SmartCloud Orchestrator 2.3 FP1 IFIX2 (2.3.0.1-CSI-ISCO-IF0002)

Fix readme


Abstract

IBM SmartCloud Orchestrator 2.3.0 Fix Pack 1 IFIX2 (2.3.0.1-CSI-ISCO-IF0002) is available. This is the README file for the release.

Content

Licensed Materials - Property of IBM
Copyright IBM Corp. 2008,2014 All Rights Reserved.
US Government Users Restricted Rights - Use, duplication or
disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

PRODUCT : IBM SmartCloud Orchestrator
IFIX 2: 2.3.0.1-CSI-ISCO-IF0002
RELEASE : v2.3.0
DATE : 2014/05/06
LAST UPDATE : 2014/05/06


==================================================================
Table of Contents
==================================================================

I. FIX
II. PREREQUISITES
III. INSTALLATION INSTRUCTIONS
IV. KNOWN DEFECTS OR LIMITATIONS
V. ADDITIONAL INFORMATION

You should print and read this document and all associated references
before applying this maintenance package. The online page where this
package was downloaded is the most up to date information and supersedes
all other versions of this document.

I. FIX

This iFix has been issued to address security vulnerabilities related to the SmartCloud Orchestrator product.

Specifically:
- The JVMs of the product components have been upgraded to Java 6 SR15 FP1
- Websphere (WAS) interim fix 8.0.0.0-WS-WASJavaSDK-LinuxX32-IFPI08995 has been applied to the Virtual Image Library (VIL) component.

The following security vulnerabilities have been addressed.
- CVE-2014-0411 - Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45
- CVE-2013-5802 - Unspecified vulnerability in Oracle Java SE related to the JAXP component
- CVE-2013-5772 - Unspecified vulnerability in Oracle Java SE related to the jhat component

More details on the security vulnerabilities addressed are available in the security bulletins published here:

IBM SDK for Java for WebSphere Application Server January 2014 CPU
https://www.ibm.com/support/docview.wss?uid=swg21663938

IBM SDK Java(TM) Technology Edition Security Bulletin January 2014
http://www.ibm.com/support/docview.wss?uid=swg21662968

IBM SDK Java(TM) Technology Edition Security Bulletin October 2013
http://www.ibm.com/support/docview.wss?uid=swg21655201

This ifix also addresses the following APARs/defects:

APAR ZZ00236 - Image not being discovered by VIL


II. PREREQUISITES

The following version of IBM SmartCloud Orchestrator must be installed:

SmartCloud Orchestrator 2.3.0 Fix Pack 1 or SmartCloud Orchestrator Enterprise 2.3.0 Fix Pack 1.

III. INSTALLATION INSTRUCTIONS


1) Stop SmartCloud Orchestrator on Central Server 1
Change to directory: /iaas/scorchestrator/
Stop SmartCloud Orchestrator: ./SCOrchestrator.py --stop
===>>> Stopping Smart Cloud Orchestrator
...
===>>> Stopping Smart Cloud Orchestrator complete

Wait until all components have stopped


2) Backup your SCO installation

Backup the Central Servers and Region Server virtual machines:

For VMware hosted virtual machines, see Taking Snaphots
http://pubs.vmware.com/vsphere-51/index.jsp?topic=/com.vmware.vsphere.vm_admin.doc/GUID-64B866EF-7636-401C-A8FF-2B4584D9CA72.html
for information about taking snapshots of the virtual machines.


3) Copy 2.3.0.1-CSI-ISCO-IF0002.tgz on Central Server 1


4) Extract 2.3.0.1-CSI-ISCO-IF0002.tgz in a directory of your choice by running the following command:
tar zxvf 2.3.0.1-CSI-ISCO-IF0002.tgz

The following files are extracted:
SmartCloud_Orchestrator_2.3.0.1_IF0002.fxtag
ibm-java-x86_64-sdk-6.0-15.1.x86_64.rpm
ibm-java-i386-sdk-6.0-15.1.i386.rpm
ICCT_Install_2.3.0.1-14.zip
il_proxy_install_package.zip
il_install_package.zip
sce310_jre_linux_installer.bin


5) Inventory Tagging

To make it easier for support to find out which SmartCloud Orchestrator
fixes are installed on your system, copy some files to
/opt/ibm/SmartCloud_Orchestrator/properties/version/ on Central-Server-3.
(if not present on Central-Server-3 create the directory)

scp *.fxtag \
Central-Server-3:/opt/ibm/SmartCloud_Orchestrator/properties/version/


