Dell CloudLink 7.1.

4
Upgrade Guide

July 2022
Rev. A00
Notes, cautions, and warnings

NOTE: A NOTE indicates important information that helps you make better use of your product.

CAUTION: A CAUTION indicates either potential damage to hardware or loss of data and tells you how to avoid
the problem.

WARNING: A WARNING indicates a potential for property damage, personal injury, or death.

© 2014 - 2022 Dell Inc. or its subsidiaries. All rights reserved. Dell Technologies, Dell, and other trademarks are trademarks of Dell Inc. or its
subsidiaries. Other trademarks may be trademarks of their respective owners.
 Contents

Chapter 1: About Dell EMC CloudLink............................................................................................ 4

About this document.......................................................................................................................................................... 4

Chapter 2: CloudLink Center upgrade requirements...................................................................... 5

Chapter 3: CloudLink upgrade overview.........................................................................................7

Group policy and CloudLink agent................................................................................................................................... 7
Change CloudLink Vault unlock modes...........................................................................................................................7
Upgrade CloudLink.............................................................................................................................................................. 8
Upgrade CloudLink Agents manually...............................................................................................................................8
Upgrade CloudLink Center Encryption for Container agents................................................................................... 9
Upgrade PowerFlex agents............................................................................................................................................... 9

Chapter 4: Verify connection between VM and CloudLink Center after upgrade........................... 10

Chapter 5: Troubleshooting and getting help................................................................................11

Contents 3
 1
About Dell EMC CloudLink
CloudLink secures sensitive information in VMs across both public and private clouds. It provides encryption for the boot volume
and additional data volumes with pre-startup authorization for cloud-hosted VMs. CloudLink provides this encryption by using
native Operating System (OS) encryption features: Microsoft BitLocker for Windows or dm-crypt for Linux.
CloudLink enables you to use native OS encryption features to encrypt the VM's boot and data volumes in a multitenant cloud
environment. This encryption helps protect the integrity of the VM itself against unauthorized modifications. CloudLink encrypts
the virtual machine boot and data volumes with unique keys that are controlled by enterprise security administrators. Neither
cloud administrators nor other tenants in the cloud have access to the keys. Securing VMs enables you define the security policy
it must meet before passing prestartup authorization, including verifying the integrity of the virtual machine’s boot chain. This
offers protection against tampering.
CloudLink ensures that only trusted and verified VMs can run and access sensitive data stored in the cloud. As part of
the CloudLink solution, CloudLink Center defines the key release policy, performs prestartup authorization, and monitors all
CloudLink Agents, events, and logs.
CloudLink also offers significant benefits for environments that use Dell EMC PowerFlex resources. PowerFlex is a Software-
Defined Solution (SDS) that enables you to transform Direct-Attached Storage (DAS) on existing hardware into shared block
storage. It offers considerable scalability and extreme performance with flexible and elastic storage capacity and nodes.
CloudLink encrypts the SDS devices with unique keys that are controlled by enterprise security administrators.
CloudLink Center—The web-based management interface for CloudLink, is used for managing encryption keys, configuring
security policies, and monitoring the security and operation events and logs.

About this document

This guide describes the process to upgrade from Dell CloudLink version 7.0.x to 7.1, and then from 7.1 to 7.1.x. Because of the
critical nature of the encryption keys and CloudLink Agent information that is contained in CloudLink Center servers, review the
information in this document before starting the upgrade process.

4 About Dell EMC CloudLink

 2
CloudLink Center upgrade requirements
Before upgrading to CloudLink version 7.1.4, ensure that the requirements listed in this chapter are met.

Upgrade paths
● Before upgrading to CloudLink version 7.1.4 (build 134.82), ensure that you are using the version 7.1 (build 3.6), 7.1.1
(build 12.28), 7.1.2 (build 111.48), or 7.1.3 (build 131.81).
NOTE: The upgrade path to CloudLink 7.1.4 is:
○ Version 7.0.x and its patches must be first upgraded to version 7.1
○ Version 7.1, 7.1.1, 7.1.2, or 7.1.3 can be directly upgraded to 7.1.4

CAUTION: Only PowerFlex 3.6.0.2 and later versions will support the new SDS mapper introduced in
CloudLink 7.1.2. PowerFlex must be upgraded to 3.6.0.2 prior to upgrading CloudLink to 7.1.3 or later
versions. To upgrade CloudLink agents on SDS nodes to use CloudLink 7.1.2, 7.1.3 or later versions, you must
manually update the PowerFlex devices. For information about using the upgraded mapper path on PowerFlex
3.6.0.2 and later versions, see the "Migrate the PowerFlex nodes to the new CloudLink path" section in the
Dell EMC PowerFlex CloudLink for SDS Devices document available on the support site.
● Log in to the CloudLink Center to verify the CloudLink version and the build number. The version and build number is
displayed in the Information box on the CloudLink Center Home panel.
● If CloudLink Center was deployed using a version earlier than CloudLink 6.9, the upgrade includes an update to Ubuntu
Server 16.04. This update increases the time that is required for the update process.
● For Microsoft Azure—If you are using the CloudLink Center 6.9, 7.0, or 7.0.1 version with Ubuntu 14.0.4, first upgrade to
CloudLink 7.0.2, and then upgrade to the 7.1 or later versions. This is because the 7.0.2 version has an update to the Ubuntu
16.0.4 version.
● For Amazon Web Services (AWS)—If you are using the CloudLink Center 6.9, 7.0, or 7.0.1 version with Ubuntu 14.0.4, first
upgrade to CloudLink 7.0.2, and then upgrade to the 7.1 or later versions. To upgrade to the 7.0.2 version, and then to 7.1 or
later versions, contact the Dell Technologies Support team.
● An active Internet connection is required to download the latest packages for upgrading Ubuntu Server on Microsoft Azure
and AWS.
● Clear all the alarms before upgrading to the latest CloudLink version.

VMs
● Ensure that your CloudLink Center virtual appliance is running the version 7.0, 7.0.1, 7.0.2 (build 16.21), 7.1 (build 3.6),
7.1.1 (build 12.28), 7.1.2 (build 111.48), or 7.1.3 (build 131.81).
● Ensure that all CloudLink Center VMs have at least 6 GB of RAM and four vCPUs before you upgrade. If a CloudLink Center
VM does not have sufficient resources for upgrading, the following message is displayed: System does not meet the
minimum requirements.
● To automatically upgrade all CloudLink Agents, ensure that all machines that are registered with CloudLink Center are online
and indicate as Connected in CloudLink Center. The Machine Agent Upgrade policy must be set to Auto.
● If the Machine Agent Upgrade policy is set to Auto, any CloudLink Agent that is not connected to CloudLink Center is
automatically upgraded the next time CloudLink connects. If machines are online and connected during the upgrade, , verify
after the upgrade process. For more information, see Postupgrade verification.
● If the Machine Agent Upgrade policy is set to Manual, then all the machines in the respective machine group that uses
Machine Agent Upgrade policy must be upgraded manually.
● Ensure that CloudLink Center cluster servers are online and synchronized with each other.

CloudLink Center upgrade requirements 5

Backups
It is recommended that you back up CloudLink Center and all VMs before starting the upgrade process. Perform backups by
using VM snapshots or traditional backup tools.
Ensure that the following critical backup requirements are met:
● Back up your CloudLink Center configuration data
For more information, see the chapter "Back up and restore CloudLink Center" in the Dell EMC CloudLink Administration
Guide.
● If you are using Microsoft Active Directory, Amazon S3 external storage, or an S3-compatible bucket, back up your
encryption keys by using tools that are specific to those environments.

Keystore
If you are using an external keystore, ensure that the keystore is connected before starting the upgrade process.

CloudLink licenses
Before starting the upgrade process:
● Ensure that CloudLink licenses are not expired.
● Licenses that are past their support duration—typically one, two, or three years from the date of purchase—are blocked
from being uploaded.
● If licenses are expired after uploading, all the existing CloudLink functionalities will continue to work including releasing of
keys.
● New CloudLink agent installation and encryption of machines and SDS devices cannot be performed.
● To reenable encryption, purchase a new license and upload it.

Passwords
You require the following:
● The CloudLink secadmin password
● The CloudLink console password
● One of the CloudLink Vault passwords
● Passwords of the encrypted VMs

CloudLink Center clusters

The upgrade process upgrades all servers in a cluster.
● Ensure that all servers are accessible.
● Upload the upgrade ISO to any server in a cluster.
● Wait until the ISO image file is uploaded to all servers before you begin the upgrade process.

Ports
Before starting the upgrade process, ensure that TCP ports 80 and 1194 and UDP port 1194, are open. For more information, see
the section "Software requirements for deploying CloudLink Center" in the Dell EMC CloudLink Deployment Guide.

6 CloudLink Center upgrade requirements

 3
CloudLink upgrade overview
Upgrading CloudLink involves uploading the upgrade ISO image file and initiating the upgrade. All servers in a CloudLink Center
cluster are automatically upgraded during the upgrade process. Connected CloudLink Agents are automatically upgraded if the
Machine Agent Upgrade policy is set to Auto. Any CloudLink Agent that is not connected is automatically upgraded the next
time it connects to CloudLink Center.
CloudLink enables you to manually upgrade CloudLink Agents after you upgrade CloudLink Center or a CloudLink Center cluster,
if the Machine Agent Upgrade policy is set to Manual. See Upgrade CloudLink Agents manually.

Group policy and CloudLink agent

If the Group Policy in an Active Directory environment handles the CloudLink agent installation, then the CloudLink Agent
Group Policy Object must be updated with the new CloudLink Agent MSI file. To upgrade the policy object, do the
following:
1. Delete the old CloudLink Agent MSI installer file from its Group Policy Object.
2. Upgrade CloudLink Center using the upgrade ISO image file.
3. Add the version 7.1.4 CloudLink Agent MSI installer file to the Group Policy Object .

Change CloudLink Vault unlock modes

Use this procedure to change CloudLink Vault unlock modes.

Prerequisites
The CloudLink Vault must be set to Auto Unlock mode before upgrading the agents. This allows CloudLink Center to unlock
immediately after the upgrade process begins so that all CloudLink Agents can be upgraded.

About this task

You can also set CloudLink Vault to Manual Unlock before the upgrade. But, you must:
● Enter one of the CloudLink Vault passcodes when prompted.
● Unlock CloudLink Center after the upgrade process.
NOTE: It is recommended to set the CloudLink Vault to Auto Unlock mode before starting the upgrade process.

Steps
1. Change the CloudLink Vault to the Auto Unlock mode:
a. Log in to CloudLink Center.
b. Click System > Vault.
c. On the Vault page, click Actions > Change Mode.
d. In the Confirm Unlock Mode Change dialog box, when prompted to confirm the Auto Unlock mode change request,
click Change.
2. Change the CloudLink Vault to the Manual Unlock mode:
a. Log in to CloudLink Center.
b. Click System > Vault.
c. On the Vault page, click Actions > Change Mode.
d. In the Confirm Unlock Mode Change dialog box, when prompted with the confirm the Manual Unlock mode change
request, click Change.

CloudLink upgrade overview 7

Upgrade CloudLink
Use this procedure to upgrade CloudLink.

Prerequisites
● Ensure that your account has the required Update System permission.
● Set CloudLink Vault to Auto Unlock mode before the upgrade begins. This setting enables CloudLink Center to unlock
immediately after the upgrade so that all CloudLink Agents can be upgraded. If CloudLink Vault is set to the Manual Unlock
mode before the upgrade, it remains in Manual Unlock mode after the upgrade and the vault is locked. You can change the
vault back to the Manual Unlock mode after the upgrade. See Change CloudLink Vault unlock modes.

Steps
1. Ensure that the CloudLink Vault is set to the Auto Unlock mode.
2. Log in to CloudLink Center.
3. Click System > Upgrade.
4. Click Upload.

5. In the Upload ISO dialog box, click to go to the upgrade ISO file, and then click Upload.
If you are upgrading a CloudLink Center cluster, it can take several seconds for the ISO image file to upload to all nodes in a
cluster. Do not attempt to upload the ISO file again during this time.
NOTE: For any reason, if the ISO image file ISO file is not automatically uploaded to all cluster nodes, manually upload
the ISO file to each cluster node.

6. Click Upgrade.
7. In the Confirm Host Upgrade dialog box, click Upgrade.
Your connection to CloudLink Center is lost during the upgrade process. After the upgrade operation is complete, the login
page is displayed.
8. Log in to CloudLink Center again when the upgrade is complete and perform the Postupgrade verification.

Upgrade CloudLink Agents manually

Use this task if you want to manually upgrade CloudLink Agents in a particular machine group.

Prerequisites
Ensure that your account has the Update System permission, which is required to upgrade CloudLink.
NOTE: If you are using CloudLink Center for KMIP purposes, then you do not have to perform the following tasks for
upgrading agents.

Steps
1. Set the Machine Agent Upgrade policy to Manual for the machine group that contains machines that have CloudLink
Agents you want to upgrade manually.
2. Upgrade CloudLink Center to version 7.1.4 by following steps 1 through 6 in Upgrade CloudLink.
3. Log in to CloudLink Center.
4. Click Agents > Machines.
5. Select a machine in the list, and then click Actions > Upgrade. Repeat this step for every machine that requires a CloudLink
Agent upgrade.

8 CloudLink upgrade overview

Upgrade CloudLink Center Encryption for Container
agents
When you upgrade the version of CloudLink Center, you must upgrade the corresponding Helm charts so you can upgrade the
agents and use the latest features of CloudLink.

Prerequisites
Ensure that you have the installed the necessary:
● Python packages (sys, yaml) and sshpass.
● Encryption for Container agents.
To upgrade the Helm charts, do the following:

Steps
1. Download the upgrade scripts from https://dl.dell.com/downloads/DLD1596.
2. Run the following script to convert the upgrade script into an executable format: chmod 777 upgradeScript.sh.
3. Run the following script to upgrade the agent version: ./upgradeScript.sh. Ensure that you enter the variables in the
script. For example:
● The values.yaml path of the older version for the old_values_loc variable. By using the Extract_values.py
data, the CloudLink IP address is extracted.
● The IP, docker port, release name, new node image name, new controller image name variables respectively in doc_ip,
doc_port, releasename, node_image, controller_image.
NOTE: When running the upgradeScript.sh, enter data such as namespace, release name, docker IP address.
Do not enter hostname and docker IP address in the node and controller image names. For example, enter sdp-
node72190:v1.0.0, sdp-controller72190:v1.0.0.
The node and controller image files are built and pushed to the registry. The Replace_values.py command is run to
replace the previous configuration from the old values.yaml file, and then the new values.yaml file is updated with
new docker image for node and controller. The Helm chart is upgraded. All these operations are performed in a separate
new-values directory which will be created at the same location where these scripts are placed.
NOTE: If the upgrade operation is unsuccessful, then the data in the new values.yaml file is deleted. By using the
steps recommended in the error message, retry the upgrade operation.

Upgrade PowerFlex agents

CAUTION: Only PowerFlex 3.6.0.2 and later versions will support the new SDS mapper introduced in CloudLink
7.1.2. PowerFlex must be upgraded to 3.6.0.2 prior to upgrading CloudLink to 7.1.3 or later versions. To upgrade
CloudLink agents on SDS nodes to use CloudLink 7.1.2, 7.1.3 or later versions, you must manually update the
PowerFlex devices. For information about using the upgraded mapper path on PowerFlex 3.6.0.2 and later
versions, see the "Migrate the PowerFlex nodes to the new CloudLink path" section in the Dell EMC PowerFlex
CloudLink for SDS Devices document available on the support site.

CloudLink upgrade overview 9

 4
Verify connection between VM and CloudLink
Center after upgrade
Use this task to perform a veify connection between VM and CloudLink Center after upgrade.

Prerequisites
Ensure that CloudLink 7.1.4 is successfully upgraded.

Steps
1. Ensure that all VMs are connected and stable in CloudLink Center.
● CloudLink Agents on connected machines attempt to connect to CloudLink Center after the upgrade is complete.
● If a machine is in a machine group that uses the Auto upgrade policy, the CloudLink Agent that is installed on that
machine is automatically upgraded to version 7.1.4.
● If a machine is in a machine group that uses the Manual upgrade policy, you must manually upgrade the agent. See
Upgrade CloudLink Agents manually.
2. Ensure that all keystores are accessible by CloudLink Center.
3. On all Windows VMs, ensure that CloudLink Agent is connected to CloudLink Center and running version 7.1.4.
4. On all Linux virtual machines:
a. Run the svm about command to ensure that the CloudLink Agent version appears as “Version 7.0.xxxx”.
b. Run the svm status command to ensure that the volume encryption type is listed as dmcrypt, ecryptfs, or LUKS
volume types in the third column. Those volumes are legacy Linux formats used by CloudLink version 5.0 and earlier, and
are no longer supported.
It is recommended that you contact Dell Technologies Support team to decrypt the ecryptfs or LUKS volumes and
encrypt them using dmcrypt.
NOTE: Key rotation is not available for ecryptfs volumes until they are decrypted and reencrypted.

5. In CloudLink Center, check if these alarms were triggered after the upgrade:
● If the Backup file wasn’t downloaded/uploaded to store recently alarm was triggered, download a
backup of the new CloudLink 7.1.4.
● If the Vault unlock codes are not configured alarm was triggered, set the CloudLink Vault passcodes as
described in the Dell EMC CloudLink Administration Guide.
● If The keystore is not accessible alarm was triggered, check the alarm for detailed information. This alarm is
cleared when the keystore locations are accessible.
6. If you changed the CloudLink Vault unlock mode from Manual Unlock to Auto Unlock before the upgrade, change it back
to Manual Unlock. For more information, see Change CloudLink Vault unlock modes.
7. Restart the VMs to ensure that their boot processes are unaffected by the upgrade.

10 Verify connection between VM and CloudLink Center after upgrade

 5
Troubleshooting and getting help
Go to Dell Technologies Online Support and click MyService360. You will see several options for contacting the Dell
Technologies Technical Support team. To open a service request, you must have a valid support agreement. Contact your Dell
Technologies Sales representative for details about obtaining a valid support agreement or with questions about your account.
Dell Technologies support, product, and licensing information can be obtained from also your Dell Technologies account
manager.

Troubleshooting and getting help 11