Upgrade

Upgrade an on-premises AxoConsole to a new version, then upgrade your AxoRouter and edge hosts.

To upgrade an on-premises or air-gapped AxoConsole deployment, run the axoflow-upgrade.sh script of the new installation bundle. Don’t run only the installer again. The installer upgrades the AxoConsole charts and images, but it doesn’t change the following:

the running k3s
the Traefik customization (traefik-config.yaml)
your operator values (axoflow-config.yaml)

Bundles before 0.90.0 differ from the current bundle in all three. The upgrade script migrates them, then runs the installer for you. If the host needs none of the migrations, the script tells you, and runs the installer immediately.

The bundle also contains the UPGRADE.md guide next to the script. It describes in detail what the script changes, how to troubleshoot the upgrade, and how to perform the same migrations by hand if you can’t use the script.

Before you start

The current installation must be healthy (kubectl -n axoflow get pods). The upgrade doesn’t repair a broken installation.
Expect a few minutes of downtime: the k3s upgrade restarts the k3s service, and the chart upgrade restarts the AxoConsole pods.
The script edits traefik-config.yaml and axoflow-config.yaml under /var/lib/rancher/k3s/server/manifests/ in place. Back them up first if you’ve customized them beyond what the installer wrote.
If the host was installed with --disable-traefik, the base hostname must resolve to your ingress controller from inside the cluster. Otherwise, AxoConsole can’t reach the identity provider after the upgrade. For details, see UPGRADE.md in the bundle.

Upgrade AxoConsole

Log in to the host running AxoConsole, extract the new bundle, and navigate into the directory.
Terminal window
```
tar -xf axoflow-all-in-one-0.90.0-linux-amd64.tar
cd axoflow-all-in-one-0.90.0-linux-amd64
```
Run the upgrade script.
Terminal window
```
sudo ./axoflow-upgrade.sh
```
The script verifies the bundle first, then reads the installed values (base hostname, license key, namespace, image mode) from the k3s manifests, so it doesn’t prompt for anything. The admin credentials are neither changed nor displayed. Each step only acts where it’s still needed, so the script can be re-run safely.

You can use the following flags as needed for your environment.
- --dry-run: Show what would be done without changing anything.
- --step: Prompt before each step.
- --skip-k3s: Leave k3s at its current version.
- --ignore-requirements: Bypass the hardware requirement check.
- --trace: Enable debug output.
Note If the container images of your host are managed outside the bundle, set IMAGE_MODE=skip on every upgrade. The environment variables of the installer (for example, K3S_TIMEOUT or AXOFLOW_TIMEOUT) apply to the whole run.

Verify the upgrade.

export KUBECONFIG=/etc/rancher/k3s/k3s.yaml
kubectl get node                                                      # VERSION = the k3s version of the bundle
kubectl -n kube-system get helmchart axoflow cert-manager -o custom-columns='NAME:.metadata.name,VERSION:.spec.version'
kubectl -n axoflow get pods                                           # all Running / Completed
curl -sk -o /dev/null -w '%{http_code} -> %{redirect_url}\n' 'https://<your-host.your-domain>/login?redirect_url=%2F'

The last command must redirect to https://<your-host.your-domain>/idp/oidc/auth?…. If it redirects to https://idp.<your-host.your-domain>/…, or if anything else looks wrong, see the troubleshooting section of UPGRADE.md in the bundle.

If everything is working as expected, re-deploy your AxoRouter and Axoflow agent instances to upgrade them.

If you have problems during the upgrade, contact our support team.