8.5

Edit

Upgrade Guide from non-TLS 8.4.4 to 8.5.3

Prerequisites

You have the WorkFusion product v8.4.4 installed on Redhat 7. You downloaded 8.5.3 installer to all servers that will be upgraded.

This is a guide how to do an in-place upgrade from 8.4.4 non-TLS to 8.5.3 non-TLS.

Collect required data from previous installation.

SSH into APP server.

Preparation

General steps

Stop all services. This step prevents from changes in the database during dumping.

  1. Run as wfuser:
php-fpm-service stop
nginx-service stop
rpa_manager-service stop
tomcat-service stop
tomcat-nlp-service stop
tabula-service stop
wfagent-service stop
  1. Stop RPA Manager:
for i in `ps auxf | grep rpa_manager | awk '{ print $2}'`; do kill -9 $i; done
  1. Stop Tabula.

Run as root:

/etc/init.d/tabula stop

  1. Collect data from Vault storage.

    1. Download the 8.5.3 installation package and use the recent loader-security-properties-8.4.5.jar from it.
    2. Run as wfuser:
    cp workfusion-8.5.3/sources/loader-security-properties-8.4.5.jar /opt/workfusion/apps/webapps/wf_sec_storage/loader-security-properties.jar
cd /opt/workfusion/apps/webapps/wf_sec_storage/
/opt/workfusion/apps/webapps/wf_sec_storage/loader.sh workfusion review > ~/security-all.properties
    1. Copy the security-all.properties file to DB server using scp, ftp or wget. Rename the directory with the 8.4.4 installation. Run as root:
    mv /opt/workfusion /opt/workfusion_old

  2. Clear crontab jobs. Run as root to delete all cronjobs:

crontab -e
  1. Remove old init scripts. Run as root:
cd /etc/init.d
rm -f rpa_manager tabula tomcat tomcat-nlp wfagent php-fpm nginx

PM Server

  1. Create a dump. Run as wfuser:

    mkdir /opt/workfusion/dumps
/opt/workfusion/lib/mongodb/mongo --host 127.0.0.1 --port 27017 --username admin --password "myadminpass" admin
mongo.shell> db.grantRolesToUser("admin",["backup"])
mongo.shell> quit()
/opt/workfusion/lib/mongodb/mongodump --host 127.0.0.1 --port 27017 --username admin --password "myadminpass" --archive=/opt/workfusion/dumps/mongo-dump.tar

  2. Stop all old services.

    Run as wfuser:

    mongod-service stop
wfagent-service stop

    Run as root:

    mv /opt/workfusion /opt/workfusion_old

  3. Clean up init services. Run as root:

    cd /etc/init.d
rm -f mongod wfagent

OCR Server

  1. Stop all old services. Run as root:

    /etc/init.d/abbyy-fre11-licensing-service stop
/etc/init.d/wfagent stop
/etc/init.d/ocr2 stop

  2. Delete all old services. Run as root:

    /etc/init.d/abbyy-fre11-licensing-service stop
/etc/init.d/wfagent stop
/etc/init.d/ocr2 stop
...

  3. Delete old ABBYY.

    Run as root:

    cd /usr/local/bin
rm -rf ABBY
cd /usr/local/lib
rm -rf ABBY

  4. Clear crontab jobs. Run as root to delete all cronjobs:

    crontab -e

  5. Rename directory with 8.4.4 installation. Run as root:

    mv /opt/workfusion /opt/workfusion_old

VDS Master Server

  1. Stop all old services.

    Run as wfuser:

    wfmanager stop all

    Run as root:

    service supervisord stop

  2. Copy old models. Copy the old models file from <s3://vds-models/models.prod> to a temporary directory. Run as wfuser:

    s3cmd -c /opt/workfusion/s3cmd_conf/vds_s3cfg --signature-v2 sync s3://vds-models/models.flat-prod /tmp/models.prod-8.4.4

  3. Clear crontab jobs. Run as wfuser to delete all cronjobs:

    crontab -e

  4. Rename directory with 8.4.4 installation. Run as root:

    mv /opt/workfusion /opt/workfusion_old

VDS Slave Server

  1. Stop all old services.

    Run as wfuser:

    wfmanager stop all

    Run as root:

    service supervisord stop

  2. Rename directory with 8.4.4 installation. Run as root:

    mv /opt/workfusion /opt/workfusion_old

DB Server

  1. Connect to DB server via SSH and find the environment.conf file used for 8.4.4 installation.

  2. Convert usernames and secrets from environment.conf to the YAML format used in 8.5.3 installation. Run as wfuser:

    cd /opt/workfusion/app-all/

    source ./environment.conf
cat << EOF > secrets_override.yml

workfusion_db_user: $WORKFUSION_MYSQL_USER
workfusion_db_pass: $WORKFUSION_MYSQL_PASS
postgresql_admin_pass: $POSTGRES_PASS

