6 Upgrading Oracle Key Vault from Release 18.x in a Multi-Master Cluster Environment
Similar to a standalone or primary-standby upgrade, this type of upgrade includes the Oracle Key Vault server software and endpoint software-related utilities.
- About Upgrading Oracle Key Vault from Release 18.x in a Multi-Master Cluster Environment
To perform this upgrade, you must upgrade each multi-master cluster node. - Step 1: Perform Pre-Upgrade Tasks
Similar to a standalone or primary-standby environment, you must prepare the Oracle Key Vault server for the pre-upgrade multi-master cluster process. - Step 2: Add Disk Space to Extend the vg_root for Upgrade to Oracle Key Vault Release 21.2
Before upgrading to Oracle Key Vault release 21.2 from release 18x, you will need to extend thevg_root
to increase disk space. - Step 3: Upgrade Multi-Master Clusters
Depending on your multi-master cluster configuration, you must follow the steps that are specific to your deployment. - Step 4: Check the Node Version and the Cluster Version
After you complete the upgrade of at least one node, you can log into any of the upgraded nodes to check the node and cluster versions. - Step 5: If Necessary, Change the Network Interface for Upgraded Nodes
Nodes that were created in Oracle Key Vault releases earlier than release 21.1 use Classic mode, in which only one network interface was used. - Step 6: Upgrade the Endpoint Software
After you have upgraded all the nodes in the cluster, you must reenroll endpoints that were created in earlier releases of Oracle Key Vault, or update the endpoint software. - Step 7: If Necessary, Add Disk Space to Extend Swap Space
If necessary, extend the swap space on each node. Oracle Key Vault release 21.2 requires a hard disk size greater than or equal to 1 TB in size with approximately 64 GB of swap space. - Step 8: If Necessary, Remove Old Kernels
For each multi-master cluster node, Oracle recommends that you clean up the older kernels that were left behind after the upgrade. - Step 9: If Necessary, Remove SSH-Related DSA Keys
For each multi-master cluster node, you should remove SSH-related DSA keys left behind after the upgrade, because they can cause problems with some code analysis tools.
6.1 About Upgrading Oracle Key Vault from Release 18.x in a Multi-Master Cluster Environment
To perform this upgrade, you must upgrade each multi-master cluster node.
There are different steps for upgrading the multi-master cluster depending on your deployment. A 2-node cluster, running Oracle Key Vault release 18.5 or earlier, configured as a single read-write pair would involve running a pre-upgrade script which no other deployment requires. Multi-master cluster nodes deployed in a read-write configuration must follow different upgrade steps than those deployed as read-only nodes.
Oracle does not support direct upgrades from Oracle Key Vault release 18.1 or earlier. You must upgrade to Oracle Key Vault release 18.2 or later before upgrading to release 21.2.
The upgrade process involves performing the upgrade on each multi-master cluster node. After you have begun a cluster upgrade, ensure that you upgrade all the nodes in the cluster one after the other, without too much intervening time between upgrades of two nodes.
Upgrading an Oracle Key Vault multi-master cluster includes upgrading each cluster node to the new later version. You must upgrade all nodes to the same Oracle Key Vault version. You should first upgrade the read-only nodes of the cluster, and then upgrade the read-write pairs. As each cluster node is upgraded, its node version is updated to the new version of the Oracle Key Vault. After you complete the upgrade of all cluster nodes, the cluster version is updated to the new version of the Oracle Key Vault. You can check the node version or the cluster version by selecting the Cluster tab, then in the left navigation bar, selecting Management. Oracle Key Vault multi-master cluster upgrade is considered complete when node version and cluster version at each cluster node is updated to the latest version of Oracle Key Vault.
Before you perform the upgrade, note the following:
- Perform the entire upgrade process on all multi-master cluster nodes, without interruption. That is, after you have started the cluster upgrade process, ensure that you try and upgrade all nodes, individually one after the other or in read-write pairs. Do not perform any critical operations or make configurational changes to Oracle Key Vault until you have completed upgrading all the nodes in your environment.
- Be aware that you cannot use any new features that were introduced in this release until you have completed upgrading all of the multi-master cluster nodes. An error is returned when such features are used from the node that has been upgraded. Oracle recommends that you plan the upgrade of all cluster nodes close to each other to ensure availability of the new features sooner.
- Starting in Oracle Key Vault release 21.2, expiration alerts for deactivated or destroyed objects are not generated. The following behavior is expected:
- As each cluster node is upgraded, Oracle Key Vault deletes all expiration alerts for any certificate and secret objects, as well as for key objects that have been revoked or destroyed.
- Cluster nodes that have not been upgraded yet will continue to generate alerts for these same objects, and also send email notifications for these alerts. This behavior that results in deletion and recreation of alerts may repeat until the last cluster node is upgraded.
- After the upgrade is complete, expiration alerts for the certificate and secret objects will have the alert type of
Certificate Object Expiration
andSecret Object Expiration
, respectively.
6.2 Step 1: Perform Pre-Upgrade Tasks
Similar to a standalone or primary-standby environment, you must prepare the Oracle Key Vault server for the pre-upgrade multi-master cluster process.
6.3 Step 2: Add Disk Space to Extend the vg_root for Upgrade to Oracle Key Vault Release 21.2
Before upgrading to Oracle Key Vault release 21.2 from release 18x, you will need to extend the vg_root
to increase disk space.
Related Topics
6.4 Step 3: Upgrade Multi-Master Clusters
Depending on your multi-master cluster configuration, you must follow the steps that are specific to your deployment.
- About Upgrading Multi-Master Clusters
When upgrading a multi-master cluster, you may upgrade the read-only nodes one after the other and in the case of read-write pairs, you must upgrade both of the nodes simultaneously. - Upgrading Multi-Master Cluster Read-Only Nodes
Before upgrading multi-master cluster read-only nodes, ensure that you understand the requirements for performing this kind of upgrade. - Upgrading Multi-Master Cluster Read-Write Pairs
Before upgrading multi-master cluster read-write pairs, ensure that you understand the requirements for performing this kind of upgrade.
6.4.1 About Upgrading Multi-Master Clusters
When upgrading a multi-master cluster, you may upgrade the read-only nodes one after the other and in the case of read-write pairs, you must upgrade both of the nodes simultaneously.
To perform the upgrade, you must upgrade each multi-master cluster node. There are different steps for upgrading the multi-master cluster depending on your deployment. A two-node cluster, running Oracle Key Vault release 18.5 or earlier, configured as a single read-write pair would involve running a pre-upgrade script which no other deployment requires. For multi-master cluster nodes that were deployed in a read-write configuration, you must follow different upgrade steps than those that were deployed as read-only nodes.
This section describes the upgrade methods for the various deployments. Choose the method that is appropriate for your configuration. When upgrading read-write pairs, after disabling both the nodes, you can upgrade the nodes at the same time. However, Oracle recommends that you upgrade the cluster nodes one at a time. If you have a multi-master cluster with three or more nodes, then you can upgrade two nodes at the same time with no down time.
When upgrading read-write pairs, it is critically important that you perform the steps in the proper order on the two nodes.
If your cluster consists of only two nodes in a read-write configuration and if you are upgrading from Oracle Key Vault release 18.2 through 18.5, then you must execute a pre-upgrade script before performing the upgrade. The pre-upgrade script is not to be executed in any other multi-master cluster configuration.
Parent topic: Step 3: Upgrade Multi-Master Clusters
6.4.2 Upgrading Multi-Master Cluster Read-Only Nodes
Before upgrading multi-master cluster read-only nodes, ensure that you understand the requirements for performing this kind of upgrade.
