System Upgrade - Zero Downtime Upgrade

This page includes the following:

labels:
  features.aa-install-operator/upgrade-mode: zdu

• For versions prior to v24.3, only use the ZDU to upgrade systems that were installed manually or test systems that were installed using the ONE Installer. You cannot migrate to a container-based system. For versions 24.3 and higher, you can choose the ZDU mode to upgrade AAKE instances, see Container-Based System Upgrade - Automic Automation Kubernetes Edition.

• Make sure all components that require a certificate have them in place, see Securing Connections to the AE (TLS/SSL).

• During ZDU, the message "System upgrade is in progress." is displayed in AWI, thus signalizing all Users that a system upgrade is in progress.

• It is not possible to carry out a Centralized Agent Upgrade (CAU) parallel to a Zero Downtime Upgrade.

If you need help, contact our support team. Our consultants are experts in upgrading AE systems and will be pleased to assist you whenever it is necessary. For more information, see Support.

The communication between the Automation Engine and the different components uses TLS/SSL through a secure WebSocket (WSS). These components establish a connection with the Java communication process (JCP) and/or the REST process (REST), which use trusted certificates to prove their identity to other communication partners, such as Agents.

The Windows, UNIX and Java agents can use different parameters in their corresponding INI file to define how to handle the certificates.

Note: The TLS/SSL implementation does not apply to the HP-UX and 32 bit ZLINUX Agents, as they are no longer supported.

More information:

• Installing the JCP

• Securing Connections to the AE (TLS/SSL)

• TLS/SSL Certificate Considerations

Make sure your system meets the system and user prerequisites, otherwise the Zero Downtime Upgrade will not work properly.

• System Setup

  To properly carry out the Zero Downtime Upgrade, you have to use a distributed installation. These installations can be located either on two separate hosts or on two separate installations on the same host, but in different bin directories. For more information, see Distributed Installation for ZDU.

  The upgrade process makes reference to either the current (base) or the new (target) system, which also represent the current and new version in the upgrade scenario.

  If you use a proxy and a firewall in the systems used for the upgrade, you have to configure the ports accordingly. For more information, see Configuring Firewall and Ports.

  Information security services, such as the TLS/SSL implementation of the ServiceManager, require features provided by the CAPKI package. You need to install CAPKI on all computers in which the AE processes or the ServiceManager and any of its clients will run.

  Important! In a UNIX environment, do not overwrite the existing installation. In UNIX this can happen without a warning even if the binaries are currently in use.

  The communication between the AE and AWI uses TLS/SSL through a secure WebSocket (WSS). The upgraded AWI instance establishes a connection with the Java communication process (JCP), which uses trusted certificates to prove its identity to other communication partners and requires a keystore to work with these certificates. Therefore, you have to install and configure the new Java communication process (JCP) and make sure you have the required certificates.

  More information:

  • CAPKI - Securing the ServiceManager
  • ServiceManager
  • Types of Server Processes
  • Installing the JCP
  • Securing Connections to the AE (TLS/SSL)
  • TLS/SSL Certificate Considerations

• Set User Privileges

  Make sure that the respective user or users (usually system administrators) have the necessary permissions. The user conducting the upgrade must have the privilege Upgrade system, start and stop processes set in the corresponding User object. For more information, see Granting Automation Engine Privileges.

As a system administrator, you have to set up a distributed installation to upgrade your on-premises system with no downtime. This ensures that a current and new versions are available to carry out the upgrade and that you can test if the system runs properly in the new version before finishing the upgrade.

Two different modes are activated during the upgrade: the compatibility mode and the parallel mode.

• Compatibility mode

  This mode is active during the whole upgrade process, even if you carry out a rollback. Certain system optimization functions are not available when in compatibility mode and the system performance is reduced by about a third.

  You cannot switch a work process (WP) to a dialog work process (DWP) while in compatibility mode.

• Parallel mode

  This mode is only active when server processes from the current and new version are active at the same time. Current version work processes (WPs) may slow down until the upgrade is completed.

The parallel mode requires two separate installations in separate bin directories: one for the version from which you want to upgrade (current); the other for the version to which you want to upgrade (new). These installations can be on the same host (recommended) or on separate hosts.

You can then choose if you want to split or distribute an existing installation, or even use a proxy. All options are explained below.

Important! You have to use the same INI file (ucsrv.ini, see Automation Engine) for the current and the new version, located in one directory only.

More information:

• Types of Server Processes
• Checking for Incompatibilities

Splitting an Existing Installation

Splitting an existing installation allows you shut down one part of the system and upgrade it instead of upgrading the whole installation at once. This means that you shut down half of the server processes, upgrade those to the new version, and start them again.

You have to use two separate bin directories.

Advantage:

• Less time needed for configuring ports, as no additional ports are necessary.

Disadvantages:

• Shutting down communication processes (CPs) results in agents and users connected to those CPs being disconnected.

• System performance is reduced to half.

Distributing an Existing Installation

This setup is recommended if you have a very large number of agents. If you need help, please contact our support department. For more information, see Support.

Set up two separate installations of the AE system you want to upgrade (current version). You can set them up on the same host or on separate hosts.

Port Information: While in parallel mode, server processes from the current and new version are active at the same time. This means that you have to configure double the amount of ports than usually necessary. These ports must be known to all clients that connect to a server process.

You also have to make sure you create double the amount of MQ (CP) tables in the database.

Advantages:

• Using this kind of setup lets users continue their work without being disconnected.
• Agents can be phased out successively and connect to the new communication processes (CPs).

Disadvantages:

• This setup requires more preparation time at first.
• Additional ports are necessary, which have to be configured in Firewall and existing Proxies.
• All ports have to be known to all existing clients before you start the upgrade.

Combining with a Proxy

You can execute the ZDU by using a Proxy.

The Proxy combines and reroutes Java communication process (JCP) connections, while agents just connect to the Proxy, using the ports or port ranges configured in it.

1. Either split or distribute your existing installation as explained above.
2. Configure the second system in the Proxy accordingly.
3. The Proxy will then reroute connections to either the current or new version JCPs, as necessary.

Advantages:

• You do not have to configure any additional ports, neither when you split nor when you duplicate your system.
• The Proxy handles the connections and the agents are connected to whatever system and JCPs are active and in use, be it current or new system.

For more information, see About Proxy.