Tenant oboarding failed in Version v2.1.0-9@c4a7daf

[tomg-formpak]

I had two tenants already for testing purposes. There was no activity on SaaS but on the application side for the docker deployment for update and db restore.

Now when I try to onboard a new tenant, and it showing the below error -

Please refer to below for ACM details -

Please advice as it's urgent that we are having an upcoming demo.

@brtrvn @PoeppingT

[brtrvn]

@tomg-formpak looks like there are 2 issues -- one is that CloudFormation can't find the ACM certificate by the ARN saved in the App Config. In the Certificate Manager console, click on the certificate and make sure the ARN matches the ARN that CloudFormation is looking for (ends in d5e8c).

Also, the certificate needs to be in the same account that you're running SaaS Boost in.

The other error is that during stack rollback, the Onboarding Service is missing an IAM permission to search Transit Gateway Routes.

[brtrvn]

You can go to the IAM console and update the inline policy for the role sb-test-onboarding-svc-role-eu-west-1 and add ec2:SearchTransitGatewayRoutes to the list of allowed actions.

[brtrvn]

You'll have to edit the Parameter for the service you've configured in your app config with the Postgres database. Look for the parameter named /saas-boost/test/app/<YOUR_SERVICE_NAME>/SERVICE_JSON and edit the database version from 14.1 to 14.7

[brtrvn]

I'm working on testing using the installer to upgrade from 2.1.0 to 2.2.3. It's taken me a bit to get 2.1.0 to work due to a few changes AWS has made with S3 and other things. I'll keep you posted.

You should be able to install a 2nd SaaS Boost environment in the same account, but there are some sharp corners with our CloudFormation macro which would be avoided if you could start fresh since your existing onboarded tenants are just for testing/demo purposes.

[tomg-formpak]

@brtrvn Thank you so much for the support. I can onboard a tenant successfully, after editing the database version from 14.1 to 14.7.

This is okay for our internal initial demo.

1. Please keep me posted on the steps or process of using the installer to upgrade from 2.1.0 to 2.2.3. Thank you.
2. Just to clarify the points, in parallel, I can try out a clean installation for the latest version of saas boost in use the same AWS account with a different SaaS Boost environment label, right, hoping this won't have any effect on the old version of saas boost env. The reasons we want to do these on the same account are below-

• At this stage I am unclear on the process of copying or migrating the hosted domain or SSL certificate in a new AWS account + I wanted to have an environment in the new AWS account in which am confident to onboard real customers for actual demo purposes.
• Second, I can maintain two dev saas boost environments in the same account with different labels - one is the existing one, which is working as of now and the second is to try with the latest version of saas boost.

The two manual things we are doing at this stage are below -

• Updating the ECS task definition with extra Environment variables that are required to access and use the application such as license key, JDBC and database-related variables. // I have added a feature request for this use case - Expose Tenant Attributes Map as Environment Variables #323 (like an option in application configuration which is common to the application and an option during tenant onboarding which is specific for each tenant)

• Replacing the initial bootstrap db file with a customer-like database file, which is required for the demo purpose (for this we are using pgAdmin from my local machine via EC2 instance (having network access to the tenant's RDS instance)as a "bastion host." - related this if you can suggest to me the best practice kind of process with detailed steps, it will be good, as you promised during our call.

The other few queries are below -

• When the tenant onboarding fails - the rollback also fails and the status for the tenant in the admin dashboard is stuck at a different status like deploying or provisioning or failed etc. Even after a tenant onboarding fails due to missing env variables in ECS and after adding those missing variables - the application is fine and accessible but tenant onboarding status is still failed.
• Regarding the above, below are the two approaches that we are taking now, which are not that effective in some cases-

The first approach that we do is to click on the Tenants or Onboarding menu, click on the tenant you want to delete, and then click Actions -> Delete in the top right. This will send a delete API call to the Tenants service, which should remove the Tenant CloudFormation stacks and all associated AWS resources. This was working before but not now - for the failed tenants, this page is blank now_

_The second approach is that - We manually delete them through the CloudFormation console - delete the sb-${env}-tenant-{$id}-app-${serviceName}-${id} stacks first before deleting the sb-${env}-tenant-{$id} stacks. - The resources for the failed tenants are deleted when the rollback is failed but it's still showing in the admin dashboard on the onboarding page- how to remove those?

Please let me know!

@PoeppingT FYI

[brtrvn]

Tom, your Spring Framework app is failing to launch. That error page is coming from Tomcat. From the error messages, it looks like a NullPointerException in FormpakDataSource

If rollback is failing in CloudFormation, it's almost certainly missing IAM permissions. If you can look through the CloudFormation events and resources tabs to find the missing permissions, we can update the Onboarding Service role so that the stack rolls back successfully. Triggering a tenant delete from the admin UI (or the REST API) is the correct approach.

As for the license key and extra attributes, we already provided an example of how to solve this natively with SaaS Boost. Last summer we sent you https://github.com/brtrvn/saas-boost-examples/tree/main/spring-framework-initialize. Simply include a *.properties text file in a ZIP archive for the tenant during onboarding (the so called "config" file on the onboarding request page).