Upgrade notes

The certificate used for HTTPS access is now the same as the one used for policy updates. During the upgrade from 6.x, the HTTPS certificate is replaced by the certificate used by policy update. After the upgrade from 6.x, you will see a warning message indicating the server certificate has changed. This is expected, and you can accept to update the certificate if you used Rudder’s self-signed certificate.

If you used a custom certificate, you will need to apply manual changes to Rudder’s configuration. As the self-signed certificate is used for internal communication, you will need to create a dedicated virtual host for the Web and API access. You need a way to distinguish access to these two virtual hosts, most often by IP, Port or ServerName (using specific DNS name).

The easiest way is probably to start over from the new default configuration and adapt it to your needs. You can access it as a new configuration file deployed by your package manager or directly in our repository.

You should only edit the virtual hosts in /etc/apache2/sites-available or /etc/httpd/conf.d which is treated as a configuration file by package managers and not automatically replaced. The most common approach is to comment the first virtual host and uncomment the last two virtual hosts, and distinguish either by hostname, IP or by port the virtual host for policy distribution and the virtual host for Web Interface/API

If you use a custom valid certificate and have enabled certificate verification in the settings, you may encounter missing reports and inventories after upgrade. This is caused by 6.X agent trying to validate your custom certificate while 7.0 relies on internal self-signed certificate for node-server communication.

In this specific case, it is necessary to upgrade agents to 7.0 before the server.

If you upgraded without following this step:

Syslog reporting is removed totally from 7.0, so if you had not switched to HTTPS reporting to the settings yet, the switch will be automatically made at upgrade.

We advise you to test HTTPS reporting before upgrading 7.0 to avoid unexpected consequences (as you won’t be able to fall back to syslog on 7.0).

If you use the non-compliant only reporting mode you will see missing reporting in the system techniques before the first agent run on you systems. This is due to changes in expected reports in these techniques, and the way the compliance is computed in this case.

We have removed deprecated techniques, you are encouraged to use the technique editor to replace them:

The recent changes view is more limited than in previous versions due to the rewrite, but will be improved in following patch releases. In particular no graphs are currently displayed, this will be improved in the upcoming releases.

We removed the role-based system groups as part of the removal of Rudder server roles. If you had a rule linked to one of these, it will be disabled after upgrade, and you will need to link it to a new group.

The old local server HTTP API (sometimes known as "v1") that existed before our public authenticated API and was deprecated for several years has finally been removed.

The list of removed endpoints is visible in the documentation.

If you still relied on this API should switch to the public API (which implements all features of the legacy one), and you can use the local system token (present in /var/lib/rudder/api-token) in local scripts.

If you have an external postgresql database you need to add a little change in your server configuration following the documentation. In short: