Page History

...

1. Clone the git repository in your computer (git@github.com:TheIdentitySelector/thiss-ops.git)
2. Open cosmos-rules global/overlay/etc/hiera/data/common.yaml, check the 'max-age' under 'cache_control_beta'. If the current s-max age is 1 hour2 days or 172800 seconds, you need to change it to zero, 1 hour 10 hours, two days before the deployment. If it is one day, you need to change it to zero 10 hours exactly 1 day before. We need to do it so the browsers old cache gets cleared from non-fastly cache nodes and new files are requested from Fastly our backend during the deployment.
3. Log into Fastly management web GUI https://manage.fastly.com/ and purge all cache for the  service 'use.thiss.io'
4. Wait as long as the old 'Wait as long as the old 's-max-age' and then proceed to the next step. Befor you do that, you can You can even check in the 'developer tools' of your browser (e.g. Chrome, Firefox) that the old cache has been cleared and response headers have the new files have max-age=0 in their response header now.**screenshot**s-maxage of 10 hours. You can try by using https://demo.beta.seamlessaccess.org/ 
5. Update the ds_version under thiss::static_beta in global/overlay/etc/hiera/data/common.yaml.

'^static-[0-9]+\.thiss\.io$':
   sunet_iaas_cloud:
   thiss::dockerhost:
      version: '5:19.03.13~3-0~ubuntu-focal'
   thiss::static:
      ds_version: 1.6.3
      base_url: https://use.thiss.io/
      mdq_search_url: https://md.thiss.io/entities/
      domain: use.thiss.io
      context: thiss.io
      cache_control: 'public, max-age=3601, must-revalidate, s-maxage=3601, proxy-revalidate'
   https:

ds_version_beta: '2.1.51'
cache_control_beta: 'public, max-age=36000, must-revalidate, s-maxage=172800, proxy-revalidate'

1. Run git add global/overlay/etc/hiera/data/common.yaml and git commit. You should ofcourse have right to commit in the repository.
2. Run the script thiss-ops/bump-tag afterwards.
3. To verify that the new version is installed, log in to the servers static-1.thiss.io and static-2.thiss.io and enter 'run-cosmo -v'. 
4. You can check the status by running the command service docker-thiss_js status.
5. You can also enter 'docker ps' in order to see if the new version is present on docker image tag.
6. We may have to do more than one version upgrade to make it backward compatible, check https://github.com/TheIdentitySelector/thiss-js/blob/staging/RELEASE.md
7. Check that the login works using demo.beta.seamlessaccess.org. You can check the transaction check & page speed in Pingdom after each upgrade. Page speed shows the response headers and other information for each file loaded from https://use.thiss.io.
8. It is also good to check the HIT ratio (observability > service overview) and origin latency under CDN services from Fastly GUI for the service 'use.thiss.io'. Chek that the HIT ratio is high enough, should be around 98 to 99 percent, latency is way below 5 seconds
9. Do git add global/overlay/etc/puppet/cosmos-rules.yaml and git commit. You should ofcourse have right to commit in the repository.
10. Run the script thiss-ops/bump-tag afterwards.
11. To verify that the new version is installed, log in to the servers static-1.thiss.io and static-2.thiss.io and enter 'run-cosmo -v'. 
12. You can check the status by running the command service docker-thiss_js status.
13. You can also enter 'docker ps' in order to see if the new version is present on docker image tag.
14. After the verification step is done, everything looks good and few hours have passed open cosmos-rulesopen global/overlay/etc/hiera/data/common.yaml and change 'max-age' under 'cache_control' _beta to original value after 10 hours have passed.

Verification

Verify that the changes have taken effect - this may take a while depending on how quickly the CDN picks up the changes. Find out which changes should be tested, check with the developer team or technical lead Leif Johansson. In addition to that, it should be checked that the discovery service works by visiting https://use.thiss.io. It is good to do it in a private window of your browser in case your browser has cached the old version. Click on the 'Login' button and see that it is possible to choose different IDPs from there. Check that the persistent service works by going back and choosing different organizations. You should be able to see the list of organizations that you have chosen and be able to edit them as well. Check that these functions work. https://use.thiss.io/manifest.json is supposed to show the latest version number. You can check the login works through https://demo.beta.seamlessaccess.org as well. 

...

1. Clone the git repository in your computer (git@github.com:TheIdentitySelector/thiss-ops.git)
2. Update the ds_the version under thiss::mdq for both 'md-1.thiss.io' and 'md-2.thiss.io'

...

1. Clone the git repository in your computer (git@github.com:TheIdentitySelector/thiss-ops.git)
2. Open global/overlay/etc/hiera/data/common.yaml and check that the whitelist is right or change it if needed.

   
   

   Warning
   title Whitelisting
   It is important to set the WHITELIST environment variable to the comma-separated list of the current whitelisted domains before deploying. Ask Marina or Leif to verify the list. The list is updated here Seamless Access Configuration Parameters.

   
   

3. Open cosmos-rulesOpen global/overlay/etc/hiera/data/common.yaml, check the 'maxs-agemaxage' under 'cache_control'_prod. If the current s-max age is 1 hour2 days or 172800 seconds, you need to change it to zero 1 hour 10 hours, two days before the deployment. If it is one day, you need to change it to zero 10 hours exactly 1 day before. We need to do it so the browsers old cache gets cleared from non-fastly cache nodes and new files are requested from Fastly our backend during the deployment.
4. Log into Fastly management web GUI https://manage.fastly.com/ and purge all cache for the  service It is good to see that backends are not overloaded, you can check the HIT ratio (observability > service overview) and origin latency under CDN services from Fastly GUI for the service 'service.seamlessaccess.org'.
5. Keep an eye on the transaction check in pingodm that it is not failing after lowering the s-maxage.
6. Wait as long as the old 's-maxageWait as long as the old 'max-age' and then proceed to the next step. Befor you do that, you can You can even check in the 'developer tools' of your browser (e.g. Chrome, Firefox) that the old cache has been cleared and response headers have the new files have max-age=0 in their response header now.**screenshot**s-maxage of 10 hours. You can try by using https://demo.seamlessaccess.org/ 
7. Update the ds_version
under thiss::static_prod for each site (ntx, se-east, aws1 and aws2)
8. _prod in global/overlay/etc/hiera/data/common.yaml.
   

   
   

   Code Block
   language bash

'^static-[0-9]\.ntx\.sunet\.eu\.seamlessaccess\.org$':
   thiss::dockerhost:
      version: '5:20.10.6~3-0~ubuntu-focal'
   thiss::static_prod:
      ds_version: 1.6.3
      base_url: https://service.seamlessaccess.org/
      mdq_search_url: https://md.seamlessaccess.org/entities/
      domain: service.seamlessaccess.org
      context: seamlessaccess.org
      cache_control: 'public, max-age=36000, must-revalidate, s-maxage=604800, proxy-revalidate'

9. ds_version_prod: '2.1.51' cache_control_prod: 'public, max-age=36000, must-revalidate, s-maxage=172800, proxy-revalidate'

   
   

10. Run git add global/overlay/etc/hiera/data/common.yaml and git commit. You should ofcourse have right to commit in the repository. Run git add global/overlay/etc/hiera/data/common.yamlas well if whitelist is changed. You should ofcourse have right to commit in the repository.
11. Run the script thiss-ops/bump-tagafterwards.
12. To verify that the new version is installed, log in to below servers and enter 'run-cosmo -v'. 

    
    

    static-1.aws1.geant.eu.seamlessaccess.org

    static-1.aws2.geant.eu.seamlessaccess.org

    static-1.ntx.sunet.eu.seamlessaccess.org

    static-1.se-east.sunet.eu.seamlessaccess.org (have to run service sunet-thiss_js restart manually)

    static-2.aws1.geant.eu.seamlessaccess.org

    static-2.aws2.geant.eu.seamlessaccess.org

    static-2.ntx.sunet.eu.seamlessaccess.org

    static-2.se-east.sunet.eu.seamlessaccess.org

13. You can check the status by running the command service docker-thiss_js status.
14. You can also enter 'docker ps' in order to see if the new version is present on docker image tag. 
15. We may have to do more than one version upgrade to make it backward compatible, check https://github.com/TheIdentitySelector/thiss-js/blob/staging/RELEASE.md
16. Check that the login works using demo.seamlessaccess.org. You can check the transaction check & page speed in Pingdom after each upgrade. Page speed shows the response headers and other information for each file loaded from https://service.seamlessaccess.org.
17. It is also good to check the HIT ratio (observability > service overview) and origin latency under CDN services from Fastly GUI for the service 'service.seamlessaccess.org'. Chek that the HIT ratio is high enough, should be around 98 to 99 percent and latency is way below 5 seconds.                                                              Image Added
18. Do git add global/overlay/etc/puppet/cosmos-rules.yaml and git commit. Do git add global/overlay/etc/hiera/data/common.yaml as well if whitelist is changed. You should ofcourse have right to commit in the repository.
19. Run the script thiss-ops/bump-tag afterwards.
To verify that the new version is installed, log in to below servers and enter 'run-cosmo -v'. 

static-1.aws1.geant.eu.seamlessaccess.org

static-1.aws2.geant.eu.seamlessaccess.org

static-1.ntx.sunet.eu.seamlessaccess.org

static-1.se-east.sunet.eu.seamlessaccess.org

static-2.aws1.geant.eu.seamlessaccess.org

static-2.aws2.geant.eu.seamlessaccess.org

static-2.ntx.sunet.eu.seamlessaccess.org

static-2.se-east.sunet.eu.seamlessaccess.org

20. You can check the status by running the command service docker-thiss_js status.
You can also enter 'docker ps' in order to see if the new version is present on docker image tag. 
22. After the verification step is done, everything looks good and few hours have passed open cosmos-rules, open global/overlay/etc/hiera/data/common.yaml and change 'max-age' under 'cache_control_prod' to  to original value for all 4 sites.

Verification

Verify that the changes have taken effect - this may take a while depending on how quickly the CDN picks up the changes. Find out which changes should be tested, check with the developer team or technical lead Leif Johansson. In addition to that, it should be checked that the discovery service works as usual by trying to login to a service for example wiki.sunet.se. It is good to do it in a private window of your browser in case your browser has cached the old version. https://service.seamlessaccess.org/manifest.json is supposed to show the latest version number. You can check the login works through https://demo.seamlessaccess.org as well. 

...

1. Clone the git repository in your computer (git@github.com:TheIdentitySelector/thiss-ops.git)
2. Update the ds_version under  under thiss::mdq for each site (ntx, se-east, aws1 and aws2)

   
   

   Code Block
   '^md-[0-9]\.ntx\.sunet\.eu\.seamlessaccess\.org$': thiss::dockerhost: thiss::mdq: version: 1.3.2 src: https://meta.ntx.sunet.eu.seamlessaccess.org/metadata.json base_url: https://md.seamlessaccess.org post: /usr/sbin/service docker-thiss_mdq restart

   
   

3. Do git add global/overlay/etc/puppet/cosmos-rules.yaml and git commit. You should ofcourse have right to commit in the repository.
4. Run the script thiss-ops/bump-tag afterwards.
5. To verify that the new version is installed, log in to below servers and enter 'run-cosmo -v'. 

   md-1.aws1.geant.eu.seamlessaccess.org

   md-1.aws2.geant.eu.seamlessaccess.org

   md-1.ntx.sunet.eu.seamlessaccess.org

   md-1.se-east.sunet.eu.seamlessaccess.org

   md-2.aws1.geant.eu.seamlessaccess.org

   md-2.aws2.geant.eu.seamlessaccess.org

   md-2.ntx.sunet.eu.seamlessaccess.org

   md-2.se-east.sunet.eu.seamlessaccess.org

6. You can check the status by running the command service docker-thiss_mdq status.
7. You can also enter 'docker ps' in order to see if the new version is present on docker image tag. 

...