/
Stage 9 - Upgrade Java JMX settings (1.8.0 -> 11.0.23)

Stage 9 - Upgrade Java JMX settings (1.8.0 -> 11.0.23)

Objective

Upgrade Java JMX settings from Java 1.8.0_X to 11.0.23

Prerequisites

Previous stages have been completed successfully.

Steps

  1. cd to the syndeia-cloud package’s bin directory:

    cd ~/syndeia-cloud-3.6-SP2/bin

  2. Run the Syndeia Cloud (SC) pre-setup script. This will port over the existing JMX settings and re-install the firewalld service definition for syndeia:

    ./syndeia-cloud-3.6_install_pre-setup.bash
bin$./syndeia-cloud-3.6_install_pre-setup.bash + shopt -s extglob + shopt -s globstar ++ readlink -f ./syndeia-cloud-3.6_install_pre-setup.bash + SC_version_parsed=/home/jdoe/syndeia-cloud-3.6-SP2.2024-09-11/bin/syndeia-cloud-3.6_install_pre-setup.bash + SC_version_parsed=/home/jdoe/syndeia-cloud-3.6-SP2.2024-09-11 + SC_version_parsed=3.6-SP2.2024-09-11 + SC_version=3.6-SP2.2024-09-11 + SC_build_ver=3.6-SP2 ++ uname + OS=Linux + [[ Linux =~ CYGWIN ]] + systemctl=systemctl + sudo=sudo + ln='ln -nfs' + [[ ! -v JAVA_HOME ]] +++ which java +++ alias +++ eval declare -f ++++ declare -f +++ /usr/bin/which --tty-only --read-alias --read-functions --show-tilde --show-dot java ++ readlink -f /usr/bin/java + JAVA_HOME=/usr/lib/jvm/java-11-openjdk-11.0.23.0.9-3.el8.x86_64/bin/java + [[ Linux =~ CYGWIN ]] + systemctl=systemctl + sudo=sudo + ln='ln -nfs' + [[ ! -v JAVA_HOME ]] +++ which java +++ alias +++ eval declare -f ++++ declare -f +++ /usr/bin/which --tty-only --read-alias --read-functions --show-tilde --show-dot java ++ readlink -f /usr/bin/java + JAVA_HOME=/usr/lib/jvm/java-11-openjdk-11.0.23.0.9-3.el8.x86_64/bin/java + [[ Linux =~ CYGWIN ]] + JAVA_HOME=/usr/lib/jvm/java-11-openjdk-11.0.23.0.9-3.el8.x86_64 + export JAVA_HOME + SC_upgrade=false + [[ -e /opt/icx/syndeia-cloud-current ]] + [[ Linux =~ CYGWIN ]] + sudo useradd --system --user-group syndeia-cloud + init_JMX_settings + [[ ! -d /usr/lib/jvm/java-11-openjdk-11.0.23.0.9-3.el8.x86_64/conf/management/ ]] + [[ false == \f\a\l\s\e ]] + JMX_monitoring_pw= + JMX_control_pw= + [[ -e /usr/lib/jvm/java-11-openjdk-11.0.23.0.9-3.el8.x86_64/conf/management/jmxremote.password.template ]] + sudo cp /usr/lib/jvm/java-11-openjdk-11.0.23.0.9-3.el8.x86_64/conf/management/jmxremote.password.template /usr/lib/jvm/java-11-openjdk-11.0.23.0.9-3.el8.x86_64/conf/management/jmxremote.password + read -e -p '- Enter a password for the monitoring JMX role (note, avoid any of the following special characters \?*[]+#&.{}$'\''" ): ' -i 'MYPw!' JMX_monitoring_pw - Enter a password for the monitoring JMX role (note, avoid any of the following special characters \?*[]+#&.{}$'" ): MYPw! + echo '' + read -e -p '- Enter a password for the control (debug) JMX role (note, avoid any of the following special characters \?*[]+#&.{}$'\''" ): ' -i 'MyDebugPw!' JMX_control_pw - Enter a password for the control (debug) JMX role (note, avoid any of the following special characters \?*[]+#&.{}$'" ): MyDebugPw! + echo '' + echo 'monitorRole MYPw!' + sudo tee -a /usr/lib/jvm/java-11-openjdk-11.0.23.0.9-3.el8.x86_64/conf/management/jmxremote.password monitorRole MYPw! + echo 'controlRole MyDebugPw!' + sudo tee -a /usr/lib/jvm/java-11-openjdk-11.0.23.0.9-3.el8.x86_64/conf/management/jmxremote.password controlRole MyDebugPw! + sudo egrep '^monitorRole |^controlRole ' /usr/lib/jvm/java-11-openjdk-11.0.23.0.9-3.el8.x86_64/conf/management/jmxremote.password controlRole MyDebugPw! + [[ ! Linux =~ CYGWIN ]] + sudo chown syndeia-cloud:syndeia-cloud /usr/lib/jvm/java-11-openjdk-11.0.23.0.9-3.el8.x86_64/conf/management/jmxremote.password + sudo chown syndeia-cloud:syndeia-cloud /usr/lib/jvm/java-11-openjdk-11.0.23.0.9-3.el8.x86_64/conf/management/jmxremote.access + sudo chmod u+rw,u-x,go-rwx /usr/lib/jvm/java-11-openjdk-11.0.23.0.9-3.el8.x86_64/conf/management/jmxremote.password + umask 0002 + sudo tee /etc/sudoers.d/syndeia-cloud + cd /home/jdoe/ + init_firewalld syndeia + service_definition=syndeia ++ which firewall-cmd ++ alias ++ eval declare -f +++ declare -f ++ /usr/bin/which --tty-only --read-alias --read-functions --show-tilde --show-dot firewall-cmd + [[ -e /usr/bin/firewall-cmd ]] + sudo cp /home/jdoe/syndeia-cloud-3.6-SP2.2024-09-11/conf/firewalld/syndeia.xml /etc/firewalld/services/. + sudo systemctl status firewalld ● firewalld.service - firewalld - dynamic firewall daemon Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled) Active: active (running) since Tue 2024-09-03 18:49:44 EDT; 34min ago Docs: man:firewalld(1) Main PID: 399 (firewalld) Tasks: 2 (limit: 102192) Memory: 55.6M CGroup: /system.slice/firewalld.service └─399 /usr/libexec/platform-python -s /usr/sbin/firewalld --nofork --nopid Sep 03 18:49:44 new-server.domain.tld systemd[1]: Starting firewalld - dynamic firewall daemon... Sep 03 18:49:44 new-server.domain.tld systemd[1]: Started firewalld - dynamic firewall daemon. Sep 03 18:49:44 new-server.domain.tld firewalld[399]: WARNING: AllowZoneDrifting is enabled. This is considered an insecure configuration option. It will be removed in a future release. Please consider disabling it now. + [[ 0 == 3 ]] + sudo firewall-cmd --reload success + sudo firewall-cmd --add-service=syndeia --permanent success + sudo firewall-cmd --reload success + sudo firewall-cmd --list-all public (active) target: default icmp-block-inversion: no interfaces: eth0 sources: services: cockpit dhcpv6-client ssh syndeia ports: protocols: forward: no masquerade: no forward-ports: source-ports: icmp-blocks: rich rules:

