SmartCloud Orchestrator 2.3 FP1 IFIX3 (2.3.0.1-CSI-ISCO-IF0003)

Fix readme


Abstract

IBM SmartCloud Orchestrator 2.3.0 Fix Pack 1 IFIX3 (2.3.0.1-CSI-ISCO-IF0003) is available. This is the README file for the release.

Content

Licensed Materials - Property of IBM
Copyright IBM Corp. 2008,2014 All Rights Reserved.
US Government Users Restricted Rights - Use, duplication or
disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

PRODUCT : IBM SmartCloud Orchestrator
IFIX 3: 2.3.0.1-CSI-ISCO-IF0003
RELEASE : v2.3.0
LAST UPDATE : 2014/06/24


============================================================================
Table of Contents
============================================================================

I. FIX
II. PREREQUISITES
III. INSTALLATION INSTRUCTIONS
IV. MANUAL STEPS FOR NON-STANDARD SCO INSTALLATION
V. KNOWN DEFECTS OR LIMITATIONS
VI. ADDITIONAL INFORMATION

You should print and read this document and all associated references
before applying this maintenance package. The online page where this
package was downloaded is the most up to date information and supersedes
all other versions of this document.

I. FIX

This iFix has been issued to address software issues related to the SmartCloud Orchestrator product.

It supersedes the previous SmartCloud Orchestrator 2.3.0.1 iFixes 2.3.0.1-CSI-ISCO-IF0001 and
2.3.0.1-CSI-ISCO-IF0002. It also supersedes 2.3.0.1-CSI-ISCO LA fixes LA0001 to LA0006.


The following issues are addressed by this iFix:

APARs & Defects
-------------------
APAR ZZ00236 - Image not being discovered by VIL (2.3.0.1-CSI-ISCO-IF0002)
APAR ZZ00240 - authentication error CTJCO0004E occurs in the self-service UI when users do not work in their default domain (2.3.0.1-CSI-ISCO-LA0001)
APAR ZZ00201 - BPM Proxy does not handle multipart/form-data content type (2.3.0.1-CSI-ISCO-LA0002)
APAR ZZ00234 - Event-based orchestration goes into endless loop if vSys instance has no associated pattern (2.3.0.1-CSI-ISCO-LA0003)
APAR IT00875 - IWD fails to allocate a disk (2.3.0.1-CSI-ISCO-LA0005)
APAR IT01808/SE59154 - SCO attempts to delete the hypervisor if it is not available over the network.(2.3.0.1-CSI-ISCO-LA0005)
APAR SE59130 - SCO change flavor updates are not reflected in the SCO UI (2.3.0.1-CSI-ISCO-LA0005)
APAR IT01591 - Deployed Virtual Instances in VMware Region show as deleted (2.3.0.1-CSI-ISCO-LA0005)
APAR ZZ00223 - Improve error message to advise to check for encrypted disks (2.3.0.1-CSI-ISCO-LA0005)
APAR SE58917 - Special characters in Resource Pool Names cause VMware region install to fail (2.3.0.1-CSI-ISCO-LA0005)
PMR 72121,999,000 - Virtual System Instances unable to be managed.(2.3.0.1-CSI-ISCO-LA0005)
APAR ZZ00244 - ReturnParameters in SCOrchestrator Toolkit cannot handle large outputParameterObject (2.3.0.1-CSI-ISCO-LA0006)
APAR ZZ00246 - Bigger JSON Content in GenericRest call (100kb) does not work (2.3.0.1-CSI-ISCO-LA0006)
DEFECT 137472 - Support for vCenter 5.5 in VIL
APAR ZZ00233 - VIL checkout to vCenter fails
APAR IT01260 - "Forgot your password" does not work in SCO 2.3
APAR IT00519 - Increasing workload deployer default log level causes system failure
APAR IT02053 - SCO 2.3 Toolbar not showing for some VMs
APAR ZZ00204 - Indexing of image and check-out operations failed for domain user with dots
APAR ZZ00256 - SAAM can't get the running status of openstack services when SCO server OS locale is non-English
APAR SE58688 - KVM compute nodes are going offline and can't deploy any new patterns and VMs
APAR ZZ00169 - ICCT extension of AIX NIM image didn't run properly
APAR ZZ00242 - Config_network.sh does not work in a "real" environment
APAR SE59389 - SCE fails to deploy to vCenter 5.1 U2 or vCenter 5.5.
DEFECT 146765 - Bulk provisioning of vsys with NovaNotification enabled sometimes failed with 'No region information for vm <uuid>'
DEFECT 141765 - PDCollect does not collect fileserver logs and error.log

Security Vulnerabilities Addressed
--------------------------------------------------------------
- CVE-2014-0076 - OpenSSL could allow a local attacker to obtain sensitive information (2.3.0.1-CSI-ISCO-IF0001)
- CVE-2014-0160 - OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the TLS/DTLS heartbeat functionality
(2.3.0.1-CSI-ISCO-IF0001)
- CVE-2014-0411 - Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45 (2.3.0.1-CSI-ISCO-IF0002)
- CVE-2013-5802 - Unspecified vulnerability in Oracle Java SE related to the JAXP component (2.3.0.1-CSI-ISCO-IF0002)
- CVE-2013-5772 - Unspecified vulnerability in Oracle Java SE related to the jhat component (2.3.0.1-CSI-ISCO-IF0002)
- CVE-2014-0473 - Django cross-site request forgery
- CVE-2014-0474 - Django data injection
- CVE-2014-0472 - Django django.core.urlresolvers.reverse() code execution
- CVE-2014-0224 - OpenSSL is vulnerable to a man-in-the-middle attack
- CVE-2014-0221 - OpenSSL is vulnerable to a denial of service
- CVE-2014-0195 - OpenSSL is vulnerable to a buffer overflow
- CVE-2014-0198 - OpenSSL is vulnerable to a denial of service
- CVE-2010-5298 - OpenSSL is vulnerable to a denial of service
- CVE-2014-3470 - OpenSSL is vulnerable to a denial of service

II. PREREQUISITES

The following version of IBM SmartCloud Orchestrator must be installed:

SmartCloud Orchestrator 2.3.0 Fix Pack 1 or SmartCloud Orchestrator Enterprise 2.3.0 Fix Pack 1 with any of the officially released 2.3.0.1 iFixes OR LA fixes.

