Upgrade Cloud Exchange as a VM - Netskope Technical Documentation

Use these steps to upgrade Cloud Exchange as a VM, standalone or HA, to the latest version. For the supported upgrade paths and the other deployment type, refer to Upgrade Cloud Exchange.

Prerequisites

If you upgrade from Cloud Exchange v5.1.0 or earlier, first upgrade the underlying Ubuntu OS from 20.04 to 22.04. For details, refer to Cloud Exchange KB Articles.
If you are upgrading from Cloud Exchange Version 5.1.1, 5.1.2, 6.0.0, 6.0.1 or 6.1.0 to any newer version in CE as a VM deployment, make sure to upgrade the underlying Ubuntu OS version to 24.04 — refer to the Cloud Exchange KB Articles.
Before you start the upgrade, make sure your instance meets the Cloud Exchange System Requirements.
Make sure the VM can connect to https://cloud-exchange-store.s3.us-east-1.amazonaws.com.
Disable all source plugins in all modules, and wait for the queued tasks to finish:
1. Wait 20 to 30 minutes after you disable the source plugins.
2. Go to Settings > Logging, click Filter Query, enter this filter in the Filters field, and click Load.
```
message Like "Ingested " || message Like "Stored " || message Like "task(s)" || message Like "Completed storing"
```
3. Monitor the filtered logs. When no new logs appear, continue with the upgrade.
4. After the upgrade is complete, enable the source plugins that you disabled.
Keep the maintenance password ready. You need it to complete some of the steps.

Important

If you lose the maintenance password, your existing data cannot be retained.

RabbitMQ data migration is not supported, because the queue type changed from Classic to Quorum.

If you run Cloud Exchange as a VM (OVA or Hyper-V) on a version earlier than v5.1.1, you need the root credentials of the VM.
Username: root
Password: M5#w6V+.T^8gv?%,

If you run Cloud Exchange as a VM on Azure or AWS, you can complete these steps yourself.

Standalone Deployment

To v7.0.0 from v5.1.1, v5.1.2, v6.0.0, v6.0.1, V6.1.0 Standalone Deployment

Before you start, complete the Prerequisites and take a backup. For details, refer to Backup Cloud Exchange.

Go to the /opt/cloudexchange/cloudexchange directory, and stop Cloud Exchange:
```
cd /opt/cloudexchange/cloudexchange
sudo ./stop
```

Add the Cloud Exchange public key as a trusted GPG key:

curl -fsSL https://cloud-exchange-store.s3.us-east-1.amazonaws.com/cloudexchange/upgrade-packages/cloud-exchange-public.gpg | sudo gpg --dearmor -o /etc/apt/trusted.gpg.d/cloud-exchange.gpg

Add the Cloud Exchange S3 URL as a package source:

echo "deb https://cloud-exchange-store.s3.us-east-1.amazonaws.com/cloudexchange/upgrade-packages stable main" | sudo tee /etc/apt/sources.list.d/cloud-exchange.list

Update the package sources:
```
sudo apt update
```
Upgrade Cloud Exchange, and wait for the upgrade to complete:
```
sudo apt install cloud-exchange=7.0.0-1
```
Before you run this command, make sure all the Cloud Exchange System Requirements are met for v7.0.0.
Run the setup script:
```
sudo python3 ./setup
```
Start Cloud Exchange:
```
sudo ./start
```
Close all your Cloud Exchange browser windows. Then clear the browser cache, or log in again in an incognito window. The Cloud Exchange UI is available at http(s)://<ip>.

HA Deployment

To v7.0.0 from v5.1.1, v5.1.2, v6.0.0, v6.0.1, v6.1.0 Standalone Deployment

Before you start, complete the Prerequisites and take a backup. For details, refer to Backup Cloud Exchange.

The existing standalone node becomes the primary node of the HA cluster. For details about the HA parameters and how to set up the cluster, refer to Cloud Exchange High Availability.

After you move to HA, Cloud Exchange may respond slowly for the first few minutes while the data is replicated to all the nodes.

On the Standalone Node (New Primary Node)

Go to the /opt/cloudexchange/cloudexchange directory, and stop the standalone deployment:
```
cd /opt/cloudexchange/cloudexchange
sudo ./stop
```

Add the Cloud Exchange public key as a trusted GPG key:

curl -fsSL https://cloud-exchange-store.s3.us-east-1.amazonaws.com/cloudexchange/upgrade-packages/cloud-exchange-public.gpg | sudo gpg --dearmor -o /etc/apt/trusted.gpg.d/cloud-exchange.gpg

Add the Cloud Exchange S3 URL as a package source:

echo "deb https://cloud-exchange-store.s3.us-east-1.amazonaws.com/cloudexchange/upgrade-packages stable main" | sudo tee /etc/apt/sources.list.d/cloud-exchange.list

Update the package sources:
```
sudo apt update
```
Upgrade Cloud Exchange, and wait for the upgrade to complete:
```
sudo apt install cloud-exchange=7.0.0-1
```
Before you run this command, make sure all the Cloud Exchange System Requirements are met for v7.0.0.

