Pre-requisites:

Have tenant admin role in your tenancy
Have Openstack Application Credentials, you can request them here EWC - How to request Openstack Application Credentials.

User procedure

Automatic

Start user procedure:

Have an Ubuntu 22 VM ready in your tenancy or create a new temporary Ubuntu 22 VM from Morpheus
1. plan: eo1.medium
2. networks: private
3. security group: ssh
Create backup of the LDAP VM (See CreatebackupofaVM );
Check the Operating System of your LDAP from Morpheus, Provisioning → Instances → select LDAP machine ;
1. If your LDAP is rocky 8 based → jump to step 8.
2. If your LDAP is centos7 based → continue to step 4.
Create LDAP replica instance type to move from centos7 to rocky 8 (see MigratefromCentos7toRocky8);
Switch IP interfaces between LDAPs using 'switch interfaces of two VMs' workflow in Morpheus (see SwitchInterfacesoftwoVMs);
Update Morpheus (see UpdateMorpheus );
Check everything is working fine (see Tests);
Create LDAP replica instance type to move from rocky 8 to rocky 9 (see MigratefromRocky8toRocky9)
Switch IP interfaces between LDAPs using 'switch interfaces of two VMs' workflow in Morpheus (see SwitchInterfacesoftwoVMs);
Update Morpheus (see UpdateMorpheus );
Check everything is working fine (see Tests);
Delete old LDAP machine/s to free resources (see Delete a VM from Morpheus).

Tasks

Migrate from Centos7 to Rocky 8

Creating a new rocky 8 LDAP replica

Login to Morpheus
Go to Provisioning → Instances and click '+ADD'
Select the LDAP replica Instance type
Select a new name for the VM (e.g. ldap-rocky8) and click 'Next'
Use the following inputs for the VM and then click 'Next' until the deployment starts:
1. version: 8
2. plan: eo1.medium
3. networks: private
4. security group: ldap

In case of errors during the provision of the replica for Rocky 8, please check ipacommandlineofWebUIaccessisdenied,withanHTTPerror401

Migrate from Rocky 8 to Rocky 9

Creating a new rocky 8 LDAP replica

Login to Morpheus
Go to Provisioning → Instances and click '+ADD'
Select the LDAP replica Instance type
Select a new name for the VM (e.g. ldap-rocky8) and click 'Next'
Use the following inputs for the VM and then click 'Next' until the deployment starts:
1. version: 9
2. plan: eo1.medium
3. networks: private
4. security group: ldap

Create backup of a VM

Go to an Ubuntu 22 VM and select 'Run Workflow'
Select the 'Create Backup of a VM using Openstack Applications Credentials'
Insert inputs and run the workflow where you provide:
1. Name of the VM to backup
2. Openstack Application Credentials ID and Secret

Switch Interfaces of two VMs

Go to an Ubuntu 22 VM and select 'Run Workflow'
Select the 'Switch Interfaces of two VMs using Openstack Applicaitons Credentials'
Insert inputs and run the workflow where you provide:
1. OLD VM in this case is the OLD LDAP machine name
2. NEW VM in this case is the NEW LDAP machine name
3. Security Group Name: ldap
4. Openstack Application Credentials ID and Secret

Update Morpheus

Login to Morpheus and change the value of the hostname for LDAP, going to Tools → Cypher:
Edit the secret/ldap_hostname with and VALUE: NEW_LDAP_HOSTNAME

Tests

ssh to ssh-proxy in your tenancy
ssh using DNS to the new LDAP machine
Run sudo ipactl status → verify the services are all up and running (if not, try sudo ipactl restart command)
From Morpheus go to Provisioning → Instances and deploy a new machine to test the enrollment to LDAP DNS is working correctly with the new LDAP machine.