III. INSTALLATION INSTRUCTIONS


1) Stop SmartCloud Orchestrator on Central Server 1
Change to directory: /iaas/scorchestrator/
Stop SmartCloud Orchestrator: ./SCOrchestrator.py --stop
===>>> Stopping Smart Cloud Orchestrator
...
===>>> Stopping Smart Cloud Orchestrator complete

Wait until all components have stopped


2) Backup your SCO installation

Backup the Central Servers and Region Server virtual machines:

For VMware hosted virtual machines, see Taking Snapshots
http://pubs.vmware.com/vsphere-51/index.jsp?topic=/com.vmware.vsphere.vm_admin.doc/GUID-64B866EF-7636-401C-A8FF-2B4584D9CA72.html
for information about taking snapshots of the virtual machines.


3) Copy 2.3.0.1-CSI-ISCO-IF0003.tar on Central Server 1


4) Extract 2.3.0.1-CSI-ISCO-IF0003.tar in a directory of your choice by running the following command:
tar -xf 2.3.0.1-CSI-ISCO-IF0003.tar
cd 2.3.0.1-CSI-ISCO-IF0003

The following files are extracted:

SmartCloud_Orchestrator_2.3.0.1_IF0003.fxtag
helper.py
ifix3.py
2.3.0.1-CSI-ISCO-IF0002/
-ibm-java-i386-sdk-6.0-15.1.i386.rpm
-ICCT_Install_2.3.0.1-16.zip
-java664sr15fp1.py
-sce310_jre_linux_installer.bin
-was85javasdk64-ifpi08994.py
-ibm-java-x86_64-sdk-6.0-15.1.x86_64.rpm
-java632sr15fp1.py
-sce310java664sr15fp1.py
-SmartCloud_Orchestrator_2.3.0.1_IF0002.fxtag
IT00875_SE58917
-check_sum.txt
-il_proxy_install_package_23021.zip
-smartcloud-2013.1-1.1.4.ibm.201405091705.noarch.rpm
-IFIX_IWD_SCO2301_LA006_20140602-0115-622.tar
-iwd_fix.py
-vilp23021.py
-il_install_package_23021.zip
-smartcloud20131114201405091705.py
-vils23021.py
ZZ00201
-iwd0002_0006checksum.txt
-iwd0002_0006.py
-opt/ibm/rainmaker/purescale.app/private/expanded/ibm/maestro.util-4.0.0.1/lib/maestro.util.jar
ZZ00234
-automation.groovy
ZZ00240
-00_SCOrchestrator_Toolkit_2301_20140403_ifix1.twx
ZZ00244_ZZ00246
-plugin.com.ibm.orchestrator.rest-1.0.1.1.jar
scp-pdcollect
-Components_nonroot.xml
-Environment.xml
-Components.xml
-PDCOLLECT_Central_Server_Template.xml
ZZ00242
-config_network.sh
SE59389
-se59389_fix.py
-se59389_fix.tar.gz


5) Update the 64-bit Java installation used by the Business Process Manager on Central Server 4

- Please follow the instructions in security bulletin "Information regarding security vulnerability in
IBM SDK Java(TM) Technology Edition that is shipped with IBM WebSphere Application Server and
addressed by Oracle CPU January 2014" to install IBM WebSphere Application Server interim fixes
as appropriate for IBM WebSphere Application Server version used by Business Process Manager
under the following link:

http://www-01.ibm.com/support/docview.wss?uid=swg21665267

- Click on the following link in section "Remediation/Fixes" named
"Install IBM WebSphere Application Server interim fixes as appropriate
for your current IBM WebSphere Application Server version as described in
Security Bulletin: Multiple vulnerabilities in current IBM SDK for
Java for WebSphere Application Server January 2014 CPU"

http://www.ibm.com/support/docview.wss?uid=swg21663938

- In "Security Bulletin: Multiple vulnerabilities in current IBM SDK for Java for
WebSphere Application Server January 2014 CPU" click on link named "PI08994"
in section "For V8.5.0.0 through 8.5.5.1 Full Profile:"

http://www-01.ibm.com/support/docview.wss?uid=swg24036965

- In "PI08994: SHIP SDK 626 SR7 FP1 FOR WSAS V8.5.0.X AND V8.5.5.X" you need to download
the correct package (Linux+64-bit+x86+AMD/Intel+Java+SDK) by clicking the FC link
which lets you download the following package:

8.5.0.0-WS-WASJavaSDK-LinuxX64-IFPI08994.zip (98.17 MB)

- When downloaded, copy 8.5.0.0-WS-WASJavaSDK-LinuxX64-IFPI08994.zip to the installation
directory of iFix 2.3.0.1-CSI-ISCO-IF0003 on Central Server 1,
<your_ifix_path>/2.3.0.1-CSI-ISCO-IF0003/2.3.0.1-CSI-ISCO-IF0002/


6) Run the iFix installation script on Central Server 1

*WARNING* If your SCO 2.3.0.1 environment is not a standard installation, please refer to section IV for manual steps of this part.

- From the directory where you unpacked the iFix package, run the iFix installation script
by using the following command:

./ifix3.py --cs2=<cs2> --cs3=<cs3> --cs4=<cs4> --rs=<regionservers> --wasa=wasadmin --wasp=passw0rd

eg ./ifix3.py --cs2=10.10.0.12 --cs3=10.10.0.13 --cs4=10.10.0.14 --rs=10.10.0.15,10.10.0.16 --wasa=wasadmin --wasp=passw0rd

You can use ./ifix3.py -h to show the usage.
Options:
-h, --help show this help message and exit
--cs2=CS2 hostname/ip address of central server 2
--cs3=CS3 hostname/ip address of central server 3
--cs4=CS4 hostname/ip address of central server 4
--rs=RS list of hostnames/ip addresses of region servers format
server1,server2,server3,...
--wasa=WASADMIN virtual image library WAS administrator ID to be used
during the installation procedure
--wasp=WASPASSWORD virtual image library WAS administrator password


7) Upgrading the Image Construction and Composition Tool

- Upgrade the Image Construction and Composition Tool using the standard upgrade procedure or
using the silent upgrade procedure by following the steps under:

http://pic.dhe.ibm.com/infocenter/tivihelp/v48r1/topic/com.ibm.sco.doc_2.3/ICON/topics/cicn_upgradeoverview.html

- In step "Download and extract the compressed file to the computer where you want to upgrade or install
the Image Construction and Composition Tool fix pack" use ICCT_Install_2.3.0.1-16.zip

Note:
"If you are installing the 2.3.0.1-16 build of Image Construction and Composition Tool as upgrade, make sure to read the Security Bulletin
http://www.ibm.com/support/docview.wss?uid=swg21676062 and perform the Remediation/Fixes.

