Upgrading the analytics subsystem on Kubernetes

Upgrade the analytics subsystem to a newer version of API Connect on Kubernetes.

Before you begin

Review and complete all steps in:

About this task

Upgrade the analytics subsystem by updating the version property in your analytics CR. The API Connect operator detects this change and starts the upgrade.

Procedure

Update the analytics CR for the new version of API Connect.
1. Run the following command to edit the CR:
```
kubectl -n <namespace> edit a7s
```
2. Set the spec.version property in the analytics CR to your target version:
  For example:
```
version: 10.0.10.0
```
3. If you are upgrading to a version of API Connect that requires a new license, update spec.license.
  For example:
```
license: L-RAWZ-DSFFFV
```
  For the list of licenses, see API Connect licenses.
4. Optional: Set the size of local database backup storage.
  Upgrades to V10.0.8.0: By default the new PVC that is created for the analytics subsystem's local database backups is set to 150Gi. If you want to specify a larger size, then add the following to the CR spec section:
```
  storage:
    backup:
      volumeClaimTemplate:
        storageClassName: <storage class>
        volumeSize: <size>
```
  where:
  - <storage class> is the same as used by your other analytics PVCs.
  - <size> is the size. For example: 500Gi. See Estimating storage requirements.
5. Attention: This step applies only when upgrading to API Connect version 10.0.10 or later.
  $PLATFORM_CA_SECRET Set to ingress-ca. The $PLATFORM_CA_SECRET contains the CA certificate for the platform ingress endpoint of the management subsystem. The analytics makes calls to the platform REST API and this property must be set so that the analytics can verify the server certificate.
```
mgmtPlatformEndpointCASecret:
               secretName: $PLATFORM_CA_SECRET
```
  Note: The value of secretName must match the name of the Kubernetes Secret containing the CA certificate for the platform ingress endpoint.
  Optional: In-cluster subsystem communication (mgmtPlatformEndpointSvcCASecret)
  If you plan to enable In-cluster intersubsystem communication (internal Kubernetes service-based communication instead of ingress) you can optionally configure the mgmtPlatformEndpointSvcCASecret field.
```
mgmtPlatformEndpointSvcCASecret:
        secretName: management-ca  # Usually 'management-ca
```
  The management-ca secret contains the certificate authority (CA) certificate that the internal Kubernetes service uses to sign its TLS certificates. This secret is typically generated automatically during the management subsystem installation. Copy the management-ca secret to the Analytics namespace.
6. Save your changes to the CR.
  
  When you save the updated CR, the upgrade starts automatically.
  
  Troubleshooting: If you see an error message when you attempt to save the CR, see the known upgrade issues.

Run the following command to verify that the upgrade was successful:

kubectl get apic -n <namespace>

Example output after an analytics subsystem upgrade:

NAME                                                      READY   STATUS    VERSION              RECONCILED VERSION      AGE
analyticscluster.analytics.apiconnect.ibm.com/analytics   5/5     Running   <version>   <version-build>   121m

If the upgrade appears to be stuck, showing the status of Pending for a long time, then check the analytics CR status for errors:

kubectl -n <namespace> get a7s -o yaml

Refer to Troubleshooting upgrades on Kubernetes, for known issues.

Update analytics profile.
If your analytics subsystem uses the n3xc4.m16 profile, then update the profile in your analytics CR to n3xc4.m32. For information about switching profiles, see Changing deployment profiles on Kubernetes and OpenShift