Upgrade

diff -r <previous-release>/terraform/aws <current-release>/terraform/aws

diff    <previous-release>/mocm/values.yaml <current-release>/mocm/values.yaml

cp <previous-release>/terraform/aws/terraform.tfstate \

   <previous-release>/terraform/aws/terraform.tfstate.pre-upgrade

# 1. Copy customer-specific files into the new release

SRC=<previous-release>/terraform/aws

DST=<current-release>/terraform/aws

cp "$SRC"/terraform.tfstate            "$DST"/

cp "$SRC"/terraform.tfstate.backup     "$DST"/ 2>/dev/null || true

cp "$SRC"/terraform.tfvars             "$DST"/

cp "$SRC"/backend.tf                   "$DST"/ 2>/dev/null || true

cp -r "$SRC"/.terraform.lock.hcl       "$DST"/ 2>/dev/null || true

#############################

# Valkey Configuration (single node, no replica)

#############################

valkey_username                   = "fusion"

valkey_engine_version             = "8.0"

valkey_node_type                  = "cache.t3.micro"

valkey_port                       = 6379

valkey_family                     = "valkey8"

valkey_num_cache_clusters         = 1

valkey_automatic_failover_enabled = false

# Password is auto-generated by Terraform and stored in AWS Secrets Manager.

# Retrieve: aws secretsmanager get-secret-value \

#   --secret-id <name_prefix>/valkey/fusion \

#   --region <aws_region>

cd <current-release>/terraform/aws

mv 09-elasticache.tf.2603 09-elasticache.tf

# 4. Re-initialise providers (versions may have changed)

cd <current-release>/terraform/aws

tofu init -upgrade

# 5. Review the plan

tofu plan -out tfplan

#    Any destroy/replace on resources you intend to keep → STOP, investigate.

# 6. Apply

tofu apply tfplan

After the apply succeeds, **archive the old release directory** (don't delete

it) so you can roll back state if needed:

```bash

tar czf previous-release.tar.gz <previous-release>/

cd <previous-release>/terraform/aws

# Create the S3 bucket + DynamoDB lock table out-of-band, then:

cp backend.tf.example backend.tf

# Edit backend.tf — set bucket, key, region, dynamodb_table

tofu init -migrate-state    # pushes local state to S3, answer "yes"

mv terraform.tfstate terraform.tfstate.migrated-to-s3

# 1. Copy customer-specific files into the new release

SRC=<previous-release>/terraform/aws

DST=<current-release>/terraform/aws

cp "$SRC"/backend.tf       "$DST"/

cp "$SRC"/terraform.tfvars "$DST"/

# 2. Activate ElastiCache (Redis) so it keeps running in parallel with the new

#    Valkey replication group. Rename back to .2603 once apps are cut over —

#    see "Stage 4 — Decommission ElastiCache" at the bottom of this document.

mv "$DST"/09-elasticache.tf.2603 "$DST"/09-elasticache.tf

# 3. Append the Valkey block to terraform.tfvars. New in 10.6.2605;

# skip if your file already contains valkey_*. The block is identical to

# Option A step 2:

#############################

# Valkey Configuration (single node, no replica)

#############################

valkey_username                   = "fusion"

valkey_engine_version             = "8.0"

valkey_node_type                  = "cache.t3.micro"

valkey_port                       = 6379

valkey_family                     = "valkey8"

valkey_num_cache_clusters         = 1

valkey_automatic_failover_enabled = false

# Password is auto-generated by Terraform and stored in AWS Secrets Manager.

# Retrieve: aws secretsmanager get-secret-value \

#   --secret-id <name_prefix>/valkey/fusion \

#   --region <aws_region>

# 4. Init, plan, apply

cd "$DST"

tofu init                  # connects to the same S3 backend

tofu plan -out tfplan

tofu apply tfplan

cd <current-release>/terraform/aws

cp terraform.tfstate terraform.tfstate.failed

cp <previous-release>/terraform/aws/terraform.tfstate.pre-upgrade \

   <previous-release>/terraform/aws/terraform.tfstate

cd <previous-release>/terraform/aws

tofu init -upgrade

tofu apply       # re-converges to the previous baseline

aws s3api list-object-versions --bucket <state-bucket> --prefix <state-key>

aws s3api get-object --bucket <state-bucket> --key <state-key> \

  --version-id <pre-upgrade-version-id> terraform.tfstate.rollback

# Then push it back with `tofu state push terraform.tfstate.rollback`

# Keep the new file as the base, copy your real values into it

cp <current-release>/mocm/values.yaml <current-release>/mocm/values.yaml.new

# Open both side-by-side and port your credentials / host / productKey /

# storage / componentReplicas from the previous release into the new file.

diff -u <current-release>/mocm/values.yaml.new \

        <previous-release>/mocm/values.yaml | less

global:

  image:

    registry: "<id>.dkr.ecr.<region>.amazonaws.com"

    tag: "10.6.2605"          # was the previous build, e.g. "10.5.2603"

    pullPolicy: IfNotPresent

cd <current-release>/mocm

helmfile -f helmfile.yaml -n fusion diff

helmfile -f helmfile.yaml -n fusion sync 2>&1 | tee helmfile-upgrade.log

helm rollback mocm-service -n fusion

# Connections to the old cache cluster should be 0 over the observation window.

aws cloudwatch get-metric-statistics \

  --namespace AWS/ElastiCache \

  --metric-name CurrConnections \

  --dimensions Name=CacheClusterId,Value=<name_prefix>-cache \

  --statistics Maximum --period 300 \

  --start-time "$(date -u -d '24 hours ago' +%FT%TZ)" \

  --end-time   "$(date -u +%FT%TZ)"

grep -RnE 'elasticache|redis\.amazonaws\.com' <current-release>/mocm/

aws elasticache create-snapshot \

  --cache-cluster-id <name_prefix>-cache \

  --snapshot-name    <name_prefix>-cache-final

cd <current-release>/terraform/aws

mv 09-elasticache.tf 09-elasticache.tf.2603

tofu plan -out tfplan

#    Expect destroys for:

#      aws_elasticache_cluster.elasticache

#      aws_elasticache_parameter_group.elasticache

#      aws_elasticache_subnet_group.elasticache

#    No destroy or replace on any *valkey* resource — if you see one, STOP.

tofu apply tfplan