Skip to main content
Migration Notice
We're migrating documentation from the old portal into this one. Some things may look a little different or out of place in the meantime — we know, and we're working to get it right. If something's unclear or doesn't look right, let us know.
Version: 2.15.0

Upgrade Guide for AirGap for Dell

Introduction​

This page provides an overview of upgrading Superna AirGap components, including the Eyeglass appliance and the Vault Agent VM. It links out to the detailed, step-by-step upgrade procedures for the Vault Agent, and summarizes general considerations to review before you start an upgrade.

info

Eyeglass appliance upgrades follow the standard Eyeglass upgrade process. This page focuses on the AirGap-specific component: the Vault Agent VM.

Before You Upgrade​

Review the Prerequisites page to confirm the target release is supported for your PowerScale OneFS or ECS platform version before you upgrade any AirGap component.

The vault cluster is normally isolated from the network. Upgrades and maintenance require deliberate, temporary access to the vault:

  • Vault cluster upgrades can be completed either through the in-band secure maintenance connection (opening the AirGap temporarily) or by connecting physically inside the vault, which is the recommended method.
  • Keep the AirGap network open only for as long as the upgrade requires, then confirm it returns to a closed state.
tip

Take a VM-level snapshot of the Vault Agent VM before starting any upgrade. See the detailed upgrade guides below for the full pre-check and rollback-relevant steps.

note

When upgrading Eyeglass, ECAs, and the Vault Agent VM together within a single maintenance window, contact Support to confirm the recommended sequencing for your environment before starting a coordinated multi-component upgrade.

Vault Agent Upgrade Procedures​

Choose the procedure that matches your upgrade approach:

Vault Agent In-Place Upgrade

Upgrade the AirGap Vault Agent VM in place using the .run upgrade file, without redeploying the VM.

View Guide

Vault Agent VM Re-deployment Upgrade

Upgrade the AirGap Vault Agent by deploying a new VM from the latest OVF and migrating configuration from the old VM.

View Guide

Vault Agent Upgrade Methods by Vault Access​

Two methods are available depending on the vault operation mode:

  • Method 1 - In-band maintenance mode: requires the Vault Agent to have in-band maintenance mode enabled.
  • Method 2 - Physical Vault VM access: requires console access, or mouse and keyboard access, to the ESX host inside the vault, which requires physical access to the vault.

Method 1 - In-Band Maintenance Mode Upgrade​

Requirements​

  • In-band maintenance mode is enabled on the Vault Agent.
  • Two-factor authentication is configured on the Eyeglass VM and the Vault Agent VM.

Procedure​

  1. Download the Vault Agent upgrade file from the Superna support portal. Record the MD5 checksum shown in the download menu.

  2. Compute the MD5 checksum of the downloaded file and compare it to the checksum posted on the download site.

  3. Use WinSCP to copy the .run file to the production PowerScale cluster that is connected to the vault network.

  4. Request a vault maintenance window of 45 minutes:

    igls airgap vaultaccessrequest --interval=45

    The Vault Agent checks for maintenance requests every 2 hours, on the hour (for example 8 am, 10 am). Prepare for the upgrade using the following steps and perform them at the next check interval.

  5. SSH to the production cluster as the user that copied the upgrade file. This example assumes the admin cluster user with a home directory of /ifs/home/admin.

  6. One minute after the hour, test access to the vault cluster (where x.x.x.x is the IP of the vault cluster interface):

    scp /ifs/home/admin/<upgrade file name> eyeglass@x.x.x.x:<upgrade file name>

    If the vault is open, a password prompt appears. If a timeout message appears, the vault has not opened for maintenance yet, so retry the copy.

  7. After the file is copied to the vault, log in to the vault cluster over SSH:

    ssh eyeglass@x.x.x.x

  8. Copy the file to the Vault Agent VM (where y.y.y.y is the IP of the Vault Agent VM) and enter the ecaadmin password to complete the copy:

    scp /ifs/home/eyeglass/<upgrade file name> ecaadmin@y.y.y.y:<upgrade file name>

  9. SSH to the Vault Agent VM:

    ssh ecaadmin@y.y.y.y

  10. Shut down the Vault Agent:

    ecactl cluster down

  11. Upgrade the Vault Agent and wait for the upgrade to complete:

    chmod +x /home/ecaadmin/<upgrade file name>
    /home/ecaadmin/<upgrade file name>

  12. Start the Vault Agent software:

    ecactl cluster up

  13. Check the time remaining in the maintenance window before the vault network closes automatically:

    ecactl airgap checkopen

  14. Verify the upgrade. All containers must be running and none restarting:

    docker ps

  15. Check the configuration:

    ecactl isilons list
    ecactl airgap list

  16. Close the vault. The SSH session times out once the vault closes:

    ecactl vault close

Method 2 - Physical Vault VM Access Upgrade​

Requirements​

  • A bastion host with access to the vault management switch inside the vault, or physical access with a laptop to the management switch inside the vault.
  • A secured laptop dedicated to vault access. Physically secure the laptop when not in use, limit access to it to a small set of personnel, and require change control to gain access to it.
  • A dedicated USB stick.

Procedure​

  1. Download the Vault Agent upgrade file from the Superna support portal. Record the MD5 checksum shown in the download menu.

  2. Compute the MD5 checksum of the downloaded file and compare it to the checksum posted on the download site.

  3. Copy the upgrade file to the USB stick, and then from the USB stick to the management laptop.

  4. Use WinSCP to copy the upgrade file to the Vault Agent VM as the ecaadmin user.

  5. SSH to the Vault Agent VM (where y.y.y.y is the IP of the Vault Agent VM):

    ssh ecaadmin@y.y.y.y

  6. Shut down the Vault Agent:

    ecactl cluster down

  7. Upgrade the Vault Agent and wait for the upgrade to complete:

    chmod +x /home/ecaadmin/<upgrade file name>
    /home/ecaadmin/<upgrade file name>

  8. Start the Vault Agent software:

    ecactl cluster up

  9. Verify the upgrade. All containers must be running and none restarting:

    docker ps

  10. Check the configuration:

    ecactl isilons list
    ecactl airgap list

  11. Test vault connectivity to the production cluster and verify successful communication:

    ecactl airgap check --prod <protected cluster name>

See Also​

  • Prerequisites – Confirm platform and release compatibility before upgrading.
  • Installation Guide – Full installation and deployment steps for AirGap components.