Control Plane In-Place Upgrade

An in-place upgrade replaces the Control Plane (CP) while reusing its database. The Dashboard and Admin API are unavailable while source CP processes are stopped and the target CP starts. Existing Data Plane (DP) nodes can continue proxying their last valid configuration when the exact version path permits that mixed-version window.

Prepare for the Upgrade

1. Confirm the exact source and target versions. For LTS releases, use Choose an LTS Upgrade Path; otherwise, confirm the combination in the release notes or an API7 Support plan.
2. Schedule the CP management interruption and define the write-freeze boundary, acceptance criteria, abort thresholds, rollback owner, and rollback deadline.
3. Save the source CP manifests, values, configuration, image tags, and required credentials.
4. Create a database-native backup and restore it into an isolated database. Verify the restored source version and representative resources.
5. Build target manifests from the target package defaults and apply every change required by the path-specific guide and release notes. Update every enabled CP component, including api7/api7-ee-3-integrated, api7/api7-ee-dp-manager, and any enabled Developer Portal backend, API usage, or file-server image.

Upgrade the Control Plane

1. Start the management write freeze across Dashboard, Admin API, Developer Portal, ADC, automation, scheduled jobs, direct database integrations, and every other database writer.
2. Stop every source CP process and other database client. Do not run source and target CP versions against the same database.
3. Take the final source backup and repeat the isolated restore check. Keep this backup immutable through the rollback window.
4. Start the target CP using the path-specific migration sequence. If the path requires one migration Dashboard replica, keep every other target database client stopped until that replica passes validation.
5. Verify the target version, migration logs, representative resources, IAM policies, license, and every gateway group's compatibility report.
6. Restore the remaining target CP replicas and optional components only after the migration gate passes.
7. Observe the target CP for the predefined period. If an abort threshold is reached, keep writes frozen and follow the path-specific backup-based rollback.

The CP upgrade is complete only when every required target component is healthy and the named decision owner records acceptance.

Next Step

Keep the write freeze in effect and continue with the Data Plane Rolling Upgrade. Resume management writes only after every DP reaches the accepted target state.