Migrate existing clusters to access new packages behind the paywall

As described in Software Access Update, HDP, HDF, and Ambari repositories have been moved behind a paywall. You might have noticed that upscales for existing clusters don't work and no new clusters can be launched from prewarmed images. Refer to the following guidelines, which will help you update the repository settings in order to be able to access the new repositories behind the paywall.

	Note
	These guidelines only work for clusters created from a base image. They do not work for clusters started from a prewarmed image.

Prerequisites

Update to the latest Cloudbreak version: Before you begin to modify your cluster, make sure that your Cloudbreak version supports the paywall feature. The minimum version is 2.9.3-rc.9. To upgrade, see Upgrade Cloudbreak to the latest version.
Set up paywall access for 2.9.3-rc.9 or newer: Obtain your customer-specific paywall credentials provided by Cloudera for your active subscription. Authentication credentials for new customers and partners are provided in an email sent from Cloudera to registered support contacts. Existing users can file a non-technical case within the support portal (https://my.cloudera.com) to obtain credentials.
Next, SSH to you Cloudbreak node and add the following variables to your Profile file, replacing the placeholders with actual user name and password obtained earlier:
```
export CB_PAYWALL_USERNAME=<paywall-username>
export CB_PAYWALL_PASSWORD=<paywall-password>
```
Next, restart Cloudbreak using:
```
cbd restart
```

Set up paywall access manually for versions older than 2.9.3-rc.9:

	Note
	These steps must be performed each time the gateway node is repaired or replaced.


            paywall.sh

. The content should be:

#!/usr/bin/env bash

: ${PAYWALL_USERNAME:? "PAYWALL_USERNAME is required"}
: ${PAYWALL_PASSWORD:? "PAYWALL_PASSWORD is required"}

if ! grep -q "password" /srv/salt/ambari/yum/ambari.repo; then
    echo "username=$PAYWALL_USERNAME" >> /srv/salt/ambari/yum/ambari.repo
    echo "password=$PAYWALL_PASSWORD" >> /srv/salt/ambari/yum/ambari.repo
fi

if ! grep -q "password" /srv/salt/gateway/yum/hdp.repo; then
    echo "username=$PAYWALL_USERNAME" >> /srv/salt/gateway/yum/hdp.repo
    echo "password=$PAYWALL_PASSWORD" >> /srv/salt/gateway/yum/hdp.repo
fi

if ! grep -q "password" /srv/salt/gateway/yum/hdp-utils.repo; then
    echo "username=$PAYWALL_USERNAME" >> /srv/salt/gateway/yum/hdp-utils.repo
    echo "password=$PAYWALL_PASSWORD" >> /srv/salt/gateway/yum/hdp-utils.repo
fi

Next, run chmod +x paywall.sh

Next, run:

PAYWALL_USERNAME=THEIR_PAYWALL_USERNAME PAYWALL_PASSWORD=THEIR_PAYWALL_PASSWORD ./paywall.sh

This will put paywall username and password into the necessary salt files, which will be distributed by salt to other nodes.

Once you've met these prerequisites, you are ready to update your clusters. Perform the following steps for each existing cluster.

Step 1: Enable maintenance mode

Prior to updating your cluster, enable maintenance mode for that cluster. This can be done from the Cloudbreak CLI using the following command:

cb cluster maintenance-mode enable --name <CLUSTER-NAME>

Step 2: Upgrade HDP/HDF repository data in Cloudbreak

Run the following command to determine your current stack version. This retrieves the current version and package information for your stack:

cb cluster describe --name <CLUSTER-NAME> | jq ".cluster.ambariStackDetails"

Example result:

{
  "enableGplRepo": false,
  "hdpVersion": "3.1.4",
  "mpacks": [
    {
      "name": "my-mpack"
    }
  ],
  "stack": {
    "amazonlinux2": "http://public-repo-1.hortonworks.com/HDP/amazonlinux2/3.x/updates/3.1.4.0",
    "repoid": "HDP-3.1",
    "repository-version": "3.1.4.0-315",
    "vdf-amazonlinux2": "http://public-repo-1.hortonworks.com/HDP/amazonlinux2/3.x/updates/3.1.4.0/HDP-3.1.4.0-315.xml",
    "vdf-url": "http://public-repo-1.hortonworks.com/HDP/amazonlinux2/3.x/updates/3.1.4.0/HDP-3.1.4.0-315.xml"
  },
  "util": {
    "amazonlinux2": "http://public-repo-1.hortonworks.com/HDP-UTILS-1.1.0.22/repos/amazonlinux2",
    "repoid": "HDP-UTILS-1.1.0.22"
  },
  "verify": true
}

In the above example, the operating system is "amazonlinux2", but in your output it will be the operating system that you are using. Note that you will need to provide the operating system name (exactly as it appears in the output of the above command) in a later step to replace the <OS> placeholder.

Based on the information obtained in the previous step, populate the following JSON file and save it to your local file system as stack.json. You can select a different name, just note that the subsequent commands refer to this file as stack.json. This file should contain new stack details copied from the result obtained in the previous step. For example:

{
  "enableGplRepo":false,
  "osType":"amazonlinux2",
  "repositoryVersion":"3.1.4.0-315",
  "stackBaseURL":"https://archive.cloudera.com/p/HDP/3.x/3.1.4.0/amazonlinux2",
  "stackRepoId":"HDP-3.1.4",
  "utilsBaseURL":"https://archive.cloudera.com/p/HDP-UTILS/1.1.0.22/repos/amazonlinux2",
  "utilsRepoId":"HDP-UTILS-1.1.0.22",
  "version":"3.1.4",
  "versionDefinitionFileUrl":"https://archive.cloudera.com/p/HDP/3.x/3.1.4.0/amazonlinux2/HDP-3.1.4.0-315.xml"
}

