Upgrading Mission Control

Stop the service.

systemd OS

systemctl stop mc

systemv OS

service mc stop

Docker Compose

cd jfrog-mc-<version>-compose
docker-compose -p mc down

Extract the contents of the compressed archive and go to the extracted folder.

Note: Make sure to merge your customizations in your current docker-compose.yaml file to the new extracted version of the docker-compose.yaml file.

tar -xvf jfrog-mc-<version>-<compose|rpm|deb>.tar.gz
cd jfrog-mc-<version>-<compose|rpm|deb>

Run the installer script.

Note: if needed, the script will prompt you with a series of mandatory inputs, including the jfrogURL (custom base URL) and joinKey.

Compose

./config.sh

RPM/DEB

./install.sh

Start and manage the Mission Control service.

systemd OS

systemctl start|stop mc

systemv OS

service mc start|stop

Docker Compose

cd jfrog-mc-<version>-compose
docker-compose -p mc up -d
docker-compose -p mc ps
docker-compose -p mc down

Access Mission Control from your browser at http://<jfrogUrl>/ui/, go to the Dashboard tab in the Application module in the UI.

Check Mission Control Log.

tail -f $JFROG_HOME/mc/var/log/console.log

Stop the current server.

systemd OS

systemctl stop mc

systemv OS

service mc stop

Extract the contents of the compressed archive and go to the extracted folder.

tar -xvf jfrog-mc-<version>-<rpm|deb>.tar.gz
cd jfrog-mc-<version>-<rpm|deb>

Configure Elasticsearch.

When connecting an external instance of Elasticsearch to Mission Control, add the following flag in the Shared Configurations of $JFROG_HOME/mc/var/etc/system. yaml file and step (6) can be skipped.

shared:
   elasticsearch:
       external: true

Recommended to install the Search Guard plugin when using Elasticsearch which is packaged with Mission Control. This will help ensure secure communication with Elasticsearch.

1. Search Guard package can be located in the extracted contents at jfrog-mc-<version>-<rpm|deb>/third-party/elasticsearch/search-guard-<version>.zip.

   For installation steps, refer to Search Guard documentation.

2. Add an admin user to Search Guard which will ensure authenticated communication with Elasticsearch.

   1. The Search Guard configuration accepts a hashed password. Use the following command to generate the hash for the password. Also, add the username and password generated here in the Shared Configuration as specified in step (5) above.

      /etc/elasticsearch/plugins/search-guard-7/tools/hash.sh -p <clear_text_password>
       
      #This will output a hashed password (<hash_password>), make a copy of it

   2. Prepare the configuration snippet to add a new(admin) user with the hashed password obtained from the previous step

      <username>:
          hash: "<hashed_password>"
          backend_roles:
             - "admin"
          description: "Insight Elastic admin user"

   3. Paste the above snippet to the end of this file sg_internal_users.yml located at /etc/elasticsearch/plugins/search-guard-7/sgconfig/

3. Enable anonymous access to “_cluster/health” endpoint. This is required to check the health of the Elasticsearch cluster.

   1. Enable anonymous auth in this file sg_config.yml at /etc/elasticsearch/plugins/search-guard-7/sgconfig/

      sg_config:
             dynamic:
                http:
                   anonymous_auth_enabled: true #set this to true

   2. Map anonymous user sg_anonymous to backend role sg_anonymous_backendrole in this file sg_roles_mapping.yml at /etc/elasticsearch/plugins/search-guard-7/sgconfig

      sg_anonymous:
          backend_roles:
              - sg_anonymous_backendrole

   3. Add this snippet to the end of this file sg_roles.yml located at /etc/elasticsearch /plugins/search-guard-7/sgconfig

      sg_anonymous:
        cluster_permissions:
          - cluster:monitor/health

Install Mission Control as a service on Red Hat-compatible Linux distributions, as a root user.

rpm

yum -y install ./mc/mc.rpm

Debian

dpkg -i ./mc/mc.deb

Set the Artifactory connection details.

Start and manage Mission Control.

service mc start|stop

Access Mission Control from your browser at: http://<jfrogUrl>/ui/, go the Dashboard tab in the Application module in the UI.

Check Mission Control Log.

tail -f $JFROG_HOME/mc/var/log/console.log

Stop the current server.

Stop Mission Control

cd $JFROG_HOME/mc/app/bin
./mc.sh stop

Configure Elasticsearch.

When connecting an external instance of Elasticsearch to Mission Control, add the following flag in the Shared Configurations of $JFROG_HOME/mc/var/etc/system. yaml file and step (6) can be skipped.

shared:
   elasticsearch:
       external: true

Recommended to install the Search Guard plugin when using Elasticsearch which is packaged with Mission Control. This will help ensure secure communication with Elasticsearch.

1. Search Guard package can be located in the extracted contents at mc/app/third-party/elasticsearch/search-guard-<version>.zip

   For installation steps, refer to Search Guard documentation.

2. Add an admin user to Search Guard which will ensure authenticated communication with Elasticsearch.

   1. The Search Guard configuration accepts a hashed password. Use the following command to generate the hash for the password. Also, add the username and password generated here in the Shared Configuration as specified in step (5) above.