6) Update the Java 64-bit installation on Central Server 1

- Check that the current version is Java 6 SR10:
/opt/ibm/java-x86_64-60/bin/java -fullversion
java full version "JRE 1.6.0 IBM Linux build pxa6460sr10-20111208_01 (SR10)"

- Update to Java 6 SR15 if not already installed:
yum localupdate ibm-java-x86_64-sdk-6.0-15.1.x86_64.rpm
...
Updated:
ibm-java-x86_64-sdk.x86_64 0:6.0-15.1

Complete!

- Check that the updated version is Java 6 SR15 FP1:
/opt/ibm/java-x86_64-60/bin/java -fullversion
java full version "JRE 1.6.0 IBM Linux build pxa6460sr15fp1-20140110_01 (SR15 FP1)"


7) Update the Java 64-bit installation on Central Server 2 (used by Public Cloud Gateway)

- Check that the current version is Java 6 SR10:
/opt/ibm/java-x86_64-60/bin/java -fullversion
java full version "JRE 1.6.0 IBM Linux build pxa6460sr10-20111208_01 (SR10)"

- Copy ibm-java-x86_64-sdk-6.0-15.1.x86_64.rpm to Central Server 2,
in a directory of your choice.

- Update to Java 6 SR15 if not already installed:
yum localupdate ibm-java-x86_64-sdk-6.0-15.1.x86_64.rpm
...
Updated:
ibm-java-x86_64-sdk.x86_64 0:6.0-15.1

Complete!

- Check that the updated version is Java 6 SR15 FP1:
/opt/ibm/java-x86_64-60/bin/java -fullversion
java full version "JRE 1.6.0 IBM Linux build pxa6460sr15fp1-20140110_01 (SR15 FP1)"


8) Upgrade Virtual Image Library (VIL) and VIL distributed proxy components on Central Server 2

- Make sure VIL and VIL proxy is stopped on Central Server 2
by running the following command:

service vil status
Tomcat service not started [FAILED]
Hbase service not started [FAILED]
VilProxy service not started [FAILED]
ProxyAgent service not started [FAILED]
Redis service not started [FAILED]
WebSphere Application Server not started [FAILED]

- Stop VIL server and VIL proxy on Central Server 2 if not already stopped
by running the following command:

service vil stop

- Make sure VIL proxy is stopped on each Region server where it is installed
by running the following command:

service vilProxy status
Checking status vilProxy service...
vilProxy service not started [FAILED]
ProxyAgent service not started [FAILED]

- Stop VIL proxy on each Region Server where it is installed if not already stopped
by running the following command:

service vilProxy stop

- Upgrade VIL proxy on each Region Server where it is installed:

- Copy il_proxy_install_package.zip to the Region Server,
in a directory of your choice.

- Unpack the Virtual Image Library proxy installation package (il_proxy_install_package.zip)
into a temporary directory.

- From the directory where you unpacked the installation package, upgrade Virtual Image Library proxy
by running the following script:

./install_vil.sh -proxy -vilServer <hostnameFqdn>

where

- proxy Runs an installation of the distributed proxy component only on a
different machine than the Virtual Image Library server.

-vilServer Specifies the fully qualified host name or the IP address of the Virtual
Image Library server. To be used only together with the -proxy option.
If you specify th fully qualified host name of the Virtual Image Library
server, the proxy must be able to resolve that host name. If it cannot,
add the IP address and host name to /etc/hosts before installing the
proxy.


Tue Apr 22 09:38:55 EDT 2014: COPINS104I vilServer parameter is valid only for a new installation, so it is ignored.
_______________________________________________________________
CONFIGURATION CHECK
Yum repository
[Success]
_______________________________________________________________
UPGRADE STEPS
Check Virtual Image Library build level
[Success]
Install new RPM packages
[Success]
Stop Proxy
[Success]
Update analytics and rbagent components
[Success]
Update proxy
[Success]
Update Virtual Image Library scripts
[Success]
Start Proxy
[Success]

COPINS229I Proxy has been successfully upgraded from build level 23013 to 23017


- Upgrade VIL server and proxy on Central Server 2:

- Copy il_install_package.zip to Central Server 2, in a directory of your choice.

