Pass rollback window duration to upgrade watcher command

[ycombinator]

What does this PR do?

This PR enhances the upgrade process to invoke the Upgrade Watcher with an additional CLI option, --rollback-window. This option accepts any value that can be parsed by time.ParseDuration. However, the code that invokes the Upgrade Watcher passes this value in seconds, e.g. 180s.

Why is it important?

The Upgrade Watcher will use the value of the --rollback-window CLI option to help ensure that the upgraded Agent can be rolled back manually within the specified rollback window duration. This functionality will be implemented in future PRs.

Checklist

• I have read and understood the pull request guidelines of this project.
• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in ./changelog/fragments using the changelog tool
• I have added an integration test or an E2E test

Disruptive User Impact

None; the Upgrade Watcher is invoked internally as part of the Agent upgrade process.

How to test this PR locally

Related issues

• Closes Elastic agent should add an available rollback entry in update marker if rollback_window is set #6880

Questions to ask yourself

• How are we going to support this in production?
• How are we going to measure its adoption?
• How are we going to debug this?
• What are the metrics I should take care of?
• ...

[mergify]

This pull request does not have a backport label. Could you fix it @ycombinator? 🙏
To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

• backport-./d./d is the label that automatically backports to the 8./d branch. /d is the digit
• backport-active-all is the label that automatically backports to all active branches.
• backport-active-8 is the label that automatically backports to all active minor branches for the 8 major.
• backport-active-9 is the label that automatically backports to all active minor branches for the 9 major.

[elasticmachine]

Pinging @elastic/elastic-agent-control-plane (Team:Elastic-Agent-Control-Plane)

[ycombinator]

Some upgrade integration tests in CI are failing with errors that look related to the changes in this PR:

Error:      	Received unexpected error:
        	            	failed to start agent upgrade to version "9.0.1": exit status 1
        	            	Error initializing version information: reading package version from file "/opt/Elastic/Agent/data/elastic-agent-9.1.0-SNAPSHOT-fb8f43/package.version": open /opt/Elastic/Agent/data/elastic-agent-9.1.0-SNAPSHOT-fb8f43/package.version: no such file or directory
        	            	Error: Failed trigger upgrade of daemon: watcher did not start in time
        	            	context deadline exceeded
        	            	os: process already finished

Moving PR back to draft while I investigate and fix.

[ycombinator]

@pchila @kaanyalti Thank you for your patience with this PR as I shifted my focus to other, more time-critical work (FIPS). This PR is ready for re-review now, when you get a chance.

[elasticmachine]

