Upgrading Maximo Application Suite

You can upgrade Maximo Application Suite automatically or manually. Before you upgrade, you must complete several prerequisite tasks to ensure that your Suite environment meets the upgrade requirements.

Upgrade methods

To upgrade Maximo Application Suite and its applications, you can use the methods in the following table. The upgrade method that is used is determined by your chosen installation method.

Upgrade method Maximo Application Suite upgrades Application upgrades
Manual - You manually keep Maximo Application Suite up-to-date with the latest version.
- You are notified when a new version is available.
- You are responsible for ensuring compatibility between versions.
- You use this upgrade method if you installed Maximo Application Suite by downloading the software from IBM Passport Advantage and running the installer script. For more information, see Installation process.
- You manually update your applications to new versions.
- You are notified when new application versions are available.
- You are responsible for ensuring application version compatibility.
Channel subscription - Your Maximo Application Suite instance is automatically kept up-to-date with the latest version that is available in the Suite operator's subscription channel.
- Optionally, you can reconfigure the subscription to ensure that upgrades require manual approval before they begin.
- This upgrade method is used if you installed Maximo Application Suite from the IBM Operator Catalog in your OpenShift cluster. For more information, see Installation process.
- Your application is automatically kept up-to-date with the latest version that is available in the application operator's subscription channel.
- You are notified when an update is available.
- If you turned on the Automatic approval switch when you deployed the application, it is automatically updated to the most current version in the channel. If you turned off this switch, you must manually approve the update.

After you install the Suite or deploy an application, you cannot change the upgrade method. To use a different upgrade method, you must reinstall the Suite or delete and redeploy the application.

Prepare your environment

Complete the following steps to prepare your Suite environment for the upgrade:

  1. If your Suite includes deployed instances of Maximo Assist 8.3.x or Maximo Visual Inspection 8.4.x, delete them because they are not supported in version 8.7.0 and later versions of the Suite. For more information, see Deactivating and deleting applications.
  2. Use this process to update your remaining deployed applications to the versions in the following table:

    Application Version
    IoT tool 8.4.2
    Maximo Health 8.2.2
    Maximo Health and Predict - Utilities 8.2.2
    Maximo Manage 8.2.2
    Maximo Monitor 8.6.2
    Maximo Predict 8.4.1
    Maximo Safety 8.2.2
  3. Update your Suite configuration to use IBM Certificate Manager instead of JetStack cert-manager for certificate management.
    Important: This task affects all of the applications in the OpenShift cluster that use cluster issuers to sign security certificates. During this task, you move cluster issuer resources from the namespace that JetStack cert-manager uses to the namespace that IBM Certificate Manager uses, which is ibm-common-services. You then reconfigure the Suite to use IBM Certificate Manager and the ibm-common-services namespace. However, other applications in the OpenShift cluster might also use cluster issuers. You must also reconfigure these applications to use IBM Certificate Manager and the ibm-common-services namespace.

    1. In the ibm-common-services namespace, install the IBM Certificate Manager service by using one of the following methods:
    2. In your OpenShift cluster, in the cert-manager namespace, run the following commands to remove the JetStack cert-manager operator:
      oc delete deployment -n cert-manager cert-manager
      oc delete deployment -n cert-manager cert-manager-webhook
      oc delete deployment -n cert-manager cert-manager-cainjector
      
    3. Copy the required secret, certificate, and issuer resources from the cert-manager namespace to the ibm-common-services namespace.

      1. If your Suite environment uses self-signed security certificates, copy the public secret, certificate, and issuer resources to the ibm-common-services namespace.
        • For secrets, run the following command:
          oc get secret <instanceid>-cert-public-ca --namespace=cert-manager -o yaml | sed 's/namespace: .*/namespace: ibm-common-services/' | oc create -f -
          
        • For certificates, run the following command:
          oc get certificate <instanceid>-cert-public-ca --namespace=cert-manager -o yaml | sed 's/namespace: .*/namespace: ibm-common-services/' | oc create -f -
          
        • For issuers, run the following command:
          oc get issuer <instanceid>-cert-public-ca --namespace=cert-manager -o yaml | sed 's/namespace: .*/namespace: ibm-common-services/' | oc create -f -
          
      2. Copy the internal secret, certificate, and issuer resources to the ibm-common-services namespace by running the following commands:
        • For secrets, run the following command:
          oc get secret <instanceid>-cert-internal-ca --namespace=cert-manager -o yaml | sed 's/namespace: .*/namespace: ibm-common-services/' | oc create -f -
          
        • For certificates, run the following command:
          oc get certificate <instanceid>-cert-internal-ca --namespace=cert-manager -o yaml | sed 's/namespace: .*/namespace: ibm-common-services/' | oc create -f -
          
        • For issuers, run the following command:
          oc get issuer <instanceid>-cert-internal-ca --namespace=cert-manager -o yaml | sed 's/namespace: .*/namespace: ibm-common-services/' | oc create -f -
          
      3. Copy the public ClusterIssuer secret to the ibm-common-services namespace. First, find the Cluster Issuer name to then get the secret name. Then, copy the secret to the namespace.
        1. Get the public Cluster Issuer name by running the following command:
          oc get suite <instanceid> -o yaml -n mas-<instanceid>-core
          
          The public Cluster Issuer name is defined in the output status.cert-manager.external.name. For example, the Cluster Issuer name in the following output is mas-<instanceid>-core-public-issuer.
          status:
           apis:
             internal:
               url: https://internalapi.mas-<instanceid>-core.svc
           cert-manager:
             external:
               duration: 8760h0m0s
               name: mas-<instanceid>-core-public-issuer
               renewBefore: 720h0m0s
             internal:
               duration: 175200h0m0s
               name: mas-<instanceid>-core-internal-issuer
               renewBefore: 2160h0m0s
          
        2. Use the public Cluster Issuer name to find the secret name by running the following command:
          oc get ClusterIssuer <public_cluster_issuer_name> -o yaml
          
        3. Copy the public Cluster Issuer secret to the namespace by running the following command:
          oc get secret <secret_name> --namespace=cert-manager -o yaml | sed 's/namespace: .*/namespace: ibm-common-services/' | oc create -f -
          
      4. Copy the internal Cluster Issuer secret to the ibm-common-services namespace. First, find the Cluster Issuer name to then get the secret name.
        1. Get the internal Cluster Issuer name by running the following command:
          oc get suite <instanceid> -o yaml -n mas-<instanceid>-core
          
          The internal Cluster Issuer name is defined in the output status.cert-manager.internal.name.
        2. Use the internal Cluster Issuer name to find the secret name by running the following command:
          oc get ClusterIssuer <internal_cluster_issuer_name> -o yaml
          
        3. Copy the internal Cluster Issuer secret to the namespace by running the following command:
          oc get secret <secret_name> --namespace=cert-manager -o yaml | sed 's/namespace: .*/namespace: ibm-common-services/' | oc create -f -
          
          Note: If your cluster contains multiple instances of the Suite, ensure that you copy the secrets for all instances. In addition, if you made any customizations to cert-manager, such as setting up external webhooks or DNS configuration, reapply these customizations to IBM Certificate Manager.
    4. Reconfigure your Suite instance to use IBM Certificate Manager and the ibm-common-services namespace by completing the following steps:

      1. Edit the Suite's custom resource definition by running the following command:
        oc edit suite -n mas-<instanceid>-core <instanceid>
        
      2. In the spec: section, specify the new namespace by adding the following field and label:
        spec:
        certManagerNamespace: ibm-common-services
        
      3. Save your changes and exit the editor.
      4. Run the following command:
        oc get suite -n mas-<instanceid>-core <instanceid> -o yaml
        
        In the spec: section of the output, verify that the certificate management namespace is set to ibm-common-services.
      5. Wait for the reconciliation of the Suite operator to complete. You can monitor the progress of this reconciliation by running the following command:
        oc get suite -n mas-<instanceid>-core \ -o jsonpath='{..status.conditions[?(@.type=="Running")].message}'
        
        If the command's output message is Running reconciliation, the reconciliation is still running. If the output message is Awaiting next reconciliation, the reconciliation is complete.
    5. Verify that all ClusterIssuers, issuers, and certificates are in a healthy state by running the following commands and reviewing the output of each command:

      oc get clusterissuer
      oc get issuer -n ibm-common-services
      oc get certificate -n ibm-common-services
      

      If the ClusterIssuer, issuer, or certificate is in a healthy state, the READY column in the command output displays TRUE.

    6. Reconfigure all of the other applications in your OpenShift cluster that use cluster issuers to use IBM Certificate Manager and the ibm-common-services namespace for certificate management. Refer to each application's documentation for the required commands.
  4. If your Suite instance uses Cloud Pak for Data components, upgrade your Cloud Pak for Data system to version 4.0.

Upgrade Maximo Application Suite

Use the upgrade process that applies to your upgrade method.

Update applications

When the Maximo Application Suite upgrade is complete, updated applications are made available. For each application, an update is automatically deployed only if you chose the Subscription upgrade method and the Automatic approval option when you deployed the application.

If you deleted deployed instances of Maximo Assist and Maximo Visual Inspection before you upgraded the Suite, you can use these steps to deploy version 8.4.0 of Maximo Assist and these steps to deploy version 8.5.0 of Maximo Visual Inspection.

To update your remaining deployed Suite applications, use the application update process. You must complete any pre-update, update, and post-update steps before you start to use the updated applications.

Optional: Upgrade your OpenShift cluster and Service Binding Operator

You can minimize issues in future Suite upgrades by completing the following steps:

  1. Upgrade your OpenShift cluster from version 4.6 to version 4.7. You can use the OpenShift Update Service to help you complete this upgrade. For more information, see this OpenShift documentation.
  2. Upgrade your cluster from version 4.7 to version 4.8.
  3. If your Suite includes a deployed instance of Maximo Predict, update this application to version 8.5.0. Version 8.4.1 of Maximo Predict is incompatible with version 4.8 of OpenShift.
  4. Uninstall version 0.8 of the Service Binding Operator.
    1. In the OpenShift web console, go to the OperatorHub.
    2. In the filter field, enter Service Binding and click the Service Binding Operator icon.
    3. In the operator page, click Uninstall.
    4. In the dialog that prompts you to remove the operator from all namespaces, click Uninstall.
  5. Install version 1.0 of the Service Binding Operator. This version is optional for version 8.7 of the Suite but is mandatory for future Suite versions.
    1. In the OperatorHub, in the filter field, enter Service Binding and click the Service Binding Operator icon.
    2. In the operator page, click Install.

Troubleshooting upgrade issues

If you encounter issues during or after the upgrade, use the troubleshooting information in this documentation to help you resolve the issues. For more information, see Troubleshooting upgrade issues.