To remove the "Enablement Bundle for Virtual Applications and System Plugins on Windows" bundle from Image Construction and Composition Tool:
- log-in to Image Construction and Composition Tool UI
- navigate thru "Images and bundles" -> "Build and manage software bundles"
- select "Enablement Bundle for Virtual Applications and System Plugins on Windows"
- click on the red "X" on the right side of the window panel"

8) Start SmartCloud Orchestrator on Central Server 1

- Stop SmartCloud Orchestrator on Central Server 1 (to enable a clean start in the following step)
Change to directory: /iaas/scorchestrator/
Stop SmartCloud Orchestrator: ./SCOrchestrator.py --stop
===>>> Stopping Smart Cloud Orchestrator
...
===>>> Stopping Smart Cloud Orchestrator complete

Wait until all components have stopped

- Start SmartCloud Orchestrator on Central Server 1
Change to directory: /iaas/scorchestrator/
Start SmartCloud Orchestrator: ./SCOrchestrator.py --start

Wait until all components have started

9) Additional manual steps required to install fix for APAR ZZ00240.

Step (1). Copy the folder ZZ00240 to a directory of your choice where the BPM brower is being run from.

Step (2). Import toolkit SCOrchestrator_Toolkit provided by this fix

Logon to IBM Process Designer with admin/$your_smartcloud_passowrd

In Process Center, select tab Toolkits and click on toolkit SCOrchestrator_Toolkit

Check that SCOrchestrator_Toolkit version 2301_20140213 is the current version
(top in the stack below "Current")

Click on Toolkits and then on Import Toolkit

In the Import Toolkit dialog, click on Browse... and select 00_SCOrchestrator_Toolkit_2301_20140403_ifix1.twx
provided with this fix and click OK

Click the Import button in dialog Import Toolkit - Will be imported - SCOrchestrator_Toolkit - 2301-20140403_ifix1
and wait for the import to be finished

Click on toolkit SCOrchestrator_Toolkit

Check that SCOrchestrator_Toolkit version 2301_20140403_ifix1 is the current version
(top in the stack below "Current")


Step (3). Upgrade dependency of toolkit SCOrchestrator_Scripting_Utilities_Toolkit

In Process Center, click on Toolkits and click on SCOrchestrator_Scripting_Utilities_Toolkit

Check that SCOrchestrator_Scripting_Utilities_Toolkit version 2301_20140226 is the current version
(top in the stack below "Current")

Click on Manage and select check box "Allow users to update toolkit" to make the toolkit editable

Click on Snapshots and click on Open in Designer

In the tree view on the left hand, right-click the yellow triangle under TOOLKITS -
SCOrchestrator_Toolkit (2301_20140213) and select "Upgrade dependency to 2301_20140403_ifix1"

Check that the dependency changed to 2301_20140403_ifix1


Step (4). Create new snapshot of toolkit SCOrchestrator_Scripting_Utilities_Toolkit

In Process Center, click on Toolkits and click on SCOrchestrator_Scripting_Utilities_Toolkit

Click on Create New Snapshot

In the Create New Snapshot dialog, type in the following snapshot name:
2301_20140403_LA0001
Optionally provide an additional description

Click on Create

Check that SCOrchestrator_Scripting_Utilities_Toolkit version 2301_20140403_LA0001 is the
current version (top in the stack below "Current")


Step (5). Upgrade dependency of toolkit SCOrchestrator_Support_IaaS_Toolkit

In Process Center, click on Toolkits and click on SCOrchestrator_Support_IaaS_Toolkit

Check that SCOrchestrator_Support_IaaS_Toolkit version 2301_20140227 is the current version
(top in the stack below "Current")

Click on Manage and select check box "Allow users to update toolkit" to make the toolkit editable

Click on Snapshots and click on Open in Designer

In the tree view on the left hand, right-click the yellow triangle under TOOLKITS -
SCOrchestrator_Toolkit (2301_20140213) and select "Upgrade dependency to 2301_20140403_ifix1"

Check that the dependency changed to 2301_20140403_ifix1


Step (6). Create new snapshot of toolkit SCOrchestrator_Support_IaaS_Toolkit

In Process Center, click on Toolkits and click on SCOrchestrator_Support_IaaS_Toolkit

Click on Create New Snapshot

In the Create New Snapshot dialog, type in the following snapshot name:
2301_20140403_LA0001
Optionally provide an additional description

Click on Create

Check that SCOrchestrator_Support_IaaS_Toolkit version 2301_20140403_LA0001 is the
current version (top in the stack below "Current")


Step (7). Upgrade dependency of toolkit SCOrchestrator_Support_vSys_Toolkit

In Process Center, click on Toolkits and click on SCOrchestrator_Support_vSys_Toolkit

Check that SCOrchestrator_Support_vSys_Toolkit version 2301_20140310 is the current version
(top in the stack below "Current")

Click on Manage and select check box "Allow users to update toolkit" to make the toolkit editable

Click on Snapshots and click on Open in Designer

In the tree view on the left hand, right-click the yellow triangle under TOOLKITS -
SCOrchestrator_Toolkit (2301_20140227) and select "Upgrade dependency to 2301_20140403_ifix1"

Check that the dependency changed to 2301_20140403_ifix1

In the tree view on the left hand, right-click the yellow triangle under TOOLKITS -
SCOrchestrator_Support_IaaS_Toolkit (2301_20140227) and select "Upgrade dependency to 2301_20140403_LA0001"

Check that the dependency changed to 2301_20140403_LA0001


Step (8). Create new snapshot of toolkit SCOrchestrator_Support_vSys_Toolkit

In Process Center, click on Toolkits and click on SCOrchestrator_Support_vSys_Toolkit

Click on Create New Snapshot

In the Create New Snapshot dialog, type in the following snapshot name:
2301_20140403_LA0001
Optionally provide an additional description

Click on Create

Check that SCOrchestrator_Support_vSys_Toolkit version 2301_20140403_LA0001 is the
current version (top in the stack below "Current")


Step (9). Upgrade dependencies of toolkit TivSAM_Integration_Toolkit

In Process Center, click on Toolkits and click on TivSAM_Integration_Toolkit

Check that TivSAM_Integration_Toolkit version 2301_20140305 is the current version
(top in the stack below "Current")

Click on Manage and select check box "Allow users to update toolkit" to make the toolkit editable

Click on Snapshots and click on Open in Designer

In the tree view on the left hand, right-click the yellow triangle under TOOLKITS -
SCOrchestrator_Toolkit (2301_20140213) and select "Upgrade dependency to 2301_20140403_ifix1"

Check that the dependency changed to 2301_20140403_ifix1

In the tree view on the left hand, right-click the yellow triangle under TOOLKITS -
SCOrchestrator_Scripting_Utilities_Toolkit (2301_20140226) and select "Upgrade dependency to 2301_20140403_LA0001"

Check that the dependency changed to 2301_20140403_LA0001


Step (10). Create new snapshot of toolkit TivSAM_Integration_Toolkit

In Process Center, click on Toolkits and click on TivSAM_Integration_Toolkit

Click on Create New Snapshot

In the Create New Snapshot dialog, type in the following snapshot name:
2301_20140403_LA0001
Optionally provide an additional description

Click on Create

Check that TivSAM_Integration_Toolkit version 2301_20140403_LA0001 is the
current version (top in the stack below "Current")


Step (11). Upgrade dependencies of process app Sample_Support_Iaas_ProcessApp

In Process Center, click on Process Apps and click on Sample_Support_Iaas_ProcessApp

Check that Sample_Support_Iaas_ProcessApp version 2301_20140305 is the current version
(top in the stack below "Current")

Click on Open in Designer

In the tree view on the left hand, right-click the yellow triangle under TOOLKITS -
SCOrchestrator_Toolkit (2301_20140213) and select "Upgrade dependency to 2301_20140403_ifix1"

Check that the dependency changed to 2301_20140403_ifix1

In the tree view on the left hand, right-click the yellow triangle under TOOLKITS -
SCOrchestrator_Support_IaaS_Toolkit (2301_20140227) and select "Upgrade dependency to 2301_20140403_LA0001"

Check that the dependency changed to 2301_20140403_LA0001


Step (12). Upgrade dependencies of process app Sample_Support_vSys_ProcessApp

In Process Center, click on Process Apps and click on Sample_Support_vSys_ProcessApp

Check that Sample_Support_vSys_ProcessApp version 2301_20140310 is the current version
(top in the stack below "Current")

Click on Open in Designer

In the tree view on the left hand, right-click the yellow triangle under TOOLKITS -
SCOrchestrator_Toolkit (2301_20140213) and select "Upgrade dependency to 2301_20140403_ifix1"

Check that the dependency changed to 2301_20140403_ifix1

In the tree view on the left hand, right-click the yellow triangle under TOOLKITS -
SCOrchestrator_Support_IaaS_Toolkit (2301_20140227) and select "Upgrade dependency to 2301_20140403_LA0001"

Check that the dependency changed to 2301_20140403_LA0001

In the tree view on the left hand, right-click the yellow triangle under TOOLKITS -
SCOrchestrator_Support_vSys_Toolkit (2301_20140310) and select "Upgrade dependency to 2301_20140403_LA0001"

Check that the dependency changed to 2301_20140403_LA0001


Step (13). Upgrade dependencies of process app TSAMITK_SampleApp

In Process Center, click on Process Apps and click on TSAMITK_SampleApp

Check that TSAMITK_SampleApp version 2301_20140305 is the current version
(top in the stack below "Current")

Click on Open in Designer

In the tree view on the left hand, right-click the yellow triangle under TOOLKITS -
SCOrchestrator_Toolkit (2301_20140213) and select "Upgrade dependency to 2301_20140403_ifix1"

Check that the dependency changed to 2301_20140403_ifix1

In the tree view on the left hand, right-click the yellow triangle under TOOLKITS -
SCOrchestrator_Scripting_Utilities_Toolkit (2301_20140226) and select "Upgrade dependency to 2301_20140403_LA0001"

Check that the dependency changed to 2301_20140403_LA0001

In the tree view on the left hand, right-click the yellow triangle under TOOLKITS -
SCOrchestrator_Integration_Toolkit (2301_20140305) and select "Upgrade dependency to 2301_20140403_LA0001"

Check that the dependency changed to 2301_20140403_LA0001

Please repeat the above described procedure for every toolkit or process application in your process centre.

Step (14). Upgrade REST endpoint in database

Logon to Central-Server-1

su - db2inst1
db2 connect to BPMDB
db2 set schema bpmuser
db2 "select guid,substr(default_value,1,29) as default_value,last_modified from lsw_env_var where name='restEndpoint'"

You should see one entry where default value is equals to https://localhost

Update this entry:
db2 "update LSW_ENV_VAR set default_value='https://<Central-Server-3-IP>' where name = 'restEndpoint' and default_value='https://localhost'"

Double-check that the update was successful:

db2 "select guid,substr(default_value,1,29) as default_value,last_modified from lsw_env_var where name='restEndpoint'"

db2 commit
db2 connect reset

Stop/Start the BPM admin server on Central-Server-4
/opt/ibm/BPM/v8.5/profiles/Node1Profile/bin/stopServer.sh SingleClusterMember1
/opt/ibm/BPM/v8.5/profiles/Node1Profile/bin/startServer.sh SingleClusterMember1

10) Apply fix for APAR ZZ00256.

If your SCO server OS locale is non-English, please perform the following steps to return the correct status of openstack services to SAAM.

On each of the SCO servers (Central-servers, region-servers and KVM compute nodes), find the file 'openstack-servicectrl.sh' in '/home/saam/' or '/home/ <yourmechid>/root/'.

(1) make a backup of openstack-servicectrl.sh
(2) edit 'openstack-servicectrl.sh',

Modify the line
CTRL_CMD="/sbin/service $SERVICE_ID"

to
CTRL_CMD="/etc/init.d/${SERVICE_ID}"
LANG=C

(3) check the output of openstack-servicectrl.sh and ensure it can get the correct status of openstack services.

For example, on central-server 2 run:

$ LANG=C /etc/init.d/openstack-keystone status
keystone (pid 2817) is running...

$ ./openstack-servicectrl.sh openstack-keystone status
root: openstack-servicectrl.sh (28621): openstack-keystone status monitor detected openstack-keystone online.

11) Apply fix for APAR SE58688 - KVM nodes going offline

KVM compute nodes are going offline and can't deploy any new patterns and VMs.
This is a bug of openstack https://bugs.launchpad.net/oslo/+bug/1211338.

On each kvm region server and compute node, backup the file /usr/lib/python2.6/site-packages/nova/openstack/common/rpc/impl_qpid.py
Then change it as bellow.
find the words:
{"type": "Direct"}
modify it to:
{"type": "direct"}

12) Apply fix for ZZ00242 on Central Server 1.

(1) backup file config_network.sh in $your_sco_install_media/installer/scripts/

(2) Update config_network.sh with the one in folder 2.3.0.1-CSI-ISCO-IF0003/ZZ00242

13) Apply fix for the DB2 PSIRT issue.

(1) downloading the DB2 fix pack

In order to address security vulnerabilities CVE-2013-6747 and CVE-2014-0963, the steps described in security bulletin here http://www-01.ibm.com/support/docview.wss?uid=swg21675724 should be implemented.

Clicking the above link brings you to:
"Security Bulletin: Security vulnerabilities have been identified in IBM® DB2® shipped with SmartCloud Orchestrator (CVE-2013-6747, CVE-2014-0963)"

From here click:
"IBM® DB2® is impacted by multiple TLS/SSL security vulnerabilities (CVE-2013-6747, CVE-2014-0963)"
Which brings you to:
http://www-01.ibm.com/support/docview.wss?uid=swg21671732

From here click:
"http://www.ibm.com/support/docview.wss?uid=swg24037557"
Note: This is for version V10.1 FP3a - if you have already upgraded DB2, select the version that matches your environment.
Which brings you to:
"DB2 Version 10.1 Fix Pack 3a for Linux, UNIX, and Windows"

Under the section "Download fix pack images per operating system" expand "Linux 64-bit, x86-64 on AMD64 and Intel EM64T"
Click "DB2 Server Fix Pack"
This brings you to Fix Central and "interim fix: DB2-linuxx64-server-10.1.0.3-FP003a"
Check the box and click Continue
Login to Fix Central if prompted
Under "Download files using https" you will be able to download:
v10.1fp3a_linuxx64_server.tar.gz (733 MB)

(2) Installing the DB2 fix pack on Central Server 1 and each Region Servers (if shared DB is not used)

Ensure the SCO processes have been stopped using SCOrchestrator.py stop as outlined in section III step 1 above
Note: The output of the command /iaas/scorchestrator/SCOrchestrator.py will list the servers that are running DB2. Update each of these servers, starting with central-server-1 and then moving on to each region server.

Perform following steps to install the DB2 fix.
<1> Copy the fix pack to central server 1 to a folder of your choice <db2fixpack>
<2> As user db2inst1 stop DB2 and DAS:
db2stop
/opt/ibm/db2/v10.1/das/bin/db2admin stop
<3> As user root extract and install the DB2 fix pack
cd <db2fixpack>
tar zxvf v10.1fp3a_linuxx64_server.tar.gz
cd server
./installFixPack -n -b /opt/ibm/db2/v10.1 -f db2lib
Please wait for the install to complete.

<4> Re-run the install command to verify the fix pack has been applied
./installFixPack -n -b /opt/ibm/db2/v10.1/ -f db2lib

Need to repeat the steps above on each Region Server which uses standalone DB2.

IV. MANUAL STEPS FOR NON-STANDARD SCO INSTALLATION

*WARNING*
If your SCO 2.3.0.1 environment is not a standard installation, then these manual steps may be followed instead of running the script ifix3.py in step 6) of section III.
If you ran the script ifix3.py and it completed successfully then the steps in this section may be skipped.

----------------------------------------------------------------------------
-1. Manual steps to upgrade Java for SCO.
----------------------------------------------------------------------------
Note: the required packages can be found in folder 'SmartCloud_Orchestrator_2.3.0.1_IF0003/2.3.0.1-CSI-ISCO-IF0002/' where your extract the IFIX.

(1) Update the Java 64-bit installation on Central Server 1

- Check that the current version is Java 6 SR10:
/opt/ibm/java-x86_64-60/bin/java -fullversion
java full version "JRE 1.6.0 IBM Linux build pxa6460sr10-20111208_01 (SR10)"

- Update to Java 6 SR15 if not already installed:
yum localupdate ibm-java-x86_64-sdk-6.0-15.1.x86_64.rpm
...
Updated:
ibm-java-x86_64-sdk.x86_64 0:6.0-15.1

Complete!

- Check that the updated version is Java 6 SR15 FP1:
/opt/ibm/java-x86_64-60/bin/java -fullversion
java full version "JRE 1.6.0 IBM Linux build pxa6460sr15fp1-20140110_01 (SR15 FP1)"

(2) Update the Java 64-bit installation on Central Server 2 (used by Public Cloud Gateway)

- Check that the current version is Java 6 SR10:
/opt/ibm/java-x86_64-60/bin/java -fullversion
java full version "JRE 1.6.0 IBM Linux build pxa6460sr10-20111208_01 (SR10)"

- Copy ibm-java-x86_64-sdk-6.0-15.1.x86_64.rpm to Central Server 2,
in a directory of your choice.

- Update to Java 6 SR15 if not already installed:
yum localupdate ibm-java-x86_64-sdk-6.0-15.1.x86_64.rpm
...
Updated:
ibm-java-x86_64-sdk.x86_64 0:6.0-15.1

Complete!

