Upgrading Autonomous Identity

Autonomous Identity provides an upgrade command to update your core software to the latest version while migrating your data.

The upgrade assumes the following:

  • Database Systems are the Same. If your current database is Apache Cassandra, you cannot upgrade to a MongoDB-based system. You will need to run a clean installation with the new version.

  • Host IPs should be the Same. Host IP addresses must be the same for existing components. You must update the ~/autoid-config/hosts file by adding the IP addresses for the Elasticsearch entries. See the instructions below.

  • Registry Key Required. To download the deployment images for the upgrade, you still need a registry key to log into the ForgeRock Google Cloud Registry (gcr.io). The registry key is only available to ForgeRock Autonomous Identity customers. For specific instructions on obtaining the registry key, see How To Configure Service Credentials (Push Auth, Docker) in Backstage.

Upgrade to Autonomous Identity 2021.3.2

The following instruction is for upgrade from Autonomous Identity 2021.3.1 to version 2021.3.2.

Upgrade to version 2021.3.2:

  1. On the deployer machine, back up the 2021.3.1 ~/autoid-config directory or move it to another location.

    $ mv ~/autoid-config ~/backup-2021.3.1
  2. Create a new ~/autoid-config directory.

    $ mkdir ~/autoid-config
  3. Copy your autoid_registry_key.json from your backup directory to ~/autoid-config.

  4. Copy your original SSH key into the new directory.

    $ cp ~/.ssh/id_rsa ~/autoid-config
  5. Change the permission on the SSH key.

    $ chmod 400 ~/autoid-config/id_rsa
  6. Check if you can successfully SSH to the target server.

    $ ssh -i ~/autoid-config/id_rsa autoid@<Target-IP-Address>
    Last login: Tue Aug 3 18:19:14 2021
  7. Stop the stack.

    $ docker stack rm configuration-service consul-server consul-client nginx jas openldap selfservice swagger-ui ui api

    You should see:

    Removing service configuration-service_configuration-service
    Removing service consul-server_consul-server
    Removing service consul-client_consul-client
    Removing service nginx_nginx
    Removing service jas_jasnode
    Removing service openldap_openldap
    Removing service openldap_phpldapadmin
    Removing service selfservice_selfservice
    Removing service swagger-ui_swagger-ui
    Removing service ui_zoran-ui
    Removing service api_zoran-api
  8. Back up the /data/conf directory. This directory holds the configuration files used in 2021.3.x.

    $ cp -r /data/conf <backup-directory>
  9. Remove the analytics container of the analytics node:

    $ docker rm -f analytics
  10. Enter exit to end your SSH session.

  11. Repeat the restart Docker command:

    $ sudo systemctl restart docker
  12. On the deployer node, change to the ~/autoid-config directory.

    $ cd ~/autoid-config
  13. Log in to the ForgeRock Google Cloud Registry (gcr.io) using the registry key. The registry key is only available to ForgeRock Autonomous Identity customers. For specific instructions on obtaining the registry key, see How To Configure Service Credentials (Push Auth, Docker) in Backstage.

    $ docker login -u _json_key -p "$(cat autoid_registry_key.json)" https://gcr.io/forgerock-autoid

    You should see:

    Login Succeeded
  14. Run the create-template command to generate the deployer.sh script wrapper and configuration files. Note that the command sets the configuration directory on the target node to /config . The --user parameter eliminates the need to use sudo while editing the hosts file and other configuration files.

    $ docker run --user=$(id -u) -v ~/autoid-config:/config -it gcr.io/forgerock-autoid/deployer:2021.3.2 create-template
    d6c7c6f3303e: Pull complete
    Digest: sha256:15225be65417f8bfb111adea37c83eb5e0d87140ed498bfb624a358f43fbbf
    Status: Downloaded newer image for gcr.io/forgerock-autoid/autoid/dev-compact/deployer@sha256:15225be65417f8bfb111a
    Config template is copied to host machine directory mapped to /config
  15. Configure your upgraded system by editing the ~/autoid-config/vars.yml , ~/autoid-config/hosts , and ~/autoid-config/vault.yml files on the deployer machine.

    The key here is to keep your configuration settings consistent from one system to another.

  16. Download the images. This step downloads software dependencies needed for the deployment and places them in the autoid-packages directory. Make sure you are in the ~/autoid-config directory.

    $ ./deployer.sh download-images

    You should see:

    localhost          : ok=19   changed=17   unreachable=0    failed=0    skipped=0    rescued=0    ignored=0
  17. SSH to the target node.

  18. Stop the Spark master and workers.

    $ /opt/autoid/spark/spark-2.4.4-bin-hadoop2.7/sbin/stop-all.sh

    You should see:

    localhost: stopping org.apache.spark.deploy.worker.Worker
    stopping org.apache.spark.deploy.master.Master
  19. Exit your SSH session.

  20. Run the upgrade.

    $ ./deployer.sh upgrade

    You should see:

    <Target-IP-Addr>   : ok=407  changed=177  unreachable=0    failed=0    skipped=134  rescued=0    ignored=0
    localhost          : ok=65   changed=22   unreachable=0    failed=0    skipped=7    rescued=0    ignored=0
  21. Add a reference to Autonomous Identity JAS to your /etc/hosts or DNS server.

    <Public IP Address> autoid-ui.forgerock.com autoid-selfservice.forgerock.com autoid-jas.forgerock.com
  22. Redo the attribute mappings. See Set Attribute Mappings.

  23. Log out and then log in. SSH to the target server.

  24. Create an analytics template. This step creates a template from the new analytics image.

    $ analytics create-template
  25. Edit the /data/conf/analytics_init_config.yml file if you made changes to this file in your previous deployment.

  26. Apply the analytics template.

    $ analytics apply-template
  27. Then, rerun the analytics pipeline.

    $ analytics ingest
    $ analytics train
    $ analytics predict-as-is
    $ analytics predict-recommendation
    $ analytics publish

    You have successfully upgraded your Autonomous Identity server to 2021.3.2.