Breadcrumbs

Upgrade VeridiumID from 3.7.x / 3.8.x to v3.9.0


🔧 Pre-Upgrade Preparation

  1. Backup & Snapshot

  • Take VM snapshots or backups of all nodes before starting.

  • Identify node roles:

    • WEBAPP node: is the node where webservices are running

    • PERSISTENCE node: is the node where Cassandra is running.

  1. Based on the OS version, please download the necessary packages.

cat /etc/redhat-release


Packages

Package URL

MD5

SHA1

Description

Update Packages Archive RHEL8

a789e1bdf3f8ca5cfdc60d74a1f7b640

90fd6cb2c10cd0e02fb5e5822b2ec2fa34c9134e

VeridiumID Update packages archive containing all RPMs, for local update procedure RHEL8

Update Packages Archive RHEL9

c2e86451c9cc77c8c78b0b8d5f663ef5

3549498756f17459ac8b91ed9845a5156c899d86

VeridiumID Update packages archive containing all RPMs, for local update procedure RHEL9

Upgrade Methods

You can use either use:

A. Local Packages

  1. Download and extract the package

    export https_proxy=PROXY_IP:PROXY_PORT
## RHEL8, Rocky8
export https_proxy=PROXY_IP:PROXY_PORT
wget --user NEXUS_USER --password NEXUS_PASSWORD \
https://veridium-repo.veridium-dev.com/repository/VeridiumUtils/Veridium-3.9.0-update/veridiumid-update-packages-rhel8-13.0.71.zip
TMP_DEST="/home/veridiumid/update390"
unzip veridiumid-update-packages-rhel8-13.0.71.zip -d ${TMP_DEST}


## RHEL9, Rocky9
export https_proxy=PROXY_IP:PROXY_PORT
wget --user NEXUS_USER --password NEXUS_PASSWORD \
https://veridium-repo.veridium-dev.com/repository/VeridiumUtils/Veridium-3.9.0-update/veridiumid-update-packages-rhel9-13.0.71.zip
TMP_DEST="/home/veridiumid/update390"
unzip veridiumid-update-packages-rhel9-13.0.71.zip -d ${TMP_DEST}

  2. Run update commands (on WEBAPP first, then PERSISTENCE nodes):

    sudo yum localinstall -y --disablerepo="*" ${TMP_DEST}/packages/veridiumid_update_procedure-13.0.71-20260811.x86_64.rpm
sudo python3 /etc/veridiumid/update-procedure/current/updateVeridium.py --version 13.0.71 --rpm-path ${TMP_DEST}/packages/
sudo bash /etc/veridiumid/scripts/check_services.sh

B. YUM Repository

  1. Ensure the repository has the package:

    sudo yum list available veridiumid_update_procedure-13.0.71-20260811

  2. Run update (one node at a time):

    sudo yum clean metadata
sudo yum install -y veridiumid_update_procedure-13.0.71
sudo python3 /etc/veridiumid/update-procedure/current/updateVeridium.py --version 13.0.71 --use-repo
sudo bash /etc/veridiumid/scripts/check_services.sh

 

Post-Upgrade Steps

1. Data Migration to ELK

Run once on a Persistence node, only if updating from versions older then 3.8.1:

sudo bash /opt/veridiumid/migration/bin/migrate_to_elk.sh

2. Cassandra Upgrade (if 4.0.9 or v4.1.4) → 5.0.2

Check version on a Persistence node:

/opt/veridiumid/cassandra/bin/nodetool describecluster | grep -A1 "Database versions"
## if the version is 4.0.9 or 4.1.4, than update should be executed; the proper version is 5.0.2

Then upgrade all Persistences node (one node at a time):

If update is done with local packages:

##check status - all nodes should be up - the status "UN" should be for everynode
/opt/veridiumid/cassandra/bin/nodetool describecluster
/opt/veridiumid/cassandra/bin/nodetool status

TMP_DEST="/home/veridiumid/update390"
sudo bash /etc/veridiumid/update-procedure/current/resources/scripts/372/update_cassandra.sh ${TMP_DEST}/packages/
##check status - all nodes should be up again, in the cluster - the status "UN" should be for everynode
sudo /opt/veridiumid/cassandra/bin/nodetool status
sudo /opt/veridiumid/cassandra/bin/nodetool describecluster

If update is done with YUM repository:

##check status - all nodes should be up - the status "UN" should be for everynode
/opt/veridiumid/cassandra/bin/nodetool describecluster
/opt/veridiumid/cassandra/bin/nodetool status
## run on everynode
/opt/veridiumid/cassandra/bin/nodetool describecluster

sudo bash /etc/veridiumid/update-procedure/current/resources/scripts/372/update_cassandra.sh
##check status - all nodes should be up again, in the cluster - the status "UN" should be for everynode
sudo /opt/veridiumid/cassandra/bin/nodetool status
sudo /opt/veridiumid/cassandra/bin/nodetool describecluster


3. Create one Zookeeper Cluster and enable Read Only mode (Optional)

In Single DC implementation on Persistence nodes, only if updating from versions 3.7.X :

sudo bash /etc/veridiumid/update-procedure/current/resources/scripts/372/update_zookeeper_configuration.sh

In case of CDCR, run the following procedure, to create one big cluster, with nodes from both datacenters. Previous command should not be executed in case of CDCR.

