Upgrade Guide

Compatibility

Pre-Upgrade Checklist

1. Read CHANGELOG.md for breaking changes.
2. Snapshot the control-plane state.
3. Verify the audit log is intact:

``bash denpex-control-plane audit-verify --since 24h ``

1. Confirm cluster capacity (rollout may double-restart pods):

``bash kubectl get nodes -o wide ``

Helm Upgrade

helm repo update
helm upgrade denpex denpex/denpex-platform \
    --namespace denpex-system \
    --reuse-values \
    --set controlPlane.image.tag=0.7.0 \
    --set agent.image.tag=0.7.0 \
    --set remediator.image.tag=0.7.0

CRD Upgrade

kubectl apply -f https://charts.denpex.ai/crds/denpex-noderemediation-v0.7.yaml

The CRD upgrade is a no-op for existing CRs (additive).

Audit Log Migration (0.5.x → 0.6.x)

denpex-control-plane audit migrate \
    --from /var/lib/denpex/audit-v0.5 \
    --to /var/lib/denpex/audit-v0.6

Rollback

helm rollback denpex 1

If the upgrade introduces a regression, roll back and report to support with denpex-control-plane diag --bundle.

Verification

After upgrade:

denpex-control-plane health
helm test denpex -n denpex-system

Multi-Region (self-hosted / on-prem only)

This section applies to self-hosted / on-prem multi-region installations. The Denpex SaaS control plane is single-region primary (WNAM) with globally-replicated reads and has no multi-region installation to upgrade (see docs/operations/SLA.md). For a self-hosted / on-prem multi-region installation, upgrade the secondary region first, observe for 24h, then upgrade the primary.