      /etc/elasticsearch/plugins/search-guard-7/tools/hash.sh -p <clear_text_password>
       
      #This will output a hashed password (<hash_password>), make a copy of it

   2. Prepare the configuration snippet to add a new(admin) user with the hashed password obtained from the previous step

      <username>:
          hash: "<hashed_password>"
          backend_roles:
             - "admin"
          description: "Insight Elastic admin user"

   3. Paste the above snippet to the end of this file sg_internal_users.yml located at /etc/elasticsearch/plugins/search-guard-7/sgconfig/

3. Enable anonymous access to “_cluster/health” endpoint. This is required to check the health of the Elasticsearch cluster.

   1. Enable anonymous auth in this file sg_config.yml at /etc/elasticsearch/plugins/search-guard-7/sgconfig/

      sg_config:
             dynamic:
                http:
                   anonymous_auth_enabled: true #set this to true

   2. Map anonymous user sg_anonymous to backend role sg_anonymous_backendrole in this file sg_roles_mapping.yml at /etc/elasticsearch/plugins/search-guard-7/sgconfig

      sg_anonymous:
          backend_roles:
              - sg_anonymous_backendrole

   3. Add this snippet to the end of this file sg_roles.yml located at /etc/elasticsearch /plugins/search-guard-7/sgconfig

      sg_anonymous:
        cluster_permissions:
          - cluster:monitor/health

Extract the contents of the compressed archive and go to the extracted folder.

Untar

tar -xvf jfrog-mc-<version>-linux.tar.gz

Replace the existing $JFROG_HOME/mc/app with the new app folder.

Upgrade

# Export variables to simplify commands
export JFROG_HOME=/opt/jfrog
export JF_NEW_VERSION=/opt/jfrog/mc-4.x
 
# Remove app
rm -rf $JFROG_HOME/mc/app
 
# Copy new app
cp -r $JF_NEW_VERSION/app $JFROG_HOME/mc
 
# Remove extracted new version
rm -rf $JF_NEW_VERSION

Run the migration script to remove old service directories.

Run the migration script with the same privileges as you have in your current Mission Control installation. This script will remove old services directories, redundant service yaml files in router  and translate your current configurations to the new configuration format, according to the new file system layout.
 
$JFROG_HOME variable points to the new installation
export JFROG_HOME=<Full path to jfrog directory, for example: /opt/jfrog>
cd $JFROG_HOME/mc/app/bin
./migrate.sh
Check that the migration has completed successfully, by reviewing the following files:
 - migration log: $JFROG_HOME/mc/var/log/migration.log
- system.yaml configuration: $JFROG_HOME/mc/var/etc/system.yaml
   This newly created file will contain your current custom configurations in the new format.

Manage Mission Control.

$JFROG_HOME/app/bin/mc.sh start|stop

Access Mission Controlfrom your browser at: http://<jfrogUrl>/ui/, go to the Dashboard tab in the Application module in the UI.

Check Mission Control Log.

tail -f $JFROG_HOME/mc/var/log/console.log

Verify that you have upgraded Artifactory to v.7x. For more information, see Helm Upgrade.

Update the existing deployed version to the updated version.

helm upgrade mission-control jfrog/mission-control

Stop the old Mission Control pod (scale down replicas to 0) (PostgreSQL remains in place).

$ kubectl scale statefulsets <OLD_RELEASE_NAME>-mission-control --replicas=0

Export data from the old PostgreSQL instance in the following way.

1. Connect to the old PostgreSQL pod (you can get the name by running kubectl get pods).

   $ kubectl exec -it <OLD_RELEASE_NAME>-postgresql bash

2. Copy the jfmcDataExport.sh file and run the following commands.

   $ kubectl cp ./jfmcDataExport.sh <OLD_RELEASE_NAME>-postgresql:/tmp/jfmcDataExport.sh
   $ chown postgres:postgres /tmp/jfmcDataExport.sh
   $ su postgres -c "PGPASSWORD=password bash /tmp/jfmcDataExport.sh --output=/tmp"
   if you are on 2x charts(operating system user postgres is not there) run ./jfmcDataExport.sh --output=/tmp and provide jfmc user password
   

3. Copy the exported file to your local system.

   $ kubectl cp <OLD_RELEASE_NAME>-postgresql:/tmp/jfmcDataExport.tar.gz ./jfmcDataExport.tar.gz

Install the new Mission Control and copy the exported file.

1. Run the helm install with the new version called mission-control-new.

2. Copy the exported tar file to the new Mission Control pod.

   $ kubectl cp ./jfmcDataExport.tar.gz <NEW_RELEASE_NAME>-mission-control:/opt/jfrog/mc/var/bootstrap/mc/jfmcDataExport.tar.gz -c mission-control

3. Restart the new Mission Control pod.

4. Validate that the import was successful. The filename should be renamed to jfmcDataExport.tar.gz.done (it will be renamed to jfmcDataExport.tar.gz.failed if the import procedure failed).

Run the following command to remove the old Mission Control deployment and Helm release.

helm delete <OLD_RELEASE_NAME>

Access Mission-Control from your browser at: http://<jfrogUrl>/ui/, then go to the Security & Compliance tab in the Application module in the UI.

Check the status of your deployed Helm releases.

helm status mission-control

Mission Control should now be available.