phanimngr
November 10, 2022, 7:11pm
1
Hi Team,
Our current DAP version is 12.0 and we would like to upgrade to latest version 12.7.
Master layer (DAP master & standby’s)
Kubernetes followers
Vault synchronizer.
Please help me on below query’s to upgrade our current setup.
Where to get the conjur-appliance to upgrade the master layer (DAP master & standby’s) ?
Below are the images used in manifest file of kubernetes followers , do I need to upgrade both the images ?
Where can I get those docker images ?
initContainers:
============
Do I need to upgrade the vault synchronizer as well ?
Currently our Vault version is 12.0.0 , will that CyberArk DAP version 12.7 is compatible with the current Vault version 12.0 ?
Any other steps need to taken care other than above to upgrade DAP ?
Regards,
Hi,
All the upgrade processes are documented in the CyberArk Docs
Master/ Standbyshttps://docs.cyberark.com/Product-Doc/OnlineHelp/AAM-DAP/Latest/en/Content/Deployment/dap-upgrade.htm
Vault SynchronizerUpgrade Vault Synchronizer ]
Latest software is available in the market place, vault synchronizer can work with vault version starting 10.5 onwards, so no compatibility issues.
For K8S images, you can download and upload to your repos.
Good luck
phanimngr
November 15, 2022, 1:46pm
3
Thanks gautam for reply !
For upgradation on K8s , do I need to upgrade both seedfetcher & conjur-appliance images ?
Regards,
Hi Phani,
I would suggest yes to update all to the latest.
Kr,
Hi gautam,
we are upgrading the DAP conjur appliance from 12.0.0 to 12.7.0.1, during the restoration process through backup it is failing on the master.
We have encrypted the master key using the KMS.
Below is the output of exceptions, please review and suggest to us any insight on resolving the issue .
root@b4a73efec8ac:/opt/conjur/etc# evoke restore --accept-eula
Error reading PKCS11 configuration file [Errno::ENOENT, No such file or directory @ rb_sysopen - /opt/conjur/etc/pkcs11.yml]
error: No valid KMS key found at /opt/conjur/etc/kms_master_key.aws.us-east-1
root@b4a73efec8ac:/opt/conjur/etc# exit
root@11a8b2d251d6:/opt/conjur/etc# evoke keys show-master-key
Error reading PKCS11 configuration file [Errno::ENOENT, No such file or directory @ rb_sysopen - /opt/conjur/etc/pkcs11.yml]
error: No valid KMS key found at /opt/conjur/etc/kms_master_key.aws.us-east-1
root@11a8b2d251d6:/opt/conjur/etc#
root@11a8b2d251d6:/opt/conjur/etc# evoke keys kms validate --region us-east-1
error: No valid KMS key
root@11a8b2d251d6:/opt/conjur/etc#
Regards,
Phani.G
Hi @phanimngr ,
You can safely ignore the PKCS11 error message in this case as that is just a result of it failing to unlock the keys with KMS. It sounds like when the backup was unpacked the key blob used for KMS was not present or couldn’t be found. Can you step into the container and list the contents of /opt/conjur/etc please?
docker exec <container_name> ls -la /opt/conjur/etc
Regards,
Hi @phanimngr ,
@micahlee found that in 12.2 we changed the file path format for the cipher text blob stored in /opt/conjur/etc. It changed from:
/opt/conjur/etc/kms_master_key.#{ec2_region}.enc
to
/opt/conjur/etc/kms_master_key.aws.#{ec2_region}.enc
This means you should be able to correct this issue by renaming the existing key blob to the new format:
docker exec <container_name> cp /opt/conjur/etc/kms_master_key.us-east-1.enc /opt/conjur/etc/kms_master_key.aws.us-east-1.enc
Please let me know how you make out!
Regards,
Thanks, Nate for your reply!
As suggested, below changes are working
docker exec <container_name> cp /opt/conjur/etc/kms_master_key.us-east-1.enc /opt/conjur/etc/kms_master_key.aws.us-east-1
Regards,
phanimngr
January 18, 2023, 12:02pm
9
Hi Nate,
Today, I tried to upgrade the Kubernetes DAP followers from 12.0 to 12.7 after the upgradation of the master layer, during this process we encountered the below issue. Please review the below logs and suggest to us any insight on resolving this issue.
As a part of the upgrade, we have modified only this manifest file 006-follower_manifest.yml file and applied the changes.
Only I find this link, but it is covering only upgradation of the OpenShift Kubernetes followers “Upgrade Conjur Kubernetes Follower
Error logs:
DAP Seed Fetcher v0.6.0-912https://qadapmr.mhf.mhc/configuration/spglobal/seed/follower …
Running authenticator…https://qadapmr.mhf.mhc/authn-k8s/NP-West/inject_client_cert: context deadline exceeded (Client.Timeout exceeded while awaiting headers)
ERROR: 2023/01/18 07:46:38.155231 authenticator.go:323: CAKC027 Failed to send https authenticate request or receive response. Reason: Post https://qadapmr.mhf.mhc/authn-k8s/NP-West/spglobal/host%2Fconjur%2Fauthn-k8s%2FNP-West%2Fapps%2Fseed-fetcher-app/authenticate: context deadline exceeded (Client.Timeout exceeded while awaiting headers)
Events logs:
kubectl get po -o wide
kubectl get events -n dapfollowerhttps://10.165.152.183:443/health: dial tcp 10.165.152.183:443: connect: connection refused130312249203.dkr.ecr.us-west-2.amazonaws.com/cyberarkdapnp:conjur-appliance ” already present on machinehttps://10.165.152.139:443/health: dial tcp 10.165.152.139:443: connect: connection refusedpods.metrics.k8s.io )
Manifest file:- I have modified the seedfetcher & conjur-appliance image names in the manifest file as created in the docker images.
Regards,
