Chapter 5. Upgrading CodeReady Workspaces This chapter describes how to upgrade a CodeReady Workspaces instance from version 2.14 to CodeReady Workspaces 2.15. The method used to install the CodeReady Workspaces instance determines the method to proceed with for the upgrade: Section 5.1, "Upgrading CodeReady Workspaces using OperatorHub" Section 5.2, "Upgrading CodeReady Workspaces using the CLI management tool" Section 5.3, "Upgrading CodeReady Workspaces using the CLI management tool in restricted environment" A CodeReady Workspaces upgrade can be rolled back: Section 5.5, "Rolling back a CodeReady Workspaces upgrade" 5.1. Upgrading CodeReady Workspaces using OperatorHub This section describes how to upgrade from an earlier minor version using the Operator from OperatorHub in the OpenShift web console. OperatorHub supports Automatic and Manual upgrade strategies: Automatic :: The upgrade process starts when a new version of the Operator is published. Manual :: The update must be manually approved every time the new version of the Operator is published. 5.1.1. Specifying the approval strategy of CodeReady Workspaces in OperatorHub Prerequisites An administrator account on an instance of OpenShift. An instance of CodeReady Workspaces 2.14 or earlier that was installed by using OperatorHub. Procedure Open the OpenShift web console. Navigate to the Operators Installed Operators page. Click Red Hat CodeReady Workspaces in the list of installed Operators. Navigate to the Subscription tab. Configure the approval strategy to Automatic or Manual . 5.1.2. Manually upgrading CodeReady Workspaces in OperatorHub OperatorHub is an assembly point for sharing Operators. The OperatorHub helps you deploy and update applications. The following section describes the process of upgrading CodeReady Workspaces by using OperatorHub and the Manual approval strategy approach. Use the Manual approval strategy to prevent automatic updates of the Operator with every release. Prerequisites An administrator account on an instance of OpenShift. An instance of CodeReady Workspaces 2.14 or earlier that was installed by using OperatorHub. The approval strategy in the subscription is Manual . Procedure Open the OpenShift web console. Navigate to the Operators Installed Operators page. In the list of the installed Operators, click Red Hat CodeReady Workspaces . Navigate to the Subscription tab. to the Upgrade Status , inspect the upgrades that require approval. The expected message is 1 requires approval . Click 1 requires approval . Click Preview Install Plan . Review the resources that are available for upgrade and click Approve . Verification steps Navigate to the Operators Installed Operators page. Monitor the upgrade progress. When complete, the status changes to Succeeded and Up to date . The 2.15 version number is visible at the end of the page. Additional resources Upgrading installed Operators section in the OpenShift documentation. 5.2. Upgrading CodeReady Workspaces using the CLI management tool This section describes how to upgrade from the minor version using the CLI management tool. Prerequisites An administrative account on OpenShift. A running instance of a minor version of Red Hat CodeReady Workspaces, installed using the CLI management tool on the same instance of OpenShift, in the <openshift-workspaces> project. crwctl is available and updated. See Section 3.3.1, "Installing the crwctl CLI management tool" . Procedure Save and push changes back to the Git repositories for all running CodeReady Workspaces 2.14 workspaces. Shut down all workspaces in the CodeReady Workspaces 2.14 instance. Upgrade