- Check that the updated version is Java 6 SR15 FP1:
/opt/ibm/java-x86_64-60/bin/java -fullversion
java full version "JRE 1.6.0 IBM Linux build pxa6460sr15fp1-20140110_01 (SR15 FP1)"

(3) Update the Java 64-bit installation on Central Server 3 (used by SCUI)

- Check that the current version is Java 6 SR10:
/opt/ibm/java-x86_64-60/bin/java -fullversion
java full version "JRE 1.6.0 IBM Linux build pxa6460sr10-20111208_01 (SR10)"

- Copy ibm-java-x86_64-sdk-6.0-15.1.x86_64.rpm to Central Server 3,
in a directory of your choice.

- Update to Java 6 SR15 if not already installed:
yum localupdate ibm-java-x86_64-sdk-6.0-15.1.x86_64.rpm
...
Updated:
ibm-java-x86_64-sdk.x86_64 0:6.0-15.1

Complete!

- Check that the updated version is Java 6 SR15 FP1:
/opt/ibm/java-x86_64-60/bin/java -fullversion
java full version "JRE 1.6.0 IBM Linux build pxa6460sr15fp1-20140110_01 (SR15 FP1)"

(4) Update the Java 32-bit installation on Central Server 3 (used by IBM Workload Deployer)

- Check that the current version is Java 6 SR9 FP3:
/opt/ibm/java-i386-60/bin/java -fullversion
java full version "JRE 1.6.0 IBM Linux build pxi3260sr9fp3-20111122_05 (SR9 FP3)"

- Copy ibm-java-i386-sdk-6.0-15.1.i386.rpm to Central Server 3,
in a directory of your choice.

- Update to Java 6 SR15 if not already installed:
yum localupdate ibm-java-i386-sdk-6.0-15.1.i386.rpm
...
Updated:
ibm-java-i386-sdk.i386 0:6.0-15.1

Complete!

- Check that the updated version is Java 6 SR15 FP1:
/opt/ibm/java-i386-60/bin/java -fullversion
java full version "JRE 1.6.0 IBM Linux build pxi3260sr15fp1-20140110_01 (SR15 FP1)"

- Copy new security (unrestricted) policy files
cp /opt/ibm/java-i386-60/demo/jce/policy-files/unrestricted/*.jar /opt/ibm/java-i386-60/jre/lib/security/

(5) Update the 64-bit Java installation used by the Business Process Manager on Central Server 4

- Please follow the instructions in security bulletin "Information regarding security vulnerability in
IBM SDK Java(TM) Technology Edition that is shipped with IBM WebSphere Application Server and
addressed by Oracle CPU January 2014" to install IBM WebSphere Application Server interim fixes
as appropriate for IBM WebSphere Application Server version used by Business Process Manager
under the following link:

http://www-01.ibm.com/support/docview.wss?uid=swg21665267

- Click on the following link in section "Remediation/Fixes" named
"Install IBM WebSphere Application Server interim fixes as appropriate
for your current IBM WebSphere Application Server version as described in
Security Bulletin: Multiple vulnerabilities in current IBM SDK for
Java for WebSphere Application Server January 2014 CPU"

http://www.ibm.com/support/docview.wss?uid=swg21663938

- In "Security Bulletin: Multiple vulnerabilities in current IBM SDK for Java for
WebSphere Application Server January 2014 CPU" click on link named "PI08994"
in section "For V8.5.0.0 through 8.5.5.1 Full Profile:"

http://www-01.ibm.com/support/docview.wss?uid=swg24036965

- In "PI08994: SHIP SDK 626 SR7 FP1 FOR WSAS V8.5.0.X AND V8.5.5.X" you need to download
the correct package (Linux+64-bit+x86+AMD/Intel+Java+SDK) by clicking the FC link
which lets you download the following package:

8.5.0.0-WS-WASJavaSDK-LinuxX64-IFPI08994.zip (98.17 MB)

- When downloaded, copy 8.5.0.0-WS-WASJavaSDK-LinuxX64-IFPI08994.zip to the Central Server 4,
in a directory of your choice.

- Check that the current version is Java 6 SR5 IFX:
/opt/ibm/BPM/v8.5/java/jre/bin/java -fullversion
java full version "JRE 1.6.0 IBM Linux build pxa6460_26sr5ifx-20130301_01 (SR5)"

- Make sure Business Process Manager is stopped on Central Server 4
by running the following command:

service bpm status
root: bpm-dmgr (14603): ::: bpm-dmgr status monitor detected bpm-dmgr OFFLINE.
root: bpm-node (14624): ::: bpm-node status monitor detected bpm-node OFFLINE.
root: bpm-server (14645): ::: bpm-server status monitor detected bpm-server OFFLINE.

- Stop Business Process Manager on Central Server 4 if not already stopped
by running the following command (wait for services to stop and confirm with
service bpm status afterwards):

service bpm stop

- Update to SR7 FP1, if not already installed, by installing the
BPM WAS Java patch 8.5.0.0-WS-WASJavaSDK-LinuxX64-IFPI08994.zip
/opt/IBM/InstallationManager/eclipse/tools/imcl install 8.5.0.0-WS-WASJavaSDK-LinuxX64-IFPI08994
-installationDirectory /opt/ibm/BPM/v8.5 -repositories <full path to the l5ocation of zip file>

For example, if the zip file is in /root:
/opt/IBM/InstallationManager/eclipse/tools/imcl install 8.5.0.0-WS-WASJavaSDK-LinuxX64-IFPI08994
-installationDirectory /opt/ibm/BPM/v8.5 -repositories /root/8.5.0.0-WS-WASJavaSDK-LinuxX64-IFPI08994.zip

Installed 8.5.0.0-WS-WASJavaSDK-LinuxX64-IFPI08994_8.5.0.20140204_1517 to the /opt/ibm/BPM/v8.5 directory.

- Check that the updated version is Java 6 SR7 FP1:
/opt/ibm/BPM/v8.5/java/jre/bin/java -fullversion
java full version "JRE 1.6.0 IBM Linux build pxa6460_26sr7fp1-20140110_01 (SR7 FP1)"


(6) Update the 64-bit Java installation used by SmartCloud Entry on each VMware Region Server

- Make sure SmartCloud Entry is stopped on each VMware Region Server
by running the following command:

service sce status
IBM SmartCloud Entry is stopped

- Copy sce310_jre_linux_installer.bin to the VMware Region Server,
in a directory of your choice.

