Upgrading Operator releases

Upgrade considerations for channels, versions, and licenses

To obtain curated versions of the IBM App Connect Operator, clusters that are connected to the internet can either access the IBM Operator Catalog or a product-specific App Connect catalog. Clusters in an air-gapped (restricted network) environment, which is not connected to the internet, similarly use a product-specific App Connect catalog within the network. The Operator Lifecycle Manager (OLM), which runs by default in the cluster, queries the catalog for new versions of the IBM App Connect Operator.

The IBM App Connect Operator is installed and managed by OLM. OLM tracks the specified channel in the catalog for new versions of the Operator, and based on the approval strategy that was specified during installation, identifies whether an automatic or manual upgrade should occur for a running Operator.

• Upgrading from an 11.4.0 or earlier Continuous Delivery (CD) version of the IBM App Connect Operator to version 11.5.x: Because the IBM App Connect Operator 11.5.x is delivered on a different channel from earlier versions, you must initialize an upgrade to this latest version by manually updating the existing v11.4 or earlier "Continuous Delivery" channel in your Operator subscription to the v11.5 channel. OLM will then track the v11.5 channel in the catalog for new versions of the Operator, and upgrade the Operator according to the approval strategy that was specified during installation.
  Note: If you want to upgrade from an Extended Update Support (EUS) or a Long Term Support (LTS) release to the latest CD release of the Operator, see Upgrading from an Extended Update Support (EUS) or a Long Term Support (LTS) release to a Continuous Delivery (CD) release. All EUS releases are now End of Support (EOS).
• Upgrading from an earlier IBM App Connect Operator 11.5.x (for example, 11.5.0) to a subsequent 11.5.x: If Automatic approval is set on the Operator's subscription, OLM automatically upgrades the Operator to the latest version, but requires manual intervention if Manual approval is set on the subscription.

After the Operator is upgraded, it determines how to upgrade existing instances of your custom resources:

• If you upgraded from IBM App Connect Operator 11.4.0 or earlier to 11.5.x, manual intervention will typically be required to complete each upgrade due to the change in the Operator channel:
  • To upgrade your instances to the latest version that the Operator provides (on the v11.5 Operator channel), you must ensure that the spec.version value is set to subscribe to the 12.0 or 12.0.12 custom resource channel, or is set to the latest fully qualified 12.0.12.0-rX version.
  • Because the release includes new features in addition to fixes, new licenses are generally required to run the instances, so also ensure that the spec.license.licence value is updated with the appropriate license.
• For subsequent releases of 11.5.x Operator versions in the v11.5 channel, existing instances of your custom resources will be upgraded as follows:
  • If the same licenses apply and spec.version is set to a channel, OLM will automatically upgrade an instance to the latest version.
  • If the same licenses apply and spec.version is set to a fully qualified version number, you will need to update the spec.version value for an instance to upgrade to the latest version. You can specify the latest fully qualified version number or a channel.
  • If a new set of licenses are required, and spec.version is set to a channel, you will need to update the spec.license.licence value for an instance in order to complete the upgrade. (Operator versions sometimes include new features in addition to fixes, so new licenses might be required to run the instances.)
  • If a new set of licenses are required, and spec.version is set to a fully qualified version number, you will need to complete the upgrade as follows:
    • Update the spec.license.licence value.
    • Update the spec.version value to the latest fully qualified version number or to a channel.

For more information, see spec.version values and Licensing reference for IBM App Connect Operator.

Guidance for online or air-gapped environments that use a product-specific App Connect catalog source for installation

If you installed the IBM App Connect Operator from a product-specific App Connect catalog source, you might need to update the catalog source and images for the Operator before you start the upgrade process. For more information, see Updating the catalog sources and images for an IBM App Connect upgrade.

Guidance for the supported Red Hat OpenShift versions

• If you are upgrading to IBM App Connect Operator 11.0.0 or later, Red Hat OpenShift 4.12 or 4.14 is supported.
• If you are upgrading to IBM App Connect Operator 7.1.0 through 10.1.1, Red Hat OpenShift 4.10 or 4.12 is supported. (Earlier versions of the Operator support Red Hat OpenShift 4.10 or earlier.)

The Red Hat OpenShift version that you upgrade to determines which channels or versions are supported for your App Connect Dashboard, App Connect Designer, switch server, integration server, and integration runtime instances. For more information, see Implications for the installed Red Hat OpenShift version.

Upgrade considerations for identity and access management (IAM) on Red Hat OpenShift

In IBM App Connect Operator 10.1.1 or earlier, you can secure access to your App Connect Designer and App Connect Dashboard instances by using the IAM service that IBM Cloud Pak foundational services 3.19.x or later 3.x.x provides. In IBM App Connect Operator 11.0.0 or later, IAM is implemented by using Keycloak.

To enable IAM with Keycloak specifically for App Connect, the following Operators need to be installed in your cluster.

If you want to use IAM to secure access to your App Connect Designer and App Connect Dashboard instances when you upgrade to IBM App Connect Operator 11.0.0 or later, either of these options apply:

• If your IBM App Connect Operator 10.1.1 or earlier is installed within an IBM Cloud Pak for Integration deployment that uses the IAM foundational service, the high-level sequence of steps is as follows. (Depending on your existing version, you might also need to upgrade Red Hat OpenShift Container Platform.)
  1. Install or upgrade the relevant Operators.
  2. Upgrade the IBM Cloud Pak Platform UI.
  3. Configure the new IAM system and migrate your users to Keycloak. For information about the new roles that you can assign for your Designer and Dashboard resources, see Roles and permissions for App Connect Designer on Red Hat OpenShift and Roles and permissions for the App Connect Dashboard on Red Hat OpenShift.
  4. Upgrade your App Connect instances and other product capability instances.

  For more information, see the IBM Cloud Pak for Integration upgrade instructions.

• If you are licensed to use an independent deployment of the IBM App Connect Operator, you need to migrate your Operator to be part of an IBM Cloud Pak for Integration deployment because this is a requirement for IAM with Keycloak. However, your license does not grant you full access to IBM Cloud Pak for Integration. Follow the IBM Cloud Pak for Integration upgrade instructions to upgrade your system, but take note of the following points:
  • You need to install the IBM Cloud Pak for Integration Operator, cert-manager Operator for Red Hat OpenShift (or IBM Cert Manager), and IBM Cloud Pak foundational services Operator as part of this process.
  • Your license entitlement does not include use of the IBM Cloud Pak Platform UI, so do not install it.
    Note: To install the Keycloak IAM system without the IBM Cloud Pak Platform UI, manually trigger the installation of Keycloak before you upgrade your App Connect instances. You can trigger the installation of Keycloak by creating a Cp4iServicesBinding resource in a namespace that contains your instances. For more information, see Installing the identity and access management system without Platform UI.

If you are using an independent deployment of the IBM App Connect Operator and don't want to use IAM to secure access to your upgraded Designer and Dashboard instances, you can upgrade as described in Upgrading from an earlier to a later Continuous Delivery (CD) release.

Implications for CouchDB storage for App Connect Designer

If your existing IBM App Connect Operator deployment supports App Connect Designer 12.0.4.0-r2 or earlier instances, you need to apply a two-stage upgrade for your Operator and Designer instances to enable you to run your 12.0.4.0-r2 or earlier instances in Operator 11.5.x or later. Before you try to upgrade your Operator and Designer instances, review the guidance in Upgrade considerations for the Operator for Apache CouchDB and App Connect Designer.