CodeReady Workspaces: Note For slow systems or internet connections, add the --k8spodwaittimeout=1800000 flag option to the crwctl server:update command to extend the Pod timeout period to 1800000 ms or longer. Verification steps Navigate to the CodeReady Workspaces instance. The 2.15 version number is visible at the bottom of the page. 5.3. Upgrading CodeReady Workspaces using the CLI management tool in restricted environment This section describes how to upgrade Red Hat CodeReady Workspaces using the CLI management tool in restricted environment. The upgrade path supports minor version update, from CodeReady Workspaces version 2.14 to version 2.15. Prerequisites An administrative account on an instance of OpenShift. A running instance version 2.14 of Red Hat CodeReady Workspaces, installed using the CLI management tool on the same instance of OpenShift, with the crwctl --installer operator method, in the <openshift-workspaces> project. See Section 3.4, "Installing CodeReady Workspaces in a restricted environment" . The crwctl 2.15 management tool is available. See Section 3.3.1, "Installing the crwctl CLI management tool" . 5.3.1. Understanding network connectivity in restricted environments CodeReady Workspaces requires that each OpenShift Route created for CodeReady Workspaces is accessible from inside the OpenShift cluster. These CodeReady Workspaces components have a OpenShift Route: codeready-workspaces-server , keycloak , devfile-registry , plugin-registry . Consider the network topology of the environment to determine how best to accomplish this. Example 5.1. Network owned by a company or an organization, disconnected from the public Internet The network administrators must ensure that it is possible to route traffic bound from the cluster to OpenShift Route host names. Example 5.2. Private subnetwork in a cloud provider Create a proxy configuration allowing the traffic to leave the node to reach an external-facing Load Balancer. 5.3.2. Building offline registry images 5.3.2.1. Building an offline devfile registry image This section describes how to build an offline devfile registry image. Starting workspaces without relying on resources from the outside Internet requires building this image. The image contains all sample projects referenced in devfiles as zip files. Prerequisites: A running installation of podman or docker . Procedure Clone the devfile registry repository and check out the version to deploy: Build an offline devfile registry image: Note To display full options for the build.sh script, use the --help parameter. Additional resources https://access.redhat.com/documentation/en-us/red_hat_codeready_workspaces/2.15/html-single/administration_guide/index#customizing-the-registries.adoc . 5.3.2.2. Building an offline plug-in registry image This section describes how to build an offline plug-in registry image. Starting workspaces without relying on resources from the outside Internet requires building this image. The image contains plug-in metadata and all plug-in or extension artifacts. Prerequisites Node.js 12.x A running version of yarn. See Installing Yarn . ./node_modules/.bin is in the PATH environment variable. A running installation of podman or docker . Procedure Clone the plug-in registry repository and check out the version to deploy: Build offline plug-in registry image: Note To display full options for the build.sh script, use the --help parameter. Additional resources https://access.redhat.com/documentation/en-us/red_hat_codeready_workspaces/2.15/html-single/administration_guide/index#customizing-the-registries.adoc . 