Upgrade Service Fabric Standalone Cluster Behind A Firewall

If you have a Service Fabric cluster behind a firewall, there are couple of ways to auto upgrade the cluster.

Option #1: Use a deployment/release server

1. You can use VSO release definition with an agent either in the same network to upgrade the cluster.
Setup a VSO Release Agent behind a firewall
If your agent is in a different network, you might have to open ACLs between your agent and the cluster

2. You can run the PowerShell script manually or via a different delivery method

Open ALCs to download latest SF bits

go.microsoft.com
download.microsoft.com

Port 443

Script to download SF bits and upgrade cluster

#*******************Script start********************
Param
(
[Parameter(Mandatory=$True)]
[string]$sfVersion,
[Parameter(Mandatory=$True)]
$clusterConnection,
[Parameter(Mandatory=$True)]
[int]$WaitTimeBetweenUpgradeChecksInSecs,
[Parameter(Mandatory=$True)]
[int]$NumberOfTimesToCheck,
    [string]$serviceFabricDownloadURL="https://go.microsoft.com/fwlink/?linkid=839354"
)

Write-Host "Service Fabric Cluster package will be downloaded from $serviceFabricDownloadURL"

$fileLocation="$PSScriptRoot\Downloads\"
Write-Host "Service Fabric package will be paced in $fileLocation"

$sfCabFileName="MicrosoftAzureServiceFabric.$($sfVersion).cab"

$sfFileName="$($fileLocation)$($sfCabFileName)"

$extractTo=$fileLocation
$retryCount = 40
$secondsToSleep=5


try
{

Write-Host "Attempting to connect to cluster" -ForegroundColor Yellow
$clusterConnection

Connect-ServiceFabricCluster @clusterConnection

$UpgradeResult=Get-ServiceFabricClusterUpgrade
If($UpgradeResult.TargetCodeVersion -eq $sfVersion)
{
Write-Host "Cluster is already in version $sfVersion" -ForegroundColor Green
}
Else
{
Write-Host "Path where the package will be downloaded - $fileLocation"  -ForegroundColor Green
Write-Host "Checking if the download folder is empty"  -ForegroundColor Yellow

IF (Test-Path $fileLocation)
{
Write-Host "Download folder is not empty. Attempting cleanup of $fileLocation"  -ForegroundColor Yellow
Remove-Item "$fileLocation\\*.*"
Write-Host "Download cleanup complete" -ForegroundColor Green
}
Else
{
Write-Host "Download folder not present. Creating one"  -ForegroundColor Yellow
New-Item -ItemType Directory -Force -Path $fileLocation
Write-Host "Download folder created" -ForegroundColor Green
}
Write-Host "Attempting download of Service Fabric package to $sfFileName"  -ForegroundColor Yellow
Invoke-WebRequest  $serviceFabricDownloadURL -OutFile $sfFileName
Write-Host "Download of Service Fabric package complete" -ForegroundColor Green

If (Test-Path "$($sfFileName)")
{
Write-Host "Attempting copy of package to fabric image store" -ForegroundColor Yellow
Copy-ServiceFabricClusterPackage -Code -CodePackagePath "$($sfFileName)" -ImageStoreConnectionString "fabric:ImageStore"

Write-Host "Attempting to register package with service fabric" -ForegroundColor Yellow
Register-ServiceFabricClusterPackage -Code -CodePackagePath $sfCabFileName

Write-Host "Starting service fabric upgrade" -ForegroundColor Yellow
Start-ServiceFabricClusterUpgrade -Code -CodePackageVersion $sfVersion -Monitored -FailureAction Rollback

For($Count=0;$Count -le $NumberOfTimesToCheck ;$Count++)
{
Write-Host "Attempt number: $Count" -ForegroundColor Yellow
$UpgradeResult=Get-ServiceFabricClusterUpgrade
$UpgradeResult

If(($UpgradeResult.TargetCodeVersion -eq $sfVersion) -and (( $UpgradeResult.UpgradeState -eq "RollingForwardCompleted")))
{
Write-Host "Upgrade Completed" -ForegroundColor Green
Break;
}
Else
{
Write-Host "Upgrade InProgress" -ForegroundColor Yellow
}

Start-Sleep -s $WaitTimeBetweenUpgradeChecksInSecs

If($Count -ge $NumberOfTimesToCheck)
{
Write-Host "Wait time exhausted and Service fabric Cluster Upgrade is still InProgress. Verify manually" -ForegroundColor Yellow
}
}
}
Else
{
Write-Host "$sfCabFileName file is missing in $extractTo" -ForegroundColor Red
}
}
}
catch
{
$_.Exception
Throw
}

#*******************Script end********************


1. Open ACLs to below URLs from your Service Fabric machines.

go.microsoft.com
download.microsoft.com

Port 443

With this method you should be able to turn on Auto upgrade on the cluster and there is on need to run the above script