Upgrade Patient Journey Intelligence
Use pj-app-updater.sh to upgrade an existing Patient Journey Intelligence release. Run it from the release directory and preserve the namespace, hostname, platform mode, and environment values used by your deployment. The updater does not remember every install option, so repeat your install options on each update.
Preserve the application address
Pass the existing DNS hostname with --host on every update. Omitting it sets ingress.noHost=true and removes the ingress host rule. For HTTPS deployments, also pass --tls and any explicit --cluster-issuer selection. Replace pjapp.example.com in these examples with your deployed hostname. Omit --host only for an intentionally hostless deployment.
The updater does not remember your platform mode: repeat --eks, --gke, --aks, or --openshift as applicable. Examples without --tls describe HTTP deployments. Add your existing --values files and --release if you use a non-default release name.
Upgrade on K3s
sudo ./pj-app-updater.sh --host pjapp.example.com --namespace dev
For an HTTPS installation using local document storage:
sudo ./pj-app-updater.sh --namespace dev --host pjapp.example.com \
--tls --values local-host.values.yaml
Use this values file only if it is the file used by your installation. Retain any explicit --cluster-issuer setting too.
Upgrade on managed Kubernetes
Managed-cluster upgrades:
# EKS
./pj-app-updater.sh --host pjapp.example.com --eks --namespace <ns>
# EKS, also create missing EFS/EBS storage classes
./pj-app-updater.sh --host pjapp.example.com --eks --efs --namespace <ns>
# GKE
./pj-app-updater.sh --host pjapp.example.com --gke --namespace <ns>
# AKS
./pj-app-updater.sh --host pjapp.example.com --aks --namespace <ns>
For OpenShift-specific authentication and update commands, follow OpenShift / ROSA.
Preserve environment values
Use the same --values/-f files on each update. The updater's explicit Helm settings preserve application secrets but do not remember an omitted environment values file. See Configuration for the shared-storage update commands and provider environment variables.
Repeat your install options
The updater keeps some settings from the running installation, but not all of them. A setting that is not kept goes back to its default when you leave out its option. For example, if you installed with --enable-kibana and update without it, Kibana is removed. The Kept on update column in Updater options shows which kind each option is. The safest approach is to save your full install command and reuse every option on each update.
./pj-app-installer.sh --host pjapp.example.com --namespace prod --tls --enable-kibana
./pj-app-updater.sh --host pjapp.example.com --namespace prod --tls --enable-kibana --silent
The updater reads the same environment variables as the installer. Use sudo -E so the script can see them. API keys already stored in the installation are kept unless you set a new value in an environment variable or at the --interactive-secrets prompt. If you use Databricks, export ECR_PASSWORD before every update; the Databricks image settings are only applied when it is set.
Updater options
| Flag | Short | Value | Default | Kept on update | Meaning |
|---|---|---|---|---|---|
--airgap | -a | none | false | No | Airgap mode: verify all images exist locally (skip pulling from registries). |
--eks | none | false | - | Managed-cluster mode for EKS: skips image pre-pull, avoids crictl, and avoids explicit --kubeconfig. | |
--efs | none | false | - | With --eks, provision AWS EFS/EBS CSI storage and pj-app-efs/pj-app-gp3 StorageClasses. | |
--gke | none | false | - | Managed-cluster mode for GKE: skips image pre-pull, avoids crictl, and avoids explicit --kubeconfig. | |
--aks | none | false | - | Managed-cluster mode for AKS: skips image pre-pull, avoids crictl, and avoids explicit --kubeconfig. | |
--openshift | none | false | - | OpenShift/ROSA mode: skips image pre-pull and configures the project, SCC bindings, and compatibility values. | |
--skip-image-pull | none | false | - | Skip the warm-up pull step. | |
--interactive-secrets | -i | none | false | - | Prompt for API keys and admin password interactively (overrides env vars). |