Before starting this configuration, make sure that you have connectivity on ports 2888 and 3888 between ALL persistence nodes.

To test the connectivity run the following commands:

on DC1:

nc -zv IPNODEDC2 2888

nc -zv IPNODEDC2 3888

Bash
## In second datacenter stop all webapp services and zookeeper services
ver_stop_webapp
service ver_zookeeper stop

## run this command on primary datacenter on one node in webapp. This generates a file DC1.tar.gz
sudo bash /etc/veridiumid/scripts/veridiumid_cdcr.sh -i

## copy the DC1.tar.gz to all nodes - webapp and persistence in both datacenters.

## run this command on all persistence nodes in both datacenters starting with the first one - 
## the script will create a large cluster containing the Zookeeper nodes in both datacenters and remove data from second DC
ARCH_PATH=/tmp/DC1.tar.gz
sudo bash /etc/veridiumid/scripts/veridiumid_cdcr.sh -c -e -a ${ARCH_PATH}

## run this command on all webapp nodes in second datacenter
ARCH_PATH=/tmp/DC1.tar.gz
sudo bash /etc/veridiumid/scripts/veridiumid_cdcr.sh -c -e -a ${ARCH_PATH}


4. ELK Stack Upgrade to 8.17.3 (Required)

Upgrade Elasticsearch, Kibana, and Filebeat (first persistence, then webapp), in case that it was not already updated.

Check version on Persistence nodes:

## check if version is now 8.17.3; if not, run the update procedure; if it is version 8.17.3, do nothing 
sudo /opt/veridiumid/elasticsearch/bin/elasticsearch --version

If update is done using local packages

Run on all nodes, first persistence then webapp nodes:

## run below command on all nodes, first on persistance and then on webapp, one by one.
TMP_DEST="/home/veridiumid/update390"
sudo bash /etc/veridiumid/update-procedure/current/resources/scripts/380/update_elk_stack.sh ${TMP_DEST}/packages/
eops -l
## it is ok if the cluster is in red status

After all persistance nodes are updated to version 8.17.3, run the following command on all nodes (persistence + webapp) starting with persistence nodes

sudo bash /etc/veridiumid/update-procedure/current/resources/scripts/380/update_elk_stack.sh post
##check elasticsearch cluster status that is in green status.
check_services

Run only on one node, on webapp:

##run on one node: 
/opt/veridiumid/migration/bin/elk_ops.sh --update-settings

If update is done using YUM repository

Run on all nodes, first persistence then webapp nodes:

sudo bash /etc/veridiumid/update-procedure/current/resources/scripts/380/update_elk_stack.sh
## here the elasticsearch cluster might be red

After all persistance nodes are updated to version 8.17.3, run the following command on all nodes (persistence + webapp) starting with persistence nodes

sudo bash /etc/veridiumid/update-procedure/current/resources/scripts/380/update_elk_stack.sh post
##check elasticsearch cluster status that is in green status.

Run only on one node, on webapp:

##run on one node: 
/opt/veridiumid/migration/bin/elk_ops.sh --update-settings


🌐 Useful Repositories


RHEL8 MD5 of each package:

