Before you upgrade:

  • Create backups of the docker-compose.yml and .env files. These files contain your server’s custom configurations and are overwritten during the upgrade.
  • If you’re also updating your OS to RHEL 9, you must first update your container engine from Docker to Podman, as Red Hat no longer supports Docker in RHEL v9.x. For more information and instructions, see Switching from docker to podman.

​
Service account roles

If you are currently using Package Security Manager 6.1.6 or later, skip ahead to Upgrading to a newer version.

Before you upgrade, you must verify that the correct permissions are set for the service account. If you do not, the Keycloak API will not be able to query user roles and users will lose all their assigned permissions.

  1. Open a browser and log in to your Keycloak admin panel using your existing Keycloak credentials. Your Keycloak admin panel can be found at https://<YOUR_DOMAIN>/auth/admin.
  2. Navigate to the Clients page from the left-hand navigation menu, then select repo-account-sync from the list.
  3. Select the Service Account Roles tab at the top of the page, then open the Client Roles dropdown menu and select realm-management.
  4. Add manage-users and manage-realm to the Assigned Roles.

​
Upgrading to a newer version

Package Security Manager supports upgrading from your current version without halting the program.

Before you upgrade, ensure your environment meets the new version’s system requirements.

​
Upgrade steps

1

Download your installer

Download your installer by running the command:

# Replace `<INSTALLER_LOCATION>` with the provided installer URL
curl -O `<INSTALLER_LOCATION>`
2

Upgrade commands

Run one of the following upgrade commands. Choose the command that corresponds with your setup.

# Replace `<INSTALLER>` with the installer you just downloaded
# Replace `<PATH_TO_REPO_FOLDER>` with the path to your repository - the default path is /opt/anaconda/repo
# Replace `<FQDN>` with your fully qualified domain name
# Replace `<PREVIOUS_INSTALLER>` with the location of the previous installer file (where the docker-compose.yml is located)
bash `<INSTALLER>`  -- -b `<PATH_TO_REPO_FOLDER>` -d `<FQDN>` --upgrade-from ../`<PREVIOUS_INSTALLER>`

If your current version of Package Security Manager is utilizing Grafana, you must include the following argument in your upgrade. If you do not, you will lose access to your Grafana dashboards. Upgrading removes your previous version of Grafana.

--grafana-monitor-stack

Don’t forget to log in and update your password for your Grafana monitoring dashboards!

Once the upgrade is complete, run the following command to instruct Keycloak to allow HTTP traffic:

# Replace `<ADMIN_PASSWORD>` with the password used to log in to Keycloak as user "admin"
docker compose exec -T keycloak ./bin/kcadm.sh update realms/master -s sslRequired=NONE --server http://localhost:8080/auth --realm master --user admin --password `<ADMIN_PASSWORD>`
3

Restore your Package Security Manager’s custom configurations

If necessary, restore your Package Security Manager’s custom configurations saved in the docker-compose.yml and .env backup files you created before you began upgrading.

​
Custom implementation considerations

If you’re using a custom implementation, verify that your docker-compose.yml and/or repo.conf (nginx configuration) files reflect the upgraded changes.

Was this page helpful?