These steps cover the upgrade from Cyral version 2.17.1 or later to subsequent Cyral versions. Earlier versions do not offer the Download Template button to assist with sidecar upgrade. For such upgrades, contact Cyral support for help getting your templates.
Upgrade your sidecars
For an introduction to Cyral version compatibility and upgrades, see Sidecar upgrades and control plane upgrades.
Sidecar upgrade instructions
During the sidecar upgrade, the sidecar will be consistently available, but existing data client connections will be broken. To perform a zero-downtime upgrade, contact Cyral support.
Note: Generally, newer Cyral control planes support their contemporary and older versions of the sidecar, but please be aware that when you upgrade to a new version of the control plane, you may need to upgrade your sidecars if you wish to use features introduced in the new control plane version.
You will download a deployment template for each sidecar and deploy it using your cloud platform's upgrade commands.
In the Cyral control plane UI, click Sidecars and click the name of the sidecar you want to upgrade.
Click Update sidecar.
In the Update sidecar window, first select the deployment method. Depending on the method you choose, a method-specific window will be shown. Below, we show an example for the Terraform deployment method.
Note! The values you provide here will be reflected in the template, but Cyral does not save them for subsequent use. If you return to this window later to download a template again, you must retype these values.
AWS key pair name
AWS VPC ID
Subnet IDs as a comma-separated list
Log Integration name
Metrics Integration name
You control the sequencing of the rolling upgrade by appending the Auto Scaling Group minimum size and maximum size parameters to your template (asg_min and asg_max on Terraform, or MaxSize and MaxSize on Cloudformation). For capacity planning tips, see our helpdesk article. For more about ASG, see the AWS documentation.
Cyral recommends that you set your ASG maximum size to a value that's greater than or equal to (your ASG desired capacity + 1). This ensures that at least one new sidecar will be created before old sidecars are removed.
Note! If you set your ASG maximum size to the same value as your ASG desired capacity (asg_desired or DesiredCapacity), it will cause old sidecars to be removed before their replacements are created. This is not recommended for ensuring uptime.
Note! If you're upgrading sidecars from version 2.23.4 or earlier, see Cyral sidecar upgrade to version 2.23.5 or later and make the template changes explained there before you run the upgrade.
Upgrade the sidecar, by running your cloud platform's upgrade command.
For Cloudformation, use the commands in the UI
For Terraform, run terraform init -upgrade and then terraform apply.
For Helm 3, if you're upgrading to version 2.20 or later of the Cyral sidecar, use the following command, where SIDECAR_K8_ID is the name created automatically for both release and namespace names when you originally downloaded the sidecar, and VERSION is the Cyral version you want to upgrade to, such as "2.20.0". Contact Cyral support to get the latest version number.
helm upgrade -i SIDECAR_K8_ID cyral-sidecar --namespace SIDECAR_K8_ID --repo https://charts.cyral.com --version VERSION
For Helm 3, if you're upgrading to version 2.19.x or earlier of the Cyral sidecar, use the following command, where SIDECAR_K8_ID is the name created automatically for both release and namespace names when you originally downloaded the sidecar, and CONTROL_PLANE is the base URL of your Cyral control plane, such as "tenant.cyral.com":
helm upgrade -i SIDECAR_K8_ID cyral-sidecar --namespace SIDECAR_K8_ID --repo https://CONTROL_PLANE/deploy/helm
This step is not needed in CloudFormation environments: Refresh your sidecar's Auto Scaling groups (ASGs) as follows: In your AWS Management Console, under Auto Scaling groups, find the ASG for the sidecar (the name is the first part of the sidecar endpoint, which you can find in the Cyral Control Plane UI). Go to Instance refresh and click Start Instance refresh.
Repeat the above procedure for each sidecar you want to upgrade.