This is unreleased documentation for Runtime Enforcer 0.11-dev.

Upgrade path

Versioning

Runtime Enforcer uses semantic versioning. A version follows the MAJOR.MINOR.PATCH pattern. The supported version is the latest release.

Two deliverables follow this version:

  • The runtime-enforcer Helm chart, in its appVersion field. The controller, the agent, and the debugger images carry this version as their tag.

  • The kubectl runtime-enforcer plugin binary.

Version compatibility among components

The Helm chart appVersion and the kubectl runtime-enforcer plugin must run the same MAJOR.MINOR.PATCH version. If the chart runs appVersion 0.10.1, install the plugin binary from the v0.10.1 release.

Helm chart versions

A Helm chart has two version fields. The appVersion field holds the Runtime Enforcer version described above. The version field is the version of the chart itself. It also follows semantic versioning, and it describes changes to the chart templates and to values.yaml.

The two fields do not move together. When you plan an upgrade, read the appVersion of the target chart.

Upgrade paths

You can upgrade across several PATCH versions in one operation. You cannot upgrade across more than one MINOR or MAJOR version in one operation.

For example, you can upgrade from 0.10.0 to 0.10.1 in one step. You cannot upgrade from 0.9.0 to 0.11.0 in one step. Upgrade from 0.9.0 to 0.10.x first, then from 0.10.x to 0.11.0. To move across a MAJOR version, apply every MINOR version between the two.

flowchart LR; accTitle: Upgrade path support graph accDescr: A diagram showing supported and unsupported upgrade paths for Runtime Enforcer. 0.9.0(0.9.0)-->0.9.1(0.9.1); 0.9.1-->0.10.0(0.10.0); 0.10.0-->0.10.1(0.10.1); 0.9.0-->0.10.0; 0.10.1-->0.11.0(0.11.0); 0.10.0-->|Not recommended|0.11.0; 0.9.1-->|Not supported|0.11.0; linkStyle 5 color:brown,stroke-width:2px,stroke-dasharray: 3 5 linkStyle 6 color:red,stroke-width:2px,stroke-dasharray: 3 5
Figure 1. Example upgrade path support graph

Upgrade order

Upgrade the runtime-enforcer Helm chart first. The chart upgrades the controller, the agent, and the debugger together. Then install the kubectl runtime-enforcer plugin binary from the same release.

The agent DaemonSet uses a rolling update with a surge. The new agent pod on a node loads every policy and binds every running pod before the old pod stops. Protection does not lapse during the upgrade. See Architecture for the sequence.

Downgrades

Runtime Enforcer does not support downgrades, and the project does not test them.

Policies

A WorkloadPolicy carries no version of its own. It holds a mode and an allow-list, and it stays in the cluster across Runtime Enforcer upgrades. You do not rewrite or re-apply your policies when you upgrade.