- Update to Java 6 SR15 from the sce310_jre_linux_installer.bin downloaded directory:

./sce310_jre_linux_installer.bin

Preparing to install...
Extracting the JRE from the installer archive...
Unpacking the JRE...
Extracting the installation resources from the installer archive...
Configuring the installer for this system's environment...

Launching installer...

===============================================================================
Choose Locale...
----------------

1- Deutsch
->2- English
...

CHOOSE LOCALE BY NUMBER:
===============================================================================
(created with InstallAnywhere)
-------------------------------------------------------------------------------

Preparing CONSOLE Mode Installation...

===============================================================================
Introduction
------------

InstallAnywhere will guide you through the JRE (Java Runtime Environment)
update for IBM SmartCloud Entry.

The JRE version of this update is 1.6.0-SR15 FP1.

It is strongly recommended that you quit all programs before continuing with
this installation.

Respond to each prompt to proceed to the next step in the installation. If you
want to change something on a previous step, type 'back'.

You may cancel this installation at any time by typing 'quit'.

PRESS <ENTER> TO CONTINUE:

===============================================================================
License Agreement
-----------------

Installation and use of IBM SmartCloud Entry JRE Update requires acceptance of
the following License Agreement:

International Program License Agreement

...

DO YOU ACCEPT THE TERMS OF THIS LICENSE AGREEMENT? (Y/N): Y

===============================================================================
IBM SmartCloud Entry Install Locations
--------------------------------------

The following IBM SmartCloud Entry installation locations require the JRE
version to be updated to version 1.6.0-SR15 FP1.

Select the install location to proceed with the JRE update.

->1- /opt/ibm/SCE31

ENTER THE NUMBER FOR YOUR CHOICE, OR PRESS <ENTER> TO ACCEPT THE DEFAULT::

===============================================================================
Pre-Installation Summary
------------------------

Please review the following information before continuing:

Installation folder:
/opt/ibm/SCE31

Product selected for update:
IBM SmartCloud Entry 3.1

Current JRE version:
1.6.0-SR13

Update JRE version:
1.6.0-SR15 FP1

PRESS <ENTER> TO CONTINUE:

===============================================================================
Ready To Install
----------------

InstallAnywhere is now ready to update the JRE version of IBM SmartCloud Entry
3.1 at the following installation location:

/opt/ibm/SCE31

PRESS <ENTER> TO INSTALL:

===============================================================================
Installing...
-------------

[==================|==================|==================|==================]
[------------------|------------------|------------------|------------------]

===============================================================================
Installation Complete
---------------------

Congratulations. The IBM SmartCloud Entry JRE update installed successfully at
the following location:

/opt/ibm/SCE31

PRESS <ENTER> TO EXIT THE INSTALLER:


- Check that the updated Java version used by SmartCloud Entry is Java 6 SR15 FP1:
/opt/ibm/SCE31/jre/bin/java -fullversion
java full version "JRE 1.6.0 IBM Linux build pxa6460sr15fp1-20140110_01 (SR15 FP1)"

----------------------------------------------------------------------------
-2. Manual steps to install fix on each VMware Region Server
----------------------------------------------------------------------------
This fix is dedicated for SCO 2.3.0.1 openstack-smartcloud component.
Note: If you already install the fix '2.3.0.1-CSI-ISCO-LA0004', please skip this step.
You can check your openstack-smartcloud version with command:
$ rpm -qa|grep smartcloud
smartcloud-2013.1-1.1.4.ibm.201405091705.noarch

Step 1. copy the file 2.3.0.1-CSI-ISCO-IF0003/IT00875_SE58917/smartcloud-2013.1-1.1.4.ibm.201405091705.noarch.rpm to VMware Region Server <your path>
Step 2. on VMware Region Server, navigate to <your path> and install the fix:
$ cd <your path>
$ rpm -Uvh smartcloud-2013.1-1.1.4.ibm.201405091705.noarch.rpm
Step 3. restart openstack-smartcloud service:
service openstack-smartcloud restart
Step 4. check service openstack-smartcloud is up and running:
service openstack-smartcloud status

----------------------------------------------------------------------------
-3. Manual steps to upgrade Virtual Image Library (VIL) and VIL
distributed proxy components on Central Server 2 and each Region server.
----------------------------------------------------------------------------

Note: the required packages can be found in folder '2.3.0.1-CSI-ISCO-IF0003/IT00875_SE58917/' where your extract the IFIX.

Step 1. make sure VIL service and VIL proxy service are all stopped

(1)on Central Server 2, check vil service status by running the following command:

service vil status

If vil service is not stopped, run the following command to stop it.

service vil stop

(2)on each Region server, check vilProxy service status by running the following command:

service vilProxy status

If vilProxy service is not stopped, run the following command to stop it.

service vilProxy stop

Step 2. upgrade VIL proxy on each Region Server where it is installed:

(1)copy il_proxy_install_package_23021.zip to the Region Server, in a directory of your choice.

(2)unpack il_proxy_install_package_23021.zip into a temporary directory <your_path>:

unzip il_proxy_install_package_23021.zip -d <your_path>

(3)navigate to <your_path> and upgrade Virtual Image Library proxy by running the following script:

cd <your_path>
./install_vil.sh -proxy -vilServer <hostnameFqdn>

Where
vilServer: Specifies the fully qualified host name or the IP address of the Virtual
Image Library server (central-server-2).
If you specify the fully qualified host name of the Virtual Image Library
server, the proxy must be able to resolve that host name. If it cannot,
add the IP address and host name to /etc/hosts before installing the
proxy.


Step 3. upgrade VIL server and proxy on Central Server 2:

(1)copy il_install_package_23021.zip to Central Server 2, in a directory of your choice.

(2)unpack il_install_package_23021.zip into a temporary directory <your_path>:

unzip il_install_package_23021.zip -d <your_path>

(3)navigate to <your_path> and upgrade Virtual Image Library by running the following script:

cd <your_path>
./install_vil.sh -u wasadmin -p $smartcloud_password

Step 4. make sure VIL service and VIL proxy service are all started.

