#dusk $DUSK @Dusk
A node upgrade can succeed technically and still fail operationally.
That is what I find important about Dusk’s upgrade process.
The installer is designed to protect the parts that should survive an upgrade, including consensus keys and chain state. At the same time, some configuration files and the systemd service definition are recreated. That means the operator has to explicitly restore the settings that define what the machine is supposed to do.
For a normal validator, missing a feature flag may be inconvenient. For an archive operator, it can be much more serious: the node can remain online, produce or follow blocks, and appear healthy while quietly losing the archive role applications depend on.
I also like the fact that Dusk verifies the replacement binary before stopping Rusk and leaves the service stopped afterward. That gives the operator a chance to inspect the new configuration instead of blindly restarting everything.
But this puts an important responsibility on the human.
The safest upgrade is not necessarily the one with the least manual work. It is the one where the operator can confirm that the node came back with the correct role, features and network settings.
For me, that is the real upgrade check on Dusk:
Is the node running — or is it running the job it was actually deployed to do?
#DUSK @DuskFoundation $GPS $ACE
A node upgrade can succeed technically and still fail operationally.
That is what I find important about Dusk’s upgrade process.
The installer is designed to protect the parts that should survive an upgrade, including consensus keys and chain state. At the same time, some configuration files and the systemd service definition are recreated. That means the operator has to explicitly restore the settings that define what the machine is supposed to do.
For a normal validator, missing a feature flag may be inconvenient. For an archive operator, it can be much more serious: the node can remain online, produce or follow blocks, and appear healthy while quietly losing the archive role applications depend on.
I also like the fact that Dusk verifies the replacement binary before stopping Rusk and leaves the service stopped afterward. That gives the operator a chance to inspect the new configuration instead of blindly restarting everything.
But this puts an important responsibility on the human.
The safest upgrade is not necessarily the one with the least manual work. It is the one where the operator can confirm that the node came back with the correct role, features and network settings.
For me, that is the real upgrade check on Dusk:
Is the node running — or is it running the job it was actually deployed to do?
#DUSK @DuskFoundation $GPS $ACE