Copy the example configuration file, and open it for editing:

cp cloudexchange.config.example cloudexchange.config
vi cloudexchange.config

In cloudexchange.config, set the values of these fields. Also set any optional fields that you use or customized, such as the proxy configuration and UI port.
```
MAINTENANCE_PASSWORD=<old cloud exchange maintenance password>
JWT_SECRET=<old cloud exchange JWT secret>
```
JWT_SECRET is optional. If you leave it empty, the setup script generates a new JWT secret.
Remove the .env file:
```
sudo rm -rf .env
```
Run the setup script:
```
sudo python3 ./setup
```
Start Cloud Exchange:
```
sudo ./start
```
Open the UI of the primary node in your browser at https://<ip>, and log in with your existing Cloud Exchange credentials.
Go to Settings > General Settings > Node Configurations and enable the Enable HA toggle. In the Confirm Action pop-up, enter the Cloud Exchange IP address or FQDN only if you need to change it, and click Enable HA.

Important

While HA is being enabled, Cloud Exchange is temporarily unavailable and may restart several times.

On the Secondary Nodes

Complete steps 1 to 8 on each secondary node. Then add the secondary nodes from the UI of the primary node.

Deploy the latest Cloud Exchange as a VM image (OVA, AMI, Azure, Hyper-V, or KVM).
Go to the /opt/cloudexchange/cloudexchange directory:
```
cd /opt/cloudexchange/cloudexchange
```

On the primary node, copy the contents of the CA key file:

/opt/cloudexchange/cloudexchange/data/ssl_certs/mongodb_rabbitmq_certs/tls_cert_ca.key

On the secondary node, create the CA key file, paste the key that you copied, and save the file. The matching CA key lets the secondary node communicate with the HA cluster.
```
sudo vi /opt/cloudexchange/cloudexchange/data/ssl_certs/mongodb_rabbitmq_certs/tls_cert_ca.key
```
Remove the .env file:
```
sudo rm -rf .env
```

Copy the example configuration file, and open it for editing:

cp cloudexchange.config.example cloudexchange.config
vi cloudexchange.config

In cloudexchange.config, set the values of these fields:

Important

The JWT secret and the CA key of a secondary node must match the primary node. If they differ, adding the secondary node to the HA cluster fails with an authentication error. If you don’t know the JWT secret of the primary node, generate and apply a new one. For the steps, refer to Cloud Exchange Troubleshooting.
```
JWT_SECRET=<JWT_SECRET value of the primary node>
MAINTENANCE_PASSWORD=<old maintenance password>
```
Run the setup script:
```
sudo python3 ./setup
```
In the UI of the primary node, go to Settings > General Settings > Node Configurations and add the secondary nodes one at a time.

You don’t need to run the start script on the secondary nodes. It runs automatically when you add a secondary node from the UI of the primary node.

To v7.0.0 from v5.1.1, v5.1.2, v6.0.0, v6.0.1, v6.1.0 HA Deployment

Before you start, complete the Prerequisites and take a backup. For details, refer to Backup Cloud Exchange.

On All Nodes

Stop the secondary nodes first, and then the primary node, so that Cloud Exchange shuts down properly:
```
cd /opt/cloudexchange/cloudexchange
sudo ./stop
```

Add the Cloud Exchange public key as a trusted GPG key. Start with the primary node, and then continue with the secondary nodes:

curl -fsSL https://cloud-exchange-store.s3.us-east-1.amazonaws.com/cloudexchange/upgrade-packages/cloud-exchange-public.gpg | sudo gpg --dearmor -o /etc/apt/trusted.gpg.d/cloud-exchange.gpg

Add the Cloud Exchange S3 URL as a package source:

echo "deb https://cloud-exchange-store.s3.us-east-1.amazonaws.com/cloudexchange/upgrade-packages stable main" | sudo tee /etc/apt/sources.list.d/cloud-exchange.list

Update the package sources:
```
sudo apt update
```
Upgrade Cloud Exchange, and wait for the upgrade to complete:
```
sudo apt install cloud-exchange=7.0.0-1
```
Before you run this command, make sure all the Cloud Exchange System Requirements are met for v7.0.0.

On the Primary Node

Copy the example configuration file, and open it for editing:

cp cloudexchange.config.example cloudexchange.config
vi cloudexchange.config

In cloudexchange.config, set the values of these fields. Also set any optional fields that you use or customized, such as the proxy configuration and UI port.
```
HA_ENABLED=True
HA_CURRENT_NODE=<current node ip>
HA_PRIMARY_NODE_IP=<current node ip>
HA_IP_LIST=<current node ip>
MAINTENANCE_PASSWORD=<old maintenance password>
JWT_SECRET=<old cloud exchange JWT secret>
```
JWT_SECRET is optional. If you leave it empty, the setup script generates a new JWT secret.
Remove the .env file:
```
sudo rm -rf .env
```
Run the setup script:
```
sudo python3 ./setup
```
Start Cloud Exchange:
```
sudo ./start
```

On the Secondary Nodes

Complete steps 1 to 6 on each secondary node. Then add the secondary nodes from the UI of the primary node.

On the primary node, copy the contents of the CA key file:

/opt/cloudexchange/cloudexchange/data/ssl_certs/mongodb_rabbitmq_certs/tls_cert_ca.key

On the secondary node, create the CA key file, paste the key that you copied, and save the file. The matching CA key lets the secondary node communicate with the HA cluster.
```
sudo vi /opt/cloudexchange/cloudexchange/data/ssl_certs/mongodb_rabbitmq_certs/tls_cert_ca.key
```
Remove the .env file:
```
sudo rm -rf .env
```

Copy the example configuration file, and open it for editing:

cp cloudexchange.config.example cloudexchange.config
vi cloudexchange.config

In cloudexchange.config, set the values of these fields:

Important

The JWT secret and the CA key of a secondary node must match the primary node. If they differ, adding the secondary node to the HA cluster fails with an authentication error. If you don’t know the JWT secret of the primary node, generate and apply a new one. For the steps, refer to Cloud Exchange Troubleshooting.
```
JWT_SECRET=<JWT_SECRET value of the primary node>
MAINTENANCE_PASSWORD=<old maintenance password>
```
Run the setup script:
```
sudo python3 ./setup
```
In the UI of the primary node, go to Settings > General Settings > Node Configurations and add the secondary nodes one at a time.

You don’t need to run the start script on the secondary nodes. It runs automatically when you add a secondary node from the UI of the primary node.

Prerequisites

If you upgrade from Cloud Exchange v5.1.0 or earlier, first upgrade the underlying Ubuntu OS from 20.04 to 22.04. For details, refer to Cloud Exchange KB Articles.

If you are upgrading from Cloud Exchange Version 5.1.1, 5.1.2, 6.0.0, 6.0.1 or 6.1.0 to any newer version in CE as a VM deployment, make sure to upgrade the underlying Ubuntu OS version to 24.04 — refer to the Cloud Exchange KB Articles.

Before you start the upgrade, make sure your instance meets the Cloud Exchange System Requirements.

Make sure the VM can connect to https://cloud-exchange-store.s3.us-east-1.amazonaws.com.

Disable all source plugins in all modules, and wait for the queued tasks to finish:

Wait 20 to 30 minutes after you disable the source plugins.

Go to Settings > Logging, click Filter Query, enter this filter in the Filters field, and click Load.

message Like "Ingested " || message Like "Stored " || message Like "task(s)" || message Like "Completed storing"

Monitor the filtered logs. When no new logs appear, continue with the upgrade.
After the upgrade is complete, enable the source plugins that you disabled.

Keep the maintenance password ready. You need it to complete some of the steps.

Important

If you lose the maintenance password, your existing data cannot be retained.

RabbitMQ data migration is not supported, because the queue type changed from Classic to Quorum.

If you run Cloud Exchange as a VM (OVA or Hyper-V) on a version earlier than v5.1.1, you need the root credentials of the VM.
Username: root
Password: M5#w6V+.T^8gv?%,

If you run Cloud Exchange as a VM on Azure or AWS, you can complete these steps yourself.

Standalone Deployment

To v7.0.0 from v5.1.1, v5.1.2, v6.0.0, v6.0.1, V6.1.0 Standalone Deployment

Before you start, complete the Prerequisites and take a backup. For details, refer to Backup Cloud Exchange.

