Upgrading Cloudera Data Services on premises using Cloudera Embedded Container Service

Review the process for upgrading Cloudera Data Services on premises using Cloudera Embedded Container Service. You can upgrade Cloudera Data Services on premises to the latest version without uninstalling your existing installation.

important

While performing the upgrade to Cloudera Data Services on premises 1.5.5 SP2, the upgrade process may stall during the first hop (from Cloudera Data Services on premises SP1 to SP2), while waiting for the Cloudera Data Services Console Web UI to become accessible.

This issue is caused by a change in how incoming requests without valid hostnames are handled following the migration to Istio:

Previous Behavior (pre-SP2 / Nginx): Requests made over HTTPS to unknown hostnames or direct IP addresses (For example, generic load balancer health probes) were answered with an HTTP 404 Not Found response using a default fallback SSL/TLS certificate. Many external load balancers (such as F5 BIG-IP) implicitly relied on this undocumented 404 response to confirm backend node health.
New Behavior (SP2+ / Istio): Istio strictly validates hostnames and SNI (Server Name Indication). If a request arrives over HTTPS without a recognized hostname or matching TLS certificate, Istio actively closes the TCP connection.

To unblock the upgrade and restore health monitoring, update the external Load Balancer (F5) settings before or during the upgrade process by changing the Health Monitor to Raw TCP.

Reconfigure the Load Balancer health monitor to check layer-4 connectivity instead of sending application-layer HTTPS requests.

Navigate to the Load Balancer (LB) configuration for the ECS Master backend pool.
Change the health check monitor type from HTTPS to Raw TCP.
Verify that the LB marks the backend pool members as Healthy.