Skip to content
WhyStackWhyStackWhyStack Edge

Migrating from RootPilot

From version 1.29.0 on, the Agent and the Profiler use the WhyStack name in everything they define, not only in the text: image, Kubernetes names, variables, hostnames, health command. Version 1.30.0 removed the fallbacks that kept an earlier installation running on the new image, so an installation made before 1.29.0 has to be reinstalled with the new names, following the steps below. Changing only the image breaks it, as described in What no longer works.

What changes

Section titled “What changes”
What Before From 1.29.0
Agent image <address>/rootpilot-agent <address>/whystack-agent
Profiler image <address>/rootpilot-profiler <address>/whystack-profiler
Artifact Registry path <project>/rootpilot/rootpilot-agent <project>/whystack/whystack-agent
Signature identity (cosign) github.com/sunnysystems/rootpilot-edge/... github.com/sunnysystems/whystack-edge/...
Control-plane (enrollment) https://app.rootpilot.sh https://app.whystack.ai
Tunnel wss://tunnel.rootpilot.sh:8443 wss://tunnel.whystack.ai:8443
Documentation docs.rootpilot.sh docs.whystack.ai
IAM policy file rootpilot-edge-readonly.json whystack-edge-readonly.json
Health command rootpilot-health whystack-health
RUNNER_HEALTH_DIR default /tmp/rootpilot-health /tmp/whystack-health
Variables ROOTPILOT_OTEL_ENABLED, ROOTPILOT_OTEL_EXPORTER, ROOTPILOT_PII_REDACTION WHYSTACK_OTEL_ENABLED, WHYSTACK_OTEL_EXPORTER, WHYSTACK_PII_REDACTION
Kubernetes namespace, StatefulSet, Service, NetworkPolicy rootpilot-agent whystack-agent
Kubernetes ConfigMap and Secret rootpilot-agent-config, rootpilot-agent-env whystack-agent-config, whystack-agent-env
Kubernetes part-of label rootpilot whystack
OIDC token audience (gke-oidc) rootpilot-enroll whystack-enroll
Compose service and identity volume rootpilot-agent, rootpilot-identity whystack-agent, whystack-identity
Profiler AppArmor profile rootpilot-profiler whystack-profiler
Telemetry, if you export it rootpilot.* spans, metrics and attributes; services rootpilot-runner, rootpilot-profiler whystack.*; services whystack-runner, whystack-profiler

Reinstalling

Section titled “Reinstalling”

The new names do not update the old installation in place: they create a new one next to it. That is what you want. Bring the new Agent up, confirm it, and only then remove the old one. Two Agents of the same organization side by side for a few minutes is fine, since each has its own identity.

  1. Egress first. Allow tunnel.whystack.ai:8443, and app.whystack.ai:443 if the Agent enrolls automatically, before the new Agent starts. See Requirements.

  2. Image. Pull whystack-agent (and whystack-profiler) by digest, and verify the signature with the new identity, as in Container image. The old repository receives no new versions.

  3. Variables. Rename the three variables in the table in your environment, Secret, or secret manager, and point RUNNER_TUNNEL_URL and RUNNER_ENROLL_URL at the new hostnames.

  4. Kubernetes. Download the base for the new version and apply your overlay on top of it (Kubernetes). Create the whystack-agent-env Secret in the whystack-agent namespace with a new bootstrap token. With gke-oidc, change the projected token’s audience to whystack-enroll in your patch. Once the new pod shows hello accepted, delete the old namespace, which takes the old PVC and identity with it:

    Terminal window
    kubectl delete namespace rootpilot-agent

  5. Docker Compose. Rename the service and the volume in your file. The new volume starts empty, so the Agent enrolls again: give it a new bootstrap token in RUNNER_BOOTSTRAP_TOKEN for the first boot (Docker Compose). docker compose up -d --remove-orphans stops the old container. Remove the old volume once the new Agent is in the Fleet.

  6. Profiler. Load the AppArmor profile under the new name (AppArmor) and change security_opt to apparmor=whystack-profiler. Then unload the old one:

    Terminal window
    sudo apparmor_parser -R /etc/apparmor.d/rootpilot-profiler
    sudo rm /etc/apparmor.d/rootpilot-profiler

  7. Your own checks. Probes, healthchecks, or scripts that call the health command by name move to whystack-health. Dashboards and alerts over the Agent’s telemetry move to whystack.*; the history before 1.29.0 stays under the old names.

What no longer works

Section titled “What no longer works”

Version 1.30.0 has none of the fallbacks that 1.29.x kept for an installation made before the rename. An installation that moves to it without being reinstalled loses these:

  • The rootpilot-health command no longer exists in the image. A probe or healthcheck that calls it fails, and Kubernetes restarts the pod over and over.
  • ROOTPILOT_OTEL_ENABLED, ROOTPILOT_OTEL_EXPORTER, and ROOTPILOT_PII_REDACTION are no longer read. Telemetry turned on by the old name stays off, and ROOTPILOT_PII_REDACTION=off no longer turns redaction off.
  • The old hostnames and the rootpilot-enroll audience no longer work: an Agent pointed at them cannot enroll or connect.

One thing stays as it is, and needs nothing from you: the Agent accepts a certificate in either SPIFFE trust domain. The control-plane still issues spiffe://rootpilot/tenant/<slug>/runner, which is what the enrolled log line shows, and will move to spiffe://whystack/tenant/<slug>/runner later. Both name the same organization.