Package URL

MD5

SHA1

Description

WebsecAdmin

1748260ae02a2f3303b89860b1e14c3f

eb86ffa28749ae4ddca84ee7d3988b05dcee351d

VeridiumID Admin Dashboard

Migration

646079c9d7dfe4d14943d703da77c05e

d57a39ba5baad9d928a9a27e2e49af29620f4376

VeridiumID migration tool

Websec

795ba34210be6a1bf675a7b074d9f089

823e881484fbb2cf3dd940140b6b524e274b5595

VeridiumID Websec

AdService

d224aed43714c23c0244f8ac2e7ba9a6

cffffe990706811ea89158164714092ddd4d6284

VeridiumID Directory Service component

DMZ

d7270d1f659951ff368ba98f0390e417

11432870e8235a747904dca35ef0804a0d24629e

VeridiumID DMZ service

Fido

312828442aac3651437936e88f2f346a

231b929cbec51acaba7d04c9ca8b03d66c6f9b4e

VeridiumID Fido service

OPA

b88fd9687427c4c91168638275be38ef

5080cc6371b8f385e07dc43dd76ccaa8b1d7ed72

VeridiumID Open Policy Agent

Elasticsearch

e08e1b6353840b9ccb94023bad3b8857

80b4ff38a785a45636860c7b64e5a6c9cbfbc088

VeridiumID Elasticsearch

Kibana

90ecadc6d318c4f395927c9349ba68de

4312ab1ef8ebda1053a95409bcb53c0a4487f350

VeridiumID Kibana

Zookeeper

83b9b941ead6349b0362ff3eb2dba7fe

e52d2af0e2db85e4bbe8ddf9ae3b2cb2b4120520

VeridiumID Zookeeper

Cassandra

498ca59cc6b609708a463286ea2a3c91

6e0910f5fee865e78d7a6605ba80d48fc003d78e

VeridiumID Cassandra

Haproxy

89f238497dd92bd7a39975dd0ee59661

6a8e950b886b4e346f1f8c808eee38d2c6001ddc

VeridiumID Haproxy

SelfServicePortal

a3be54f3572bdaf904f34515a788d05e

ca2eefb7bbb9eb78919ab86dc3cc978067475125

VeridiumID Self Service Portal

Shibboleth

44462a846bb2c0ecadf7cdb52224d6d7

45d4197b05170b97b770f3958a29c2c5cbba3eb3

VeridiumID Shibboleth Identity Provider

Tomcat

6573ffc68b0a5d81b5ed81ed1b2e2fb5

c2479d15880686f9a832162f3363cf6b0d5b9231

VeridiumID Tomcat

Setupagent

f4d5dd4d4b20de1838c60774f37387e7

34b84c86446b6c7ff1c49819d1a11aabf8dc3772

VeridiumID Setupagent

Freeradius

ecd06dd6eeef9e3d15c7638182bb429d

d4475b9c924d2a9965e87fe0c4188484c8fef244

VeridiumID FreeRadius

4F

a9b20f17279573d781215ff48c19a909

cafccff3f2f418181599dc88e1608adde17a6aa3

VeridiumID 4F biometric library

VFace

b61f438458acb00614be57471886b657

62d468bc431b7f442c1e5535dc4862a6cd4008df

VeridiumID VFace biometric library

Update procedure RPM

c7bb60e3d267761ee20ec2a4ffebcf90

e3db0e003ccd55fe59489a7b14a8cb9589163a48

Update scripts

RHEL9 MD5 of each package:

Package URL

MD5

SHA1

Description

WebsecAdmin

0b4e0e7624841f7765f5b3aa10e3a202

58dc0a78a9de5bd51dbdb96da2d755d4d5bd8bd7

VeridiumID Admin Dashboard

Migration

ce361476f4333dd7ddaccc89e20d2b52

098fdefd21c227c0bfcebfb1673f82f47be960c8

VeridiumID migration tool

Websec

4b99af3463a63660139ba1d66646eb3a

7d411a44290d7b5e21ed59ab6df89acbb7c7bc8d

VeridiumID Websec

AdService

0ab338fe1accde54bd24a1572fa9af15

fbbdb8302aa73dbf30925d98c0ef6b4208758c9c

VeridiumID Directory Service component

DMZ

6a53dc16a62f8617311b9291c39f5a0e

faa9dadc9591b05dc6bdb7e5660841aaba18f8e0

VeridiumID DMZ service

Fido

47678d2f5129f108f19e3d3b212dcc24

8f1ce8c168aa7e9e729d6397806e73b7baac78f5

VeridiumID Fido service

OPA

b14d977435e1e9864d57af6bb747de89

5df401dc3d7657e8c020e0e13100886a4344d0a8

VeridiumID Open Policy Agent

Elasticsearch

643251e2f090f55b1a29e912db2ec40c

b7dbb5e653256805ea4a77f8d463d639720e66ef

VeridiumID Elasticsearch

Kibana

4278981ad0ae2c6f02b877a7f9d82abe

a0c1b4ae384d2d741cdb8045b37ddf71f561d6ea

VeridiumID Kibana

Zookeeper

2f6945f604486e0d19c73a0bbfab9552

48f2fec28ac15f84b5759d9c1201493fdad959a3

VeridiumID Zookeeper

Cassandra

66b77d1c9d2cbef3d053c437fbe9b85d

3165b207cb5fbbb4adf9e0aad9b6557d484822fd

VeridiumID Cassandra

Haproxy

5032600348319ae8408f2008b5e51b10

32c4484667c90e2393153bfbbef3160bccc838ee

VeridiumID Haproxy

SelfServicePortal

622dd4648c23f4eda38a28c801a7b7d8

53520deda6a220cf4bc938977099a619c7bb71f8

VeridiumID Self Service Portal

Shibboleth

d7c6786f71c639536f2a4373ee40eaba

c1c92d58e7adb4d72ce45f53912ae63ca61eeb89

VeridiumID Shibboleth Identity Provider

Tomcat

b761d3ca918a2af3f573a609f37664c9

bbe0b0385fc114ec567bac78017e3055633be396

VeridiumID Tomcat

Setupagent

cbc06d7042222142a899ab297c58b210

30f6c0e6be3edbe8632f3fa9f3a9556077059619

VeridiumID Setupagent

Freeradius

19dccdc03d039c8c88b0851cb0e865ce

1200b53fc8946363632e9bafd69c7a2d370173c5

VeridiumID FreeRadius

4F

df2b4def3cd3e61202163f1be0c8086f

ad6ae9edef058b6232b7d54fd6e582226f0b3117

VeridiumID 4F biometric library

VFace

0283c75f675a75f7d242d349bb7914a5

ed711f927392d5bdd3619350153dcbc8f096cdf0

VeridiumID VFace biometric library

Update procedure RPM

af01841562025296a78fe42b401e5880

f3df3024abaff75934ad0f66a6cefc5aa503bc55

Update scripts

Last updated: