IBM Verify

IBM Verify

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Expand all | Collapse all

Docker ISAM 9.0.7.2_IF3 image to ISVA 10.0.3.0 / 10.0.3.1 lightweight images upgrade issues

  • 1.  Docker ISAM 9.0.7.2_IF3 image to ISVA 10.0.3.0 / 10.0.3.1 lightweight images upgrade issues

    Posted Mon March 21, 2022 09:36 AM
    Hello Everyone.

    We are getting issues to upgrade our docker ISAM 9.0.7.2_IF3  image to ISVA 10.0.3.1 lightweight images.

    In ISAM we use only one image to run one config container and 3 service containers(runtime, dsc & wrp)

    while upgrading to ISVA 10.0.3.1, plan to use lightweight images so we create one more container to run the snapshotmgr image,

    snapshotmgr service -> ibmcom/verify-access-snapshotmgr:10.0.3.0
    configuration service -> ibmcom/verify-access:10.0.3.0
    runtime service -> ibmcom/verify-access-runtime:10.0.3.0
    dsc service -> ibmcom/verify-access-dsc:10.0.3.0
    reverse-proxy service -> ibmcom/verify-access-wrp:10.0.3.0

    after we stop then remove old ISAM containers, we create and start new ISVA containers,

    We did see the ISVA config container successfully converted the old ISAM snapshot to ISVA snapshot and also successfully auto POST to snapshotmgr container after a while. but the rest of 3 service containers(runtime/dsc/wrp) not able to startup for a long time,
    so we check the snapshotmgr container logs and find http 404 get error from the 3 containers:
    172.24.0.5 - - [13/Mar/2022 04:14:12] "GET /snapshots/isva_10.0.3.0_published.snapshot?type=File&client=isvareverseproxy HTTP/1.1" 404 -
    172.24.0.6 - - [13/Mar/2022 04:14:12] code 404, message File not found
    172.24.0.6 - - [13/Mar/2022 04:14:12] "GET /snapshots/isva_10.0.3.0_published.snapshot?type=File&client=isvaruntime HTTP/1.1" 404 -
    172.24.0.2 - - [13/Mar/2022 04:14:13] code 404, message File not found
    172.24.0.2 - - [13/Mar/2022 04:14:13] "GET /snapshots/isva_10.0.3.0_published.snapshot?type=File&client=isvadsc-one HTTP/1.1" 404 -
    Then we check the config container auto POST snapshot in the snapshot container, we found that it has more string in the file name " ?client=isvaconfig "
    docker exec -it isvasnapshotmgr ls -l /data/snapshots
    total 15232  -rw-r--r-- 1 guest users 15594707 Mar 13 04:08 isva_10.0.3.0_published.snapshot?client=isvaconfig
    After we re-name the file to isva_10.0.3.0_published.snapshot (removed the string " ?client=isvaconfig "), then we found that the dsc container startup successful but runtime and wrp container still not able to startup

    the we check the 2 container logs, we found that
    mkdir: cannot create directory '/var/application.logs/db': Permission denied
    /bin/sh: /var/application.logs/db/config/logfile: No such file or directory
    pg_ctl: could not start server
    ...
    TRAS0037E: The system could not create new file /var/application.logs.local/rtprofile
    CWWKE0005E: The runtime environment could not be launched.
    it looks the runtime and wrp container try to create new path without the container id

    in ISAM env, it create the path in /var/application.logs/<container id>/db ; /var/application.logs/<container id>/rtprofile ... etc

    don't know why ISVA removed the <container id>

    Not sure if they are bug, any one get the same issue for upgrade?

    Thank you!

    Roman

    ------------------------------
    CHUN MING HUANG
    ------------------------------


  • 2.  RE: Docker ISAM 9.0.7.2_IF3 image to ISVA 10.0.3.0 / 10.0.3.1 lightweight images upgrade issues

    Posted Mon March 21, 2022 10:53 PM

    There is currently an issue with the ibmcom/isva-snapshotmgr Docker image.  A new version (10.0.3.1_IF1) has just been released – and if you move to this version, it should start working again correctly.

     

    The file permissions problem which you are seeing must be coming from a mounted volume.  Have you mounted a volume at '/var/application.logs'?  If so, you need to ensure that permissions within this volume allow the user which the container is running to have write access.  A decision was made to not include the 'container-id' in the path as this caused confusion amongst many customers.

     

    Thanks.

     

     

    Scott A. Exton
    Senior Software Engineer
    Chief Programmer - IBM Security Verify Access

    IBM Master Inventor