Upgrade from 2.2.2 to 2.2.3 using Helm

If your deployment is on a specific version and you want to upgrade, check the Release Notes to learn about the new features and fixes before upgrading. To successfully upgrade SPK from 2.2.2 to 2.2.3, follow the instructions provided in the following sections in the specified sequence.

  1. Upgrade the CRD Conversion pod and upgrade CRDs

  2. Upgrade the Cert Manager

  3. Upgrade the RabbitMQ

  4. Upgrade the CWC

  5. Upgrade the Coremond

  6. Upgrade the CRD Conversion pod

  7. Upgrade the dSSM

  8. Upgrade the Toda-fluentd

  9. Upgrade the F5Ingress

  10. Upgrade the OTeL

Prereqisites:

Upgrade CRDs

  1. Upgrade the common CRDs.

    helm upgrade f5-spk-crds-common tar/f5-spk-crds-common-14.19.4-0.1.55.tgz -f crds_overrides.yaml

    Sample Output:

    Release "f5-spk-crds-common" has been upgraded. Happy Helming!
NAME: f5-spk-crds-common
LAST DEPLOYED: Wed May 06 11:25:04 2026
NAMESPACE: default
STATUS: deployed
REVISION: 2
DESCRIPTION: Upgrade complete
TEST SUITE: None

  2. Upgrade the SPK CRDs.

    helm upgrade f5-spk-crds-service-proxy tar/f5-spk-crds-service-proxy-14.19.4-0.1.55.tgz -f crds_overrides.yaml

    Sample Output:

    Release "f5-spk-crds-service-proxy" has been upgraded. Happy Helming!
NAME: f5-spk-crds-service-proxy
LAST DEPLOYED: Wed May 06 11:25:04 2026
NAMESPACE: default
STATUS: deployed
REVISION: 2
DESCRIPTION: Upgrade complete
TEST SUITE: None

Upgrade the cert-manager

  1. Verify the cert-manager.yaml contents.

    cat cert-manager.yaml

    Sample Output:

    image:
  repository: repo.f5.com/images
 
webhook:
  image:
    repository: repo.f5.com/images
 
cainjector:
  image:
    repository: repo.f5.com/images
 
startupapicheck:
  image:
    repository: repo.f5.com/images
 
init_container:
  image:
    name: init-certmgr
    repository: repo.f5.com/images
logging_sidecar:
  # Enable/Disable logging sidecar
  enabled: false
  name: logging-sidecar
  image:
    name: f5-fluentbit
    repository: repo.f5.com/images
 
  fluentbit:
    input:
      pipes:
        bufSize: 8096
    tls:
      enabled: true
  fluentd:
    host: f5-toda-fluentd.spk-utilities.svc.cluster.local.

  2. Upgrade the cert-manager.

    helm upgrade f5-certificate-manager tar/f5-cert-manager-0.23.48-0.1.20.tgz -n spk-utilities   -f cert-manager.yaml

    Sample Output:

    Release "f5-certificate-manager" has been upgraded. Happy Helming!
NAME: f5-certificate-manager
LAST DEPLOYED: Wed May 06 11:25:04 2026
NAMESPACE: f5-common
STATUS: deployed
REVISION: 2
DESCRIPTION: Upgrade complete
TEST SUITE: None
NOTES:

  3. See the installed releases in spk-utilities namespace to check for newly upgraded Cert Manager.

    helm list -n spk-utilities

Upgrade the RabbitMQ

  1. Verify the rabbitmq-values.yaml contents.

    cat rabbitmq-values.yaml

    Sample Output:

    image:
  repository: repo.f5.com/images
 
fluentbit_sidecar:
  image:
    repository: repo.f5.com/images

  2. Upgrade the RabbitMQ.

    helm upgrade rabbitmq tar/rabbitmq-0.8.9-0.0.16.tgz -n spk-utilities -f rabbitmq-values.yaml

    Sample Output:

    Release "rabbitmq" has been upgraded. Happy Helming!
NAME: rabbitmq
LAST DEPLOYED: Wed May 06 11:25:04 2026
NAMESPACE: f5-common
STATUS: deployed
REVISION: 2
DESCRIPTION: Upgrade complete
TEST SUITE: None
NOTES:
The RabbitMQ has been installed.