- Unpack the Virtual Image Library installation package (il_install_package.zip)
into a temporary directory.

- From the directory where you unpacked the installation package, upgrade Virtual Image Library
by running the following script:

./install_vil.sh -u was_admin_name -p was_admin_password

where

-u was_admin_name Specifies the Virtual Image Library Websphere administrator ID used during
the installation (For example, wasadmin). This parameter is required.
-p was_admin_password Specifies the Virtual Image Library Websphere administrator password. This
parameter is required.

Tue Apr 22 10:12:45 EDT 2014: COPINS103I Virtual Image Library is already installed, launching upgrade script.
Tue Apr 22 10:12:46 EDT 2014: COPINS201I The previous upgrade did not complete successfully.
_______________________________________________________________
CONFIGURATION CHECK
Yum repository
[Success]
_______________________________________________________________
UPGRADE STEPS
Check Virtual Image Library Server status
[Success]
Update ImageLibraryVMwareConnector.ear
[Success]
Update ImageLibraryOpenStackConnector.ear
[Success]
Update ImageLibraryVMControlConnector.ear
[Success]
Update ImageManager.ear
[Success]
Uninstall old OSSC RPM packages
[Success]
Install new RPM packages
[Success]
Update Virtual Image Library tables
[Success]
Stop Virtual Image Library server
[Success]
Install WebSphere Application Server Express iFix
[Success]
Update analytics and rbagent components
[Success]
Update proxy
[Success]
Update Virtual Image Library scripts
[Success]
Start Virtual Image Library server
[Success]
Set java heap size for WebSphere Application Server
[Success]
Install support for vSphere Client plug-in
[Success]
Register TAI for IAAS
[Success]
Restart Virtual Image Library Server
[Success]

COPINS214I Virtual Image Library has been successfully upgraded from build level 23013 to 23017.


- Check that the updated Java version used by Virtual Image Library is Java 6 SR7 FP1:
/opt/IBM/WebSphere/AppServer/java/bin/java -fullversion
java full version "JRE 1.6.0 IBM Linux build pxi3260_26sr7fp1-20140110_01 (SR7 FP1)"


9) Update the Java 64-bit installation on Central Server 3 (used by SCUI)

- Check that the current version is Java 6 SR10:
/opt/ibm/java-x86_64-60/bin/java -fullversion
java full version "JRE 1.6.0 IBM Linux build pxa6460sr10-20111208_01 (SR10)"

- Copy ibm-java-x86_64-sdk-6.0-15.1.x86_64.rpm to Central Server 3,
in a directory of your choice.

- Update to Java 6 SR15 if not already installed:
yum localupdate ibm-java-x86_64-sdk-6.0-15.1.x86_64.rpm
...
Updated:
ibm-java-x86_64-sdk.x86_64 0:6.0-15.1

Complete!

- Check that the updated version is Java 6 SR15 FP1:
/opt/ibm/java-x86_64-60/bin/java -fullversion
java full version "JRE 1.6.0 IBM Linux build pxa6460sr15fp1-20140110_01 (SR15 FP1)"


10) Update the Java 32-bit installation on Central Server 3 (used by IBM Workload Deployer)

- Check that the current version is Java 6 SR9 FP3:
/opt/ibm/java-i386-60/bin/java -fullversion
java full version "JRE 1.6.0 IBM Linux build pxi3260sr9fp3-20111122_05 (SR9 FP3)"

- Copy ibm-java-i386-sdk-6.0-15.1.i386.rpm to Central Server 3,
in a directory of your choice.

- Update to Java 6 SR15 if not already installed:
yum localupdate ibm-java-i386-sdk-6.0-15.1.i386.rpm
...
Updated:
ibm-java-i386-sdk.i386 0:6.0-15.1

Complete!

