...

User procedure

Pre-requisite info to have ready:

• OLD_LDAP_SERVER_NAME → Name of the server from Openstack → you can find the name from openstack server list command
• OLD_LDAP_PRIVATE_IP → logging in Morpheus → Provisioning → Instances, check your OLD LDAP VM IP address
• OLD_LDAP_HOSTNAME → logging in Morpheus → Tools → Cypher and check the following secret → secret/ldap_hostname
• NEW_LDAP_SERVER_NAME → Name of the server from Openstack → you can find the name from openstack server list command
  
• NEW_LDAP_PRIVATE_IP → logging in Morpheus → Provisioning → Instances, check your new LDAP VM IP address
• NEW_LDAP_HOSTNAME → <name-of-the-machine>.<tenancy-domain> where tenancy-domain → logging in Morpheus → Tools → Cypher and check the following secret → secret/ldap_domain (e.g. ldap-test-rocky.eumetsat.sandbox.ewc)
• DNS_HOSTED_ZONE→ logging in Morpheus → Tools → Cypher and check the following secret → secret/ldap_hostname

Start user procedure:

1. SSH into the OLD LDAP machine (your current one) and create DNS reverse zone (NAME_FROM_IP = LDAP IP or using IP range ) (https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/7/html/linux_domain_identity_authentication_and_policy_guide/managing-reverse-dns-zones) 
   

   Code Block
   ipa dnszone-add --name-from-ip=NAME_FROM_IP

2. ssh to the VM with Openstack Client and run the following commands (see EWC - OpenStack Command-Line client for more details):
   1. List ldap security group rule 

      Code Block
      openstack security group rule list ldap

   2. add port 636 TCP.749 TCP,464 UDP to ldap security group if they are missing

      Code Block
      openstack security group rule create ldap --protocol tcp --ingress --dst-port 636 --remote-ip 0.0.0.0/0 --ethertype IPv4 openstack security group rule create ldap --protocol tcp --ingress --dst-port 749 --remote-ip 0.0.0.0/0 --ethertype IPv4 openstack security group rule create ldap --protocol udp --ingress --dst-port 464 --remote-ip 0.0.0.0/0 --ethertype IPv4

   3. Backup existing LDAP machine using the following documentation: EWC - How to create and restore backups from VMs
3. Check the Operating System of your LDAP (either from Morpheus, Provisioning → Instances → select LDAP machine Image Added;
   1. If your LDAP is rocky 8 based
   ,
   1. → jump to step 7.
   , if it
   1.  
      
   2. If your LDAP is centos7 based
   continue the procedure normally
   1. → continue to step 4.
4. Create LDAP replica instance type to move from centos7 to rocky 8 (see MigratefromCentos7toRocky8);
5. Switch IP interfaces between LDAPs (see SwitchIPinterfacesbetweenLDAP );
6. Check everything is fine (see Tests);
   
7. Create LDAP replica instance type to move from rocky 8 to rocky 9 (see MigratefromRocky8toRocky9)
8. Switch IP interfaces between LDAPs (see SwitchIPinterfacesbetweenLDAP );
9. Check everything is fine (see Tests);
10. Remove old LDAPs machines to free resources (from Morpheus)

...

Switch IP interfaces between LDAP

Pre-requisite info to have ready:

...

LDAP

...

Prepare new LDAP machine

1. SSH In the NEW LDAP machine (LDAP replica) and become root
   1. Edit the /etc/hosts file and make sure it is as follow:

   2. Code Block
      [murdaca@ipa ~]$ cat /etc/hosts <!-- BEGIN ANSIBLE MANAGED BLOCK --> OLD_LDAP_PRIVATE_IP NEW_LDAP_HOSTNAME <!-- END ANSIBLE MANAGED BLOCK -->

   3. Delete OLD LDAP machine DNS records

      Code Block
      ipa-replica-manage del OLD_LDAP_HOSTNAME --force

   4. Replace the NEW LDAP machine IP DNS records with the IP of the interface of the OLD LDAP machine
      

      Code Block
      ipa dnsrecord-mod DNS_HOSTED_ZONE ipa-ca --a-rec OLD_LDAP_PRIVATE_IP ipa dnsrecord-mod DNS_HOSTED_ZONE NEW_LDAP_HOSTNAME --a-rec OLD_LDAP_PRIVATE_IP

...

1. SSH to the VM with Openstack client installed and run the following commands:
   1. Show information about the OLD LDAP machine (SERVER_NAME usually is ldap in the tenancies by default):
      

      Code Block
      openstack server show OLD_LDAP_SERVER_NAME

   2. Detach the interface from the OLD LDAP machine (SERVER_NAME is the name of the OLD LDAP VM from previous command, IP_ADDRESS is the private IP of the OLD LDAP VM, you listed with the previous command, SAVE IT in your notes!)

      Code Block
      openstack server remove fixed ip OLD_LDAP_SERVER_NAME OLD_LDAP_PRIVATE_IP

   3. Switch off the NEW LDAP machine (SERVER_NAME is the name of the VM, you can find it with openstack server list )

      Code Block
      openstack server stop OLD_LDAP_SERVER_NAME

   4. Detach the interface from the NEW LDAP machine (SERVER_NAME is the name of the VM, IP_ADDRESS is the private IP of the NEW LDAP VM )

      Code Block
      openstack server remove fixed ip NEW_LDAP_SERVER_NAME NEW_LDAP_PRIVATE_IP

   5. Add interface to the NEW LDAP machine with the IP of the old LDAP machine (SERVER_NAME is the name of the VM, IP_ADDRESS=The one you saved before in your notes!

      Code Block
      openstack server add fixed ip NEW_LDAP_SERVER_NAME OLD_LDAP_PRIVATE_IP

   6. Add LDAP security group to new LDAP machine (SERVER_NAME is the name of the NEW LDAP VM)

      Code Block
      openstack server add security group NEW_LDAP_SERVER_NAME ldap

   7. Restart NEW LDAP machine (SERVER_NAME is the name of the new LDAP VM)

      Code Block
      openstack server restart NEW_LDAP_SERVER_NAME

Update Morpheus

1. Login to Morpheus and change the value of the hostname for LDAP, going to Tools → Cypher:
   1. Delete the secret/ldap_hostname
      
   2. Use the '+ADD' to create a new secret
   3.  Add KEY: secret/ldap_hostname and VALUE: NEW_LDAP_HOSTNAME 

...