5.3.3. Preparing an private registry Prerequisites The oc tool is available. The skopeo tool, version 0.1.40 or later, is available. The podman tool is available. An image registry accessible from the OpenShift cluster and supporting the format of the V2 image manifest, schema version 2. Ensure you can push to it from a location having, at least temporarily, access to the internet. Table 5.1. Placeholders used in examples <source-image> Full coordinates of the source image, including registry, organization, and digest. <target-registry> Host name and port of the target container-image registry. <target-organization> Organization in the target container-image registry <target-image> Image name and digest in the target container-image registry. <target-user> User name in the target container-image registry. <target-password> User password in the target container-image registry. Procedure Log into the internal image registry: Note If you encounter an error, like x509: certificate signed by unknown authority , when attempting to push to the internal registry, try one of these workarounds: add the OpenShift cluster's certificate to /etc/containers/certs.d/ <target-registry> add the registry as an insecure registry by adding the following lines to the Podman configuration file located at /etc/containers/registries.conf : Copy images without changing their digest. Repeat this step for every image in the following table: Note Table 5.2. Understanding the usage of the container-images from the prefix or keyword they include in their name Usage Prefix or keyword Essential not stacks- or plugin- Workspaces stacks- , plugin- Table 5.3. Images to copy in the private registry <source-image> <target-image> registry.redhat.io/codeready-workspaces/backup-rhel8@sha256:6b636d6bba6c509756803c4186960ed69adfa2eae42dde5af48b67c6e0794915 backup-rhel8@sha256:6b636d6bba6c509756803c4186960ed69adfa2eae42dde5af48b67c6e0794915 registry.redhat.io/codeready-workspaces/configbump-rhel8@sha256:15574551ec79aa8cd9e0eea3d379fc7a77a4e16cc92f937b4a89c6f9a6f2ce40 configbump-rhel8@sha256:15574551ec79aa8cd9e0eea3d379fc7a77a4e16cc92f937b4a89c6f9a6f2ce40 registry.redhat.io/codeready-workspaces/crw-2-rhel8-operator@sha256:1c8b06e457ba008f86e5fefc82013acdb4639317cde809e926931d202a194a17 crw-2-rhel8-operator@sha256:1c8b06e457ba008f86e5fefc82013acdb4639317cde809e926931d202a194a17 registry.redhat.io/codeready-workspaces/dashboard-rhel8@sha256:e46636f0c66221d9a01506b114e18f3d3afe61da99bf224e71cf4051235e51ac dashboard-rhel8@sha256:e46636f0c66221d9a01506b114e18f3d3afe61da99bf224e71cf4051235e51ac registry.redhat.io/codeready-workspaces/devfileregistry-rhel8@sha256:fdcd72766757f08486a6e4dbf3a24bf084aefdb2e86971c440048aec0315d7e8 devfileregistry-rhel8@sha256:fdcd72766757f08486a6e4dbf3a24bf084aefdb2e86971c440048aec0315d7e8 registry.redhat.io/codeready-workspaces/idea-rhel8@sha256:eff6db1da4c9743ff77b91acf08378bce6a652826b3b252512e63f767de07785 idea-rhel8@sha256:eff6db1da4c9743ff77b91acf08378bce6a652826b3b252512e63f767de07785 registry.redhat.io/codeready-workspaces/jwtproxy-rhel8@sha256:6176e28c4c02f0a40f8192088ccb505ce5722258bcaab0addff9bafa310c1ca4 jwtproxy-rhel8@sha256:6176e28c4c02f0a40f8192088ccb505ce5722258bcaab0addff9bafa310c1ca4 registry.redhat.io/codeready-workspaces/machineexec-rhel8@sha256:dc0e082c9522158cb12345b1d184c3803d8a4a63a7189940e853e51557e43acf machineexec-rhel8@sha256:dc0e082c9522158cb12345b1d184c3803d8a4a63a7189940e853e51557e43acf registry.redhat.io/codeready-workspaces/plugin-java11-rhel8@sha256:315273182e1f4dc884365fc3330ada3937b40369f3faf7762847ec433c3ac537 plugin-java11-rhel8@sha256:315273182e1f4dc884365fc3330ada3937b40369f3faf7762847ec433c3ac537 