Manual

You can find the manual procedure for some of the steps above

Migrate from Centos7 to Rocky 8

Creating a new LDAP to migrate to

From Morpheus, deploy a new machine with
1. image: rocky 8
2. security group: ldap security group
3. plan: eo1.medium
4. name: different from existing ldap machine
SSH to the new machine and become root

Stop and disable firewalld on the machine

systemctl stop firewalld && systemctl disable firewalld

Add OLD LDAP IP and domain of the machine acting as LDAP in one line to /etc/hosts on this machine (OLD_LDAP_IP is the private IP of your current LDAP and OLD_LDAP_DOMAIN is the domain from your current LDAP (e.g. ldap.eumetsat.sandbox.ewc) )

[test234@test-podman2 ~]$ cat /etc/hosts
<!-- BEGIN ANSIBLE MANAGED BLOCK -->
10.0.0.133 test-podman2.eumetsat.sandbox.ewc (this is an example, you will see the private IP of your machine and the domain from your machine here)
OLD_LDAP_IP OLD_LDAP_DOMAIN 
<!-- END ANSIBLE MANAGED BLOCK -->

Install freeipa dependencies

for rocky 8:

```
sudo yum -y update
```
```
sudo yum module reset idm:DL1
```
```
sudo yum module enable idm:DL1
```

sudo dnf install freeipa-server ipa-server-dns bind-dyndb-ldap -y

Run the following command to install the LDAP replica

ipa-replica-install --domain "eumetsat.sandbox.ewc" --principal sandbox-ldap-admin --admin-password hunter2 --server <OLD LDAP complete domain (e.g. ldap.eumetsat.sandbox.ewc)> --setup-ca --setup-dns --force-join --forwarder=8.8.8.8 --forwarder=1.1.1.1 --no-host-dns --unattended

(add --verbose for more logs) NOTE: go ahead with the default netbios and also put yes when asked about the ipa-sidgen task installation for users

Make the new ldap machine primary, running the following commands
1. Find the dns zone name
  1. ipa dnszone-find
2. Make the ldap machine primary (SERVER IS the new LDAP machine complete domain (e.g. ldap-test-rocky.eumetsat.sandbox.ewc), while DNS_ZONE is the zone name from the previous command)
  1. ipa dnszone-mod DNS_ZONE --name-server=SERVER

Migrate from Rocky 8 to Rocky 9

Creating a new LDAP to migrate to

From Morpheus, deploy a new machine with
1. image: rocky 9
2. security group: ldap security group
3. plan: eo1.medium
4. name: different from existing ldap machine
SSH to the new machine and become root

Stop and disable firewalld on the machine

systemctl stop firewalld && systemctl disable firewalld

Add old ldap IP and domain of the machine acting as LDAP in one line to /etc/hosts on this machine (OLD_LDAP_IP is the private IP of your current LDAP and OLD_LDAP_DOMAIN is the domain from your current LDAP (e.g. ldap.eumetsat.sandbox.ewc) )

[test234@test-podman2 ~]$ cat /etc/hosts
<!-- BEGIN ANSIBLE MANAGED BLOCK -->
 10.0.0.133 test-podman2.eumetsat.sandbox.ewc (this is an example, you will see the private IP of your machine and the domain from your machine here)
OLD_LDAP_IP OLD_LDAP_DOMAIN  
<!-- END ANSIBLE MANAGED BLOCK -->

Install freeipa dependencies

for rocky 9:

sudo dnf install ipa-server ipa-server-dns -y

Run the following command to install the LDAP replica

ipa-replica-install --domain "eumetsat.sandbox.ewc" --principal sandbox-ldap-admin --admin-password hunter2 --server <OLD LDAP complete domain (e.g. ldap.eumetsat.sandbox.ewc)> --setup-ca --setup-dns --force-join --forwarder=8.8.8.8 --forwarder=1.1.1.1 --no-host-dns --unattended

add --verbose for more logs

Make the new ldap machine primary, running the following commands
1. Find the dns zone name
  1. ipa dnszone-find
2. Make the ldap machine primary (SERVER is the new LDAP machine complete domain (e.g. ldap-test-rocky.eumetsat.sandbox.ewc), while DNS_ZONE is the zone name from the previous command)
  1. ipa dnszone-mod DNS_ZONE --name-server=SERVER

