Always conduct upgrades in sequence: first the control plane, then all apoctl clients, then the enforcers (optional).

After upgrading the control plane, you should upgrade all apoctl clients. Otherwise, you may experience unexpected behavior. The upgrade of apoctl consists of a simple reinstall.

Never upgrade the enforcers without first upgrading the control plane. Newer enforcers cannot communicate with older control planes. Upgrading the enforcers is optional as older enforcers can continue to communicate with newer control planes.

Upgrade the
control plane
Upgrade apoctl
Upgrade the
enforcers (optional)