registry.redhat.io/codeready-workspaces/plugin-java8-rhel8@sha256:8cb1e495825051b83cf903bb317e55823a6f57b3bad92e9407dc8fa59c24c0cc plugin-java8-rhel8@sha256:8cb1e495825051b83cf903bb317e55823a6f57b3bad92e9407dc8fa59c24c0cc registry.redhat.io/codeready-workspaces/plugin-kubernetes-rhel8@sha256:75fe8823dea867489b68169b764dc8b0b03290a456e9bfec5fe0cc413eec7355 plugin-kubernetes-rhel8@sha256:75fe8823dea867489b68169b764dc8b0b03290a456e9bfec5fe0cc413eec7355 registry.redhat.io/codeready-workspaces/plugin-openshift-rhel8@sha256:d7603582f7ace76283641809b0c61dbcb78621735e536b789428e5a910d35af3 plugin-openshift-rhel8@sha256:d7603582f7ace76283641809b0c61dbcb78621735e536b789428e5a910d35af3 registry.redhat.io/codeready-workspaces/pluginbroker-artifacts-rhel8@sha256:6d13003539fcbda201065eae2e66dc67fed007ba3ba41fb3b8ec841650c52bc2 pluginbroker-artifacts-rhel8@sha256:6d13003539fcbda201065eae2e66dc67fed007ba3ba41fb3b8ec841650c52bc2 registry.redhat.io/codeready-workspaces/pluginbroker-metadata-rhel8@sha256:de8ede01ce5d3b06ae8b1866bb482bb937f020f7dee5dfb20b041f02c1e63f68 pluginbroker-metadata-rhel8@sha256:de8ede01ce5d3b06ae8b1866bb482bb937f020f7dee5dfb20b041f02c1e63f68 registry.redhat.io/codeready-workspaces/pluginregistry-rhel8@sha256:cbb82d5bcea22d6d65644c2a4c88ce1e3a082e8a696217d6a104b67daa60384e pluginregistry-rhel8@sha256:cbb82d5bcea22d6d65644c2a4c88ce1e3a082e8a696217d6a104b67daa60384e registry.redhat.io/codeready-workspaces/server-rhel8@sha256:e1694549ca2af22a1d1780cc7d92bb0829a411f74377f825eab3e0fba7c020d9 server-rhel8@sha256:e1694549ca2af22a1d1780cc7d92bb0829a411f74377f825eab3e0fba7c020d9 registry.redhat.io/codeready-workspaces/stacks-cpp-rhel8@sha256:c2f38140f52112b2a7688c2a179afcaa930ad6216925eb322cfd9634a71cfc13 stacks-cpp-rhel8@sha256:c2f38140f52112b2a7688c2a179afcaa930ad6216925eb322cfd9634a71cfc13 registry.redhat.io/codeready-workspaces/stacks-dotnet-rhel8@sha256:f48fe1caa5be1ae91140681bee159ca8b11dc687fa50fbf9dc5644f4852bf5c8 stacks-dotnet-rhel8@sha256:f48fe1caa5be1ae91140681bee159ca8b11dc687fa50fbf9dc5644f4852bf5c8 registry.redhat.io/codeready-workspaces/stacks-golang-rhel8@sha256:db76d04752973223e2c0de9401ebf06b84263e1bb6d29f1455daaff0cb39c1b3 stacks-golang-rhel8@sha256:db76d04752973223e2c0de9401ebf06b84263e1bb6d29f1455daaff0cb39c1b3 registry.redhat.io/codeready-workspaces/stacks-php-rhel8@sha256:d120c41ee8dd80fb960dd4c1657bede536d32f13f3c3ca84e986a830ec2ead3b stacks-php-rhel8@sha256:d120c41ee8dd80fb960dd4c1657bede536d32f13f3c3ca84e986a830ec2ead3b registry.redhat.io/codeready-workspaces/theia-endpoint-rhel8@sha256:5d26cf000924716d8d03969121a4c636e7fc8ef08aa21148eafa28a2c4aeaff7 theia-endpoint-rhel8@sha256:5d26cf000924716d8d03969121a4c636e7fc8ef08aa21148eafa28a2c4aeaff7 registry.redhat.io/codeready-workspaces/theia-rhel8@sha256:6000d00ef1029583642c01fec588f92addb95f16d56d0c23991a8f19314b0f06 theia-rhel8@sha256:6000d00ef1029583642c01fec588f92addb95f16d56d0c23991a8f19314b0f06 registry.redhat.io/codeready-workspaces/traefik-rhel8@sha256:70215465e2ad65a61d1b5401378532a3a10aa60afdda0702fb6061d89b8ba3be traefik-rhel8@sha256:70215465e2ad65a61d1b5401378532a3a10aa60afdda0702fb6061d89b8ba3be registry.redhat.io/devworkspace/devworkspace-rhel8-operator@sha256:3f96fb70c3f56dea3384ea31b9252a5c6aca8e0f33dc53be590f134912244078 devworkspacedevworkspace-rhel8-operator@sha256:3f96fb70c3f56dea3384ea31b9252a5c6aca8e0f33dc53be590f134912244078 registry.redhat.io/jboss-eap-7/eap-xp3-openjdk11-openshift-rhel8@sha256:bb3072afdbf31ddd1071fea37ed5308db3bf8a2478b5aa5aff8373e8042d6aeb eap-xp3-openjdk11-openshift-rhel8@sha256:bb3072afdbf31ddd1071fea37ed5308db3bf8a2478b5aa5aff8373e8042d6aeb