 4.12, you must complete 2 upgrades:

   1. Upgrade to 4.11
   2. Upgrade to 4.12

   For upgrade instructions, see the Red Hat OpenShift documentation.