  3. View the list of pods associated with spk-utilities namespace/project.

    oc get pods -n spk-utilities

Upgrade the CWC

  1. Verify the cwc_overrides.yaml contents.

    cat cwc_overrides.yaml

    Sample Output:

    cwc:
  image:
    repository: devrepo.f5.com/images
orch:
  image:
    repository: devrepo.f5.com/images
 
fluentbit_sidecar:
  image:
      repository: devrepo.f5.com/images
rbac:
  multiNSDeployment: true

  2. Upgrade the CWC.

    **Note: Make sure to replace cpclConfig.jwt value in the command with a valid JWT token.

    helm upgrade cwc tar/cwc-0.49.7-0.0.33.tgz -n spk-utilities -f cwc_overrides.yaml --set rabbitmqNamespace=spk-utilities --set cpclConfig.jwt="<JWT Token>"

    Sample Output:

    Release "cwc" has been upgraded. Happy Helming!
NAME: cwc
LAST DEPLOYED: Wed May 06 11:25:04 2026
NAMESPACE: f5-common
STATUS: deployed
REVISION: 2
DESCRIPTION: Upgrade complete
TEST SUITE: None
NOTES:
The Cluster Wide Controller has been installed.
====================================================
Admin Token Feature: DISABLED
No authentication token is required for REST API calls.
====================================================

  3. View the list of pods associated with spk-utilities namespace/project.

    oc get pods -n spk-utilities

  4. Check the license status after the CWC upgrade, see License status. If the license has expired, renew it before proceeding with the F5Ingress upgrade.

Upgrade the Coremond

  1. Verify the coremond-values.yaml contents.

    cat coremond-values.yaml

    Sample Output:

    image:
  repository: repo.f5.com/images

persistence:
  storageClass: managed-nfs-storage

resources:
  limits:
    cpu: "1"
    memory: 200
  requests:
    cpu: "0.5"
    memory: 50

fluentbit_sidecar:
  image:
    repository: repo.f5.com/images  
  resources:
    limits:
      cpu: "0.5"
      memory: "512Mi"
    requests:
      cpu: "0.2"
      memory: "256Mi"

  2. Upgrade the Coremond.

    helm upgrade f5-coremond tar/coremond-0.10.0-0.3.10.tgz -n spk-utilities -f coremond-values.yaml

    Sample Output:

    Release "f5-coremond" has been upgraded. Happy Helming!
NAME: f5-coremond
LAST DEPLOYED: Wed May 06 11:25:04 2026
NAMESPACE: f5-common
STATUS: deployed
REVISION: 2
DESCRIPTION: Upgrade complete
TEST SUITE: None

  3. View the list of pods associated with spk-utilities namespace/project.

    oc get pods -n spk-utilities

Upgrade the CRD Conversion pod

  1. Verify the crd_conv_overrides_2.2.2.yaml contents.

    cat crd_conv_overrides_2.2.2.yaml

    Sample Output:

    crdconversion:
  image:
    repository: repo.f5.com/images
 
  rabbitmqNamespace: spk-utilities
 
  fluentbit_sidecar:
    image:
      repository: repo.f5.com/images
    fluentd:
      host: f5-toda-fluentd.spk-utilities.svc.cluster.local.

  2. Upgrade the the CRD Conversion pod.

    In this example, the new version of f5-crdconversion helm chart is 0.61.4-0.0.60.

     helm upgrade f5-crd-conversion tar/f5-crdconversion-0.61.4-0.0.60.tgz -f crd_conv_overrides_2.2.2.yaml -n  spk-utilities

    Sample Output:

    Release "f5-crdconversion" has been upgraded. Happy Helming!
NAME: f5-crdconversion
LAST DEPLOYED: Wed May 06 11:25:04 2026
NAMESPACE: f5-common
STATUS: deployed
REVISION: 2
DESCRIPTION: Upgrade complete
TEST SUITE: None

  3. Verify the crds_overrides.yaml contents.

    cat crds_overrides.yaml

    Sample Output:

    conversion:
  namespace: spk-utilities

Upgrade the dSSM

To successfully upgrade dSSM, follow the instructions in Upgrading dSSM.

Upgrade the Toda-fluentd

  1. Verify the toda.yaml contents.

    cat toda.yaml

    Sample Output:

    image:
  repository: repo.f5.com/images
  pullPolicy: Always
 
dssm_logs:
  enabled: true
  stdout: true
 
f5ingress_logs:
  enabled: true
  stdout: true
 
dssm_sentinel_logs:
  enabled: true
  stdout: true
 
persistence:
  enabled: true
 
tls:
  enabled: true

  2. Upgrade the Toda-fluentd.

    helm upgrade f5-toda-fluentd tar/f5-toda-fluentd-2.3.2-0.0.27.tgz -f toda.yaml -n spk-utilities

    Sample Output:

    Release "f5-toda-fluentd" has been upgraded. Happy Helming!
NAME: f5-toda-fluentd
LAST DEPLOYED: Wed May 06 11:25:04 2026
NAMESPACE: dav7-f5-spk
STATUS: deployed
REVISION: 2
DESCRIPTION: Upgrade complete
TEST SUITE: None
NOTES:
Log aggregator - FluentD is deployed, which get logs from fluentbit sidecars.
FluentD outputs:
    'stdout' is "false"
    'persistent volume' is "true"
Persistent volume claim created with:
    accessModes: "ReadWriteOnce"
    storage: "3Gi"