registry.redhat.io/jboss-eap-7/eap74-openjdk8-openshift-rhel7@sha256:b4a113c4d4972d142a3c350e2006a2b297dc883f8ddb29a88db19c892358632d eap74-openjdk8-openshift-rhel7@sha256:b4a113c4d4972d142a3c350e2006a2b297dc883f8ddb29a88db19c892358632d registry.redhat.io/openshift4/ose-kube-rbac-proxy@sha256:1dc542b5ab33368443f698305a90c617385b4e9b101acc4acc0aa7b4bf58a292 openshift4ose-kube-rbac-proxy@sha256:1dc542b5ab33368443f698305a90c617385b4e9b101acc4acc0aa7b4bf58a292 registry.redhat.io/openshift4/ose-oauth-proxy@sha256:83988048d5f585ca936442963e23b77520e1e4d8c3d5b8160e43ae834a24b720 openshift4ose-oauth-proxy@sha256:83988048d5f585ca936442963e23b77520e1e4d8c3d5b8160e43ae834a24b720 registry.redhat.io/rh-sso-7/sso75-openshift-rhel8@sha256:dd4ea229521fb58dda7e547ea6db993156f4c61aa8a00f2fd1375bb77168b6e6 sso75-openshift-rhel8@sha256:dd4ea229521fb58dda7e547ea6db993156f4c61aa8a00f2fd1375bb77168b6e6 registry.redhat.io/rhel8/postgresql-13@sha256:6032adb3eac903ee8aa61f296ca9aaa57f5709e5673504b609222e042823f195 postgresql-13@sha256:6032adb3eac903ee8aa61f296ca9aaa57f5709e5673504b609222e042823f195 registry.redhat.io/rhel8/postgresql-96@sha256:314747a4a64ac16c33ead6a34479dccf16b9a07abf440ea7eeef7cda4cd19e32 postgresql-96@sha256:314747a4a64ac16c33ead6a34479dccf16b9a07abf440ea7eeef7cda4cd19e32 registry.redhat.io/rhscl/mongodb-36-rhel7@sha256:9f799d356d7d2e442bde9d401b720600fd9059a3d8eefea6f3b2ffa721c0dc73 mongodb-36-rhel7@sha256:9f799d356d7d2e442bde9d401b720600fd9059a3d8eefea6f3b2ffa721c0dc73 registry.redhat.io/ubi8/ubi-minimal@sha256:2e4bbb2be6e7aff711ddc93f0b07e49c93d41e4c2ffc8ea75f804ad6fe25564e ubi8ubi-minimal@sha256:2e4bbb2be6e7aff711ddc93f0b07e49c93d41e4c2ffc8ea75f804ad6fe25564e Verification steps Verify the images have the same digests: Additional resources To find the sources of the images list, see the values of the relatedImages attribute in the link: - CodeReady Workspaces Operator ClusterServiceVersion sources . 5.3.4. Upgrading CodeReady Workspaces using the CLI management tool in restricted environment This section describes how to upgrade Red Hat CodeReady Workspaces using the CLI management tool in restricted environment. Prerequisites An administrative account on an OpenShift instance. A running instance version 2.14 of Red Hat CodeReady Workspaces, installed using the CLI management tool on the same instance of OpenShift, with the crwctl --installer operator method, in the <openshift-workspaces> project. See Section 3.4, "Installing CodeReady Workspaces in a restricted environment" . Essential container images are available to the CodeReady Workspaces server running in the cluster. See Section 5.3.3, "Preparing an private registry" . The crwctl 2.15 management tool is available. See Section 3.3.1, "Installing the crwctl CLI management tool" . Procedure In all running workspaces in the CodeReady Workspaces 2.14 instance, save and push changes back to the Git repositories. Stop all workspaces in the CodeReady Workspaces 2.14 instance. Run the following command: <image-registry> : A hostname and a port of the container-image registry accessible in the restricted environment. <organization> : An organization of the container-image registry. See: Section 5.3.3, "Preparing an private registry" . Verification steps Navigate to the CodeReady Workspaces instance. The 2.15 version number is visible at the bottom of the page. Note For slow systems or internet connections, add the --k8spodwaittimeout=1800000 flag option to the crwctl server:update command to extend the Pod timeout period to 1800000 ms or longer. 