Cluster Version 12

Overview

Cluster version 12 introduces secure cluster messaging between cluster nodes. Secure cluster messaging requires the use of X.509 digital certificates to verify cluster nodes are trusted before allowing them to start in the cluster.

When a cluster is running at cluster version 11 and all nodes support secure cluster messaging, the following message is issued when clustering starts:

About this task

This procedure describes how to configure the required certificates, upgrade the cluster version, and perform initial authentication of each cluster node.

Before You Begin

Confirm the following before upgrading:

• This requires the following software products are installed on the systems:

  • IBM i Option 34 (Digital Certificate Manager)

  • IBM i Option 35 (CCA Cryptographic Services Provider)

• You have sufficient authority to manage certificates through IBM Digital Certificate Manager

• You can sign into each cluster node

• You have *IOSYSCFG special authority on each cluster node

• The potential HA version of all nodes in the cluster are at least 6.2.x. Use the DSPCLUINF command to verify the potential version of all cluster nodes.

Procedure

Changing Clustering to Only Allow Nodes that are Authenticated

1. Run the following command: CHGNETA ALWADDCLU(*RQSAUT).

2. In Digital Certificate Manager, assign a certificate to the QIBM_QCST_CLUSTER_SECURITY application.

3. If using a self-signed certificate, ensure that the certificate authorities for all nodes are trusted by all the nodes in the cluster.

4. Repeat steps 1-3 for all nodes in the cluster.

Validate the Certificate Configuration

1. End clustering on all nodes: ENDCLUNOD NODE(*ALL).

2. Start clustering on all nodes using the STRCLUNOD command.

3. Verify that all nodes have a status of Active by using the DSPCLUINF command.

Upgrade the PowerHA Version (If Required)

If the current HA version shown in DSPCLUINF is less than 6.2.x, use the CHGCLUVER command to upgrade the PowerHA version until it is at 6.2.x. The following command, increases the modification level of PowerHA in the cluster MYCLU.
CHGCLUVER CLUSTER(MYCLU) CLUVER(*SAME) HAVER(*UP1MOD)

End clustering on all but a single node

1. End clustering on all nodes: ENDCLUNOD NODE(*ALL).

2. Start clustering just on the local node: STRCLUNOD NODE(*).

Upgrade the Cluster Version

1. On the local node, run the CHGCLUVER command to upgrade the cluster version. The following is an example of the command for the cluster MYCLU: CHGCLUVER CLUSTER(MYCLU)

2. A confirmation panel is displayed, press F16 to confirm the cluster version change.

Authenticating Remote Nodes

Before additional nodes can be started, each node must be authenticated with the cluster using a one-time authentication code. This authentication process normally is only required once per node.

1. On the active cluster node, generate a code for a remote node with the CHGCLUNODE command. The following example generates an authentication code for a node named DR:
   CHGCLUNODE NODE(DR) OPTION(*GENOTP)

2. A panel is displayed with the code hidden. Press F16 to display the one-time authentication code.

3. Sign in to the DR node.

4. Run the command to set the authentication code: CHGCLUNODE NODE(DR) OPTION(*SETOTP)

5. A panel is displayed with the option to enter the generated code. Provide the generated code and press enter.

6. Return back to the active cluster node and run STRCLUNOD NODE(DR) to start clustering.

7. Repeat steps 1 through 6 for each additional node in the cluster.

Results

Clustering is now at version 12 and all nodes are active.