--enable-kibana | none | false | No | Enable Kibana deployment (default: disabled). | |
--disable-cpg-agent | none | false | No | Disable CPG Agent when its private-registry credentials are unavailable. | |
--license-file | string | - | Path to the license file for Spark NLP Station and Resolver. | ||
--tls | none | false | No | Enable TLS/HTTPS ingress via cert-manager (requires --host with an FQDN). | |
--cluster-issuer | string | No | Use an existing cert-manager ClusterIssuer. If omitted, the chart auto-discovers one. | ||
--create-cluster-issuer | none | false | - | Create the named ClusterIssuer if it does not already exist. | |
--acme-email | string | - | Email for Let's Encrypt ACME registration. Defaults to le@johnsnowlabs.com when creating an issuer. | ||
--install-cert-manager | none | false | - | Install cert-manager only if it is missing. During TLS setup, it also reuses one existing issuer or creates default letsencrypt-prod when none exists. | |
--help | none | - | Show help message and exit. | ||
--silent | -s | none | false | - | Silent mode: skips all prompts (API keys and admin password). |
--namespace | -n | string | default | No | Kubernetes namespace where the release is running. |
--release | -r | string | pj-app | No | Helm release name to upgrade. |
--values | -f | path | No | Additional environment-specific Helm values file; repeat for multiple files. | |
--nfs | none | false | No | Provision NFS-backed RWX storage for the pipeline cache on self-managed clusters. Use for multi-node K3s; incompatible with managed-cluster modes. | |
--enable-naaccr-services | none | false | No | Enable NAACCR Edits60 API and XML Service. | |
--enable-seed-rds | none | false | No | Enable the post-migration RDS seeding hook job. | |
--modes | list | current modes | - | Licensed product modes: comma-separated registry, deid, curation, journey. When set, turns the matching services on or off. See Product Modes. | |
--enable-dcs | none | false | No | Enable Data Curation Service; requires --dcs-tag. | |
--dcs-tag | tag | unset | No | Set the Data Curation Service image tag. | |
--enable-cpg-agent | none | true | - | Enable CPG Agent; requires its registry credentials. | |
--cpg-agent-tag=TAG | tag | 0.1.0-rc44 | - | Override the CPG Agent image tag. Use the equals-sign form. | |
--disable-db-hostport | none | false | No | Disable the relational database host port; EKS mode disables it automatically. | |
--enable-es-external | none | false | No | Enable Elasticsearch external access. | |
--disable-es-external | none | external access disabled | - | Disable Elasticsearch external access. | |
--elasticsearch-profile | small / medium / advanced | preserve existing | - | Select Elasticsearch sizing: small uses 2 nodes and 2 GB heap; medium uses 3 nodes and 4 GB heap; advanced uses 3 master and 2 data nodes with 8 GB data heap. Explicit heap/replica options override the profile. | |
--elasticsearch-heap | size | preserve existing | Yes | Set Elasticsearch heap; memory limit is twice the heap size. | |
--elasticsearch-replicas | number | preserve existing | Yes | Set Elasticsearch master node replica count. | |
--elasticsearch-storage | size | preserve existing | Yes | Set Elasticsearch PVC size. Existing volumes require a supported storage resize procedure. | |
--with-gpu-doc-processor | none | false | - | Also pull the GPU document processor image, needed by jobs whose template has "Use GPU" on for document ingestion. | |
--slm-ocr | none | preserve existing | Yes | Enable HunyuanOCR service. | |
--install-gpu-operator | none | false | - | Install NVIDIA GPU Operator for GPU workloads. | |
--host | -h | DNS name | hostless | No | Set the existing ingress hostname. Required on every update to preserve host-based routing. |
--enable-resolver-replica | none | false; retained once enabled | Yes | Provision the resolver database read replica and read-only pool. | |
--terminology-creds | none | false | - | Enable terminology credential updates. | |
--terminology-user | user | existing value or script fallback | - | Set the terminology account; see the argument limitation below. | |
