Stop-SIRunAndUpdate
Stop the running pipeline run, then update
Purpose
Container install: cancels the running pipeline run the product's way, waits until the stop is confirmed (the run reads Cancelled and none of its jobs executes), and only then starts the updater once and reads the installed version back. Plan by default; -Apply acts.
When to run it
When a run that must not finish (a hang, a run on an older release) is in the way of an update. Never cancel a run and start the updater at the same moment: the updater then finds the run still going and steps aside.
Who may run it
| Kind | Role | Scope | Why |
|---|---|---|---|
| azureRbac | Contributor (or Container Apps Contributor) | the install's resource group | to read the jobs and their executions and to start caj-si-flow (the cancel) and caj-si-updater once each |
| azureRbac | Key Vault Secrets User (optional) | the install's Key Vault | to read the updater's last manifest check (the version the install's ring serves); without it the plan says it is not known |
| sql | a reader / writer of the Pro database (optional) | the Pro database | to read the run record (the run reads Cancelled) and to write the audit rows; a database that does not answer from here is never opened -- the stop is then confirmed from the jobs' executions |
| sql | the Invardia Support app's support grant (setup level, at most 1 hour; only in a Support session at an install where support holds no standing database admin) | the install's product databases | to write each audit row: the grant is opened just before the row, read back, and closed again right after; when it cannot be opened the row is not written (a warning) and the stop and the update go on |
What it changes
| Where | Action | What | Permission / role | Scope | Why | Undo |
|---|---|---|---|---|---|---|
| Container Apps jobs | create | one execution of caj-si-flow with SI_FLOW_CANCEL=1 (the product's cancel of the running run: marked Cancelled, its executions stopped, the lock released) | the install's resource group | stop the running pipeline run | a cancelled run is final; the next run starts on the pipeline's next wake-up or schedule | |
| Container Apps jobs | create | one execution of caj-si-updater (update now), only after the stop is confirmed | the install's resource group | install the release the install's ring serves | the updater restores the previous release itself when a roll fails | |
| Pro SQL database | create | two audit rows: job.flowrun.cancel and job.execution.start | the Pro database (when it answers from where the script runs) | who stopped the run and started the update, and why | none: the audit trail is append-only |
What it only reads
- the jobs, their executions and the updater's tags (si-installed, si-update-waits)
- the last pipeline run record
- the updater's update state (its last manifest check)
Parameters
| Parameter | Required | Default | What it does |
|---|---|---|---|
| -Reason | yes | Why the run is stopped (required): kept with the cancelled run and on the audit trail. | |
| -ResourceGroupName | no | $(if ($global:SI_Bootstrap_ResourceGroupName) { [string]$global:SI_Bootstrap_ResourceGroupName } else { '' }) | |
| -SubscriptionId | no | $(if ($global:SI_Bootstrap_SubscriptionId) { [string]$global:SI_Bootstrap_SubscriptionId } else { [string]$global:SI_AzSubscriptionId }) | |
| -RunId | no | '' | Only this run (its id, as Operations > Jobs shows it). Default: the run that is running now. A run that is not running is never touched; when another run is running, nothing is done. |
| -SkipUpdate | no | Only stop the run (steps 0-2). | |
| -TimeoutMinutes | no | 30 | How long the stop may take to be confirmed (default 30, said in the log). Past it nothing more is started. |
| -PollSeconds | no | 30 | |
| -Apply | no |
Preview with -WhatIf
The plan: the running run (id, trigger, step, age), every running execution, the installed version against the version the ring serves, and what would happen; nothing is started (same as without -Apply).
Undo
A cancelled run is not resumed; start the pipeline again from Operations > Jobs when needed. An update is not rolled back by this script.
Network
It connects to: *.blob.core.windows.net, *.queue.core.windows.net, *.table.core.windows.net, *.vault.azure.net, 169.254.169.254, api.loganalytics, api.loganalytics.io, api.msrc.microsoft.com, api.security.microsoft.com, api.securitycenter.microsoft.com, api.securityplatform.microsoft.com, database.windows.net, entra.microsoft.com, graph.microsoft.com, invardia.com, licenses.nuget.org, login.microsoftonline.com, management.azure.com, monitor.azure.com, nvd.nist.gov, outlook.office.com, outlook.office365.com, portal.invardia.com, storage.azure.com, vault.azure.net, www.powershellgallery.com
Download and run
Run these lines in PowerShell: the first downloads the script into the current folder, the second runs it.
Invoke-WebRequest https://invardia.com/support/si/Stop-SIRunAndUpdate.ps1 -OutFile Stop-SIRunAndUpdate.ps1
.\Stop-SIRunAndUpdate.ps1 -Reason <Reason>To check the download first, compare its SHA-256 with the published one:
SHA-256 7e2ada7a574b08758a6dd8bcd7c6529fa10460f634c225b3e4ee1b084baa43ad
Checksums: SHA256SUMS.txt · Version 3.0.79
Before you run it, compare the file's SHA-256 with its line in SHA256SUMS.txt.
Every parameter: Get-Help .\Stop-SIRunAndUpdate.ps1 -Full · Source: Stop-SIRunAndUpdate.ps1
Every script, identity and permission for your security review: SecurityInsight