# Elasticsearch upgrade failed from 7.4.0 to 7.5.2

**URL:** <https://discuss.elastic.co/t/elasticsearch-upgrade-failed-from-7-4-0-to-7-5-2/229622>\
**Category:** Elasticsearch\
**Created:** [April 24, 2020, 10:33am UTC](https://discuss.elastic.co/t/elasticsearch-upgrade-failed-from-7-4-0-to-7-5-2/229622 "2020-04-24T10:33:33Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![kasim123](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kasim123/32/58684_2.png) [@kasim123](https://discuss.elastic.co/u/kasim123)\
**Post date:** [April 24, 2020, 10:33am UTC](https://discuss.elastic.co/t/elasticsearch-upgrade-failed-from-7-4-0-to-7-5-2/229622/1 "2020-04-24T10:33:33Z")

</div>

Hi Team,

We have a elasticsearch cluster configured with 7.4.0 version. Now we wanted to upgrade it to 7.5.2 and enable xpack security. When I tried to upgrade to 7.5.2 version, I ended up with below error message. What could have been wrong in upgrade process.

```auto
helm upgrade elasticsearch --tiller-namespace logging --namespace logging elastic/elasticsearch/ -f logging/tools/values-tools.yaml
UPGRADE FAILED
Error: StatefulSet.apps "elasticsearch-master" is invalid: spec: Forbidden: updates to statefulset spec for fields other than 'replicas', 'template', and 'updateStrategy' are forbidden
Error: UPGRADE FAILED: StatefulSet.apps "elasticsearch-master" is invalid: spec: Forbidden: updates to statefulset spec for fields other than 'replicas', 'template', and 'updateStrategy' are forbidden

```

Thanks,  
Kasim Shaik.

---

<div class="post-metadata">

**Author:** ![Julien\_MAILLERET](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/julien_mailleret/32/45074_2.png) [@Julien\_MAILLERET](https://discuss.elastic.co/u/Julien_MAILLERET)\
**Post date:** [April 27, 2020, 7:41am UTC](https://discuss.elastic.co/t/elasticsearch-upgrade-failed-from-7-4-0-to-7-5-2/229622/2 "2020-04-27T07:41:46Z")

</div>

Hi @kasim123,

> Now we wanted to upgrade it to 7.5.2 and enable xpack security

Can you paste here the `values.yaml` used with 7.4.0 and 7.5.2 (don't forget to expunge any secret)?

---

<div class="post-metadata">

**Author:** ![kasim123](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kasim123/32/58684_2.png) [@kasim123](https://discuss.elastic.co/u/kasim123)\
**Post date:** [April 28, 2020, 9:59am UTC](https://discuss.elastic.co/t/elasticsearch-upgrade-failed-from-7-4-0-to-7-5-2/229622/3 "2020-04-28T09:59:28Z")

