Uninstallation and upgrade

This article covers various topics of uninstallation, cleanup, and upgrade of Airlock Microgateway. Note that some instructions in this article are release-dependent because upgrading from Microgateway versions 4.0 and 4.1 to helm-install-based Microgateway 4.2 (and newer) is not possible.

 
Notice

Do not add the --reuse-values flag during the helm upgrade operations when upgrading to a different version of Airlock Microgateway/Helm charts. This flag would prevent updating some required settings and changes, such as new chart default values and container image digests.

If the helm upgrade command does not change the Airlock Microgateway version, the flag is safe to use in the commands below, e.g., to clean up test resources.

Upgrade from Microgateway 4.1 to 4.2

When changing from any older Airlock Microgateway 4 version to Microgateway 4.2 and newer, you must uninstall the old version first. Except the CRDs and the CNI plugin have been installed via Helm. The following brief sequence describes the upgrade from a Microgatway 4.x release to 4.2 and newer.
Note that the instructions must be performed in the correct order.

  1. Label all the applications that should be protected with Airlock Microgateway with the new label sidecar.microgateway.airlock.com/inject=true . This is necessary because we switched from annotation to label.
  2. Uninstall the Microgateway CNI plugin if it was installed with kustomize.

  3. Adapt the <environment> part before running the following command:

  4.  
    Terminal box
    kubectl kustomize --enable-helm https://github.com/airlock/microgateway/deploy/cni/<environment> | kubectl delete -f -
  5. Upgrade the Microgateway CNI plugin. If the CNI plugin was installed with kustomize the command is helm install instead of helm upgrade.
  6.  
    Terminal box
    helm upgrade airlock-microgateway-cni -n kube-system oci://quay.io/airlockcharts/microgateway-cni --version '4.3.0'
  7. Uninstall Microgateway deployments. Note that you must not uninstall the CRDs.
  8.  
    Terminal box
    kubectl delete -k https://github.com/airlock/microgateway/deploy/deployment/
kubectl delete -k https://github.com/airlock/microgateway/deploy/crd-rbac/
  9. Apply the new license. This is important because the license format changed in Microgateway 4.2.
  10.  
    Terminal box
    kubectl create namespace airlock-microgateway-system
kubectl -n airlock-microgateway-system create secret generic airlock-microgateway-license --from-file=microgateway-license.txt
  11. Update the CRDs. This will not break your current installation if not noted otherwise in the release notes of the new Microgateway version.
  12.  
    Terminal box
    kubectl apply -k https://github.com/airlock/microgateway/deploy/charts/airlock-microgateway/crds/?ref=4.3.0
  13. Install the new Microgateway Operator.
  14.  
    Terminal box
    helm install airlock-microgateway -n airlock-microgateway-system oci://quay.io/airlockcharts/microgateway --version '4.3.0'
  15. You can verify the current Pod status by checking the version label. To finalize the upgrade process, manually restart all application Pods containing Microgateway Engine sidecars. See Uninstallation and upgrade (MGW) section in this article.

Uninstalling Microgateway versions 4.0 and 4.1

  1. Remove the label sidecar.microgateway.airlock.com/inject from your applications and make sure they are restarted.
  2. Uninstall Microgateway deployments and the CRDs.
  3.  
    Terminal box
    kubectl delete -k https://github.com/airlock/microgateway/deploy/deployment/
kubectl delete -k https://github.com/airlock/microgateway/deploy/crd-rbac/
kubectl delete -k https://github.com/airlock/microgateway/deploy/crds
  4. Uninstall the Microgateway CNI plugin.

  5. If the CNI plugin has been manually installed using kustomize adapt the <environment> part before running the following command:

  6.  
    Terminal box
    kubectl kustomize --enable-helm https://github.com/airlock/microgateway/deploy/cni/<environment> | kubectl delete -f -

  7. If the CNI plugin has been installed using helm, run:

  8.  
    Terminal box
    helm uninstall -n kube-system airlock-microgateway-cni

Uninstalling Microgateway version 4.2 and newer

Airlock Microgateway 4.2 and newer releases are helm-based and can be uninstalled using helm commands. However, helm does not support removing installed CRDs, which requires using kubectl delete commands to complete the uninstallation process.

  1. Remove the label sidecar.microgateway.airlock.com/inject from your applications and make sure they are restarted.
  2. Uninstall the Microgateway Operator.
  3.  
    Terminal box
    helm uninstall -n airlock-microgateway-system airlock-microgateway
  4. Uninstall the CRDs.
  5.  
    Notice

    Before uninstalling the CRDs make sure that no other Airlock Microgateway installation is existing.

