Update Apigee Edge 4.16.09 to 4.17.09

Edge for Private Cloud v. 4.17.09

Which Edge versions can you update to 4.17.09

You can update Apigee Edge version 4.16.09.0x to 4.17.09 using this procedure.

If you have a version of Edge previous to version 4.16.01, then you must first migrate to version 4.16.01.x and then update to version 4.17.09.

Who can perform the update

The user running the update should be the same as the user who originally installed Edge, or a user running as root.

After you install the Edge RPMs, any user can configure them.

Which components must you update

You must update all Edge components. Edge does not support a setup that contains components from multiple versions.

Required upgrade to Qpid 1.35

This release contains a required update to Qpid 1.35. As part of updating a Qpid node, you have to:

Temporarily prevent Routers and Message Processors from writing to the Qpid node by blocking port 5672 on the Qpid node. You can use the following command to block this port on the Qpid node:
> sudo iptables -A INPUT -p tcp --destination-port 5672 ! -s `hostname` -i eth0 -j DROP
Wait for the Qpid queue to empty of messages to ensure that the Qpid node has processed all messages before the update. Use the following command to ensure that the Qpid message queue is empty:
> qpid-stat -q
Update the Qpid node.
Unblock port 5672 on the Qpid node to allows access from Routers and Message Processors. You can use the following command to unblock this port:
> sudo iptables -F

Note that if you are using iptables for other rules, you can use the -D option to reverse the specific change:
> sudo iptables -D INPUT -p tcp --destination-port 5672 ! -s `hostname` -i eth0 -j DROP

This process is described in detail below for each Edge topology.

Required to enable EPEL repo

You must enable Extra Packages for Enterprise Linux (or EPEL) to install or update Edge. The command you use depends on your version of RedHat/CentOS:

For RedHat/CentOS/Oracle 7.x:
> wget https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm; rpm -ivh epel-release-latest-7.noarch.rpm
For RedHat/CentOS/Oracle 6.x:
wget https://dl.fedoraproject.org/pub/epel/epel-release-latest-6.noarch.rpm; rpm -ivh epel-release-latest-6.noarch.rpm

Required addition of SMTPMAILFROM configuration parameter

Edge 4.17.05 added a new required parameter to the configuration file used when you enable an SMTP server. If you are updating from 4.17.01, then you must set SMTPMAILFROM in the configuration file when enabling the SMTP server.

API BaaS version 4.17.09 also added support for the SMTPMAILFROM property. When updating API BaaS, you must set SMTPMAILFROM in the configuration file.

This parameter has the form:

SMTPMAILFROM="My Company <myco@company.com>"

Required if updating when using external authentication

You can integrate an external directory service into an existing Apigee Edge Private Cloud installation. This feature is designed to work with any directory service that supports LDAP, such as Active Directory, OpenLDAP, and others. An external LDAP solution allows system administrators to manage user credentials from a centralized directory management service, external to systems like Apigee Edge that use them.

See External Authentication Configuration for more.

When external authentication is enabled, most customers use the Active Directory SAM account name field as the username for authentication, instead of an email address which is used by the Edge OpenLDAP server.

If you have integrated with an external directory service, then add the following line to your config file when updating Edge to 4.17.09:

IS_EXTERNAL_AUTH="true"

This line configures Edge to support an account name, rather than an email address, as the username.

Automatic propagation of property settings

If you have set any properties by editing .properties files in /opt/apigee/customer/application then these values are retained by the update.

Update prerequisites

Take care of following prerequisites before upgrading Apigee Edge:

Backup all nodes
Before you update, it is recommended to perform a complete backup of all nodes for safety reasons. Use the procedure for your current version of Edge to perform the backup.

This allows you to have a backup plan, in case the update to a new version doesn’t function properly. For more information on backup, see Backup and Restore.
Ensure Edge is running
Ensure that Edge is up and running during update process by using the command:

> /opt/apigee/apigee-service/bin/apigee-all status

Handling a failed update

In the case of an update failure, you can try to correct the issue, and then run update.sh again. You can run the update multiple times and it continues the update from where it last left off.

If the failure requires that you roll back the update to your previous version, see 4.17.09 Rollback Process for more.

Logging update information

By default, the update.sh utility writes log information to:

/opt/apigee/var/log/apigee-setup/update.log

If the user running the update.sh utility does not have access to that directory, it writes the log to the /tmp directory as a file named update_username.log.

If the user does not have access to /tmp, the update.sh utility fails.

Zero-downtime update

A zero-downtime update, or rolling update, lets you update your Edge installation without bringing down Edge.

Zero-downtime update is only possible with a 5-node configuration and larger.

The key to zero-downtime upgrading is to remove each Router, one at a time, from the load balancer. You then update the Router and any other components on the same machine as the Router, and then add the Router back to the load balancer.

Update the machines in the correct order for your installation as described below in "Order of machine update".
When it is time to update the Routers, select any one Router and make it unreachable, as described in Enabling/Disabling Server (Message Processor/Router) Reachability.
Update the selected Router and all other Edge components on the same machine as the Router. All Edge configurations show a Router and Message Processor on the same node.
Make the Router reachable again.
Repeat steps 2 through 4 for the remaining Routers.
Continue the update for any remaining machines in your installation.

Take care of the following before/after update:

On combined Router and Message Processor node:
- Before update – perform the following:
  1. Make the Router unreachable.
  2. Make the Message Processor unreachable.
- After update - perform the following:
  1. Make the Message Processor reachable.
  2. Make the Router reachable.
On single Router node:
- Before update, make the Router unreachable.
- After update, make the Router reachable.
On single Message Processor node:
- Before update, make the Message Processor unreachable.
- After update, make the Message Processor reachable.

Using a silent configuration file

You must pass a silent configuration file to the update command. The silent configuration file should be the same one you used to install Edge 4.16.09.

Procedure for updating to 4.17.09 on a node with an external internet connection

Use the following procedure to update the Edge components on a node:

If present, disable any CRON jobs configured to perform a repair operation on Cassandra until after the update completes.
Log in to your node as root to install the Edge RPMs.
Note: While RPM installation requires root access, you can perform Edge configuration without root access.
Install yum-utils and yum-plugin-priorities:
> sudo yum install yum-utils
> sudo yum install yum-plugin-priorities
Disable SELinux as described in Install the Edge apigee-setup utility.
Enable EPEL repo as described above.
If you are installing on AWS, run the following yum-configure-manager command:
> sudo yum-config-manager --enable rhui-REGION-rhel-server-extras rhui-REGION-rhel-server-optional
Download the Edge 4.17.09 bootstrap_4.17.09.sh file to /tmp/bootstrap_4.17.09.sh:
> curl https://software.apigee.com/bootstrap_4.17.09.sh -o /tmp/bootstrap_4.17.09.sh
Install the Edge 4.17.09 apigee-service utility and dependencies:
> sudo bash /tmp/bootstrap_4.17.09.sh apigeeuser=uName apigeepassword=pWord

where uName:pWord are the username and password you received from Apigee. If you omit pWord, you will be prompted to enter it.

By default, the installer checks to see that you have Java 1.8 installed. If you do not, it installs it for you. Use the JAVA_FIX option to specify how to handle Java installation. JAVA_FIX takes the following values:

I = Install OpenJDK 1.8 (default)
C = Continue without installing Java
Q = Quit. For this option, you have to install Java yourself.
Use apigee-service to update the apigee-setup utility:
> /opt/apigee/apigee-service/bin/apigee-service apigee-setup update
Update the apigee-validate utility on the Management Server:
> /opt/apigee/apigee-service/bin/apigee-service apigee-validate update
Update the apigee-provision utility:
> /opt/apigee/apigee-service/bin/apigee-service apigee-provision update
Run the update utility on your nodes in the order described below in "Order of machine update" below:
> /opt/apigee/apigee-setup/bin/update.sh -c component -f configFile

The only requirement on the config file is that the configuration file must be accessible or readable by the "apigee" user.

Use the “-c” option to specify the component to update. The list of possible components includes:
ldap = OpenLDAP
cs = Cassandra
zk = Zookeeper
qpid = qpidd
ps = postgresql
edge =All Edge components except Edge UI: Management Server, Message Processor, Router, QPID Server, Postgres Server
ui = Edge UI
all = update all components on machine (only use for an Edge aio installation profile or an API BaaS asa installation profile)
e = ElasticSearch
b = API BaaS Stack
p = API BaaS Portal
ebp = ElasticSearch, API BaaS Stack, and API BaaS Portal on the same node
Test the update by running the apigee-validate utility on the Management Server, as described in Test the install.

To later rollback the update, use the procedure described in 4.17.09 Rollback Process.

