Upgrade Ambassador Edge Stack 3.4.Z to Ambassador Edge Stack 3.10.2 (YAML)

Since Ambassador Edge Stack's configuration is entirely stored in Kubernetes resources, upgrading between versions is straightforward.

Resources to check before migrating to 3.10.2.

Ambassador Edge Stack 3.4 has been upgraded from Envoy 1.23 to Envoy 1.24.1 which removed support for the LightStep tracing driver. The team at LightStep and the maintainers of Envoy-Proxy recommend that users instead leverage the OpenTelemetry Collector to send tracing information to LightStep. We have written a guide which can be found here Distributed Tracing with OpenTelemetry and Lightstep that outlines how to set this up. It is important that you follow this upgrade path prior to upgrading or you will drop tracing data.

Migration Steps

Migration is a two-step process:

1. Install new CRDs.

   After reviewing the changes in 3.x and confirming that you are ready to upgrade, the process is the same as upgrading minor versions in previous version of Ambassador Edge Stack and does not require the complex migration steps that the migration from 1.x tto 2.x required.

   Before installing Ambassador Edge Stack 3.10.2 itself, you need to update the CRDs in your cluster. This is mandatory during any upgrade of Ambassador Edge Stack.

   Ambassador Edge Stack 3.10.2 includes a Deployment in the `emissary-system` namespace called emissary-apiext. This is the APIserver extension that supports converting Ambassador Edge Stack CRDs between getambassador.io/v2and getambassador.io/v3alpha1. This Deployment needs to be running at all times.
   If the emissary-apiext Deployment's Pods all stop running, you will not be able to use getambassador.io/v3alpha1 CRDs until restarting the emissary-apiext Deployment.
   There is a known issue with the emissary-apiext service that impacts all Ambassador Edge Stack 2.x and 3.x users. Specifically, the TLS certificate used by apiext expires one year after creation and does not auto-renew. All users who are running Ambassador Edge Stack/Emissary-ingress 2.x or 3.x with the apiext service should proactively renew their certificate as soon as practical by running kubectl delete --all secrets --namespace=emissary-system to delete the existing certificate, and then restart the emissary-apiext deployment with kubectl rollout restart deploy/emissary-apiext -n emissary-system. This will create a new certificate with a one year expiration. We will issue a software patch to address this issue well before the one year expiration. Note that certificate renewal will not cause any downtime.

2. Create an Ambassador Cloud Connect Token

   Ambassador Edge Stack requires a license to operate. Licenses are obtained and refreshed automatically using an API Token. If your installation of Ambassador Edge Stack is already connected to the cloud then you can skip this step. Otherwise, you can create a Cloud Connect Token in Ambassador Cloud and apply it using the command below. For more information on licensing please refer to the license page.

3. Install Ambassador Edge Stack 3.10.2.

   After installing the new CRDs, upgrade Ambassador Edge Stack 3.10.2: