Apply a DSE 5.1 patch release

Improper upgrades can result in downtime, data loss, and other errors.

To minimize risk for an upgrade, review the entire upgrade guide before you begin, including warnings, restrictions, release notes, and all pre-upgrade, upgrade, and post-upgrade steps.

You must prepare all nodes in the cluster before upgrading any nodes. Failure to prepare all nodes can result in mismatched configurations, repair states, and schemas that can disrupt the upgrade process.

Use these instructions to manually apply a patch release for DataStax Enterprise (DSE) 5.1.

Upgrade path to avoid data loss

TTL expiration timestamps are susceptible to the year 2038 problem. If the TTL value is long and an expiration date that is greater than the maximum threshold of 2038-01-19T03:14:06+00:00, the data is immediately expired and purged on the next compaction. To protect against silent data loss, upgrade to DSE 5.1.7 or later and recover and reinsert rows with overflowed timestamps.

As a best practice, always upgrade to the latest available patch release unless you have specific requirements to do otherwise.

Check your current version with dse -v, and then compare it with the latest version available for your DSE release series.

Avoid certain operations during the upgrade

The upgrade process for DSE can be completed with minimal downtime (ideally zero) by upgrading nodes in a rolling fashion: upgrade and restart one node at a time while the other nodes continue to operate.

The moment that you install the new version on one node in a cluster, the cluster enters a partially upgraded state. In this state, the cluster continues to operate as though all nodes are running the earlier, pre-upgraded version. The cluster remains in this state until you have upgraded all nodes in the cluster.

You must avoid or block the following operations during the upgrade to maintain cluster stability and prevent errors:

Don’t enable new features.

This restriction includes net new features and existing features that you weren’t using previously. For example, don’t enable Change Data Capture (CDC) for the first time during an upgrade. Upgrade the entire cluster, and then enable the feature.
Don’t change credentials, permissions, or any other security settings unless explicitly instructed to do so.

To preserve your existing configuration, you will transfer your existing security settings from your current configuration files to the new configuration files during the upgrade process. The new files might use different settings due to enhancements, deprecations, and removals between versions. This mapping is required for a successful upgrade, and it isn’t the same as an extraneous change to the security configuration.

Examples of security changes to avoid include modifications to authenticators, authorizers, CQL roles, and CQL permissions. Postpone all such changes until after the upgrade.

If you aren’t already using Kerberos, don’t set up Kerberos authentication immediately before upgrading. First upgrade the cluster, and then set up Kerberos. If you are already using Kerberos, you can continue to use it during the upgrade.
Don’t run repairs manually or automatically:
- Disable all automated and scheduled repairs, including Reaper, crontab, and scripts that run nodetool repair.
- Don’t manually run commands like nodetool repair.
- Don’t repair SSTables while the cluster is in a partially upgraded state. Only repair SSTables before and after upgrading the entire cluster.
  
  If enabled, stop the DSE OpsCenter Repair Service.
You must complete the cluster-wide upgrade before the expiration of gc_grace_seconds (approximately 10 days by default) to ensure any post-upgrade repairs complete successfully.

Attempting to run repairs on partially upgraded clusters can cause performance issues, data inconsistencies, and repair failures. If you absolutely must run repairs on a partially upgraded cluster, determine which SSTable formats and streaming protocols are supported on each node, and then thoroughly test your intended repair operation on an isolated non-production cluster. Small incremental repairs are less risky but they aren’t risk free.
Don’t add (bootstrap) new nodes or decommission existing nodes.
Don’t issue DDL-related queries like TRUNCATE.

Depending on your infrastructure, workloads, and consistency levels, you might want to avoid other operations that could require excessive resources or coordination across mixed-version nodes. For example, BATCH operations can be resource intensive.
Don’t alter any schemas.

Schema versions must be consistent across the cluster before starting the upgrade.

Propagation of schema changes between mixed-version nodes can cause query failures, data consistency issues, and other errors. Take action to prevent schema changes from occurring during the upgrade process.

During the upgrade, it is normal for nodes on different versions to show schema disagreements. These disagreements should resolve after the entire cluster is upgraded.
Don’t rebuild indexes during the upgrade.
Disable services that can cause data inconsistencies and interfere with the upgrade process:
- Disable backup services, scheduled backups, and automated snapshots.
If you disabled the Performance Service before the upgrade, don’t reenable it during the upgrade.
DSE Analytics nodes: Don’t run analytics jobs until all nodes are upgraded.

When upgrading to a new major or minor version of DSE, all nodes in a DSE datacenter that run Spark must be on the same version of Spark, and the Spark jobs must be compiled for that version. To determine the Spark version, see the DSE release notes.

Before reinitiating Spark jobs, all datacenters comprising a Spark cluster must be on the same upgraded DSE version. If any Spark jobs run against Graph keyspaces, don’t reinitiate Spark jobs until you have upgraded all Analytics and non-Analytics nodes in the entire cluster. When Graph keyspaces are involved, Spark jobs fail due to mixed Spark and DSE versions across all nodes.

Strict upgrade order for cluster stability

Don’t upgrade any nodes until you have completed the pre-upgrade steps on all nodes.

When upgrading nodes, always upgrade seed nodes before non-seed nodes.

To avoid cluster-wide downtime, you must upgrade and restart one node at a time in a specific order based on workload types and deployment architecture:

For multi-cluster deployments, upgrade one cluster at a time.
For multi-datacenter clusters, upgrade one datacenter at a time.
If using racks, upgrade one rack at a time within a datacenter.
Within a datacenter (or rack), upgrade one node at a time, starting with seed nodes.
If using advanced workloads (Analytics, Graph, Search), upgrade datacenters or nodes according to the following workload type hierarchy:
1. Upgrade DSE Analytics datacenters.
2. Upgrade transactional (Cassandra) and DSE Graph datacenters.
3. Upgrade DSE Search datacenters.
If each datacenter has only one workload type, upgrade your datacenters in the given order. Within each datacenter, proceed rack-by-rack (if applicable) and node-by-node, starting with the seed nodes.

If a datacenter has multiple workload types, upgrade nodes within that datacenter in the given order, starting with the seed nodes. If using racks, apply the hierarchy to each rack.
Repeat until you have upgraded all nodes in all racks, datacenters, and clusters.

Use an isolated deployment to test the upgrade.

For example, in multi-datacenter clusters with an active-passive configuration, you can complete the entire upgrade process (pre-upgrade, upgrade, and post-upgrade) on the passive datacenter first, run performance tests on that datacenter, and then upgrade the active datacenter if the tests are successful. If the tests fail, you can destroy the passive datacenter and rebuild it without impacting the active datacenter.

Similarly, if you have a test deployment with no connectivity to your production nodes, datacenters, or clusters, then you can safely perform the entire upgrade process in that isolated deployment before rolling out the upgrade to your production deployment.

Prepare to upgrade

Before upgrading any node, you must prepare all nodes for the upgrade. Complete the pre-upgrade steps on every node in the recommended order. Following the recommended order ensures that you don’t miss any nodes, although some steps aren’t applicable to every node.

Some pre-upgrade steps provide information about actions that you must take later in the upgrade process. This information is given in advance because it might impact your upgrade plan. Be sure to revisit these steps at the appropriate time.

Familiarize yourself with the changes and features in the new release, reviewing all releases between your current version and the latest 5.1 patch release as well as Apache Cassandra® changes:
Make sure each node has adequate free disk space for the upgrade.

The required overhead depends on the compaction strategy. For more information, see Disk space.
1. Get the size of the DSE data directory:
  sudo du -sh /var/lib/cassandra/data/
2. Check available space on disk:
  sudo df -hT /
  The following output includes one disk named /dev/sda1. Your output depends on your disk configuration.
  Filesystem Type Size Used Avail Use% Mounted on /dev/sda1 ext4 59G 16G 41G 28% /
3. If necessary, make adjustments to your disks or data directory configuration to allow for more disk space.

DSE Analytics nodes: If you use DSEFS authorization, you must enable DSE authorization before upgrading to DSE 5.1.6 or later.

Starting in DSE 5.1.6, DSEFS authorization is dependent on DSE authorization, which is separate from DSE authentication. In earlier versions, enabling DSE authentication also enabled DSEFS authorization regardless of the state of DSE authorization.

If you enable DSE authentication only (leaving DSE authorization disabled), then DSEFS authorization is disabled.

Don’t make this change during the upgrade. Only change your security configuration before or after upgrading the entire cluster.

DSE Search nodes: Tune the schema before you upgrade:
- Starting in DSE 5.1.4, all field definitions in the schema are validated and must be compatible with DSE Search. This requirement applies to all fields, including fields with docValues applied, fields used as a copy-field source, and fields that aren’t indexed.
  
  By default, automatic resource generation includes all columns. To improve performance, take action to prevent fields from being loaded from the database. For example, make sure your schema includes only required fields by removing or commenting out unused fields.
- All unique key elements must be indexed in the Solr schema. In schema.xml, make sure all unique key fields have indexed=true.
If you change the schema, do a full reindex:
```
dsetool reload_core keyspace_name.table_name schema=filepath solrconfig=filepath reindex=true deleteAll=true distributed=false
```

Upgrade all SSTables on all nodes.

To avoid significant performance degradation and issues with incompatible SSTables formats, always upgrade SSTables before and after any database upgrade, including minor and patch releases.

This process is recommended for all upgrades, and it is critical for upgrades that involve a major underlying Cassandra version change.

On each node, run nodetool upgradesstables with the -a flag to ensure that all SSTables use the latest SSTable format and version for your current database version:

nodetool upgradesstables -a

DataStax recommends running the upgradesstables command on one node at a time or, when using racks, one rack at a time. Running the command on too many nodes at once can degrade performance.

You can use the --jobs option to set the number of SSTables that upgrade simultaneously. The default setting is 2, which minimizes the impact on the cluster. Set to 0 to use all available compaction threads.

If all SSTables are already on the latest version and format, the command returns immediately and takes no action.

For more information about this command, see nodetool upgradesstables.

Run nodetool repair to ensure that data on each replica is consistent with data on other nodes:
```
nodetool repair -pr
```
Repair nodes on a regular basis to minimize the overhead and time required for repair operations.

If you use DSE OpsCenter, you can repair nodes with the Repair Service but you must disable the Repair Service before upgrading any nodes.

Back up all DSE data and files, and then store the backups separately from your existing DSE installation.

Backup your existing installation before every upgrade, regardless of the extent of the upgrade.

To avoid data loss, you must store your backup configuration files in a separate directory from your DSE installation. The new version overwrites configuration files that are present in the installation directory, replacing all existing values with new default values.

Examples of data and files to back up include:

SSTable snapshots
Commit logs
Logs
Configuration files
Encrypted table recovery data:
- A snapshot of the entire dse_system keyspace with the encrypted_keys table
- All system keys

Some backup files are used during the upgrade process to align the new version with the previous version, and a complete backup is required if you need to rollback to the previous version or restore lost data.

If your upgrade requires significant pre-upgrade changes, consider creating a backup before making those changes and again immediately before upgrading the first node. Create the final backup as close to the beginning of your upgrade as possible to ensure your backup contains the most recent configuration files and data.

For instructions, see Back up and restore a DSE package installation or Back up and restore a DSE tarball installation.

Upgrades from 5.1.0 or 5.1.1: Restart the node with -Dcassandra.force_3_0_protocol_version=true to enforce a backwards-compatible protocol version:
```
installation_location/bin/dse cassandra -Dcassandra.force_3_0_protocol_version=true
```
After the upgrade is complete, you can remove this flag.

This step isn’t required if you are already running 5.1.2 or later.

While mixed versions exist during the upgrade, don’t add or remove columns from existing tables.

Upgrade steps

Upgrade one node at a time in the recommended order. Following the recommended order minimizes downtime and ensures that you don’t miss any nodes.

DSE Analytics nodes: Kill all Spark worker processes:

for pid in $(jps | grep Worker | awk '{print $1}'); do kill -9 $pid; done

Flush the commit log of the current installation:
```
nodetool drain
```
Stop the node.

Install the new DSE 5.1 version, but don’t start DSE.

Don’t start DSE yet. Before restarting the node, you must reconfigure DSE as explained in the next steps.

If you use DSE OpsCenter, you can use Lifecycle Manager (LCM) to clone a configuration profile and run an upgrade job on a datacenter or node. This approach can help streamline the install and reconfiguration process.

Use the same installation type as your current version. Mismatched installation types can cause problems with the upgrade.

Package install using Yum
Package install using APT
Binary tarball install
DataStax Installer

Support for the DataStax Installer ended with DSE 5.1.10. If you previously used the DataStax Installer, you must migrate to a tarball or a package installation to upgrade past 5.1.10.

Configure the new DSE version by comparing the new configuration files to your backup configuration files.

Patch releases are unlikely to introduce significant changes, but you must ensure that your existing settings are transferred to the new version. The extent of the changes depends on your workloads, previous configurations, and the number of patch releases between your current and new versions. For example:

Remove deprecated and removed settings.
Configure new settings.
Migrate previous custom configuration values to your new configuration files.
Modify previous configurations to account for changes described in the DSE release notes.

You must use the new configuration files included with your new installation. Copy values from your old configuration files into the new files. Don’t overwrite entire files with the old files.

For default configuration file locations in DSE 5.1, see Default file locations for package and Installer-Services installations and Default file locations for tarball and Installer-No Services installations.

You can use the yaml_diff tool to compare your backup YAML files with the new YAML files:

cd /usr/share/dse/tools/yamls

./yaml_diff path/to/yaml-file-old path/to/yaml-file-new

The output is a diff between the specified YAML files. For example:

...
 CHANGES
=========
authenticator:
- AllowAllAuthenticator
+ com.datastax.bdp.cassandra.auth.DseAuthenticator

authorizer:
- AllowAllAuthorizer
+ com.datastax.bdp.cassandra.auth.DseAuthorizer

roles_validity_in_ms:
- 2000
+ 120000
...

Make sure the catalina.properties and context.xml files are present in the Apache Tomcat® conf directory.

DSE won’t start after the upgrade if these files are missing.

The default location of the Tomcat conf directory depends on the type of installation:
- Package installations: /etc/dse/tomcat/conf
- Tarball installations: INSTALL_DIRECTORY/resources/tomcat/conf

Upgrades to 5.1.0 through 5.1.15: If you are intentionally installing a version earlier than 5.1.16 and any tables use DSE Tiered Storage, then you must remove all txn_compaction log files from second-level tiers and lower.

At versions 5.1.0 to 5.1.15, data loss can occur if you don’t remove the txn_compaction log files before starting DSE. Additionally, versions 5.1.0 to 5.1.7 are susceptible to the Year 2038 problem. DataStax strongly recommends that you upgrade to 5.1.16 or later.

You can find the tiers and directories in the dse.yaml configuration file. For example, given the following tiered_storage_options configuration, you would remove txn_compaction log files from the /mnt2 and /mnt3 directories:

tiered_storage_options:
    strategy1:
        tiers:
            - paths:
                - /mnt1
            - paths:
                - /mnt2
            - paths:
                - /mnt3

The following example removes the files from the second and third tier directories using find commands:

find /mnt2 -name "*_txn_compaction_*.log" -type f -delete &&
find /mnt3 -name "*_txn_compaction_*.log" -type f -delete

Start the node:
- Package installations: Starting DataStax Enterprise as a service
- Tarball installations: Starting DataStax Enterprise as a stand-alone process
Verify that the upgraded datacenter names match the datacenter names in the keyspace schema definition.

This is only relevant when using NetworkTopologyStrategy.
1. Get the node’s datacenter name:
  nodetool status | grep "Datacenter"
2. Get the replication configuration for a keyspace:
  cqlsh --execute "DESCRIBE KEYSPACE keyspace-name;" | grep "replication"
3. If the datacenter name in replication does not match the node’s datacenter name, alter or recreate the keyspace accordingly:
  ALTER KEYSPACE keyspace-name WITH replication = {'class': 'NetworkTopologyStrategy', 'datacenter-name': '3'};
Review the logs for warnings, errors, and exceptions:
```
grep -w 'WARN\|ERROR\|exception' /var/log/cassandra/*.log
```
If the default log location returns no results, check dse-env.sh for custom log locations.

Warnings, errors, and exceptions are frequently found in the logs when starting an upgraded node. Some messages provide information to help you complete specific upgrade steps, and some messages can be ignored while the cluster is in a partially upgraded state. If you find warnings, errors, or exceptions that are unexpected or persist after upgrading the entire cluster, contact IBM Support.
Repeat the upgrade process on each node in the cluster following the recommended order.

Post-upgrade steps

The post-upgrade steps include multi-node and cross-datacenter operations that can cause errors while a cluster is in a partially upgraded state. For example, repairs can propagate incompatible data between mixed-version nodes, and SSTable snapshots can be corrupted or unreadable due to mixed SSTable formats and versions.

Only start the post-upgrade steps after you upgrade all dependent nodes. Node dependencies are determined by your deployment architecture:

Architecture	Examples	Post-upgrade path
Isolated or non-production deployment	Upgrading a test deployment before rolling out the upgrade to production. Upgrading a passive datacenter in an active-passive multi-datacenter deployment.	Start the post-upgrade steps after upgrading all nodes in the test deployment or passive datacenter. For example, in a test deployment with two datacenters and cross-datacenter replication, you must upgrade all nodes in both datacenters before starting the post-upgrade steps. In contrast, in a test deployment with one datacenter and no cross-datacenter connections, you must upgrade all nodes in that datacenter before starting the post-upgrade steps.
Production deployment	Rolling out an upgrade to an entire production cluster. Upgrading a multi-datacenter deployment that has cross-datacenter replication.	Start the post-upgrade steps after upgrading all nodes included in the deployment. For example, in a multi-datacenter deployment with cross-datacenter replication, you must upgrade all nodes in all datacenters before starting the post-upgrade steps.

Architecture

Examples

Post-upgrade path

Isolated or non-production deployment

Upgrading a test deployment before rolling out the upgrade to production.
Upgrading a passive datacenter in an active-passive multi-datacenter deployment.

Start the post-upgrade steps after upgrading all nodes in the test deployment or passive datacenter.

For example, in a test deployment with two datacenters and cross-datacenter replication, you must upgrade all nodes in both datacenters before starting the post-upgrade steps.

In contrast, in a test deployment with one datacenter and no cross-datacenter connections, you must upgrade all nodes in that datacenter before starting the post-upgrade steps.

Production deployment

Rolling out an upgrade to an entire production cluster.
Upgrading a multi-datacenter deployment that has cross-datacenter replication.

Start the post-upgrade steps after upgrading all nodes included in the deployment.

For example, in a multi-datacenter deployment with cross-datacenter replication, you must upgrade all nodes in all datacenters before starting the post-upgrade steps.

Complete the post-upgrade steps progressively in the recommended order. Modify the recommended order as needed for your deployment architecture and workloads.

Upgrade all SSTables again.

Your database upgrade isn’t complete until you upgrade all SSTables.