From 02ed1d8f785bd1fbea04455612d6259677f046c6 Mon Sep 17 00:00:00 2001
From: reyesj2 <94730068+reyesj2@users.noreply.github.com>
Date: Wed, 26 Aug 2026 13:56:23 -0500
Subject: [PATCH] reorder fleet package / policy installation & upgrade

---
 salt/elasticfleet/manager.sls                         | 11 +++++++++++
 .../tools/sbin_jinja/so-elastic-fleet-package-upgrade | 11 +++++++++++
 2 files changed, 22 insertions(+)

diff --git a/salt/elasticfleet/manager.sls b/salt/elasticfleet/manager.sls
index 4ae64314b..c1f38f1f7 100644
--- a/salt/elasticfleet/manager.sls
+++ b/salt/elasticfleet/manager.sls
@@ -76,6 +76,16 @@ so-elastic-fleet-integrations:
         interval: 10
     - require:
       - http: wait_for_so-kibana
+      - cmd: so-elastic-fleet-package-upgrade
+
+so-elastic-fleet-package-upgrade-verify:
+  cmd.run:
+    - name: /usr/sbin/so-elastic-fleet-package-upgrade
+    - retry:
+        attempts: 3
+        interval: 30
+    - require:
+      - cmd: so-elastic-fleet-integration-upgrade
 
 so-elastic-agent-grid-upgrade:
   cmd.run:
@@ -94,6 +104,7 @@ so-elastic-fleet-integration-upgrade:
         interval: 10
     - require:
       - http: wait_for_so-kibana
+      - cmd: so-elastic-fleet-integrations
 
 {# Optional integrations script doesn't need the retries like so-elastic-fleet-integration-upgrade which loads the default integrations #}
 so-elastic-fleet-addon-integrations:
diff --git a/salt/elasticfleet/tools/sbin_jinja/so-elastic-fleet-package-upgrade b/salt/elasticfleet/tools/sbin_jinja/so-elastic-fleet-package-upgrade
index d645403d5..17e7f8c43 100644
--- a/salt/elasticfleet/tools/sbin_jinja/so-elastic-fleet-package-upgrade
+++ b/salt/elasticfleet/tools/sbin_jinja/so-elastic-fleet-package-upgrade
@@ -21,6 +21,17 @@ if INSTALLED_VERSION=$(elastic_fleet_package_version_check "{{ PACKAGE }}") && L
         if ! elastic_fleet_package_install "{{ PACKAGE }}" "$LATEST_VERSION"; then
             PKG_LOAD_FAILURES=$((PKG_LOAD_FAILURES + 1))
             PKG_LOAD_FAILURES_NAMES+=("{{ PACKAGE }}")
+        # check that package has upgraded to the expected version after install command
+        elif ! LATEST_VERSION=$(elastic_fleet_package_latest_version_check "{{ PACKAGE }}"); then
+            echo "ERROR: Failed to get latest version information for integration {{ PACKAGE }} after upgrade attempt"
+            PKG_LOAD_FAILURES=$((PKG_LOAD_FAILURES + 1))
+            PKG_LOAD_FAILURES_NAMES+=("{{ PACKAGE }}")
+        elif INSTALLED_VERSION=$(elastic_fleet_package_version_check "{{ PACKAGE }}") && [ "$INSTALLED_VERSION" == "$LATEST_VERSION" ]; then
+            echo "{{ PACKAGE }} integration upgraded to version $LATEST_VERSION."
+        else
+            echo "ERROR: {{ PACKAGE }} integration still at ${INSTALLED_VERSION:-unknown}; expected $LATEST_VERSION"
+            PKG_LOAD_FAILURES=$((PKG_LOAD_FAILURES + 1))
+            PKG_LOAD_FAILURES_NAMES+=("{{ PACKAGE }}")
         fi
     fi
 else