If you have a management pack registered to your stack, you need to register a new management pack with a new name and a new archive.cloudera.com URL, as described in Add management pack documentation. After this, you need to add this new mpack name to the JSON file. For example:

{
  "enableGplRepo":false,
  "mpacks": [
    {
      "name": "my-new-paywall-mpack"
    }
  ],
  "osType":"amazonlinux2",
  "repositoryVersion":"3.1.4.0-315",
  "stackBaseURL":"https://archive.cloudera.com/p/HDP/3.x/3.1.4.0/amazonlinux2",
  "stackRepoId":"HDP-3.1.4",
  "utilsBaseURL":"https://archive.cloudera.com/p/HDP-UTILS/1.1.0.22/repos/amazonlinux2",
  "utilsRepoId":"HDP-UTILS-1.1.0.22",
  "version":"3.1.4",
  "versionDefinitionFileUrl":"https://archive.cloudera.com/p/HDP/3.x/3.1.4.0/amazonlinux2/HDP-3.1.4.0-315.xml"
}

Modify the stack repository metadata in Cloudbreak with the following commands based on your stack type:

HDP cluster:

cb cluster maintenance-mode hdp --name <CLUSTER-NAME> --cli-input-json stack.json

HDF cluster:

cb cluster maintenance-mode hdf --name <CLUSTER-NAME> --cli-input-json stack.json

(Optional) Verify that the update was successful using this command:

cb cluster describe --name <CLUSTER-NAME> | jq ".cluster.ambariStackDetails"

Once you have successfully validated the repository configuration, disable maintenance mode by using the following CLI command:
```
cb cluster maintenance-mode disable --name <CLUSTER-NAME>
```

Step 3: Update Ambari repository information

You only need to perform the upgrade steps listed below if you are running a release Ambari version (such as 2.6.2.0) or if you are not using the latest hotfix version (for example, you should upgrade if your current version is 2.6.2.1 but the 2.6.2.2 is available).

Run the following command to determine your current Ambari version:

cb cluster describe --name <CLUSTER-NAME> | jq ".cluster.ambariRepoDetailsJson"

Example result:

{
  "baseUrl": "http://public-repo-1.hortonworks.com/ambari/amazonlinux2/2.x/updates/2.7.4.0/",
  "gpgKeyUrl": "http://public-repo-1.hortonworks.com/ambari/amazonlinux2/2.x/updates/2.7.4.0/RPM-GPG-KEY/RPM-GPG-KEY-Jenkins",
  "version": "2.7.4"
}

The following table includes the upgrade matrix. You should find your current Ambari version and determine the target Ambari version that you need to upgrade to:

Table 1.
Your current Ambari version	Target Ambari version	Your current HDP version
2.7.4	2.7.4.14	3.1.4
2.7.3	2.7.3.39	3.1.0
2.7.1	2.7.1.3	3.0.1
2.7.0	2.7.0.7	3.0.0
2.6.2	2.6.2.59	2.6.5
2.6.2.2	2.6.2.59	2.6.5
2.6.1	2.6.1.21	2.6.5
2.6.1.5	2.6.1.21	2.6.5

Cloudbreak can update your Ambari cluster to a given Ambari version. This endpoint is not exposed as an API call, so you need to fill this example cURl command with the proper parts and run it.

You can retrieve AUTH-TOKEN from the Cloudbreak with the following cURL command:

AUTH-TOKEN=$(curl -k -iX POST -H "accept: application/x-www-form-urlencoded" -d 'credentials={"username":"<USER-NAME>","password":"<PASSWORD>"}' "<CB-ADDRESS>/identity/oauth/authorize?response_type=token&client_id=cloudbreak_shell&scope.0=openid&source=login&redirect_uri=http://cloudbreak.shell" | grep -i location | cut -d'=' -f 3 | cut -d'&' -f 1)

You need to replace the following placeholders:

<USER-NAME>  (Should be in the following format: admin@example.com)
<PASSWORD>   (Cloudbreak password)
<CB-ADDRESS> (Cloudbreak https url, for example: https://cloudbreak-controller-6uhdxz2xtuhww.westus.cloudapp.azure.com)

Obtain your stack identifier by running the following command, replacing the <CLUSTER-NAME> with an actual name):
```
cb cluster describe --name <CLUSTER-NAME> | jq .id
```

Run the following command, passing the obtained token:

curl -k --location --request POST '<CB-ADDRESS>/cb/api/v1/stacks/<STACK-ID>/cluster/upgrade' \
--header 'Authorization: Bearer <AUTH-TOKEN>' \
--header 'Content-Type: application/json' \
--data-raw '{
  "version":"<TARGET-AMBARI-VERSION>",
  "baseUrl":"https://archive.cloudera.com/p/ambari/2.x/<TARGET-AMBARI-VERSION>/<OS>",
  "gpgKeyUrl":"https://archive.cloudera.com/p/ambari/2.x/<TARGET-AMBARI-VERSION>/<OS>/RPM-GPG-KEY/RPM-GPG-KEY-Jenkins"
}'

You need to replace the following placeholders:

<CB-ADDRESS>  (Cloudbreak https url, for example: https://cloudbreak-controller-6uhdxz2xtuhww.westus.cloudapp.azure.com)
<STACK-ID>    (Stack identifier obtained in the previosu step) 
<AUTH-TOKEN>  (Token obtained in one of the previous steps)
<TARGET-AMBARI-VERSION>  (Target Ambari version from the table in step 1. For exampe, 2.7.4.14)
<OS>          (Operating system. For example, amazonlinux2)

After the successful execution, your existing cluster nodes will be upgraded to the new version.

Sync your cluster:
```
cb cluster sync --name <cluster-name>
```