Am I missing a Trick?

Pcotgrove · May 5, 2021, 6:33pm

After installing conjur enterprise as a master with 2 standbys I tried to enable sync replication. The evoke output was that there must be a minimum of 2 standbys to support this config! I used the --force option and hoped it would be ok. After realising that my config had issues I restarted the 3 vms and now even though the containers are running, I can’t do a health check or load the UI. Am I able to use the containers without reconfiguring After a host restart? I guess I should …

rpothier · May 5, 2021, 7:58pm

Hi Paul,
What was the error on the config? You said it required two standby’s but you did have the two is that corect?
Thanks - Rob

Pcotgrove · May 5, 2021, 8:06pm

Hi Rob, yes I had two standbys to satisfy the requirements for sync replication. I created the seed files and deployed the first standby, then recreated the seed files again referencing the 2nd standby and then deployed the 2nd standby. Not sure that this was correct. I did this because on the first attempt, I used the 1st set of seed files for both standbys. When I looked at the health report it looked like the first standby was replicating to the 2nd!.

This is when I killed the 2nd standby, created the 2nd set of seed files and reconfigured. When the sync failed to identify 2 standbys I restarted all containers and now ai can’t connect to any of them. The load balancers sees them all as down as well

jody.hunt · May 5, 2021, 8:49pm

I haven’t run this in while, but this is the standby config function in the script I use to stand up an HA cluster.

github.com

jodyhuntatx/cybrsm-demos/blob/main/1_master_cluster/strt_cluster#L98


    --name $standby_name \
    --label role=conjur_node \
    --restart always \
    --security-opt seccomp:unconfined \
    $CONJUR_APPLIANCE_IMAGE


  $DOCKER network connect $CONJUR_NETWORK $standby_name
}


############################
configure_standbys() {
  echo "Preparing standby seed files..."


  mkdir -p tmp
  master_ip=$($DOCKER inspect $CONJUR_MASTER_CONTAINER_NAME --format "{{ .NetworkSettings.IPAddress }}")


  $DOCKER exec $CONJUR_MASTER_CONTAINER_NAME evoke seed standby $CONJUR_STANDBY1_NAME $CONJUR_MASTER_CONTAINER_NAME > ./tmp/${CONJUR_STANDBY1_NAME}-seed.tar
  configure_standby $CONJUR_STANDBY1_NAME $master_ip


  $DOCKER exec $CONJUR_MASTER_CONTAINER_NAME evoke seed standby $CONJUR_STANDBY2_NAME $CONJUR_MASTER_CONTAINER_NAME > ./tmp/${CONJUR_STANDBY2_NAME}-seed.tar
  configure_standby $CONJUR_STANDBY2_NAME $master_ip

Topic		Replies	Views
Conjur Standby Nodes rebuild issue Secrets Management - Conjur, Secrets Hub & CP	3	643	June 17, 2021
Starting the Conjur Journey - Sever Setup Secrets Management - Conjur, Secrets Hub & CP	4	1046	February 13, 2020
Conjur clustering having issue Conjur Enterprise	4	707	March 9, 2023
Conjur Master seed file issue Secrets Management - Conjur, Secrets Hub & CP	0	189	March 9, 2023
Issues configuring Standby's in HA Cluster Conjur Enterprise	3	680	May 14, 2020

Am I missing a Trick?

Related Topics