SupportConsoleDevelopersStart a trialContact

Chapter 2. Upgrading using Helm charts

You must follow a specific upgrade path for RHACS depending on the release of RHACS that you are running. You must also back up your Central database before updating the Helm chart and performing the upgrade.

Important

In RHACS 4.11, all container image names changed from the -rhel8 suffix to -rhel9 as part of the migration to UBI 9 Minimal base images. For example, rhacs-main-rhel8 is now rhacs-main-rhel9.

If you use image mirrors, allowlists, or firewall rules that reference specific RHACS image names, you must update them to use the new -rhel9 names before upgrading. For the complete list of current image names, see Image versions.

2.1. Helm upgrade overview
Copy link

If you have installed RHACS by using Helm charts, you must follow specific steps to upgrade to the latest version.

  1. Back up the Central database.
  2. Optional: Optimize Central’s database and Persistent Volume Claim (PVC).
  3. Optional: Generate a values-private.yaml configuration file containing root certificates for the central-services Helm chart.
  4. Run the helm upgrade command.
Important
  • To ensure optimal functionality, use the same version for your secured-cluster-services Helm chart and central-services Helm chart.
  • To upgrade to RHACS 4.8, which includes an upgrade to PostgreSQL 15, you must free up disk space. Before beginning the upgrade, ensure that you have free disk space that is at least double the size of your existing database.

2.2. Backing up the Central database
Copy link

You can back up the Central database and use that backup for rolling back from a failed upgrade or data restoration in the case of an infrastructure disaster.

Prerequisites

  • You must have an API token with read permission for all resources of Red Hat Advanced Cluster Security for Kubernetes. The Analyst system role has read permissions for all resources.
  • You have installed the roxctl CLI.
  • You have configured the ROX_API_TOKEN and the ROX_CENTRAL_ADDRESS environment variables.

Procedure

  • Run the backup command: 

    $ roxctl -e "$ROX_CENTRAL_ADDRESS" central backup

When you upgrade to Red Hat Advanced Cluster Security for Kubernetes (RHACS) 4.0, RHACS creates a PostgreSQL instance called central-db. This instance uses a default Persistent Volume Claim (PVC). You can customize the central-db or PVC configuration.

Red Hat recommends the following minimum memory and CPU requests: 

central:
  db:
    resources:
      requests:
        memory: 16Gi
        cpu: 8
      limits:
        memory: 16Gi
        cpu: 8

2.4. Generating root certificates file
Copy link

If you do not have access to your values-private.yaml configuration file that you have used to install Red Hat Advanced Cluster Security for Kubernetes (RHACS), use the following instruction to generate the values-private.yaml configuration file containing root certificates.

Skip the instruction here, if you have access to your values-private.yaml configuration file.

Important

The generated values-private.yaml file has sensitive configuration options. Ensure that you store this file securely.

Procedure

  1. Download the create_certificate_values_file.sh script.

  2. Make the create_certificate_values_file.sh script executable: 

    $ chmod +x create_certificate_values_file.sh

  3. Run the create_certificate_values_file.sh script file: 

    $ create_certificate_values_file.sh values-private.yaml

2.5. Updating the Helm chart repository
Copy link

You must always update Helm charts before upgrading to a new version of Red Hat Advanced Cluster Security for Kubernetes.

Prerequisites

  • You must have already added the Red Hat Advanced Cluster Security for Kubernetes Helm chart repository.
  • You must be using Helm version 3.8.3 or newer.

Procedure

  • Update Red Hat Advanced Cluster Security for Kubernetes charts repository. 

    $ helm repo update

Verification

  • Run the following command to verify the added chart repository: 

    $ helm search repo -l rhacs/

If upgrading from version 4.6 or 4.7, you must prepare the SecurityPolicy custom resource definition (CRD) to avoid upgrade errors.

Note

If you use Kubernetes, enter kubectl instead of oc.

Procedure

  • Apply Helm-specific labels and annotations to the CRD by running the following commands: 

    $ oc annotate crd/securitypolicies.config.stackrox.io meta.helm.sh/release-name=stackrox-central-services

    Adjust the value of the release-name as needed. The default value is stackrox-central-services. 

    $ oc annotate crd/securitypolicies.config.stackrox.io meta.helm.sh/release-namespace=stackrox

    Adjust the value of the release-namespace as needed. The default value is stackrox. 

    $ oc label crd/securitypolicies.config.stackrox.io app.kubernetes.io/managed-by=Helm

2.8. Running the Helm upgrade command
Copy link

You can use the helm upgrade command to update Red Hat Advanced Cluster Security for Kubernetes (RHACS).

Prerequisites

  • You must have access to the values-private.yaml configuration file that you have used to install Red Hat Advanced Cluster Security for Kubernetes (RHACS). Otherwise, you must generate the values-private.yaml configuration file containing root certificates before proceeding with these commands.

Procedure

  • Run the helm upgrade command and specify the configuration files by using the -f option: 

    $ helm upgrade -n stackrox stackrox-central-services \
  rhacs/central-services --version <current_rhacs_version> \
  -f values-private.yaml \
  --set central.db.password.generate=true \
  --set central.db.serviceTLS.generate=true \
  --set central.db.persistence.persistentVolumeClaim.createClaim=true
     
    $ helm upgrade -n stackrox stackrox-secured-cluster-services \
  rhacs/secured-cluster-services --version <current_rhacs_version> \
  -f values-private.yaml
    Note

    You might use the --reuse-values option to preserve the Helm values that were configured before the upgrade. If you do that, you must turn off central-db creation before you upgrade to the next version.

    See the following command example: 

    $ helm upgrade -n stackrox stackrox-central-services \
  rhacs/central-services --version <current_rhacs_version> --reuse-values \
  -f values-private.yaml \
  --set central.db.password.generate=false \
  --set central.db.serviceTLS.generate=false \
  --set central.db.persistence.persistentVolumeClaim.createClaim=false

2.9. Rolling back a Helm upgrade
Copy link

You can roll back to an earlier version of Central if the upgrade to a new version is unsuccessful.

Note

If you use Kubernetes, enter kubectl instead of oc.

Procedure

  1. Run the following helm upgrade command: 

    $ helm upgrade -n stackrox \
  stackrox-central-services rhacs/central-services \
  --version <previous_rhacs_74_version> \
  --set central.db.enabled=false

    where:

    <previous_rhacs_74_version>
    Specifies the RHACS version installed before the upgrade.

  2. Delete the central-db persistent volume claim (PVC): 

    $ oc -n stackrox delete pvc central-db
Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Legal Notice

Theme

© 2026 Red HatBack to top