Skip to content

Upgrade to v0.13

Move from v0.12 to v0.13: configuration version 2, secrets named ...Secret, and Senders on the ingest side. v0.13 reads version 1 for one minor. Before v0.6, start with the v0.6 upgrade. Other changes are in the CHANGELOG.

Breaking changes

  • Roll binaries before the layer that says audit.truvity.github.io/<kind>/v2. A v0.12 binary refuses it. Library and zip must be one release, unless Guards.AllowVersionSkew is set.

  • On Lambda, secrets.source: env is refused at run time. A version 1 ...Env converts to it, so move that secret to source: ssm. The preview refuses a ...Env key in Writer.Keys.

  • Ingest.Senders is required when ingest is on, and the queue policy denies sqs:SendMessage to everyone else. Senders and Redrivers take IAM role or user ARNs. Assumed-role, sts, bare account id and wildcard values are refused.

  • Readiness probes read /readyz with timeoutSeconds: 3. Follow this in probe overrides and goldens.

  • authn.SplitGroup and authn.ScopeAll replace policy.SplitGroup and policy.ScopeAll.

Steps

1. Lambda: the stack

  1. Pin the release's zips and bump the library to the same release (ship a release).

  2. Add Ingest.Senders, and Redrivers for an operator role. Never combine Ingest.AnySenderInAccount: true with Senders.

  3. Move each secret that a variable held to a SecureString under the SecretsRoot output, and name it in Writer.Keys: tokenSecret: openbao/token is <root>/openbao/token (store secrets in SSM). The first invocation starts.

2. Kubernetes: the values

In each config:, set apiVersion: audit.truvity.github.io/<kind>/v2. Rename passwordEnv, credentialsEnv and tokenEnv to passwordSecret, credentialsSecret and tokenSecret. Add one secrets block.

secrets: {source: file, root: /etc/audit/secrets}

Replace each secretEnv entry with a secretFiles entry whose name is the file name, such as database-password. To keep reading variables, set secrets: {source: env} and leave the deprecated secretEnv. Run helm template.

Roll back

On Lambda, run pulumi up with the previous program; the previous layer version is kept. On Kubernetes, restore the version 1 config:.

Delete the version 1 spellings before the next minor removes them.