- Check that the updated version is Java 6 SR15 FP1:
/opt/ibm/java-i386-60/bin/java -fullversion
java full version "JRE 1.6.0 IBM Linux build pxi3260sr15fp1-20140110_01 (SR15 FP1)"

- Copy new security (unrestricted) policy files
cp /opt/ibm/java-i386-60/demo/jce/policy-files/unrestricted/*.jar /opt/ibm/java-i386-60/jre/lib/security/


11) Update the 64-bit Java installation used by the Business Process Manager on Central Server 4

- Please follow the instructions in security bulletin "Information regarding security vulnerability in
IBM SDK Java(TM) Technology Edition that is shipped with IBM WebSphere Application Server and
addressed by Oracle CPU January 2014" to install IBM WebSphere Application Server interim fixes
as appropriate for IBM WebSphere Application Server version used by Business Process Manager
under the following link:

http://www-01.ibm.com/support/docview.wss?uid=swg21665267

- Click on the following link in section "Remediation/Fixes" named
"Install IBM WebSphere Application Server interim fixes as appropriate
for your current IBM WebSphere Application Server version as described in
Security Bulletin: Multiple vulnerabilities in current IBM SDK for
Java for WebSphere Application Server January 2014 CPU"

http://www.ibm.com/support/docview.wss?uid=swg21663938

- In "Security Bulletin: Multiple vulnerabilities in current IBM SDK for Java for
WebSphere Application Server January 2014 CPU" click on link named "PI08994"
in section "For V8.5.0.0 through 8.5.5.1 Full Profile:"

http://www-01.ibm.com/support/docview.wss?uid=swg24036965

- In "PI08994: SHIP SDK 626 SR7 FP1 FOR WSAS V8.5.0.X AND V8.5.5.X" you need to download
the correct package (Linux+64-bit+x86+AMD/Intel+Java+SDK) by clicking the FC link
which lets you download the following package:

8.5.0.0-WS-WASJavaSDK-LinuxX64-IFPI08994.zip (98.17 MB)

- When downloaded, copy 8.5.0.0-WS-WASJavaSDK-LinuxX64-IFPI08994.zip to the Central Server 4,
in a directory of your choice.

- Check that the current version is Java 6 SR5 IFX:
/opt/ibm/BPM/v8.5/java/jre/bin/java -fullversion
java full version "JRE 1.6.0 IBM Linux build pxa6460_26sr5ifx-20130301_01 (SR5)"

- Make sure Business Process Manager is stopped on Central Server 4
by running the following command:

service bpm status
root: bpm-dmgr (14603): ::: bpm-dmgr status monitor detected bpm-dmgr OFFLINE.
root: bpm-node (14624): ::: bpm-node status monitor detected bpm-node OFFLINE.
root: bpm-server (14645): ::: bpm-server status monitor detected bpm-server OFFLINE.

- Stop Business Process Manager on Central Server 4 if not already stopped
by running the following command (wait for services to stop and confirm with
service bpm status afterwards):

service bpm stop

- Update to SR7 FP1, if not already installed, by installing the
BPM WAS Java patch 8.5.0.0-WS-WASJavaSDK-LinuxX64-IFPI08994.zip
/opt/IBM/InstallationManager/eclipse/tools/imcl install 8.5.0.0-WS-WASJavaSDK-LinuxX64-IFPI08994
-installationDirectory /opt/ibm/BPM/v8.5 -repositories <full path to the l5ocation of zip file>

For example, if the zip file is in /root:
/opt/IBM/InstallationManager/eclipse/tools/imcl install 8.5.0.0-WS-WASJavaSDK-LinuxX64-IFPI08994
-installationDirectory /opt/ibm/BPM/v8.5 -repositories /root/8.5.0.0-WS-WASJavaSDK-LinuxX64-IFPI08994.zip

Installed 8.5.0.0-WS-WASJavaSDK-LinuxX64-IFPI08994_8.5.0.20140204_1517 to the /opt/ibm/BPM/v8.5 directory.

- Check that the updated version is Java 6 SR7 FP1:
/opt/ibm/BPM/v8.5/java/jre/bin/java -fullversion
java full version "JRE 1.6.0 IBM Linux build pxa6460_26sr7fp1-20140110_01 (SR7 FP1)"


12) Update the 64-bit Java installation used by SmartCloud Entry on each VMware Region Server

- Make sure SmartCloud Entry is stopped on each VMware Region Server
by running the following command:

service sce status
IBM SmartCloud Entry is stopped

- Copy sce310_jre_linux_installer.bin to the VMware Region Server,
in a directory of your choice.

- Update to Java 6 SR15 from the sce310_jre_linux_installer.bin downloaded directory:

./sce310_jre_linux_installer.bin

Preparing to install...
Extracting the JRE from the installer archive...
Unpacking the JRE...
Extracting the installation resources from the installer archive...
Configuring the installer for this system's environment...

Launching installer...

