Upgrade paths
Which release upgrades straight to which. The cloud plans from the same data,
read from the signed release index: stratumctl admin upgrade available shows
the path to each newer release, and a plan that skips a required stop or takes
a broken upgrade fails its upgrade-path precheck with the way round it.
0.7.0 starts the upgrade chain. A cloud on an older release does not upgrade to it or to anything later: install 0.7.0 fresh from its ISO (Install), then upgrade from there.
Find your path
Section titled “Find your path”Pick the release the cloud runs and the one you want. The answer is the one the cloud gives.
- A release that starts the upgrade chain is not upgraded into: an older cloud installs it fresh from its ISO.
- No upgrade skips a required stop: an older cloud upgrades to the stop first.
- A release can name the oldest release that upgrades to it straight; an older cloud upgrades to a release in between first.
- A broken upgrade is never planned; the table below says what to use instead.
- Otherwise an upgrade goes straight to the release. When it cannot, it takes the fewest upgrades that can, through the newest releases.
- A patch release upgrades from every earlier patch of its minor.
Releases
Section titled “Releases”| Release | Type | Required stop | Upgrades from | Notes |
|---|---|---|---|---|
| 0.7.0 | feature | no | none: starts the upgrade chain, install fresh | Starts the upgrade chain: older releases reinstall from its ISO. Hyperconverged clusters: install a first node as a cluster of one and add nodes with a join code and an approval, up to 5 control-plane nodes. Simpler installer with a table of NICs, bonds and VLANs at install, install-time disk and NIC roles, and browser recovery actions. Ceph capacity history on the Ceph page. Operator recipes in the system project. |
| 0.4.2 | fix | no | 0.3.0 or newer | Security: a guest could read another instance's metadata and credentials (fixed; the legacy IMDS port is gone). Console sign-in with OIDC, release token, guest logs, clearer launch and backup errors. |
| 0.4.1 | fix | no | 0.3.0 or newer | Node shut down and reboot; base images with the agent dormant (enable without an install command); trace operation catalog; dev mode on by default for single-node; the control plane reports the release version. |
| 0.4.0 | feature | no | 0.3.0 or newer | New installer ISO (installs on used disks, host reservation step, dev mode off by default); agent on and off after launch, quota switch, apex NS on every zone. Upgraded nodes keep dev mode on. |
| 0.3.3 | fix | no | 0.3.0 or newer | A run-command right after an upgrade no longer fails; no false lock-loss ERROR on shutdown. |
| 0.3.2 | fix | no | 0.3.0 or newer | Every OS package locked by version; releases ship as bundles only. |
| 0.3.1 | fix | no | 0.3.0 or newer | An upgrade that restarts OpenBao unseals it the way boot does; TF provider plans no replace. |
| 0.3.0 | feature | no | none: starts the upgrade chain, install fresh | Starts the upgrade chain: older releases reinstall from its ISO. |
| 0.2.3 | fix | no | any older release | The host-helper no longer restarts OpenBao live. |
| 0.2.2 | fix | no | any older release | Changes openbao.container; unsafe from an older host-helper. |
| 0.2.1 | fix | no | any older release | |
| 0.2.0 | feature | no | any older release | Ships the installer ISO. |
| 0.1.0 | feature | no | any older release |
To the newest release
Section titled “To the newest release”| From | To 0.7.0 |
|---|---|
| 0.4.2 | reinstall from 0.7.0 |
| 0.4.1 | reinstall from 0.7.0 |
| 0.4.0 | reinstall from 0.7.0 |
| 0.3.3 | reinstall from 0.7.0 |
| 0.3.2 | reinstall from 0.7.0 |
| 0.3.1 | reinstall from 0.7.0 |
| 0.3.0 | reinstall from 0.7.0 |
| 0.2.3 | reinstall from 0.7.0 |
| 0.2.2 | reinstall from 0.7.0 |
| 0.2.1 | reinstall from 0.7.0 |
| 0.2.0 | reinstall from 0.7.0 |
| 0.1.0 | reinstall from 0.7.0 |
Broken upgrades
Section titled “Broken upgrades”Never planned: the precheck fails and names the release to use instead.