Go to the /opt/cloudexchange/cloudexchange directory, and stop Cloud Exchange:
```
cd /opt/cloudexchange/cloudexchange
sudo ./stop
```

Add the Cloud Exchange public key as a trusted GPG key:

curl -fsSL https://cloud-exchange-store.s3.us-east-1.amazonaws.com/cloudexchange/upgrade-packages/cloud-exchange-public.gpg | sudo gpg --dearmor -o /etc/apt/trusted.gpg.d/cloud-exchange.gpg

Add the Cloud Exchange S3 URL as a package source:

echo "deb https://cloud-exchange-store.s3.us-east-1.amazonaws.com/cloudexchange/upgrade-packages stable main" | sudo tee /etc/apt/sources.list.d/cloud-exchange.list

Update the package sources:
```
sudo apt update
```
Upgrade Cloud Exchange, and wait for the upgrade to complete:
```
sudo apt install cloud-exchange=7.0.0-1
```
Before you run this command, make sure all the Cloud Exchange System Requirements are met for v7.0.0.
Run the setup script:
```
sudo python3 ./setup
```
Start Cloud Exchange:
```
sudo ./start
```
Close all your Cloud Exchange browser windows. Then clear the browser cache, or log in again in an incognito window. The Cloud Exchange UI is available at http(s)://<ip>.

HA Deployment

To v7.0.0 from v5.1.1, v5.1.2, v6.0.0, v6.0.1, v6.1.0 Standalone Deployment

Before you start, complete the Prerequisites and take a backup. For details, refer to Backup Cloud Exchange.

The existing standalone node becomes the primary node of the HA cluster. For details about the HA parameters and how to set up the cluster, refer to Cloud Exchange High Availability.

After you move to HA, Cloud Exchange may respond slowly for the first few minutes while the data is replicated to all the nodes.

On the Standalone Node (New Primary Node)

Go to the /opt/cloudexchange/cloudexchange directory, and stop the standalone deployment:
```
cd /opt/cloudexchange/cloudexchange
sudo ./stop
```

Add the Cloud Exchange public key as a trusted GPG key:

curl -fsSL https://cloud-exchange-store.s3.us-east-1.amazonaws.com/cloudexchange/upgrade-packages/cloud-exchange-public.gpg | sudo gpg --dearmor -o /etc/apt/trusted.gpg.d/cloud-exchange.gpg

Add the Cloud Exchange S3 URL as a package source:

echo "deb https://cloud-exchange-store.s3.us-east-1.amazonaws.com/cloudexchange/upgrade-packages stable main" | sudo tee /etc/apt/sources.list.d/cloud-exchange.list

Update the package sources:
```
sudo apt update
```
Upgrade Cloud Exchange, and wait for the upgrade to complete:
```
sudo apt install cloud-exchange=7.0.0-1
```
Before you run this command, make sure all the Cloud Exchange System Requirements are met for v7.0.0.

Copy the example configuration file, and open it for editing:

cp cloudexchange.config.example cloudexchange.config
vi cloudexchange.config

In cloudexchange.config, set the values of these fields. Also set any optional fields that you use or customized, such as the proxy configuration and UI port.
```
MAINTENANCE_PASSWORD=<old cloud exchange maintenance password>
JWT_SECRET=<old cloud exchange JWT secret>
```
JWT_SECRET is optional. If you leave it empty, the setup script generates a new JWT secret.
Remove the .env file:
```
sudo rm -rf .env
```
Run the setup script:
```
sudo python3 ./setup
```
Start Cloud Exchange:
```
sudo ./start
```
Open the UI of the primary node in your browser at https://<ip>, and log in with your existing Cloud Exchange credentials.
Go to Settings > General Settings > Node Configurations and enable the Enable HA toggle. In the Confirm Action pop-up, enter the Cloud Exchange IP address or FQDN only if you need to change it, and click Enable HA.

Important

While HA is being enabled, Cloud Exchange is temporarily unavailable and may restart several times.

On the Secondary Nodes

Complete steps 1 to 8 on each secondary node. Then add the secondary nodes from the UI of the primary node.

Deploy the latest Cloud Exchange as a VM image (OVA, AMI, Azure, Hyper-V, or KVM).
Go to the /opt/cloudexchange/cloudexchange directory:
```
cd /opt/cloudexchange/cloudexchange
```

On the primary node, copy the contents of the CA key file:

/opt/cloudexchange/cloudexchange/data/ssl_certs/mongodb_rabbitmq_certs/tls_cert_ca.key

On the secondary node, create the CA key file, paste the key that you copied, and save the file. The matching CA key lets the secondary node communicate with the HA cluster.
```
sudo vi /opt/cloudexchange/cloudexchange/data/ssl_certs/mongodb_rabbitmq_certs/tls_cert_ca.key
```
Remove the .env file:
```
sudo rm -rf .env
```

