Upgrading Teamscale
Teamscale can generally be upgraded like any other Dogu via kubectl or a Blueprint upgrade.
However, there is one peculiarity when performing major or minor upgrades of Teamscale.
The database cannot be migrated together with the Dogu. In this case, the upgrade performs a project export. Afterwards, all data is deleted, the previously created backup is imported, and the projects are scanned again. This behavior is unavoidable and intended by Teamscale. No data is lost except for old scanner results. The project export is only possible with a valid Teamscale license, therefore the Teamscale Dogu cannot be upgraded without a valid license.
The project export is only necessary for minor or major version upgrades and is only executed in those cases.
For example, when upgrading from Teamscale version 7.7.0-1 to Teamscale version 7.7.1-1 or 7.7.0-2, the project export is not performed.
However, when upgrading from version 7.7.0-1 to version 7.8.0-1 or 8.0.0-1, the project export and import described above are performed.
One-time change of the configuration administrator password
The dogu runs its own administrator in Teamscale (dogu_config_admin_*) to configure the application. On instances
that were set up by an older dogu version, that account's password was generated with an insecure random source. It
is therefore replaced automatically, once, on the first start after the upgrade. No manual action is required.
Affected are instances that were set up with a dogu version up to and including v2025.6.13-7. What matters is the
version at install time, not the version currently running — instances newly installed from this version onwards are
not affected. Whether an individual password was in fact generated insecurely cannot be told after the fact, so every
pre-existing instance rotates once.
The change runs the same way in the classic EcoSystem and in the Multinode EcoSystem; there is no distinction by environment. The marker in the dogu configuration shows whether it has happened.
Classic EcoSystem:
sudo docker exec teamscale doguctl config config_admin_password_rotatedMultinode EcoSystem:
kubectl exec -n ecosystem \
"$(kubectl get pods -n ecosystem -l dogu.name=teamscale \
-o jsonpath='{.items[0].metadata.name}')" \
-- doguctl config config_admin_password_rotatedtrue means it is done and will not be repeated. If the change fails — for instance because Teamscale was not yet
reachable during startup — the previous password stays valid, the log contains a line saying
could not rotate the config admin password, and the next start tries again. The dogu starts up normally either way.
Troubleshooting after upgrade
Analysis errors after upgrade
In rare cases, one or more projects can no longer be analyzed after a Dogu upgrade.
The dashboards will then display Error. If this happens, the issue can only be fixed by deleting the repositories from the file system.
For this purpose, an Exposed-Command was added to the Dogu that removes the repositories from the file system.
To execute it, run:
kubectl exec -n ecosystem $(kubectl get pod -l dogu.name=teamscale -o jsonpath='{.items[0].metadata.name}') -- remove-repositoriesAfterwards, to trigger a fresh analysis for all projects, run:
kubectl exec -n ecosystem $(kubectl get pod -l dogu.name=teamscale -o jsonpath='{.items[0].metadata.name}') -- reanalyze-projectsCaution: Depending on the size of the instance, the reanalysis can take several hours. However, reanalysis is unavoidable after every Dogu upgrade anyway.