Upgrade Tableau Server Independent Gateway

This topic walks you through the process of upgrading Tableau Server Independent Gateway. The process described in this topic is the same for all version upgrades. This means you can use this process for major version (for example, 2022.1 to 2023.1) and maintenance version (2022.1.1 to 2023.1.1) upgrades.

You must use an installer for Tableau Server Independent Gateway with a major version that matches the version of Tableau Server. We recommend maintenance versions (2022.1.1 or 2022.1.2 for example) match as well, but this is not a requirement. If "static assets" change between versions and versions do not match, you may see some unexpected image impact. For example, maps may not be up-to-date if Independent Gateway is an earlier version than Tableau Server.-

Overview

The upgrade process for Independent Gateway is actually a process of uninstalling then reinstalling the software. However, you can minimize configuration and overall downtime by following the process as described in this topic.

The process described in this topic assumes that you have a functional deployment of Tableau Server and Tableau Server Independent Gateway running. If you are upgrading the backend Tableau Server deployment as part of your upgrade, we recommend upgrading the Independent Gateway server(s) first, validating basic connectivity with a Tableau client, then proceeding with Tableau Server upgrade.

The steps detailed in this topic are summarized here:

  1. Copy some existing files for use during upgrade.
  2. Run the obliterate script to remove Independent Gateway.
  3. Install new version of Independent Gateway.
  4. Optional: Overwrite tsighk-auth file with original copy.
  5. Update TLS settings.
  6. Optional: Update back end Tableau Server
  7. Restart Independent Gateway service.

Step 1: Copy files for reference

You may need to reference the configuration settings stored in the following files. Copy these files to a secure and accessible location (file paths are default location):

  • /var/opt/tableau/tableau_tsig/config/tsighk-auth.conf
  • /var/opt/tableau/tableau_tsig/config/httpd.conf.stub
  • /etc/opt/tableau/tableau_tsig/environment.bash

Step 2: Obliterate Independent Gateway

To remove Independent Gateway from the server(s), run the tableau-tsig-obliterate script:

  1. On the initial node, open a terminal session.

  2. Run the tableau-tsig-obliterate script:

    sudo /opt/tableau/tableau_tsig/packages/scripts.<version_code>/tableau-tsig-obliterate -y -y -y

  3. Restart the computer.

Step 3: Install Independent Gateway

Download the version of Independent Gateway that you want to upgrade to and then follow the same installation procedure as described in the topic, Install Tableau Server with Independent Gateway.

As with the original installation, you will need to specify initialization settings as part of set up. To use the same values, reference the enviornment.bash file that you copied in step 1. Do not overwrite the new bash file with the original.

Step 4: (Optional) Overwrite tsighk-auth file with original copy

The tsighk-auth file is a configuration file that stores a unique string called the authsecret. The authsecret is used to verify that the back end Tableau Server is communicating with a trusted instance of Independent Gateway. When you set up the original instance of Independent Gateway, you had to update a configuration file on the back end Tableau Server with the authsecret.

If your security policy allows, you can continue to use the original authsecret on Independent Gateway. Doing so avoids the process of updating and restarting the back end Tableau Server with a new authsecret.

To maintain the original authsecret, overwrite the tsighk-auth.conf file (located at /var/opt/tableau/tableau_tsig/config/tsighk-auth.conf) with the copy that you saved in step 1.

If your security policy requires that you refresh the authsecret, then make note of the new authsecret that was generated by the installation process. You will update the back end Tableau Server with the new authsecret later in the process.

Step 5: Update housekeeping TLS settings

If you did not configure TLS for housekeeping (HK) communication between Independent Gateway instance(s) and the back end Tableau Server deployment, then you can skip this step.

If you configured HK TLS, then you must manually copy the configuration from the original httpd.conf.stub file into the file located at /var/opt/tableau/tableau_tsig/config/httpd.conf.stub) . Do not overwrite the new file with original file, as the newer file may include other settings.

  1. Update the relevant TLS configuration settings in the following block:

    <VirtualHost *:${TSIG_HK_PORT}>
    SSLEngine on
    #TLS# SSLHonorCipherOrder on
    #TLS# SSLCompression off
    SSLCertificateFile /etc/ssl/certs/tsig-ssl.crt
    SSLCertificateKeyFile /etc/ssl/private/tsig-ssl.key
    SSLCACertificateFile /etc/ssl/certs/rootTS-CACert.pem 
    #TLS# SSLCARevocationFile /path/to/file
    </VirtualHost>

    For more information about these settings, see Configure TLS on Independent Gateway.

  2. When you have finished updating httpd.conf.stub, save it.

  3. Copy httpd.conf.stub and then save to overwrite httpd.conf in the same directory.

Step 6: (Optional) Update back-end Tableau Server deployment

If you copied the original authsecret file (tsighk-auth.conf) to the new instance of Independent Gateway as described in step 4, then you may skip this step.

If you are refreshing the authsecret in the back end Tableau Server deployment, then you must update the tsig.json file on the initial node with the new authsecret. See Install Tableau Server with Independent Gateway. When you are finished, run the following TSM commands:

tsm stop
tsm topology external-services gateway update -c tsig.json
tsm start

Step 7: Restart the tsig-httpd service

When you have finished with the configuration. restart the tsig-httpd service.

sudo su - tableau-tsig
systemctl --user restart tsig-httpd
exit