Set up the Upgrade Environment

Before you set up the upgrade environment, ensure that your cluster meets the Requirements for Upgrading Portworx Backup. Then complete the applicable configuration steps in this topic to prepare the environment for the upgrade.

Configure mTLS (optional)

If you want to enable mTLS for Portworx Backup, make sure Istio or Linkerd is installed on the cluster where you want to deploy Portworx Backup with the following parameters set to true:

• Istio:

  • meshConfig.defaultConfig.holdApplicationUntilProxyStarts=true
  • values.pilot.env.ENABLE_NATIVE_SIDECARS=true

• Linkerd:

  • proxyInit.runAsRoot=true

If multiple applications use the same path prefix (/), Istio encounters traffic routing conflicts. To prevent this, you must update the VirtualService that Portworx Backup creates with a unique hostname.

Label or annotate the Portworx Backup namespace based on your service mesh:

• Istio

  • Istio sidecar mode:

    kubectl label namespace <pxb-namespace> istio-injection=enabled --overwrite

    Here <pxb-namespace> is the namespace where you deploy Portworx Backup.

  • Istio ambient mode:

    kubectl label namespace <pxb-namespace> istio.io/dataplane-mode=ambient --overwrite

• Linkerd:

  1. Annotate the Portworx Backup namespace to inform Linkerd to inject linkerd-proxy required for mTLS:

     kubectl annotate ns <pxb-namespace> linkerd.io/inject=enabled

  2. Annotate the namespace for Kubernetes native sidecar support so that the Linkerd sidecar proxy container can run and shut down gracefully without causing any issues:

     kubectl annotate ns <pxb-namespace> config.alpha.linkerd.io/proxy-enable-native-sidecar=true

Configure external OIDC endpoints

If you enabled an external OIDC during the Portworx Backup installation, you must manually configure the redirect URI in your OIDC provider.

Refer to the Setup login redirects section of the Portworx Enterprise documentation for instructions.

Prepare for air-gapped upgrade

If you are upgrading in an air-gapped environment, pull the required Docker images and push them to your internal registry before proceeding. This uses the same pxcentral-ag-install-backup.sh script used during initial installation — it handles both install and upgrade image mirroring:

1. Download the pxcentral-ag-install-backup.sh air-gapped bootstrap script.

   By default, the script includes only the images for the pxBackup and pxCentral modules. PX-Monitor and PX-License-Server are separate, optional components and their images are not included by default. Append the following query parameters to also mirror those images:

   Scenario	Download URL
   PX-Backup only (default)	https://install.portworx.com/pxcentral-air-gapped?px-backup=true
   PX-Backup + Monitoring + License Server	https://install.portworx.com/pxcentral-air-gapped?px-backup=true&px-monitor=true&px-license-server=true
   PX-Backup + Monitoring + License Server (pinned to a specific release)	https://install.portworx.com/pxcentral-air-gapped?px-backup=true&px-monitor=true&px-license-server=true&version=3.1.0

   Where:

   • &px-monitor=true: Adds Cassandra, Consul, Cortex, Grafana, Prometheus, prometheus-config-reloader, prometheus-operator, memcached, memcached-exporter, nginx, and go-dnsmasq images.
   • &px-license-server=true: Adds the PX-License-Server (px-els) image.
   note

   The stork and cmdexecutor images are not part of the PX-Backup air-gap script. They ship with the PX-Enterprise air-gap script (https://install.portworx.com/air-gapped). If you are running PX-Enterprise alongside PX-Backup, these images are already mirrored from the PX-Enterprise script.

   For example, to download the default (PX-Backup only) script:

   curl -o pxcentral-ag-install-backup.sh -L "https://install.portworx.com/pxcentral-air-gapped?px-backup=true"

   To download the full bundle (PX-Backup + Monitoring + License Server):

   curl -o pxcentral-ag-install-backup.sh -L "https://install.portworx.com/pxcentral-air-gapped?px-backup=true&px-monitor=true&px-license-server=true"

   To download the full bundle for a specific release:

   curl -o pxcentral-ag-install-backup.sh -L "https://install.portworx.com/pxcentral-air-gapped?px-backup=true&px-monitor=true&px-license-server=true&version=3.1.0"

2. Provide execute permission for the script:

   chmod +x pxcentral-ag-install-backup.sh

3. Pull the container images:

   ./pxcentral-ag-install-backup.sh pull

4. Push the images to a local registry server accessible by the air-gapped nodes. Replace <repo> with your registry location:

   ./pxcentral-ag-install-backup.sh push <repo>

What to do next

Generate Portworx Backup Spec