AirGap Vault Agent - Re-deployment Upgrade

Upgrade Pre-checks

1. Customers must have eyeglass user password of both Vault and source PowerScale clusters.

2. SSH to AirGap Vault Agent VM as ecaadmin user.

3. Get output of the following commands and copy them to a notepad:

   a. ecactl isilons list

   b. history | grep "isilon add"

   note

   This command should return the isilon add ** command used during deployment from the history log, so you don't have to rebuild the command. If the output is empty, that's OK — you will need to rebuild the command to add clusters post upgrade.

   c. cat /opt/superna/eca/eca-env-common.conf

4. Run the following commands to verify AirGap is working:

   a. ecactl airgap syncjob

   • Output should be the list of airgap job names.

   b. ecactl airgap check --prod <NAME_OF_PROD_CLUSTER> (name of the protected cluster will be in the Step 3.a output)

   • Output should show connection to the production Eyeglass as succeeded. If failing, open a support ticket to troubleshoot further.
   • If multiple production Isilons, test for each separately.

5. If all looks good, proceed with upgrade.

---

Upgrade Steps

1. On the old AirGap Vault Agent VM, run ecactl cluster down to bring the cluster down, then Power Off the old VM.

2. Download the latest OVF file from the support portal: https://support.superna.net/hc/en-us

3. Deploy the new AirGap Vault Agent VM with the same or different network details.

4. Deploy the new EVA VM with the same cluster name. You can find the name under the ECA_CLUSTER_ID flag in the /opt/superna/eca/eca-env-common.conf file.

5. Power On the new AirGap Vault Agent VM.

6. Verify the configuration is correct:

   a. SSH to the new EVA VM with ecaadmin user.

   b. Switch to root user: sudo su

   c. ovf print-env

   note

   Mode should be vault-agent.

   d. df -h

   note

   zkramdisk should not be present.

   e. cat /etc/fstab

   note

   The tmpfs line should not be present. If present, follow the steps below to remove it:

   1. Run: nano /etc/fstab
   2. Remove the line: tmpfs /opt/superna/mnt/zk-ramdisk tmpfs nodev,nosuid,noexec,nodiratime,size=512M 0 0
   3. Save the file:
      • Press Ctrl+X
      • Answer yes to save and exit the nano editor.

7. Update /opt/superna/eca/eca-env-common.conf with the old AirGap Vault Agent VM details.

8. Update NTP server IP if required:

   a. nano /etc/chrony.d/pool.conf

   b. Remove default entries and update with the internal NTP server IP.

   c. Save the file:

   • Press Ctrl+X
   • Answer yes to save and exit the nano editor.

   d. Restart the service: systemctl restart chronyd.service

9. Run: sudo systemctl restart docker

10. Run: ecactl cluster up

    warning

    Do NOT use the --clean flag, otherwise zk-ramdisk gets cleared.

11. Once the cluster is up, add Vault and source PowerScale clusters,

    a. Run:

    ecactl isilon add \
    --vaulthost x.x.x.x \
    --user eyeglass \
    --vaultPoolName groupnet0.subnet0.xxx \
    --vaultsynciqexternalInterface 1:ext-1,2:ext-1,3:ext-1,4:ext-1

    b. Run:

    ecactl isilon add \
    --protectedhost x.x.x.x \
    --protectedManagementNode X \
    --user eyeglass
    note

    Use the command copied from the old AirGap Vault Agent VM history command output. Otherwise, update the command above based on the output of ecactl isilons list.

12. Update ecaadmin user default password:

    a. Switch to root user: sudo su

    b. Update password: passwd ecaadmin

---

Post Upgrade Checks

1. Run ecactl isilons list and verify the output is the same as before the upgrade.

2. Run the following commands to verify AirGap is working:

   a. ecactl airgap syncjobs

   • Output should be the list of airgap job names and scheduled job times.

   b. ecactl airgap check --prod <NAME_OF_PROD_CLUSTER> (name of the protected Isilon will be in the Step 1 output)

   • Output should show connection to the production Eyeglass as succeeded. If failing, open a support ticket to troubleshoot further.

3. Verify the AirGap job list:

   ecactl airgap list

4. Start an AirGap job if required, or wait for the scheduled run:

   ecactl airgap startjob --job <job name> (job name can be retrieved from Step 3 output)

5. View the job status:

   ecactl jobs view --follow --id <Job_ID> (Job ID can be retrieved from Step 4 output)