(1)on Central Server 2, check vil service status by running the following command:

service vil status

If vil service is not started, run the following command to start it.

service vil start

(2)on each Region server, check vilProxy service status by running the following command:

service vilProxy status

If vilProxy service is not started, run the following command to start it.

service vilProxy start

Step 5. Check that the updated Java version used by Virtual Image Library is Java 6 SR7 FP1:

/opt/IBM/WebSphere/AppServer/java/bin/java -fullversion
java full version "JRE 1.6.0 IBM Linux build pxi3260_26sr7fp1-20140110_01 (SR7 FP1)"

----------------------------------------------------------------------------
-4. Manual steps to apply the fixes on Central Server 3.
----------------------------------------------------------------------------
(1) Copy the following files from Central Server 1 to $your_folder on Central Server 3.

2.3.0.1-CSI-ISCO-IF0003/SmartCloud_Orchestrator_2.3.0.1_IF0003.fxtag
2.3.0.1-CSI-ISCO-IF0003/ZZ00234/automation.groovy
2.3.0.1-CSI-ISCO-IF0003/ZZ00244_ZZ00246/plugin.com.ibm.orchestrator.rest-1.0.1.1.jar
2.3.0.1-CSI-ISCO-IF0003/ZZ00201/opt/ibm/rainmaker/purescale.app/private/expanded/ibm/maestro.util-4.0.0.1/lib/maestro.util.jar
2.3.0.1-CSI-ISCO-IF0003/IT00875_SE58917/IFIX_IWD_SCO2301_LA006_20140602-0115-622.tar

(2) Stop IWD server on Central Server 3:
service iwd stop

(3) Inventory Tagging

cd $your_folder
cp SmartCloud_Orchestrator_2.3.0.1_IF0003.fxtag /opt/ibm/SmartCloud_Orchestrator/properties/version/ on Central-Server-3.
(if not present on Central-Server-3 create the directory)

(4) Backup the following files on Central Server 3:

mkdir -p /tmp/$your_backup
cd /tmp/$your_backup
cp --preserve /opt/ibm/rainmaker/purescale.app/private/expanded/ibm/maestro.util-4.0.0.1/lib/maestro.util.jar maestro.util.jar_ori
cp --preserve /opt/ibm/rainmaker/purescale.app/private/expanded/ibm/orchestrator.ui-4.0.0.1/app/resources/automation.groovy automation.groovy_ori
cp --preserve /drouter/ramdisk2/mnt/raid-volume/raid0/usr/servers/kernelservices/plugins/bundles/com.ibm.orchestrator.task/1.0.1.0 plugin.com.ibm.orchestrator.rest-1.0.1.1.jar plugin.com.ibm.orchestrator.rest-1.0.1.1.jar_ori

(5) Update the files on Central Server 3

cd $your_folder
cp -f maestro.util.jar /opt/ibm/rainmaker/purescale.app/private/expanded/ibm/maestro.util-4.0.0.1/lib/
cp -f automation.groovy /opt/ibm/rainmaker/purescale.app/private/expanded/ibm/orchestrator.ui-4.0.0.1/app/resources/
cp -f plugin.com.ibm.orchestrator.rest-1.0.1.1.jar /drouter/ramdisk2/mnt/raid-volume/raid0/usr/servers/kernelservices/plugins/bundles/com.ibm.orchestrator.task/1.0.1.0/

(6) Install fix IFIX_IWD_SCO2301_LA006_20140602-0115-622.tar

cd $your_folder
tar -xf IFIX_IWD_SCO2301_LA006_20140602-0115-622.tar
cd IFIX_IWD_SCO2301_LA006_20140602-0115-622
./install_fix.sh (Note: this need to be carry out in current path of install_fix.sh. For manual steps for the fix, please refer to README.txt)

(7) Start IWD server on Central Server 3:
service iwd start

----------------------------------------------------------------------------
-5. Manual steps to update pdcollect files on Central Server 1.
----------------------------------------------------------------------------
(1) Backup below files in '/iaas/pdcollect' on Central Server 1 (If you are using no-root pdcollect, please find the files in /home/<yourmechid>)
Components_nonroot.xml
Components.xml
Environment.xml
PDCOLLECT_Central_Server_Template.xml

(2) Update the files in /iaas/pdcollect with the ones in folder '2.3.0.1-CSI-ISCO-IF0003/scp-pdcollect/'

------------------------------------------------------------------------------------
-6. Manual steps to install fix for vCenter 5.5 support on each VMware Region Server.
------------------------------------------------------------------------------------
(1) Copy package '2.3.0.1-CSI-ISCO-IF0003/SE59389/se59389_fix.tar.gz' to the region server $your_folder.

(2) On VMware Region Server, extract the fix package:
cd $your_folder
tar -xf se59389_fix.tar.gz

(3) Ensure SCE service is stopped.
service sce status
If SCE service is running, stop it with below command.
service sce stop

(4) Backup some jar files:
cp /opt/ibm/SCE31/program/plugins/com.ibm.cfs.rest.client_3.1.0.0-201305131252.jar $your_folder/com.ibm.cfs.rest.client_3.1.0.0-201305131252.jar_orig
cp /opt/ibm/SCE31/program/plugins/com.ibm.cfs.rest.client_3.1.0.3.jar $your_folder/com.ibm.cfs.rest.client_3.1.0.3.jar_orig

(5) Update SCE jar files:
cp -pf com.ibm.cfs.rest.client_3.1.0.0-201305131252.jar /opt/ibm/SCE31/program/plugins/
cp -pf com.ibm.cfs.rest.client_3.1.0.3.jar /opt/ibm/SCE31/program/plugins/

(6) Start SCE service:
service sce start


V. KNOWN DEFECTS OR LIMITATIONS

VI. ADDITIONAL INFORMATION

For trademark attribution, visit the IBM Terms of Use web site (http://www.ibm.com/legal/us/).

Related information

Fix Central location for 2.3.0.1-CSI-ISCO-IF0003

Rate this page:

(0 users)Average rating

Document information


More support for:

IBM Cloud Orchestrator

Software version:

2.3

Operating system(s):

Platform Independent

Reference #:

1677236

Modified date:

2014-06-24

Translate my page

Machine Translation

Content navigation