💔 Build Failed

• Buildkite Build
• Commit: de48e61

Failed CI Steps

• Windows:2022:amd64:sudo
• Windows:2025:amd64:sudo
• Ubuntu:2404:amd64:sudo
• Win2022:sudo:default
• Win2022:sudo:default
• Win2022:sudo:fleet
• Win2022:sudo:fleet
• Win2022:sudo:fleet-endpoint-security
• Win2022:sudo:fleet-privileged
• Win2022:sudo:fleet-privileged
• Win2022:sudo:upgrade
• Win2022:sudo:upgrade
• Win2022:sudo:install-uninstall
• Win2022:non-sudo:default
• Win2025:sudo:default
• Win2025:sudo:default
• Win2025:sudo:fleet
• Win2025:sudo:fleet
• Win2025:sudo:fleet-endpoint-security
• Win2025:sudo:fleet-privileged
• Win2025:sudo:fleet-privileged
• Win2025:sudo:upgrade
• Win2025:sudo:upgrade
• Win2025:sudo:install-uninstall
• Win2025:non-sudo:default
• x86_64:non-sudo: default
• x86_64:sudo: default
• x86_64:sudo: default
• x86_64:sudo: upgrade
• x86_64:sudo: upgrade
• x86_64:sudo: fleet
• x86_64:sudo: fleet
• x86_64:sudo: fleet-endpoint-security
• x86_64:sudo: fleet-airgapped
• x86_64:sudo: fleet-airgapped
• x86_64:sudo: fleet-airgapped-privileged
• x86_64:sudo: fleet-airgapped-privileged
• x86_64:sudo: fleet-privileged
• x86_64:sudo: fleet-privileged
• x86_64:sudo: fleet-upgrade-to-pr-build
• x86_64:sudo: fleet-upgrade-to-pr-build
• x86_64:sudo: install-uninstall
• x86_64:sudo: fqdn
• x86_64:sudo: deb
• x86_64:sudo: container
• arm:sudo: default
• arm:sudo: default
• arm:sudo: upgrade
• arm:sudo: upgrade
• arm:sudo: fleet
• arm:sudo: fleet
• x86_64:non-sudo: default
• x86_64:sudo: default
• x86_64:sudo: default
• x86_64:sudo: upgrade
• x86_64:sudo: upgrade
• x86_64:sudo: fleet
• x86_64:sudo: fleet
• x86_64:sudo: fleet-endpoint-security
• x86_64:sudo: fleet-airgapped
• x86_64:sudo: fleet-airgapped
• x86_64:sudo: fleet-airgapped-privileged
• x86_64:sudo: fleet-airgapped-privileged
• x86_64:sudo: fleet-privileged
• x86_64:sudo: fleet-privileged
• x86_64:sudo: fleet-upgrade-to-pr-build
• x86_64:sudo: fleet-upgrade-to-pr-build
• x86_64:sudo: install-uninstall
• x86_64:sudo: deb
• x86_64:sudo: container
• x86_64:sudo:rpm
• v1.27.16:amd64:basic,slim,complete,service,elastic-otel-collector
• v1.28.15:amd64:basic,slim,complete,service,elastic-otel-collector
• v1.29.14:amd64:basic,slim,complete,service,elastic-otel-collector
• v1.30.0:amd64:basic,slim,complete,service,elastic-otel-collector
• v1.31.0:amd64:basic,slim,complete,service,elastic-otel-collector
• v1.32.0:amd64:basic,slim,complete,service,elastic-otel-collector
• v1.33.0:amd64:basic,slim,complete,service,elastic-otel-collector
• v1.27.16:amd64:wolfi,slim-wolfi,complete-wolfi,elastic-otel-collector-wolfi
• v1.28.15:amd64:wolfi,slim-wolfi,complete-wolfi,elastic-otel-collector-wolfi
• v1.29.14:amd64:wolfi,slim-wolfi,complete-wolfi,elastic-otel-collector-wolfi
• v1.30.0:amd64:wolfi,slim-wolfi,complete-wolfi,elastic-otel-collector-wolfi
• v1.31.0:amd64:wolfi,slim-wolfi,complete-wolfi,elastic-otel-collector-wolfi
• v1.32.0:amd64:wolfi,slim-wolfi,complete-wolfi,elastic-otel-collector-wolfi
• v1.33.0:amd64:wolfi,slim-wolfi,complete-wolfi,elastic-otel-collector-wolfi
• Windows:2022:amd64:sudo
• Windows:2022:amd64:sudo
• Windows:2025:amd64:sudo
• Windows:2025:amd64:sudo
• Ubuntu:2404:amd64:sudo
• Ubuntu:2404:amd64:sudo
• fips:x86_64:sudo-false:fleet
• fips:x86_64:sudo-false:fleet
• fips:x86_64:sudo-true:fleet
• fips:x86_64:sudo-true:fleet
• fips:arm64:sudo-false:fleet
• fips:arm64:sudo-false:fleet
• fips:arm64:sudo-true:fleet
• fips:arm64:sudo-true:fleet

History

• 💔 Build #23236 failed 596f79c
• 💛 Build #23124 was flaky da545a0
• 💚 Build #22189 succeeded bd961a3
• 💛 Build #22006 was flaky 03c3729

cc @ycombinator

[elastic-sonarqube]

Quality Gate passed

Issues
4 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
50.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[pchila]

@pchila @kaanyalti Thank you for your patience with this PR as I shifted my focus to other, more time-critical work (FIPS). This PR is ready for re-review now, when you get a chance.

@ycombinator can we put this one on hold for the moment? The discussion around locking for the upgrade marker may have impacts on the distributions of responsibilities (we may even want the elastic-agent main process to handle the writing of the rollback window, in which case we don't need to pass an extra parameter to the watcher)

[pchila]

Superseded by #8767