Aller au contenu

Upgrade Ingress Caascad#

  1. Prerequisites This procedure is to be applied on k8s version >= 1.21 and as part of CCE upgrades to more recent versions. 
    export ZONE_NAME=<name of the cloud zone>

  2. apply fe_loadbalacer_v3

    • the fe_loadbalancer_v3 configuration has been changed to allow for skipping the creation of the route53 DNS entries
    • trackbone's global config hass been modified to add a custom "skip_dns_entries" tag 
      $ trackbone apply -z ${ZONE_NAME} -c fe_loadbalancer_v3 -t skip_dns_entries=true
    • Check output:
    • PROD 
      export VAULT_ADDR="https://vault.infra-prd.caascad.com"
vault login -method oidc
    • STG 
      export VAULT_ADDR="https://vault.infra-stg.caascad.com"
vault login -method oidc


    LBS=$(vault read secret/applications/trackbone/state/${ZONE_NAME}/fe_loadbalancer_v3/outputs -format=json|jq '.data.loadbalancers.value|keys[] as $k| "\($k),\(.[$k]|.public_ip)"'|tr -d '"')
echo $LBS
    This should show a list of load balancers and their respective EIPs

  3. Deploy ingress_controller_v2 

    trackbone apply -z ${ZONE_NAME} -c ingress_controller_v2_public
trackbone apply -z ${ZONE_NAME} -c ingress_controller_v2_private

  4. Update route53 

    export VAULT_ADDR="https://vault.corp.caascad.com"
vault login -methoid oidc
    * PROD 
    eval $(vault read aws/sts/infra-prd-power-user -format=json| jq -r '.data|"export AWS_ACCESS_KEY_ID=\(.access_key)\nexport AWS_SECRET_ACCESS_KEY=\(.secret_key)\nexport AWS_SESSION_TOKEN=\(.security_token)"')
    * STG 
    eval $(vault read aws/sts/infra-stg-power-user -format=json| jq -r '.data|"export AWS_ACCESS_KEY_ID=\(.access_key)\nexport AWS_SECRET_ACCESS_KEY=\(.secret_key)\nexport AWS_SESSION_TOKEN=\(.security_token)"')
    * Create backup copy of the DNS zone 
    cli53 export --output ~/tmp/${ZONE_NAME}.txt ${ZONE_NAME}.caascad.com
cp ~/tmp/${ZONE_NAME}.txt ~/tmp/${ZONE_NAME}.new
    * Add the EIPs of the new load balancers to the DNS entry by editing the ~/tmp/${ZONE_NAME}.new file 
    for i in $LBS; do
  NAME=$(echo $i|awk -F, '{print $1}')
  IP=$(echo $i|awk -F, '{print $2}')
  echo "${NAME} 30 IN A ${IP}" >> ~/tmp/${ZONE_NAME}.new
done
tail ~/tmp/${ZONE_NAME}.new
    * Import modified copy of the DNS zone

    • Dry run: 
      cli53 import --file ~/tmp/${ZONE_NAME}.new --dry-run ${ZONE_NAME}.caascad.com
    • Apply: 
      cli53 import --file ~/tmp/${ZONE_NAME}.new --replace ${ZONE_NAME}.caascad.com
    • Check: 
      cli53 export  ${ZONE_NAME}.caascad.com|egrep "^p.*[0-9]$"
      There should be one entry with the EIP of the v2 ELBs and one entry with the EIP of the v3 ELB.

  5. Re-apply fe_loadbalancer_v3 

    trackbone apply -z ${ZONE_NAME} -c fe_loadbalancer_v3 -t bootstrap=true
    The bootstrap=true tag will ensure that the DNS records can be overwritten thus removing the unused EIPs

  6. Destroy fe_loadbalancer * Remove aws53 resources from the state file 

    trackbone shell -z ${ZONE_NAME} -c fe_loadbalancer

    terraform init
terraform state list|grep route53
    Followed by the command below for each resource: terraform state rm '<route53_resource>' * Destroy fe_loadbalancer resources 
    trackbone destroy -z ${ZONE_NAME} -c fe_loadbalancer

Only two entries with the EIPs of the v3 ELBs should be visible

  1. Destroy ingress_controller legacy This step should be done after a while to allow for the propagation of the DNS changes (1h). 
    trackbone destroy -z ${ZONE_NAME} -c ingress_controller_private
trackbone destroy -z ${ZONE_NAME} -c ingress_controller_public