Switch IP interfaces between LDAP

SSH to the VM with Openstack Application credentials (EWC - OpenStack Command-Line client) installed and run the following commands:
1. Show information about the OLD LDAP machine (SERVER_NAME usually is ldap in the tenancies by default):
```
openstack server show SERVER_NAME
```
2. Detach the interface from the OLD LDAP machine (SERVER_NAME is the name of the OLD LDAP VM from previous command, IP_ADDRESS is the private IP of the OLD LDAP VM, you listed with the previous command, SAVE IT in your notes!)
```
openstack server remove fixed ip SERVER_NAME IP_ADDRESS 
```
SSH In the NEW LDAP machine (LDAP replica)
1. Update the IP of the NEW LDAP machine in the /etc/hosts (IP_ADDRESS ) with the IP of the OLD LDAP machine and remove the line relative to the OLD LDAP ( The one you saved before in your notes!)
```
[murdaca@ipa ~]$ cat /etc/hosts



IP_ADDRESS ipa.batchpro.ewc


```
SSH to the VM with Openstack client installed and run the following commands:
1. Switch off the NEW LDAP machine (SERVER_NAME is the name of the VM, you can find it with openstack server list )
```
openstack server stop SERVER_NAME 
```
2. Detach the interface from the NEW LDAP machine (SERVER_NAME is the name of the VM, IP_ADDRESS is the private IP of the NEW LDAP VM )
```
openstack server remove fixed ip SERVER_NAME IP_ADDRESS 
```
3. Add interface to the NEW LDAP machine with the IP of the old LDAP machine (SERVER_NAME is the name of the VM, IP_ADDRESS=The one you saved before in your notes!
```
openstack server add fixed ip SERVER_NAME IP_ADDRESS 
```
4. Add LDAP security group to new LDAP machine (SERVER_NAME is the name of the NEW LDAP VM)
```
openstack server add security group SERVER_NAME ldap
```
5. Restart NEW LDAP machine (SERVER_NAME is the name of the new LDAP VM)
```
openstack server restart SERVER_NAME 
```

Post installation

You can run it after you switched the IP in the new LDAP machine

Delete OLD LDAP machine DNS records (SERVER is the old LDAP machine complete domain (e.g. ldap-test-rocky.eumetsat.sandbox.ewc)
```
ipa-replica-manage del SERVER --force
```
Find the dns zone name
```
ipa dnszone-find
```
Replace the NEW LDAP machine IP with the IP of the interface of the OLD LDAP machine (HOSTED_ZONE is the output name from the previous command, IP_ADDRESS=The one you saved before in your notes!, HOSTNAME is the new LDAP machine complete domain (e.g. ldap-test-rocky.eumetsat.sandbox.ewc)
```
ipa dnsrecord-mod HOSTED_ZONE ipa-ca --a-rec IP_ADDRESS 
ipa dnsrecord-mod HOSTED_ZONE HOSTNAME --a-rec  IP_ADDRESS
```

Known possible errors

`ipa` command line of WebUI access is denied, with an HTTP error 401

You could identify this error during tests (e.g. running a ipa command) or enrollment of a machine into LDAP, after the migration from Centos7 to Rocky8.

Example error:

[root@replica-first ~]# ipa --verbose
ipa: INFO: Connection to https://replica-first.coreservices.ewc/ipa/session/json failed with <ProtocolError for replica-first.coreservices.ewc/ipa/session/json: 401 Unauthorized>
ipa: INFO: Connection to https://ldap.coreservices.ewc/ipa/session/json failed with [Errno -2] Name or service not known
ipa: ERROR: cannot connect to 'any of the configured servers': https://replica-first.coreservices.ewc/ipa/session/json, https://ldap.coreservices.ewc/ipa/session/json

In order to fix this authentication issue:

SSH to the current LDAP machine you have
become root

Run the following

python3 /usr/libexec/ipa/oddjob/org.freeipa.server.config-enable-sid --add-sids

restart ipa
```
ipactl restart
```
finally kinit with the LDAP admin user ( you can find it in Morpheus Cypher → secret/ipaadmin_username, password/ipaadmin and try to run ipa commands to verify the above error is no more there)
```
kinit <ldap-admin-user>
```

Finish procedure for new rocky 8 replica

Delete OLD LDAP machine DNS records

ipa-replica-manage del OLD_LDAP_HOSTNAME --force

Replace the NEW LDAP machine IP DNS records with the IP of the interface of the OLD LDAP machine

ipa dnsrecord-mod DNS_HOSTED_ZONE ipa-ca --a-rec OLD_LDAP_PRIVATE_IP
ipa dnsrecord-mod DNS_HOSTED_ZONE NEW_LDAP_SERVER_NAME --a-rec OLD_LDAP_PRIVATE_IP

Edit the /etc/hosts file and make sure it is as follow:

[murdaca@ipa ~]$ cat /etc/hosts
 
<!-- BEGIN ANSIBLE MANAGED BLOCK -->
 
OLD_LDAP_PRIVATE_IP NEW_LDAP_HOSTNAME
 
<!-- END ANSIBLE MANAGED BLOCK -->

where:

DNS_HOSTED_ZONE→ logging in Morpheus → Tools → Cypher and check the following secret → secret/ldap_domain
OLD_LDAP_PRIVATE_IP → logging in Morpheus → Provisioning → Instances, check your OLD LDAP VM IP address
OLD_LDAP_HOSTNAME → logging in Morpheus → Tools → Cypher and check the following secret → secret/ldap_hostname
NEW_LDAP_SERVER_NAME → name of the machine

Resource: https://access.redhat.com/solutions/7052125

DNA range issue

After the IPA Migration, especially from Centos7 to Rocky9, there might be still some possible errors, like the one below:

ipa: ERROR: Operations error: Allocation of a new value for range cn=posix ids,cn=distributed numeric assignment plugin,cn=plugins,cn=config failed! Unable to proceed.

There is a FreeIPA doc site related to this: https://www.freeipa.org/page/V3/Recover_DNA_Ranges.html

The fix for that error is the following command:

Check if your DNA ranges exists
```
ipa-replica-manage dnarange-show
```
(This command should return ldap_server: No on-deck range set)
Identify min and max range of IDs (min=First Posix ID of the range) (max=First Posix ID of the range + Number of IDs in the range)
```
 ipa idrange-find
```
Assign the DNS range using ${min}-${max} identified in the previous steps
```
 ipa-replica-manage dnarange-set $ldap_server ${min}-${max}
```
Check the range is assigned now

ipa-replica-manage dnarange-show

Space shortcuts

Page tree

User procedure

Automatic

Tasks

Migrate from Centos7 to Rocky 8

Migrate from Rocky 8 to Rocky 9

Create backup of a VM

Switch Interfaces of two VMs

Update Morpheus

Tests

Manual

Migrate from Centos7 to Rocky 8

Migrate from Rocky 8 to Rocky 9

Switch IP interfaces between LDAP

Post installation

Known possible errors

`ipa` command line of WebUI access is denied, with an HTTP error 401

DNA range issue

Space shortcuts

Page tree

EUMETSAT: LDAP migration

User procedure

Automatic

Tasks

Migrate from Centos7 to Rocky 8

Migrate from Rocky 8 to Rocky 9

Create backup of a VM

Switch Interfaces of two VMs

Update Morpheus

Tests

Manual

Migrate from Centos7 to Rocky 8

Migrate from Rocky 8 to Rocky 9

Switch IP interfaces between LDAP

Post installation

Known possible errors

ipa command line of WebUI access is denied, with an HTTP error 401

DNA range issue

`ipa` command line of WebUI access is denied, with an HTTP error 401