5.4. Upgrading CodeReady Workspaces that uses project strategies other than 'per user' This section describes how to upgrade CodeReady Workspaces that uses project strategies other than 'per user'. CodeReady Workspaces intends to use Kubernetes secrets as a storage for all sensitive user data. One project per user simplifies the design of the workspaces. This is the reason why project strategies other than per user become deprecated. The deprecation process happens in two steps. In the First Step project strategies other than per user are allowed but not recommended. In the Second Step support for project strategies other than per user is going to be removed. Note No automated upgrade support exists between First Step and Second Step for the installations where project strategies other than per user are used without losing data. Prerequisites CodeReady Workspaces configured with the project strategies other than per user . Intention to use CodeReady Workspaces configured with the per user namespace strategies per user . 5.4.1. Upgrading CodeReady Workspaces and backing up user data Procedure Notify all CodeReady Workspaces users about the upcoming data wipe. Note To back up the data, you can commit workspace configuration to an SCM server and use factories to restore it later. Re-install CodeReady Workspaces with per user namespace strategy. 5.4.2. Upgrading CodeReady Workspaces and losing user data When CodeReady Workspaces is upgraded and user data is not backed up, workspace configuration and user preferences are going to be preserved but all runtime data will be wiped out. Procedure Notify all CodeReady Workspaces users about the upcoming data wipe. Change project strategy to per user . Note Upgrading without backing up user data has disadvantage. Original PVs with runtime data are going to be preserved and will no longer be used. This may lead to the waste of resources. Additional resources Section 4.2, "Configuring workspace target project" Chapter 3, Installing CodeReady Workspaces https://access.redhat.com/documentation/en-us/red_hat_codeready_workspaces/2.15/html-single/end-user_guide/index#workspaces-overview.adoc https://access.redhat.com/documentation/en-us/red_hat_codeready_workspaces/2.15/html-single/end-user_guide/index#importing-the-source-code-of-a-project-into-a-workspace.adoc 5.5. Rolling back a CodeReady Workspaces upgrade To restore CodeReady Workspaces to the pre-upgrade version, roll back the CodeReady Workspaces version upgrade as follows: Prerequisites Installed crwctl . Procedure Run the following command on a command line: Note CodeReady Workspaces Operator automatically creates a backup before every upgrade.

Commands:
crwctl server:update -n openshift-workspaces
git clone git@github.com:redhat-developer/codeready-workspaces.git cd codeready-workspaces git checkout crw-2.15-rhel-8
cd dependencies/che-devfile-registry ./build.sh --organization <my-org> --registry <my-registry> --tag <my-tag> --offline
git clone git@github.com:redhat-developer/codeready-workspaces.git cd codeready-workspaces git checkout crw-2.15-rhel-8
cd dependencies/che-plugin-registry ./build.sh --organization <my-org> --registry <my-registry> --tag <my-tag> --offline --skip-digest-generation
podman login --username <user> --password <password> <target-registry>
[registries.insecure] registries = [' <target-registry> ']
skopeo copy --all docker:// <source-image> docker:// <target-registry> / <target-organization> / <target-image>
skopeo inspect docker:// <source-image> skopeo inspect docker:// <target-registry> / <target-organization> / <target-image>
crwctl server:update --che-operator-image= <image-registry> / <organization> /crw-2-rhel8-operator:2.15 -n openshift-workspaces
crwctl server:restore --rollback