IDSP Upgrade on OpenShift Fails with 403 or Pages Not Loading When ssp.ingress.keepLegacyRoutes Is Not Set

Products

• Symantec Identity Security Platform - IDSP (formerly VIP Authentication Hub)

Issue/Introduction

When upgrading Identity Security Platform (IDSP) in an environment using OpenShift Routes, the following option must be added to the upgrade command [1]:

--set ssp.ingress.keepLegacyRoutes=true

If this flag is not set during the upgrade, the IDSP Admin Console and other pages become unreachable, resulting in 403 errors or pages failing to load entirely.

Environment

Upgrade IDSP 4.0.1 and earlier to 4.0.2

Resolution

The option --set ssp.ingress.keepLegacyRoutes=true is required only for the initial upgrade step.

Step 1 — Run the upgrade command with the flag set to true:

--set ssp.ingress.keepLegacyRoutes=true

This keeps the current routing using OpenShift Routes for the duration of the upgrade, ensuring the Admin Console and other pages remain accessible.

Step 2 — After the upgrade completes successfully, re-run the upgrade command with the flag set to false, and dataseed can be disabled at this point:

--set ssp.ingress.keepLegacyRoutes=false

Setting keepLegacyRoutes=false switches routing to the OpenShift Native Router, with the SSP Router handling service multiplexing internally [2].

Additional Information

1. Upgrading Symantec Identity Security Platform
   
   
2. Release Notes 4.0.2