workfusion_datastore_user: $WORKFUSION_PSQL_USER
workfusion_datastore_pass: $WORKFUSION_PSQL_PASS

rpa_manager_db_admin_user: $MONGO_ADMIN_NAME
rpa_manager_db_admin_pass: $MONGO_ADMIN_PASS

wfagent_master_db_user: $MONGO_ADMIN_NAME # ??
wfagent_master_db_pass: $MONGO_ADMIN_PASS # ??

wfagent_mongodb_ro_user: $MONGO_ADMIN_RO_NAME
wfagent_mongodb_ro_pass: $MONGO_ADMIN_RO_PASS

wfagent_username: $WFAGENT_AUTH_USER
wfagent_password: $WFAGENT_AUTH_PASSWORD

ocr_passwd: $OCR_PASSWD

s3_access_key: $ACCESS_KEY
s3_secret_key: $SECRET_KEY

wfbi_db_user: $WFBI_USER
wfbi_db_pass: $WFBI_PASSWORD

apm_hostname: $APMHOSTNAME
db_hostname: $DBHOSTNAME
app_hostname: $WFHOSTNAME
ocr_hostname: $OCRHOSTNAME
vds_master_hostname: $MLHOSTNAME
EOF

  3. Copy the resulting secrets_override.yml file to the directory with the 8.5.3 installer.

Data backup

Dumps directory

Create a directory where you store the dumps, for example, /opt/workfusion/dumps.

Run as wfuser:

mkdir /opt/workfusion/dumps

MySQL

sudo -u wfuser -i
/opt/workfusion/lib/mysql/bin/mysqldump --add-drop-database --routines -S /opt/workfusion/apps/mysql/mysql.sock -u root -p -B sqc -B wfdb  >> /opt/workfusion/dumps/mysql-sqc_wfdb.sql

PostgreSQL

export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/opt/workfusion/lib/pgsql-9.4.7/lib
/opt/workfusion/lib/pgsql-client-9.4.7/bin/pg_dumpall -U postgres -h 127.0.0.1 -p 5432 > /opt/workfusion/dumps/postgres-all.sql

MongoDB

/opt/workfusion/lib/mongodb/mongo --host 127.0.0.1 --port 27017 --username admin --password "myadminpass" admin
mongo.shell> db.grantRolesToUser("admin",["backup"])
mongo.shell> quit()
/opt/workfusion/lib/mongodb/mongodump --host 127.0.0.1 --port 27017 --username admin --password "myadminpass" --archive=/opt/workfusion/dumps/mongo-dump.tar

S3Emu

s3emu-service stop
tar -czvf /opt/workfusion/dumps/riak.tar.gz /opt/workfusion/apps/s3emu/riak

Solr

solr-service stop
tar -czvf /opt/workfusion/dumps/solr.tar.gz /opt/workfusion/apps/solr

Nexus

nexus stop
tar -czvf /opt/workfusion/dumps/nexus.tar.gz /opt/workfusion/apps/nexus/sonatype-work/nexus

Running services

Stop remaining running services.

Run as wfuser:

mongod-service stop
mysql-service stop
postgresql-9.4-service stop
vault-service stop
wfagent-service stop

Make sure there are no running processes launched from wfuser.

Old installation renaming

Rename an old installation directory.

Run as root:

mv /opt/workfusion /opt/workfusion_old

Postmigrate scripts

Remove postmigrate scripts:

  • Go to the directory with the ansible installer 8.5.3.

  • Remove postmigrate scripts to prevent removing custom Control Tower roles from database.

    cd <directory_with_ansible_installer_8.5.3>
rm -f roles/init-sqldb/templates/scripts/*

No files should remain in the roles/init-sqldb/templates/scripts/ directory.

Installation and data restoring

DB Server

Follow the installation guide for DB server.

Do not forget to apply secrets_override.yml with the -e @secrets_override.yml parameter.

./install.sh precheck db
./install.sh preinstall db
./install.sh install db -e @secrets_override.yml
./install.sh check db

cd /opt/workfusion_old/dumps/

S3Emu

Replace s3emu data.

wfmanager stop riak riak-cs riak-stanchion
tar -xzvf riak.tar.gz
mv /opt/workfusion/riak/data/ /opt/workfusion/riak/data-bak
mkdir /opt/workfusion/riak/data
cp -r /opt/workfusion_old/dumps/opt/workfusion/apps/s3emu/riak/* /opt/workfusion/riak/data/

The extracted riak directory should containt two subfolders only: leveldb and bitcask.

MySQL

important

Do if a new installation URL differs from the previous one. For example, if a port changed, or URL switched from HTTP to HTTPS.

If your new environment runs on a port that differs from the one previously set, use the sed command in accordance with the new enviroment URL.

Example 1

The old environment uses the port 4443 non-TLS, while the new one works on the port 8443 with TLS.

So the sed command to replace the url is as follows:

sed -i "s/http\:\/\/old-wf\.workfusion\.com\:4443/https\:\/\/new-wf\.workfusion\.com\:8443/g" mysql-dump.sql

Example 2

The old environment uses the port 4443 TLS while the new one should work on the port 8443 with TLS.

sed -i "s/https\:\/\/old-wf\.workfusion\.com\:4443/https\:\/\/new-wf\.workfusion\.com\:8443/g" mysql-dump.sql

Upload the dump to MySQL.

mysql -u mysql -h 127.0.0.1 -p < mysql-sqc_wfdb.sql

PostgreSQL

Connect to PostgreSQL database.

psql -U postgres -h 127.0.0.1

Run the next queries in the PostgreSQL shell to remove connections that may prevent dropping of databases (you can copy and paste all of them to the PSQL shell and press Enter):

SELECT pg_terminate_backend(pg_stat_activity.pid)
FROM pg_stat_activity
WHERE pg_stat_activity.datname = 'virtualizer_sandbox'
  AND pid <> pg_backend_pid();
SELECT pg_terminate_backend(pg_stat_activity.pid)
FROM pg_stat_activity
WHERE pg_stat_activity.datname = 'virtualizer'
  AND pid <> pg_backend_pid();
SELECT pg_terminate_backend(pg_stat_activity.pid)
FROM pg_stat_activity
WHERE pg_stat_activity.datname = 'wf_datastore'
  AND pid <> pg_backend_pid();
SELECT pg_terminate_backend(pg_stat_activity.pid)
FROM pg_stat_activity
WHERE pg_stat_activity.datname = 'wfml_automation'
  AND pid <> pg_backend_pid();

drop database virtualizer_sandbox;
drop database virtualizer;
drop database wf_datastore;
drop database wfml_automation;
important

Do if a new installation URL differs from the previous one. For example, if a port changed, or URL switched from HTTP to HTTPS.

In case your new environment runs on a port that differs from the one previously set, you should use the sed command in accordance with the new enviroment URL.

Example 1

The old environment uses the port 4443 non-TLS while the new one works on the port 8443 with TLS.

So the sed command to replace the URL is as follows:

sed -i "s/http\:\/\/old-wf\.workfusion\.com\:4443/https\:\/\/new-wf\.workfusion\.com\:8443/g" postgres-all.sql

Example 2

The old environment uses the port 4443 TLS while the new one should work on the port 8443 with TLS.

sed -i "s/https\:\/\/old-wf\.workfusion\.com\:4443/https\:\/\/new-wf\.workfusion\.com\:8443/g" mysql-dump.sql

Restore data from the PostgreSQL 8.4.4 dump:

psql -U postgres -f postgres-all.sql

MongoDB

Restore the database from backup:

mongo --host 127.0.0.1 --port 27016 --username admin --password "myadminpass" admin
mongo.shell> db.grantRolesToUser("admin",["root"])
mongorestore --host 127.0.0.1 --port 27016 --username admin --password "myadminpass" --archive=mongo-dump.tar

Nexus

tar -xvzf nexus.tar.gz
cd opt/workfusion/apps/nexus/
wfmanager stop nexus
cp -r sonatype-work/* /opt/workfusion/nexus/sonatype-work/

Solr

tar -xvzf solr.tar.gz
wfmanager stop solr
cp -r opt/workfusion/apps/solr/* /opt/workfusion/solr/

DB migrations

Apply DB migrations:

cd /opt/workfusion/_migrations/workfusion
migrate pending --env=development
migrate up --env=development
cd /opt/workfusion/_migrations/workspace
migrate pending --env=development
migrate up --env=development
cd /opt/workfusion/_migrations/sandbox
migrate pending --env=development
migrate up --env=development
cd /opt/workfusion/_migrations/sqc
migrate pending --env=development
migrate up --env=development

Vault

Upload the user secrets from 8.4.4 Business Process to Vault.

cp ~/security-all.properties /opt/workfusion/wf-sec-storage
cd /opt/workfusion/wf-sec-storage
cat security-all.properties | grep -v 'This property is not configured.' |grep -v "It's all" | grep -v 'Key : Value' | grep -v 'You are working with safe' | grep -v 'Properties from secure storage' |sed s%\\[INFO\ \\]\ %%g | sed s/\ :\ /=/ > security-filtered-all.properties
./loader.sh workfusion security-filtered-all.properties

Final migrations

To apply final migrations, go to the directory with the ansible installer 8.5.3. Run as wfuser:

./install.sh install db -e @secrets_override.yml
./install.sh check db -e @secrets_override.yml

APP Server

  1. Go to the directory with the ansible installer 8.5.3.

    cd <directory_with_installer_8.5.3>
cp /opt/workfusion_old/apps/webapps/apache-tomcat-8.5.20/conf/license.properties .

  2. Follow the installation guide for APP server.

    Do not forget to apply secrets_override.yml with the -e @secrets_override.yml parameter.

    • Run as root:
    ./install.sh precheck app
./install.sh preinstall app
    • Run as wfuser:
    ./install.sh install app -e @secrets_override.yml
./install.sh check app -e @secrets_override.yml

  3. Copy RPA Manager quota to the new installation.

    cp /opt/workfusion_old/apps/rpa_manager/grid-router/quota/user.xml /opt/workfusion/rpa-manager/grid-router/quota/user.xml

  4. Re-log in as wfuser otherwise the wfmanager executable will not be found.

    wfmanager restart all

PM Server

  1. Go to the directory with the ansible installer 8.5.3.

    cd <directory_with_installer_8.5.3>

  2. Follow the installation guide for PM server.

    Do not forget to apply secrets_override.yml with the -e @secrets_override.yml parameter.

    • Run as root:
    ./install.sh precheck apm
./install.sh preinstall apm
    • Run as wfuser:
    ./install.sh install apm -e @secrets_override.yml
./install.sh check apm -e @secrets_override.yml

  3. Re-log in as wfuser otherwise the the wfmanager executable will not be found.

mongorestore --host 127.0.0.1 --port 13017 --username mongodb --password "mongodb" --archive=/opt/workfusion_old/dumps/mongo-dump.tar

OCR Server

  1. Go to the directory with the ansible installer 8.5.3.
cd <directory_with_installer_8.5.3>

  1. Follow the installation guide for OCR server.

    Do not forget to apply secrets_override.yml with the -e @secrets_override.yml parameter.

    • Run as root:
    ./install.sh precheck ocr
./install.sh preinstall ocr
    • Run as wfuser:
    ./install.sh install ocr -e @secrets_override.yml
./install.sh check ocr -e @secrets_override.yml

VDS Master

  1. Connect to VDS Master Server.

  2. Go to the directory with the ansible installer 8.5.3.

    cd <directory_with_installer_8.5.3>

  3. Follow the installation guide for VDS Master.

    Do not forget to apply secrets_override.yml with the -e @secrets_override.yml parameter.

    Run as wfuser:

    ./install.sh precheck vds-master -e @secrets_override.yml
./install.sh preinstall vds-master -e @secrets_override.yml
./install.sh install vds-master -e @secrets_override.yml
./install.sh check vds-master -e @secrets_override.yml

  4. Copy the new models file from <s3://vds-models/models.flat-prod> to a temprorary directory:

    s3cmd -c /opt/workfusion/s3cmd_conf/vds_s3cfg --signature-v2 sync s3://vds-models/models.flat-prod /tmp/

  5. Merge these files to a new one:

    cat /tmp/models.prod-8.4.4 >> /tmp/models.flat-prod

  6. Upload the merged file to <s3://vds-models/models.flat-prod>:

    s3cmd -c /opt/workfusion/s3cmd_conf/vds_s3cfg --signature-v2 sync /tmp/models.flat-prod s3://vds-models/models.flat-prod

  7. Restart wfmanager:

    wfmanager restart all

VDS Slave

  1. Go to the directory with the ansible installer 8.5.3.

    cd <directory_with_installer_8.5.3>

  2. Follow the installation guide for VDS Slave.

    Do not forget to apply secrets_override.yml with the -e @secrets_override.yml parameter.

    • Run as root:
    ./install.sh precheck vds-slave
./install.sh preinstall vds-slave
    • Run as wfuser:
    ./install.sh install vds-slave -e @secrets_override.yml
./install.sh check vds-slave -e @secrets_override.yml

Post-installation steps

Perform post-installation procedures as described in Post Installation.

← PreviousNext →