</div>

@Julien_MAILLERET,

Here is my values.yaml file entries.

```auto
---
clusterName: "elasticsearch"
nodeGroup: "master"

masterService: ""

roles:
  master: "true"
  ingest: "true"
  data: "true"

replicas: 3
minimumMasterNodes: 2

esMajorVersion: ""

securityEnable: "true"
esConfig:
  elasticsearch.yml: |
     xpack.security.enabled: true
     xpack.security.transport.ssl.enabled: true
     xpack.security.transport.ssl.verification_mode: certificate
     xpack.security.transport.ssl.keystore.path: /usr/share/elasticsearch/config/certs/XXXX.p12
     xpack.security.transport.ssl.truststore.path: /usr/share/elasticsearch/config/certs/XXXX.p12
     xpack.security.http.ssl.enabled: true
     xpack.security.http.ssl.truststore.path: /usr/share/elasticsearch/config/certs/XXXX.p12
     xpack.security.http.ssl.keystore.path: /usr/share/elasticsearch/config/certs/XXXX.p12

extraEnvs:
  - name: ELASTIC_PASSWORD
    valueFrom:
      secretKeyRef:
        name: elastic-credentials
        key: password
  - name: ELASTIC_USERNAME
    valueFrom:
      secretKeyRef:
        name: elastic-credentials
        key: username

secretMounts:
  - name: elastic-certificates
    secretName: elastic-certificates
    path: /usr/share/elasticsearch/config/certs

image: "docker.elastic.co/elasticsearch/elasticsearch"
imageTag: "7.5.2"
imagePullPolicy: "IfNotPresent"

podAnnotations: {}
  # iam.amazonaws.com/role: es-cluster

labels: {}

esJavaOpts: "-Xmx1g -Xms1g"

resources:
  requests:
    cpu: "1000m"
    memory: "2Gi"
  limits:
    cpu: "2000m"
    memory: "4Gi"

initResources: {}
  # limits:
  # cpu: "25m"
  # # memory: "128Mi"
  # requests:
  # cpu: "25m"
  # memory: "128Mi"

sidecarResources: {}
  # limits:
  # cpu: "25m"
  # # memory: "128Mi"
  # requests:
  # cpu: "25m"
  # memory: "128Mi"

networkHost: "0.0.0.0"

volumeClaimTemplate:
  accessModes: ["ReadWriteOnce"]
  storageClassName: "rook-ceph-block"
  resources:
    requests:
      storage: 100Gi

rbac:
  create: false
  serviceAccountName: ""

podSecurityPolicy:
  create: false
  name: ""
  spec:
    privileged: true
    fsGroup:
      rule: RunAsAny
    runAsUser:
      rule: RunAsAny
    seLinux:
      rule: RunAsAny
    supplementalGroups:
      rule: RunAsAny
    volumes:
      - secret
      - configMap
      - persistentVolumeClaim

persistence:
  enabled: true
  annotations: {}

extraVolumes: ""
  # - name: extras
  # emptyDir: {}

extraVolumeMounts: ""
  # - name: extras
  # mountPath: /usr/share/extras
  # readOnly: true

extraInitContainers: ""
  # - name: do-something
  # image: busybox
  # command: ['do', 'something']

priorityClassName: ""

antiAffinityTopologyKey: "kubernetes.io/hostname"

antiAffinity: "hard"

nodeAffinity: {}

podManagementPolicy: "Parallel"

protocol: https
httpPort: 9200
transportPort: 9300

service:
  labels: {}
  labelsHeadless: {}
  type: ClusterIP
  nodePort: ""
  annotations: {}
  httpPortName: http
  transportPortName: transport

updateStrategy: RollingUpdate

maxUnavailable: 1

podSecurityContext:
  fsGroup: 1000
  runAsUser: 1000

fsGroup: ""

securityContext:
  capabilities:
    drop:
    - ALL
  # readOnlyRootFilesystem: true
  runAsNonRoot: true
  runAsUser: 1000

terminationGracePeriod: 120

sysctlVmMaxMapCount: 262144

readinessProbe:
  failureThreshold: 3
  initialDelaySeconds: 10
  periodSeconds: 10
  successThreshold: 3
  timeoutSeconds: 5

clusterHealthCheckParams: "wait_for_status=green&timeout=1s"

schedulerName: ""

imagePullSecrets: []
nodeSelector: {}
tolerations: []

ingress:
  enabled: false
  annotations: {}
    # kubernetes.io/ingress.class: nginx
    # kubernetes.io/tls-acme: "true"
  path: /
  hosts:
    - chart-example.local
  tls: []
  # - secretName: chart-example-tls
  # hosts:
  # - chart-example.local

nameOverride: ""
fullnameOverride: ""

masterTerminationFix: false

lifecycle: {}
  # preStop:
  # exec:
  # command: ["/bin/sh", "-c", "echo Hello from the postStart handler > /usr/share/message"]
  # postStart:
  # exec:
  # command:
  # - bash
  # - -c
  # - |
  # #!/bin/bash
  # # Add a template to adjust number of shards/replicas
  # TEMPLATE_NAME=my_template
  # INDEX_PATTERN="logstash-*"
  # SHARD_COUNT=8
  # REPLICA_COUNT=1
  # ES_URL=http://localhost:9200
  # while [["$(curl -s -o /dev/null -w '%{http_code}\n' $ES_URL)" != "200"]]; do sleep 1; done
  # curl -XPUT "$ES_URL/_template/$TEMPLATE_NAME" -H 'Content-Type: application/json' -d'{"index_patterns":['\""$INDEX_PATTERN"\"'],"settings":{"number_of_shards":'$SHARD_COUNT',"number_of_replicas":'$REPLICA_COUNT'}}'

sysctlInitContainer:
  enabled: true

```

---

<div class="post-metadata">

**Author:** ![Julien\_MAILLERET](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/julien_mailleret/32/45074_2.png) [@Julien\_MAILLERET](https://discuss.elastic.co/u/Julien_MAILLERET)\
**Post date:** [May 11, 2020, 12:28pm UTC](https://discuss.elastic.co/t/elasticsearch-upgrade-failed-from-7-4-0-to-7-5-2/229622/4 "2020-05-11T12:28:49Z")

</div>

Hi @kasim123,

I don't see anything that could be generate this error, neither in your values.yaml nor in the changes we did between 7.4.0 and 7.5.2. In addition our upgrade tests are working fine.

Can you provide result of `helm get <RELEASE_NAME>`?

Also, can you provide the version of helm and kubernetes that you are using?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 8, 2020, 12:29pm UTC](https://discuss.elastic.co/t/elasticsearch-upgrade-failed-from-7-4-0-to-7-5-2/229622/5 "2020-06-08T12:29:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.