===================================================================
Choose Locale...
----------------

1- Deutsch
->2- English
...

CHOOSE LOCALE BY NUMBER:
===================================================================
(created with InstallAnywhere)
-------------------------------------------------------------------

Preparing CONSOLE Mode Installation...

===================================================================
Introduction
------------

InstallAnywhere will guide you through the JRE (Java Runtime Environment)
update for IBM SmartCloud Entry.

The JRE version of this update is 1.6.0-SR15 FP1.

It is strongly recommended that you quit all programs before continuing with
this installation.

Respond to each prompt to proceed to the next step in the installation. If you
want to change something on a previous step, type 'back'.

You may cancel this installation at any time by typing 'quit'.

PRESS <ENTER> TO CONTINUE:

===================================================================
License Agreement
-----------------

Installation and use of IBM SmartCloud Entry JRE Update requires acceptance of
the following License Agreement:

International Program License Agreement

...

DO YOU ACCEPT THE TERMS OF THIS LICENSE AGREEMENT? (Y/N): Y

===================================================================
IBM SmartCloud Entry Install Locations
--------------------------------------

The following IBM SmartCloud Entry installation locations require the JRE
version to be updated to version 1.6.0-SR15 FP1.

Select the install location to proceed with the JRE update.

->1- /opt/ibm/SCE31

ENTER THE NUMBER FOR YOUR CHOICE, OR PRESS <ENTER> TO ACCEPT THE DEFAULT::

===================================================================
Pre-Installation Summary
------------------------

Please review the following information before continuing:

Installation folder:
/opt/ibm/SCE31

Product selected for update:
IBM SmartCloud Entry 3.1

Current JRE version:
1.6.0-SR13

Update JRE verson:
1.6.0-SR15 FP1

PRESS <ENTER> TO CONTINUE:

================================================================
Ready To Install
----------------

InstallAnywhere is now ready to update the JRE version of IBM SmartCloud Entry
3.1 at the following installation location:

/opt/ibm/SCE31

PRESS <ENTER> TO INSTALL:

=================================================================
Installing...
-------------

[==================|==================|==================|========]
[------------------|------------------|------------------|--------]

===================================================================
Installation Complete
---------------------

Congratulations. The IBM SmartCloud Entry JRE update installed successfully at
the following location:

/opt/ibm/SCE31

PRESS <ENTER> TO EXIT THE INSTALLER:


- Check that the updated Java version used by SmartCloud Entry is Java 6 SR15 FP1:
/opt/ibm/SCE31/jre/bin/java -fullversion
java full version "JRE 1.6.0 IBM Linux build pxa6460sr15fp1-20140110_01 (SR15 FP1)"


13) Upgrading the Image Construction and Composition Tool

- Upgrade the Image Construction and Composition Tool using the standard upgrade procedure or
using the silent upgrade procedure by following the steps under:

http://pic.dhe.ibm.com/infocenter/tivihelp/v48r1/topic/com.ibm.sco.doc_2.3/ICON/topics/cicn_upgradeoverview.html

- In step "Download and extract the compressed file to the computer where you want to upgrade or install
the Image Construction and Composition Tool fix pack" use ICCT_Install_2.3.0.1-14.zip


14) Start SmartCloud Orchestrator on Central Server 1

- Stop SmartCloud Orchestrator on Central Server 1 (to enable a clean start in the following step)
Change to directory: /iaas/scorchestrator/
Stop SmartCloud Orchestrator: ./SCOrchestrator.py --stop
===>>> Stopping Smart Cloud Orchestrator
...
===>>> Stopping Smart Cloud Orchestrator complete

Wait until all components have stopped

- Start SmartCloud Orchestrator on Central Server 1
Change to directory: /iaas/scorchestrator/
Start SmartCloud Orchestrator: ./SCOrchestrator.py --start

Wait until all components have started


IV. KNOWN DEFECTS OR LIMITATIONS

None

V. ADDITIONAL INFORMATION

For trademark attribution, visit the IBM Terms of Use web site (http://www.ibm.com/legal/us/).

Related information

Fix central location for 2.3.0.1-CSI-ISCO-IF0002

Rate this page:

(0 users)Average rating

Document information


More support for:

IBM Cloud Orchestrator

Software version:

2.3

Operating system(s):

Platform Independent

Reference #:

1672414

Modified date:

2014-05-07

Translate my page

Machine Translation

Content navigation