Note, during execution in an environment that needs an upgrade, you will not be prompted to set credentials for JMX monitoring. Instead, your existing JMX reader & read-write credentials will be ported from Java 8 to Java 11. If you do not wish to use JMX, you can do so pre or post-SC setup via the steps in Appendix C3.6).

Verification

  1. Verify JMX is configured correctly by checking passwords are set:

    JAVA_HOME=$(readlink -f $(which java)) JAVA_HOME=${JAVA_HOME%/bin/java} sudo egrep '^monitorRole |^controlRole ' "${JAVA_HOME}"/conf/management/jmxremote.password

  2. Check ownership and permissions are set correctly on the file by doing an ls -lah on it:

    ls -lah "${JAVA_HOME}"/conf/management/jmxremote.password

    … it should look like the below:

    -rw------- 1 syndeia-cloud syndeia-cloud 5.6K Jun 28 05:49 /usr/lib/jvm/java-11-openjdk-11.0.23.0.9-3.el8.x86_64/conf/management/jmxremote.password

  3. Make sure the default syndeia.xml firewalld service definition was applied by running the command below:

    sudo firewall-cmd --list-all

    Check that "syndeia" appears in the list of services next to services: in the output. See example below.

public (active) target: default icmp-block-inversion: no interfaces: eth0 sources: services: cockpit dhcpv6-client ssh syndeia ports: protocols: forward: no masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: