Tasks
Products
Steps
Duration
Downtime
Prepare:
Certificate File Preparation
Download the new AWS RDS certificate bundle PEM file
For region of us-gov-west-1, download the below certificate:
Prepare:
Update certificate configuration in application side
OMT
1. Acquire database info before running the script:
You may get the db user, db name and PASSWORD_KEY values from database configmap with below commands:
kubectl get cm default-database-configmap -n
The result is like:
DEFAULT_DB_CDFIDM_PASSWORD_KEY: defaultdb_cdfidm_user_password
DEFAULT_DB_CDFIDM_USERNAME: cdfidm
DEFAULT_DB_HOST: xxxxxyyyyy.us-west-2.rds.amazonaws.com
DEFAULT_DB_NAME: itom-cdf-idm
2. Get the cdfidm db password:
kubectl get pod -n $CDF_NAMESPACE | grep "itom-idm" | head -1 | awk '{print $1}'
kubectl exec -it
For example:
kubectl exec -it $(kubectl get pod -n $CDF_NAMESPACE | grep "itom-idm" | head -1 | awk '{print $1}') -n $CDF_NAMESPACE -c idm -- get_secret defaultdb_cdfidm_user_password
Note: Record the database info and password, they will be used in execute command
https://docs.microfocus.com/doc/SMAX/24.2/ModifyExternalDBConfig
SMAX & HCMX
- [Optional] If you don't remember the path of your custom my-values.yaml file, run the following command to get your yaml file.
helm get values-n > - Confirm if tlsEnabled is set to true and replace the caCertificates under "database" with the new PEM content directly or base64 all the content (e.g cat
| base 64)
Example:
global:
database:
tlsEnabled: true
tlsMode: verify-full # or use verify-ca
......
database:
caCertificates:
pg_ca.crt:or PEM Note:
If you are using base64 encoded content, make sure the encoded content is formatted in one line, as below:
If you are not using base64 encoded content, please refer to below format: 
- Run the command to check if job exist in ENV. It should return nothing. If job exist, make sure it's in Completed status and delete it.
kubectl get job -n|grep -v NAME | awk '{print $1}'
Run below command to get the pod status - if they are "Completed", it means the jobs are done and you may delete the jobs with 'delete job' command:
kubectl get pods -n|grep job
If above pods are all completed status, delete related jobs:
kubectl delete job-n
NOTE: The yaml file with new pem content replaced will be used in RDS certificate replacement.Reference: https://staging.docs.microfocus.com/doc/SMAX/Main/ChangeCertForPostgreSQL
https://docs.microfocus.com/doc/SMAX/24.2/ModifyExternalDBConfig
CMS
- Get the CMS values.yaml from current running deployment by running below command
helm get values
2. Replace the content of caCertificates.postgresql.crt in values.yaml with the content of AWS RDS certificate bundle got at above step.
Note:every line of certificate content starts with 4 indentations in values.yaml, for example:
Audit
- Get the Audit values.yaml
helm get values
2. Replace the content of caCertificates.RE_ca_dbcrt in values.yaml with the content of AWS RDS certificate bundle got at above step.
Note: every line of certificate content starts with 4 indentations in values.yaml, for example:
Execute certificate update in application side
Note: There is no dependency on each application.
OMT
Navigate to the $CDF_HOME/bin directory, run the updateExternalDbInfo.sh script with below parameters:
./updateExternalDbInfo.sh -H
For example:
./updateExternalDbInfo.sh -H xxxxyyyy.us-west-2.rds.amazonaws.com -p 5432 -d cdfidmdb -u cdfidm --dbpassword
Reference: https://docs.microfocus.com/doc/OMT/24.2/ModifyExternalDatabaseConfiguration
1min
0
SMAX & HCMX
- Run the following commands to apply DB setting change. The yaml file is the one with new pem content replaced in preparation steps.
helm upgrade-n -f my-values.yaml
For example:
helm upgrade itsma ESM_Helm_Chart-2x.x/charts/esm-1.0.0+2x.x-xxx.tgz -n itsma-xxyy -f values.yaml Run the following command to make sure that all SMAX pods are ready before next step.
kubectl get pod -n < ESM_NAMESPACE > |grep -v 1/1|grep -v 2/2|grep -v 3/3|grep -v 4/4|grep -v CompletedRestart the suite (Another option is to do the restart later via one command along with other products)
$CDF_HOME/bin/cdfctl runlevel set -l DOWN -n
Wait till all pods are down, then run below command to bring the application up
$CDF_HOME/bin/cdfctl runlevel set -l UP -n
4mins
0
CMS
- Update the deployment by running helm upgrade command. The yaml file is the one with new pem content replaced in preparation steps.
helm upgrade-n -f values.yaml - Restart CMS (Another option is to do the restart later via one command along with other products)
$CDF_HOME/bin/cdfctl runlevel set -l DOWN -n
wait till all pods are shut down
$CDF_HOME/bin/cdfctl runlevel set -l UP -n
NOTE: You may do this in parallel with SMAX restart
1min
0
Audit
- Update the deployment by running helm upgrade command. The yaml file is the one with new pem content replaced in preparation steps.
helm upgrade-n -f values.yaml - Restart Audit (Another option is to do the restart later via one command along with other products)
$CDF_HOME/bin/cdfctl runlevel set -l DOWN -n
wait till all pods are shut down
$CDF_HOME/bin/cdfctl runlevel set -l UP -n
NOTE: You may do this in parallel with SMAX restart
1min
0
Restart pods (Alternative)
You may also do the helm upgrade for all products in parallel without restarting.
Then do the restart against all products whose RDS certificates were changed
For example:
$CDF_HOME/bin/cdfctl runlevel set -l DOWN -n
wait till all pods are shut down and start the pods
$CDF_HOME/bin/cdfctl runlevel set -l UP -n
14mins
14mins
kubectl get pod -n < ESM_NAMESPACE > |grep -v 1/1|grep -v 2/2|grep -v 3/3|grep -v 4/4|grep -v Completed
Update the certificates of AWS RDS DB instances.
Update the certificate on AWS RDS DB instances.
1.Login AWS console, go to the RDS instances that you want to update the certificates.
2.Select the RDS instance, click modify button
3.Change the Certificate authority.
If your primary certificate CA is rds-ca-2019, it's recommended to select the rds-ca-rsa4096-g1 CA as new value
4.Save the change and select immediate effect.
5.Repeat the steps for all your RDS instances
2mins
0
If you are not using base64 encoded content, please refer to below format:
