将旧版 SUSE Multi-Linux Manager 服务器迁移到容器

要将旧版 SUSE Multi-Linux Manager 服务器迁移到容器，需要准备一台新计算机。

在该迁移场景中，旧版 SUSE Multi-Linux Manager 服务器（RPM 安装方式）有时也被称为_旧服务器_。

1. 要求和注意事项

1.1. 主机名

目前，该迁移过程既不支持就地迁移，也不提供主机名重命名功能。

因此，新服务器的完全限定域名 (FQDN) 将与旧版服务器保持一致。

迁移之后，需要更新 DHCP 和 DNS 记录以指向新的服务器。

有关详细信息，请参见 完成迁移。

2. GPG 密钥

  • 自信任 GPG 密钥不会被迁移。

  • GPG keys that are trusted in the RPM database only are not migrated. Thus synchronizing channels with spacewalk-repo-sync can fail.

  • 在完成服务器的实际迁移后，管理员必须手动将这些密钥从旧版 SUSE Multi-Linux Manager 系统迁移到容器主机。

过程：将 GPG 密钥手动迁移到新服务器

  1. 将旧版 Uyuni 服务器中的密钥复制到新服务器的容器主机。

  2. Later, add each key to the migrated server with the command mgradm gpg add <PATH_TO_KEY_FILE>.

2.1. 旧版服务器上的初始准备工作

迁移可能需要很长时间，具体时长取决于需要复制的数据量。为了减少停机时间，可以在初始复制、重新复制或最终复制和切换过程中多次执行迁移，同时旧版服务器上的所有服务都可以保持正常运行。

只有在最终迁移期间才需要停止旧版服务器上的进程。

For all non-final replications add the parameter --prepare to prevent the automatic stopping the services on the legacy server. For example:

mgradm migrate podman <oldserver.fqdn> --prepare
过程：旧版服务器上的初始准备工作

  1. 停止 SUSE Multi-Linux Manager 服务：

    spacewalk-service stop

  2. 停止 PostgreSQL 服务：

    systemctl stop postgresql

2.2. SSH 连接准备

过程：准备 SSH 连接

  1. Ensure that for root an SSH key exists on the new 5.1 server. If a key does not exist, create it with the command:

    ssh-keygen -t rsa

  2. 新服务器上的 SSH 配置和代理应准备就绪，这样在连接旧版服务器时，就不会出现输入口令的提示。

    eval $(ssh-agent); ssh-add

    To establish a connection without prompting for a password, the migration script relies on an SSH agent running on the new server. If the agent is not active yet, initiate it by running eval $(ssh-agent). Then add the SSH key to the running agent with ssh-add followed by the path to the private key. You will be prompted to enter the password for the private key during this process.

  3. Copy the public SSH key to the legacy SUSE Multi-Linux Manager Server (<oldserver.fqdn>) with ssh-copy-id. Replace <oldserver.fqdn> with the FQDN of the legacy server:

    ssh-copy-id <oldserver.fqdn>

    The SSH key will be copied into the legacy server’s ~/.ssh/authorized_keys file. For more information, see the ssh-copy-id manpage.

  4. Establish an SSH connection from the new server to the legacy SUSE Multi-Linux Manager Server to check that no password is needed. Also there must not by any problem with the host fingerprint. In case of trouble, remove old fingerprints from the ~/.ssh/known_hosts file. Then try again. The fingerprint will be stored in the local ~/.ssh/known_hosts file.

2.3. 执行迁移

在规划从旧版 SUSE Multi-Linux Manager 到容器化 SUSE Multi-Linux Manager 的迁移时，请确保您的目标实例达到或超过旧版设置的规格。这包括但不限于内存 (RAM)、CPU 核心、存储空间和网络带宽。

SUSE Multi-Linux Manager server hosts that are hardened for security may restrict execution of files from the /tmp folder. In such cases, as a workaround, export the TMPDIR environment variable to another existing path before running mgradm.

例如：

export TMPDIR=/path/to/other/tmp

在 SUSE Multi-Linux Manager 的后续更新中，相关工具将进行优化，届时无需再使用此临时解决方案。

2.3.1. 配置自定义永久性存储

Configuring persistent storage is optional, but it is the only way to avoid serious trouble with container full disk conditions. It is highly recommended to configure custom persistent storage with the mgr-storage-server tool.

For more information, see mgr-storage-server --help. This tool simplifies creating the container storage and database volumes.

如下所示使用命令：

mgr-storage-server <storage-disk-device> [<database-disk-device>]

设备上不得存在任何文件系统。如果存储设备上存在文件系统，命令会中止。

例如：

mgr-storage-server /dev/nvme1n1 /dev/nvme2n1

This command will create the persistent storage volumes at /var/lib/containers/storage/volumes.

有关详细信息，请参见

2.3.2. 执行迁移

  1. Execute the following command to install a new SUSE Multi-Linux Manager server. Replace <oldserver.fqdn> with the FQDN of the legacy server:

    mgradm migrate podman <oldserver.fqdn>

  2. 迁移可信 SSL CA 证书。

2.3.3. 证书的迁移

Trusted SSL CA certificates that were installed as part of an RPM and stored on a legacy SUSE Multi-Linux Manager in the /usr/share/pki/trust/anchors/ directory will not be migrated. Because SUSE does not install RPM packages in the container, the administrator must migrate these certificate files manually from the legacy installation after migration:

过程：迁移证书

  1. 将旧版服务器中的该文件复制到新服务器。 For example, as /local/ca.file.

  2. 使用以下命令将文件复制到容器中：

    mgrctl cp /local/ca.file server:/etc/pki/trust/anchors/

2.3.4. 完成迁移

After successfully running the mgradm migrate command, the Salt setup on all clients will still point to the legacy server.

要将其重定向到新的 5.1 服务器，需要在基础架构级别（DHCP 和 DNS）重命名新服务器，以使用与旧版服务器相同的 FQDN 和 IP 地址。

如果迁移过程中出现问题，可重启旧系统。请以 root 身份执行以下命令，重启 PostgreSQL 和 spacewalk 服务：

service postgresql start
spacewalk-service start

3. Kubernetes 准备工作

Before executing the migration with mgradm migrate command, it is essential to predefine Persistent Volumes, especially considering that the migration job initiates the container from scratch.

有关详细信息，请参见安装章节中关于准备这些卷的内容，具体可查看 永久性容器卷。

4. 迁移

执行以下命令安装新的 SUSE Multi-Linux Manager 服务器（请将 <oldserver.fqdn> 替换为旧版服务器的相应 FQDN）：

mgradm migrate podman <oldserver.fqdn>

或

mgradm migrate kubernetes <oldserver.fqdn>

After successfully running the mgradm migrate command, the Salt setup on all clients will still point to the legacy server. To redirect them to the new server, it is required to rename the new server at the infrastructure level (DHCP and DNS) to use the same FQDN and IP address as the legacy server.