Skip to main content

Upgrading Pomerium Enterprise

Review the upgrade guide below before upgrading to the latest version of Pomerium Enterprise.

0.21.0​

Before you upgrade​

Breaking​

Re-enroll devices​

The devices (beta) data model had an internal change that is not forward compatible. Please re-register your enrolled devices and update their device IDs. You may need to update your existing policies as well.

Auto TLS​

  • You can autogenerate TLS certificates to secure communication between the Enterprise Console and the Databroker services with the --derive-tls=domains configuration setting. The derive-tls setting derives your CA from your shared_secret and generates TLS certificates to protect the Databroker gRPC endpoint.

Client TLS renegotiation​

  • You can renegotiate server-initiated TLS for upstream clusters with the new tls_upstream_allow_renegotiation configuration setting.

Fixes​

  • v0.21.0 includes various fixes to the Enterprise Console's UI, builds, gRPC calls, and more.

0.20.0​

Before You Upgrade​

Groups & directory sync are managed from external data sources​

IdP directory sync has been moved to be part of the External Data Sources integration, in order to provide unification with other external data sources, consolidate job scheduling and monitoring. Setting the below options in Pomerium config file would now result in an error. In Pomerium Enterprise Console, please navigate to Settings > Identity Provider and configure directory sync there.

idp_enterprise

  • idp_service_account: use IdP provider specific options in the UI.
  • idp_refresh_directory_timeout: use Polling Min Delay.
  • idp_refresh_directory_interval: replaced by Polling Max Delay.
  • idp_qps: not required, IdP providers adjust their qps rate.

Pomerium Core would only perform user authentication and session refresh with the IdP provider, and would not try to synchronize user details and groups, which is now part of External Data Sources. Please review your identity provider's docs for instructions specific to your IdP (e.g. Identity Providers -> Google -> Directory Sync (Enterprise)).

0.18.0​

Before You Upgrade​

0.17.0​

Before You Upgrade​

  • The new license-key option is required for starting Pomerium Enterprise. Please contact your account team if you have not been issued one yet.

0.16.0​

Before You Upgrade​

  • The signing-key has been replaced with authenticate-service-url. Instead of manually setting the signing key in the Enterprise Console to match the Authenticate Service, we specify the trusted URL of the Authenticate Service to pull the signing key from.

    The signing-key key will continue to work for existing configurations, but device enrollment will not work until it is replaced by authenticate-service-url.

0.15.0​

Before You Upgrade​

  • signing-key is now a required option to improve request security from Pomerium Core. The value should match the one set in Pomerium Core. See the signing key reference page for more information on generating a key.
  • audience is now a required option to improve request security from Pomerium Core. The value should match the Enterprise Console's external URL hostname, as defined in the from field in the Routes entry (not including the protocol).

Helm Installations​

  • As of v0.15.0, All Helm charts have been consolidated to a single repository. Remove the pomerium-enterprise repo and upgrade from pomerium:

    helm repo remove pomerium-enterprise
    helm upgrade --install pomerium-console pomerium/pomerium-console --values=pomerium-console-values.yaml

  • As noted above, signing-key must be shared between Pomerium and Enterprise. See the Update Pomerium section of Install Pomerium Enterprise in Helm for more information.