These steps cover the upgrade from Cyral version 2.17.1 or later to subsequent Cyral versions. Earlier versions do not offer the Download Template button to assist with sidecar upgrade. For such upgrades, contact Cyral support for help getting your templates.
Upgrade your sidecars
Sidecar upgrade instructions
During the sidecar upgrade, the sidecar will be consistently available, but existing data client connections will be broken. To perform a zero-downtime upgrade, contact Cyral support.
Note: Generally, newer Cyral control planes support their contemporary and older versions of the sidecar, but be aware that when you upgrade to a new version of the control plane, you may need to upgrade your sidecars to use features introduced in the new control plane version.
You will download a deployment template for each sidecar and deploy it using your cloud platform's upgrade commands.
In the Cyral control plane UI, click Sidecars and click the name of the sidecar you want to upgrade.
Click Download Template.
In the Download Template window first select the deployment method. Depending on the method you choose, a method-specific window will be shown. Below, we show an example for the Terraform deployment method.
Note! The values you provide here will be reflected in the template, but Cyral does not save them for subsequent use. If you return to this window later to download a template again, you must retype these values.
AWS key pair name
AWS VPC ID
Subnet IDs as a comma-separated list
Log Integration name
Metrics Integration name
You control the sequencing of the rolling upgrade by appending the Auto Scaling Group minimum size and maximum size parameters to your template (asg_min and asg_max on Terraform, or MaxSize and MaxSize on CloudFormation). For details, see Amazon's ASG documentation.
Cyral recommends that you set your ASG maximum size to a value that's greater than or equal to (your ASG desired capacity + 1). This ensures that at least one new sidecar will be created before old sidecars are removed.
Note! If you set your ASG maximum size to the same value as your ASG desired capacity (asg_desired or DesiredCapacity), it will cause old sidecars to be removed before their replacements are created. This is not recommended for ensuring uptime.
Upgrade the sidecar, by running your cloud platform's upgrade command. For example, for Cloudformation, use the commands in the UI, and for Terraform, run terraform init -upgrade and then terraform apply.
This step is not needed in CloudFormation environments: Refresh your sidecar's Auto Scaling groups (ASGs) as follows: In your AWS Management Console, under Auto Scaling groups, find the ASG for the sidecar (the name is the first part of the sidecar endpoint, which you can find in the Cyral Control Plane UI). Go to Instance refresh and click Start Instance refresh.
Repeat the above procedure for each sidecar you want to upgrade.
Preparing for higher volume
If you need to support a higher volume of activity with your sidecar, you can increase the number of sidecar instances in the AWS Auto Scaling group. Edit the deployment template, sidecar.tf. In the module "cyral_sidecar," add the following variable assignments. We show examples for Terraform and CloudFormation environments:
asg_min = X
asg_desired = Y
asg_max = Z
MinSize = X
DesiredCapacity = Y
MaxSize = Z
Where X is the minimum, Y is the desired, and Z is the maximum number of instances you want to have in the sidecar ASG.