Copy the example configuration file, and open it for editing:

cp cloudexchange.config.example cloudexchange.config
vi cloudexchange.config

In cloudexchange.config, set the values of these fields:

Important

The JWT secret and the CA key of a secondary node must match the primary node. If they differ, adding the secondary node to the HA cluster fails with an authentication error. If you don’t know the JWT secret of the primary node, generate and apply a new one. For the steps, refer to Cloud Exchange Troubleshooting.
```
JWT_SECRET=<JWT_SECRET value of the primary node>
MAINTENANCE_PASSWORD=<old maintenance password>
```
Run the setup script:
```
sudo python3 ./setup
```
In the UI of the primary node, go to Settings > General Settings > Node Configurations and add the secondary nodes one at a time.

You don’t need to run the start script on the secondary nodes. It runs automatically when you add a secondary node from the UI of the primary node.

To v7.0.0 from v5.1.1, v5.1.2, v6.0.0, v6.0.1, v6.1.0 HA Deployment

Before you start, complete the Prerequisites and take a backup. For details, refer to Backup Cloud Exchange.

On All Nodes

Stop the secondary nodes first, and then the primary node, so that Cloud Exchange shuts down properly:
```
cd /opt/cloudexchange/cloudexchange
sudo ./stop
```

Add the Cloud Exchange public key as a trusted GPG key. Start with the primary node, and then continue with the secondary nodes:

curl -fsSL https://cloud-exchange-store.s3.us-east-1.amazonaws.com/cloudexchange/upgrade-packages/cloud-exchange-public.gpg | sudo gpg --dearmor -o /etc/apt/trusted.gpg.d/cloud-exchange.gpg

Add the Cloud Exchange S3 URL as a package source:

echo "deb https://cloud-exchange-store.s3.us-east-1.amazonaws.com/cloudexchange/upgrade-packages stable main" | sudo tee /etc/apt/sources.list.d/cloud-exchange.list

Update the package sources:
```
sudo apt update
```
Upgrade Cloud Exchange, and wait for the upgrade to complete:
```
sudo apt install cloud-exchange=7.0.0-1
```
Before you run this command, make sure all the Cloud Exchange System Requirements are met for v7.0.0.

On the Primary Node

Copy the example configuration file, and open it for editing:

cp cloudexchange.config.example cloudexchange.config
vi cloudexchange.config

In cloudexchange.config, set the values of these fields. Also set any optional fields that you use or customized, such as the proxy configuration and UI port.
```
HA_ENABLED=True
HA_CURRENT_NODE=<current node ip>
HA_PRIMARY_NODE_IP=<current node ip>
HA_IP_LIST=<current node ip>
MAINTENANCE_PASSWORD=<old maintenance password>
JWT_SECRET=<old cloud exchange JWT secret>
```
JWT_SECRET is optional. If you leave it empty, the setup script generates a new JWT secret.
Remove the .env file:
```
sudo rm -rf .env
```
Run the setup script:
```
sudo python3 ./setup
```
Start Cloud Exchange:
```
sudo ./start
```

On the Secondary Nodes

Complete steps 1 to 6 on each secondary node. Then add the secondary nodes from the UI of the primary node.

On the primary node, copy the contents of the CA key file:

/opt/cloudexchange/cloudexchange/data/ssl_certs/mongodb_rabbitmq_certs/tls_cert_ca.key

On the secondary node, create the CA key file, paste the key that you copied, and save the file. The matching CA key lets the secondary node communicate with the HA cluster.
```
sudo vi /opt/cloudexchange/cloudexchange/data/ssl_certs/mongodb_rabbitmq_certs/tls_cert_ca.key
```
Remove the .env file:
```
sudo rm -rf .env
```

Copy the example configuration file, and open it for editing:

cp cloudexchange.config.example cloudexchange.config
vi cloudexchange.config

In cloudexchange.config, set the values of these fields:

Important

The JWT secret and the CA key of a secondary node must match the primary node. If they differ, adding the secondary node to the HA cluster fails with an authentication error. If you don’t know the JWT secret of the primary node, generate and apply a new one. For the steps, refer to Cloud Exchange Troubleshooting.
```
JWT_SECRET=<JWT_SECRET value of the primary node>
MAINTENANCE_PASSWORD=<old maintenance password>
```
Run the setup script:
```
sudo python3 ./setup
```
In the UI of the primary node, go to Settings > General Settings > Node Configurations and add the secondary nodes one at a time.

You don’t need to run the start script on the secondary nodes. It runs automatically when you add a secondary node from the UI of the primary node.