  6.  
    Terminal box
    kubectl delete -k "https://github.com/airlock/microgateway/deploy/charts/airlock-microgateway/crds/?ref=<installed-release-version>"
  7. Uninstall the Microgateway CNI plugin.
  8.  
    Terminal box
    helm uninstall -n kube-system airlock-microgateway-cni

Cleanup after installation tests for Microgateway version 4.2 and newer

CNI and operator test pods are not automatically uninstalled after test completion. We recommend uninstalling them after testing, even if they are inactive and do not require any resources.

  1. Delete the CNI test Pods.
  2.  
    Terminal box
    kubectl delete pod -n kube-system -l "app.kubernetes.io/instance=airlock-microgateway-cni,app.kubernetes.io/component=test-install"
  3. Delete the Operator test Pods.
  4.  
    Terminal box
    kubectl delete pod -n airlock-microgateway-system -l "app.kubernetes.io/instance=airlock-microgateway,app.kubernetes.io/component=test-install"
  5. To remove remaining test resources, run:
  6.  
    Terminal box
    helm upgrade airlock-microgateway -n airlock-microgateway-system --set tests.enabled=false --reuse-values oci://quay.io/airlockcharts/microgateway --version '<installed-version>'
helm upgrade airlock-microgateway-cni -n kube-system --set tests.enabled=false --reuse-values oci://quay.io/airlockcharts/microgateway-cni --version '<installed-version>'

Upgrading Microgateway 4.2 and newer

The following upgrade instructions aim to upgrade running deployments to a newer version of Airlock Microgateway without interruption of service.

 
Notice

This instruction may not apply to breaking release upgrades of Airlock Microgateway. Refer to the release notes of the Microgatway version you want to upgrade to before following the below instructions.

  1. Update the CRDs. This will not break your current installation if not noted otherwise in the release notes of the new Microgateway version.
  2.  
    Terminal box
    kubectl apply -k https://github.com/airlock/microgateway/deploy/charts/airlock-microgateway/crds/?ref=4.3.0 --server-side --force-conflicts
  3. Upgrade the Microgateway CNI plugin.
  4.  
    Terminal box
    helm upgrade airlock-microgateway-cni -n kube-system oci://quay.io/airlockcharts/microgateway-cni --version '4.3.0'
  5. Upgrade the Microgateway Operator.
  6.  
    Terminal box
    helm upgrade airlock-microgateway -n airlock-microgateway-system oci://quay.io/airlockcharts/microgateway --version '4.3.0'
  7. You can verify the current Pod status by checking the version label. To finalize the upgrade process, manually restart all application Pods containing Microgateway Engine sidecars.

Script-supported upgrading of deployments with outdated application Pods:

We have created a useful script to accelerate the deployment update process with multiple application Pods. The script can fetch Deployments, DaemonSets, and StatefulSets managing outdated application Pods.

  1. Save the script fetch-outdated-resources, rename it to fetch-outdated-resources.sh, and make it executable.
  2.  
    Example
    #!/bin/sh 
set -eu 
namespace=${1:-"default"} 
 
pod_selector="sidecar.microgateway.airlock.com/incompatible=true"
 
rootController() { 
    namespace=$1 
    resource=$2 
    owner=$(kubectl get "${resource}" -n "${namespace}" -ojsonpath='{range .metadata.ownerReferences[?(@.controller==true)]}{.kind}/{.name}{"\n"}{end}') 
    if [ -n "$owner" ]; then 
        rootController "${namespace}" "${owner}" 
    elif echo "${resource}" | grep -vq Pod/; then 
        echo "${resource}" 
    fi 
} 
 
for pod in $(kubectl get pods -n "${namespace}" -l "${pod_selector}" -ojsonpath='{range .items[*]}Pod/{.metadata.name}{"\n"}{end}'); do 
        rootController "${namespace}" "${pod}" 
done | sort -u
  3. Variant 1

  4. Automatic rollout restart of outdated resources with the following command:

  5.  
    Terminal box
    ./fetch-outdated-resources.sh <application-namespace> | xargs kubectl rollout restart -n <application-namespace>
  6. Variant 2
    1. Set the microgateway.airlock.com/restartRequired=true label.
    2.  
      Terminal box
      ./fetch-outdated-resources.sh <application-namespace> | xargs -I{} kubectl label {} -n <application-namespace> "restartRequired=true"
    3. Perform a rollout restart of the labeled resources.
    4.  
      Terminal box
      kubectl rollout restart -n <application-namespace> deployments -l microgateway.airlock.com/restartRequired=true
kubectl rollout restart -n <application-namespace> daemonsets -l microgateway.airlock.com/restartRequired=true
kubectl rollout restart -n <application-namespace> statefulsets -l microgateway.airlock.com/restartRequired=true
    5. Remove the microgateway.airlock.com/restartRequired=true label after rollout.

Further information and links

Internal links:

  • See chapter Installation for available installation options and instructions.