| From | To | Why | Use instead |
|---|---|---|---|
| 0.2.0, 0.2.1 | 0.2.2 | 0.2.2 changes openbao.container; the host-helper of the running release restarts OpenBao in the upgrade's restart step and does not unseal it, so the control plane crash-loops until OpenBao is unsealed by hand. | 0.2.3 |
Tested upgrades
Section titled “Tested upgrades”Each upgrade run end to end, from a row’s release to a column’s: pass, fail, or blank when not tested yet. Tested upgrades start at the start of the upgrade chain; the runs before it are history.
No upgrade within the chain yet: 0.7.0 is its only release.
| Date | From | To | Result | TPM | Run | Notes |
|---|---|---|---|---|---|---|
| 2026-10-17 | 0.2.0 | 0.2.2 | fail | no | install-test node with tenant fixtures | OpenBao sealed after the restart step, control plane crash-loop; recovered by a manual unseal. |
| 2026-10-17 | 0.2.0 | 0.2.3 | pass | no | install-test node with tenant fixtures, 6/6 checks | |
| 2026-10-17 | 0.3.0 | 0.3.1 | pass | yes | upgrade-test.sh from golden v0.3.0-tf (Terraform tenants), local | 25 of 25 checks, no drift, no LB or floating-IP gap, no VM restart. |
| 2026-10-17 | 0.3.0 | 0.3.2 | pass | yes | upgrade-test.sh from golden v0.3.0-tf (Terraform tenants), local | 25 of 25 checks, no drift, no probe gap, no VM restart. |
| 2026-10-17 | 0.3.1 | 0.3.2 | pass | yes | upgrade-test.sh from golden v0.3.1-tf (Terraform tenants), local | 25 of 25 checks, no drift, no probe gap, no VM restart. |
| 2026-10-18 | 0.3.0 | 0.3.3 | pass | yes | upgrade-test.sh from golden v0.3.0-tf (Terraform tenants), local | 25 of 25 checks, no drift, no probe gap, no VM restart. |
| 2026-10-18 | 0.3.2 | 0.3.3 | pass | yes | upgrade-test.sh from golden v0.3.2-tf (Terraform tenants), local | 25 of 25 checks, no drift, no probe gap, no VM restart. |
| 2026-10-18 | 0.3.0 | 0.4.0 | pass | yes | upgrade-test.sh from golden v0.3.0-tf (Terraform tenants), local, on the build of main 7dbbf164 | 22 pass, 3 skip (vm-boot, VMs restart); full reboot (psi=1), web tier back 46 s after READY. |
| 2026-10-18 | 0.3.3 | 0.4.0 | pass | yes | upgrade-test.sh from golden v0.3.3-tf (Terraform tenants), local, on the build of main 7dbbf164 | 22 pass, 3 skip (vm-boot, VMs restart); full reboot (psi=1), web tier back 43 s after READY. |
| 2026-10-19 | 0.4.0 | 0.4.1 | pass | yes | upgrade-test.sh from golden v0.4.0-tf (Terraform tenants), local, on candidate 0.4.1-rc.98f2d383 (promoted) | Host upgrade, no reboot, VMs keep running; release consistent after the upgrade. |
| 2026-10-19 | 0.3.3 | 0.4.1 | pass | yes | upgrade-test.sh from golden v0.3.3-tf (Terraform tenants), local, on candidate 0.4.1-rc.98f2d383 (promoted) | OS upgrade with a full reboot, VMs restart (vm-boot skipped as announced); release consistent. |
As data
Section titled “As data”The same data, with the path for every pair of releases, is served as
upgrade-paths.json with each version of these
docs.