Related Topics
- Step 1: Perform Pre-Upgrade Tasks for the Upgrade from Release 21.1
- Upgrading a Standalone Oracle Key Vault Server
- Step 2: Add Disk Space to Extend the vg_root for Upgrade to Oracle Key Vault Release 21.2
- Oracle Key Vault Administrator's Guide
- Step 4: Upgrade the Oracle Key Vault Server
- Oracle Key Vault Administrator's Guide
Parent topic: Step 3: Upgrade Multi-Master Clusters
6.4.3 Upgrading Multi-Master Cluster Read-Write Pairs
Before upgrading multi-master cluster read-write pairs, ensure that you understand the requirements for performing this kind of upgrade.
Do not perform any critical operations or make configuration changes to Oracle Key Vault until you have completed upgrading all multi-master cluster nodes.
You must perform these steps on both nodes of the cluster read-write pair in the order specified for all read-write pairs of your cluster. In order to perform the upgrade using this method, you must arbitrarily decide which of the read-write nodes of your pair will be Node A and which node will be Node B. The steps below will refer to Node A and Node B which correspond to your Node A and Node B.
Direct upgrades to Oracle Key Vault 21.2 from releases 18.1 or earlier are not supported. You must upgrade to Oracle Key Vault release 18.2 or later before upgrading to release 21.2. If you are upgrading a two-node cluster that runs Oracle Key Vault release 18.5 or earlier and is configured as a single read-write pair, then you must run the pre-upgrade script on each multi-master cluster node after mounting the ISO, but before performing the full upgrade.
Generally, once your cluster nodes are disabled, they become unavailable for use. Therefore, in order to allow operational continuity when you upgrade a two-node cluster that is configured as a read-write pair, applying the pre-upgrade script on both nodes allows the node to remain available in a read-only mode, even when the node is disabled. After both the nodes are disabled, you can upgrade the nodes one at a time; the order is at your discretion. However, when you enable the nodes after they have been upgraded, you must enable them in the reverse order that they were disabled.
If your deployment required running the pre-upgrade script, then after you run the pre-upgrade script, proceed with the standard upgrade process as follows. Disable both nodes (the order of disabling matters) of the read-write pair, add the extra disk space as necessary and then perform the upgrade and reboot. When you run the upgrade and reboot commands, Oracle recommends running them on one node of the pair before running it on the other node to avoid down time.
6.5 Step 4: Check the Node Version and the Cluster Version
After you complete the upgrade of at least one node, you can log into any of the upgraded nodes to check the node and cluster versions.
- Log in to the Oracle Key Vault management console as a user who has the System Administrator role.
- Select the Cluster tab.
- In the left navigation bar, select Management.
- Check the following areas:
- To find the node version, check the Cluster Details area.
- To find the cluster version, check the Cluster Information area.
6.6 Step 5: If Necessary, Change the Network Interface for Upgraded Nodes
Nodes that were created in Oracle Key Vault releases earlier than release 21.1 use Classic mode, in which only one network interface was used.
If you prefer to use dual NIC network mode, which supports the use two network interfaces, then you can switch the node to use this mode, from the command line.
Related Topics
6.7 Step 6: Upgrade the Endpoint Software
After you have upgraded all the nodes in the cluster, you must reenroll endpoints that were created in earlier releases of Oracle Key Vault, or update the endpoint software.
Related Topics
6.8 Step 7: If Necessary, Add Disk Space to Extend Swap Space
If necessary, extend the swap space on each node. Oracle Key Vault release 21.2 requires a hard disk size greater than or equal to 1 TB in size with approximately 64 GB of swap space.
swapon -s
command. By default, Oracle Key Vault releases earlier than release 18.1 were installed with approximately 4 GB of swap space. After you complete the upgrade to release 18.1 or later, Oracle recommends that you increase the swap space allocation for the server on which you upgraded Oracle Key Vault. A new Oracle Key Vault installation is automatically configured with sufficient swap space. However, if you upgraded from a previous release, and your system does not have the desired amount of swap space configured, then you must manually add disk space to extend the swap space, particularly if the intention is to convert the upgraded server into the first node of a multi-master cluster.
6.9 Step 8: If Necessary, Remove Old Kernels
For each multi-master cluster node, Oracle recommends that you clean up the older kernels that were left behind after the upgrade.