Whether and how an upgrade can be rolled back.
curl --request GET \ --url https://stratum.example.com/v1/admin/upgrades/example/rollback \ --header 'Authorization: Bearer <token>'The way back to the release the cluster ran before the upgrade (for the
first upgrade, the release the node was installed with), computed and
changing nothing: its kind and steps, whether the previous control
plane runs on the database as it is (restoreRequired false), whether
the pre-upgrade backup can be restored in place, what a restore loses,
and every reason the upgrade cannot be rolled back (refusals).
Install-scope; gates on upgrade:DescribeUpgrade.
Authorizations
Section titled “Authorizations”Parameters
Section titled “Parameters”Path Parameters
Section titled “Path Parameters”Responses
Section titled “Responses”The way back.
Whether and how an upgrade can be rolled back, and what it would do.
allowed is true when a rollback without a restore can start now.
object
The release the rollback returns to.
The release it leaves.
The node steps of the way back.
The previous control plane cannot run on the database as it is; only a restore goes back.
The pre-upgrade backup can be restored in place.
Why it cannot, when it cannot, and what to do about it: for a backup encrypted to the backup recipient, where to put the recipient’s identity on the node.
object
node: on the node, with no backup target set. target: the backup target.
The bundle on the node.
Encrypted to the backup recipient; otherwise readable by root only.
What a restore loses.
object
The release key that signed the manifest.
What the operator will see, in a sentence or two.
One node’s part of a plan.
object
What restarts, in order.
object
Os, kernel, kernelArgs, hostBinaries, sysext:
security when the release’s OS change fixes a vulnerability and a
node reboots for it; absent otherwise. A staged upgrade waiting to
reboot for it raises NodeRebootPending as a warning, and the
node-reboot-pending alarm after 7 days.
The vulnerabilities the OS change fixes, with rebootReason security.
The upgrade’s steps, in order.
object
object
The previous OS stays bootable.
The old control plane cannot run on the new schema; going back means a restore.
object
The pinned components the upgrade changes: the target
release’s component list against the running release’s
(componentsFrom release), or, for a running release built before
the lists, against what a node reports (nodes: its image pins and
the host packages it lists). Empty when nothing changes or nothing
could be compared (none).
One pinned component the upgrade changes: a container image
(by digest) or a host package (by NEVRA). from is empty for a component
the running release does not have, to for one the target drops.
object
The images.yaml service name, or the package name.
What runs now, for reading - an image’s version and short digest, a package’s [epoch:]version-release.
What the release pins, in the same form.
Exact - the digest, or name-epoch:version-release.arch; empty when not known.
Exact, as fromId.
What the component changes were compared with, or why they could not be.
object
Release, version, upgrade-path, upgrade, cluster-shutdown, readiness,
schema, node, components, release-differs, space or backup-space.
upgrade-path fails a known-broken upgrade, or one that skips a
required stop, and says the way round it.
A precheck failed; the upgrade would be refused.
Example
{ "kind": "", "backup": { "location": "node" }, "plan": { "sourceKind": "media", "kind": "", "nodes": [ { "kind": "", "reboot": "none" } ], "rebootReason": "security", "backup": { "location": "node" }, "componentChanges": [ { "kind": "image" } ], "componentsFrom": "release", "prechecks": [ { "status": "pass" } ] }}Authenticated but not authorized.
object
The findings of a rejected IAM policy document (custom and resource policies).
One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.
object
The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.
Index of the statement at fault; -1 for the document as a whole.
The offending action, where one is at fault (ACTION_NOT_APPLICABLE).
Field errors, for codes that carry them: each problem at its field
(see FieldError). Documented on the responses that set it, e.g.
approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED.
Absent otherwise.
One field’s problem, the stage-2 installer API’s shape.
field is the field’s path, message what is wrong with it.
object
The field’s path, e.g. links[0].interface, disks[1].confirm,
mgmt.address or role; empty for the whole request.
Structured facts about the refusal, for codes that carry them. The
shape is fixed per code and documented on the response that answers
it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and
IMAGE_IN_USE. Absent for codes that carry none.
object
Example
{ "issues": [ { "code": "ACTION_NOT_APPLICABLE", "action": "compute:CreateVpc" } ]}Resource not found.
object
The findings of a rejected IAM policy document (custom and resource policies).
One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.
object
The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.
Index of the statement at fault; -1 for the document as a whole.
The offending action, where one is at fault (ACTION_NOT_APPLICABLE).
Field errors, for codes that carry them: each problem at its field
(see FieldError). Documented on the responses that set it, e.g.
approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED.
Absent otherwise.
One field’s problem, the stage-2 installer API’s shape.
field is the field’s path, message what is wrong with it.
object
The field’s path, e.g. links[0].interface, disks[1].confirm,
mgmt.address or role; empty for the whole request.
Structured facts about the refusal, for codes that carry them. The
shape is fixed per code and documented on the response that answers
it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and
IMAGE_IN_USE. Absent for codes that carry none.
object
Example
{ "issues": [ { "code": "ACTION_NOT_APPLICABLE", "action": "compute:CreateVpc" } ]}Upstream temporarily unavailable (driver / scheduler / dependency).
object
The findings of a rejected IAM policy document (custom and resource policies).
One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.
object
The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.
Index of the statement at fault; -1 for the document as a whole.
The offending action, where one is at fault (ACTION_NOT_APPLICABLE).
Field errors, for codes that carry them: each problem at its field
(see FieldError). Documented on the responses that set it, e.g.
approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED.
Absent otherwise.
One field’s problem, the stage-2 installer API’s shape.
field is the field’s path, message what is wrong with it.
object
The field’s path, e.g. links[0].interface, disks[1].confirm,
mgmt.address or role; empty for the whole request.
Structured facts about the refusal, for codes that carry them. The
shape is fixed per code and documented on the response that answers
it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and
IMAGE_IN_USE. Absent for codes that carry none.
object
Example
{ "issues": [ { "code": "ACTION_NOT_APPLICABLE", "action": "compute:CreateVpc" } ]}