Procedure for updating to 4.17.09 from a local repo

If your Edge nodes are behind a firewall, or in some other way are prohibited from accessing the Apigee repository over the Internet, then you can perform the update from a local repository, or mirror, of the Apigee repo.

After you create a local Edge repository, you have two options for updating Edge from the local repo:

Create a .tar file of the repo, copy the .tar file to a node, and then update Edge from the .tar file.
Install a webserver on the node with the local repo so that other nodes can access it. Apigee provides the Nginx webserver for you to use, or you can use your own webserver.

To update from a local 4.17.09 repo:

Create a local 4.17.09 repo as described in "Create a local Apigee repository" at Install the Edge apigee-setup utility.
Note: If you already have an existing 4.16.09 repo, you can add the 4.17.09 repo to it as described in "Update a local Apigee repository" at Install the Edge apigee-setup utility.
To install apigee-service from a .tar file:
1. On the node with the local repo, use the following command to package the local repo into a single .tar file named /opt/apigee/data/apigee-mirror/apigee-4.17.09.tar.gz:
  > /opt/apigee/apigee-service/bin/apigee-service apigee-mirror package
2. Copy the .tar file to the node where you want to update Edge. For example, copy it to the /tmp directory on the new node.
3. On the new node, untar the file to the /tmp directory:
  > tar -xzf apigee-4.17.09.tar.gz
  
  This command creates a new directory, named repos, in the directory containing the .tar file. For example /tmp/repos.
4. Install the Edge apigee-service utility and dependencies from /tmp/repos:
  > sudo bash /tmp/repos/bootstrap_4.17.09.sh apigeeprotocol="file://" apigeerepobasepath=/tmp/repos
  
  Notice that you include the path to the repos directory in this command.
To install apigee-service using the Nginx webserver:
1. Configure the Nginx web server as described in "Install from the repo using the Nginx webserver" at Install the Edge apigee-setup utility.
2. On the remote node, download the Edge bootstrap_4.17.09.sh file to /tmp/bootstrap_4.17.09.sh:
  > /usr/bin/curl http://uName:pWord@remoteRepo:3939/bootstrap_4.17.09.sh -o /tmp/bootstrap_4.17.09.sh
  
  where uName:pWord are the username and password you set above for the repo, and remoteRepo is the IP address or DNS name of the repo node.
3. On the remote node, install the Edge apigee-service utility and dependencies:
  > sudo bash /tmp/bootstrap_4.17.09.sh apigeerepohost=remoteRepo:3939 apigeeuser=uName apigeepassword=pWord apigeeprotocol=http://
  
  where uName:pWord are the repo username and password.
Use apigee-service to update the apigee-setup utility:
> /opt/apigee/apigee-service/bin/apigee-service apigee-setup update
Update the apigee-validate utility on the Management Server.
> /opt/apigee/apigee-service/bin/apigee-service apigee-validate update
Update the apigee-provision utility:
> /opt/apigee/apigee-service/bin/apigee-service apigee-provision update
Run the update utility on your nodes in the order described below in "Order of machine update" below:
> /opt/apigee/apigee-setup/bin/update.sh -c component -f configFile

The only requirement on the config file is that the configuration file must be accessible or readable by the "apigee" user.

Use the “-c” option to specify the component to update. The list of possible components includes:
ldap = OpenLDAP
cs = Cassandra
zk = Zookeeper
qpid = qpidd
ps = postgresql
edge =All Edge components except Edge UI: Management Server, Message Processor, Router, QPID Server, Postgres Server
ui = Edge UI
all = update all components on machine (only use for an Edge aio installation profile or an API BaaS asa installation profile)
e = ElasticSearch
b = API BaaS Stack
p = API BaaS Portal
ebp = ElasticSearch, API BaaS Stack, and API BaaS Portal on the same node
Test the update by running the apigee-validate utility on the Management Server, as described in Test the install.

To later rollback the update, use the procedure described in 4.17.09 Rollback Process.

Order of machine update

The order that you update the machines in an Edge installation is important. The most important considerations to an update are:

You must update all Cassandra and ZooKeeper nodes before you update any other nodes.
For any machine with multiple Edge components (Management Server, Message Processor, Router, QPID Server but not Postgres Server), use the "-c edge" option to update them all at the same time.
If a step specifies that it should be performed on multiple machines, perform it in the specified machine order.
There is no separate step to update Monetization. It is updated when you specify the "-c edge" option.