FluentD hostname: f5-toda-fluentd.dav7-f5-spk.svc.cluster.local.
FluentD port: "54321"
Use this info to connect to it:
    --set f5-toda-logging.fluentd.host="f5-toda-fluentd.dav7-f5-spk.svc.cluster.local."
    --set f5-toda-logging.fluentd.port=54321

FluentD service IP family:
    serviceIpFamily: .Values.serviceIpFamily

  3. See the installed releases in spk-utilities namespace to check for newly installed Cert Manager.

    helm list -n spk-utilities

  4. View the list of pods associated with spk-utilities namespace/project.

    oc get pods -n spk-utilities

Upgrade the F5Ingress

With the implementation of readinessGates (config and routing gates), we have ensured TMM is available to process the network traffic with minimal traffic loss. For more information, see TMM Rolling Update.

Important: Based on the maxUnavailable, maxSurge, and TMM replicas configuration, ensure that you have:

  • Enough resources available.

  • Additional SelfIPs and translationIPs (SNAT and CGNAT).

  1. Verify the overrides_2.2.2_values.yaml contents.

    Note: The following parameters are configured to ensure that, during the upgrade, the TMM pod is immediately available to receive network traffic with a very less traffic loss:

    • tmm.bfdToOVN.enabled is set to True

    • tmm.dynamicRouting.bfd is configured.

    cat overrides_2.2.2_values.yaml

    Sample Output:

  2. (Optional) If you want to use the Multiple External Gateway (MEG) with SPK 2.2.2, apply the AdminPolicyBasedExternalRoute CR. For more information, see AdminPolicyBasedExternalRoute.

  3. (Optional) If you have f5-afm pod enabled in values.yaml, add privileges to the f5-afm service account.

    oc adm policy add-scc-to-user privileged -n spk-ingress -z f5-afm

  4. Upgrade the F5Ingress.

    Note: Before upgrading F5Ingress, ensure that readinessGates.enabled is set to true in values.yaml.

    helm upgrade f5ingress tar/f5ingress-<version>.tgz -f <values>.yaml -n namespace

    In this example, the Pods will be upgraded using the f5ingress-v15.82.0-0.9.133 Helm chart.

    helm upgrade f5ingress tar/f5ingress-v15.82.0-0.9.133.tgz -f overrides_2.2.2_values.yaml -n spk-ingress

    Sample Output:

    Release "f5ingress" has been upgraded. Happy Helming!
NAME: f5ingress
LAST DEPLOYED: Wed May 06 11:25:04 2026
NAMESPACE: dav7-alpha
STATUS: deployed
REVISION: 2
DESCRIPTION: Upgrade complete
TEST SUITE: None
NOTES:
The F5Ingress Controller has been installed.
TMM debug sidecar is deployed. To access: kubectl exec -it deployment/f5-tmm -c debug -n dav7-alpha -- bash

  5. View the list of pods associated with spk-ingress namespace/project.

    oc get pods -n spk-ingress -o wide

  6. See the installed releases in spk-ingress namespace.

    In this example, the below command shows the installed releases in spk-ingress Project.

    helm list -n spk-ingress

  7. During F5Ingress update process, run the below command to check the status of readinessGates (ConfigurationDone and RoutingDone gates).

    In this example, the f5-tmm-7fb766f798-6bgbk is TMM pod.

    oc describe pod f5-tmm-7fb766f798-6bgbk

    Sample Output:

    Readiness Gates:
  Type                Status
  ConfigurationDone   True
  RoutingDone         True

Upgrade the OTeL

  1. Verify the otel-override.yaml contents.

    $ cat otel-override.yaml

    Override value file: otel-override.yaml

    enabled: true
cert-orchestrator:
  enabled: true
image:
  repository: devrepo.f5.com/images
resources:
  requests:
    cpu: 1m
    memory: 1Mi
exporters:
  prometheus:
    namespace: ""
otelCustomConf: |
  exporters:
    otlp:
      endpoint: otel-test.default.svc.cluster.local:4317
      tls:
        insecure: true
      retry_on_failure:
        enabled: true
        initial_interval: 1s
        max_interval: 10s
        max_elapsed_time: 0
  service:
    pipelines:
      metrics:
        exporters: [otlp, prometheus]
global:
  imageCredentials:
    name: far-secret

  2. Upgrade the OTeL.

    $ helm upgrade otel tar/f5-stats_collector-1.0.21-0.0.8.tgz -n spk-ingress -f otel.yaml

    Sample output

    Release "otel" has been upgraded. Happy Helming!
NAME: otel
LAST DEPLOYED: Tue May 06 11:25:04 2026
NAMESPACE: spk-ingress
STATUS: deployed
REVISION: 2
DESCRIPTION: Upgrade complete
TEST SUITE: None