--terminology-keycloak-url | URL | existing value or script fallback | - | Set the terminology authentication URL; see the argument limitation below. | |
--terminology-client-secret | secret | existing value or script fallback | - | Set your terminology client secret. | |
--terminology-password | password | existing value or script fallback | - | Set your terminology password. | |
--k8s | none | false | No | Required on every update of a self-managed Kubernetes installation. Without it, the updater looks for the K3s settings file and cannot reach the cluster. Do not combine with --eks, --gke, --aks, or --openshift. | |
--slm-mode | cpu / gpu / none | current value | Yes | Where the language model runs. none turns it off. | |
--slm-gpu-count | number | 1 | - | How many GPUs the language model uses. Only applies with --slm-mode gpu. | |
--llm | jsl-27b-v3 / default | current value | Yes | Which language model to serve. jsl-27b-v3 needs --slm-mode gpu. | |
--litellm | true / false | current value | Yes | Put a LiteLLM proxy in front of the language model. Needs --slm-mode cpu or gpu. | |
--doc-processor-mode | cpu / gpu | cpu | No | Where the document processor runs. With GPU mode, pass --doc-processor-mode gpu on every update. |
Argument compatibility
Use --elasticsearch-profile=medium (with =) when selecting an Elasticsearch profile. The updater currently misroutes the space-separated form. Its --terminology-user and --terminology-keycloak-url arguments also collide with Elasticsearch argument parsing. To update terminology settings, pass all required config.terminology values in a protected environment values file with --values, without --terminology-creds. Do not rely on the terminology fallback credentials.
Updater examples
# Silent upgrade, no prompts
./pj-app-updater.sh --host pjapp.example.com -n dev -s
# Enable HTTPS (cert-manager and one issuer already present)
./pj-app-updater.sh --namespace prod --host pjapp.example.com --tls
# Enable HTTPS for the first time on a fresh cluster
./pj-app-updater.sh --namespace prod --host pjapp.example.com --tls --install-cert-manager
# Enable HTTPS with an explicitly selected existing issuer
./pj-app-updater.sh --namespace prod --host pjapp.example.com --tls --cluster-issuer letsencrypt-prod
# Create a custom issuer explicitly
./pj-app-updater.sh --namespace prod --host pjapp.example.com --tls --cluster-issuer letsencrypt-prod --create-cluster-issuer --acme-email admin@example.com --install-cert-manager
# Change domain (cert-manager already set up; issuer auto-discovered)
./pj-app-updater.sh --namespace prod --host new.example.com --tls
API keys and secrets
Both scripts check environment variables (OPENAI_API_KEY, CUSTOM_LLM_API_KEY, OLLAMA_API_KEY, HUGGINGFACE_API_TOKEN) first, then prompt interactively. Custom data-curation LLM settings can also be supplied with LLM_PROVIDER, CUSTOM_LLM_API_BASE, CUSTOM_LLM_BASE_URL, and CUSTOM_LLM_MODEL. Use --interactive-secrets to prompt for API keys and admin password (updater only) even when env vars are set.
Frequently asked questions
Download and unpack the new release into its own folder, then run pj-app-updater.sh from that folder with the same host, namespace, release name, platform mode, HTTPS options, and --values files you used at install time. Do not run the installer again for an upgrade.
Leaving out --host sets ingress.noHost=true and removes the ingress host rule, and leaving out --tls returns the application to HTTP. Run the updater again with your original options.
Yes. API keys already stored in the installation are kept unless you set a new value in an environment variable or at the --interactive-secrets prompt. --silent skips all prompts.
Only some. A setting that is not kept goes back to its default when you leave out its option; for example, updating without --enable-kibana removes Kibana. The Kept on update column in the updater options table shows each option's behavior. The safest approach is to save your full install command and reuse every option on each update.
Yes. The updater does not remember the platform mode, so repeat --eks, --gke, --aks, --openshift, or --k8s as applicable.