Prepare the Classic Controller

To prepare classic Controller for installing Virtual Appliance services, complete the following steps:

Configure the Standalone Controller in Splunk AppDynamics On-Premises

Complete post-installation tasks for the Standalone Controller after installing AppDynamics Services.

  1. Log in to the Controller database by using the following command:
    CODE 
    <controller-home>/bin/controller.sh login-db
    Note: You must enter the root database password to connect to the MySQL database.
  2. Retrieve the configured database credentials from the primary node:
    CODE 
    # Run on the VA primary node
helm secrets decrypt /var/appd/config/secrets.yaml.encrypted | yq .hybrid.mysql.dbUser
helm secrets decrypt /var/appd/config/secrets.yaml.encrypted | yq .hybrid.mysql.dbPassword
    Note: The hybrid.mysql.dbUser value is for Secure Application only. Do not change it from the default value: secureapp.
  3. Create the user and grant access.
    Supply the <dbUser> value from the previous steps. Replace <dbUser> and <dbPassword> with the values you retrieved:
    CODE 
    # Run in the database shell; substitute the exact decrypted values
DROP USER IF EXISTS '<DB_USER>'@'%';
CREATE USER '<DB_USER>'@'%' IDENTIFIED BY '<DB_PASSWORD>' REQUIRE SSL;
GRANT USAGE ON *.* TO '<DB_USER>'@'%';
GRANT SELECT, UPDATE ON controller.* TO '<DB_USER>'@'%';
    Note: Do not paste real passwords into shell history or tickets. Use your approved secret-handling procedure.
  4. (Optional) Generate the hybrid configuration file to prevent multiple Controller restarts.
  5. Access the Enterprise Console UI.
    1. Select the platform.
    2. Go to the Configuration tab.
    3. Navigate to Controller Settings > Appserver Configurations > JVM Options > JVM Config.
    4. In the JVM Config field, append the following content:
      Note: Replace <DNS_DOMAIN> with the value that you configured as dnsDomain in /var/appd/config/globals.yaml.gotmpl.
      CODE 
      -Dappdynamics.auth.service.hosted.zone=-tnt-authn.<DNS_DOMAIN>
-Dappdynamics.auth.service.port=443
-Dappdynamics.auth.service.ssl.access.enabled=true
-Dappdynamics.auth.service.token.generation.enabled=true
-Dappdynamics.controller.authentication.resource.accessible=true
-Dappdynamics.auth.client.token.validation.enabled=true
-Dappdynamics.mds.rbac.rest.api.enabled=true
-Dappdynamics.rbac.internal.resource=true
    5. Click Save.
      Note: Saving JVM configuration restarts the Controller. Coordinate this with the later hybrid bootstrap so you do not cause unnecessary restarts.

Configure the Controller Properties by Using the Kubernetes Cluster CLI

Configure Controller properties by using the Kubernetes cluster CLI after installing services.

Ensure that you have the latest CA certificates obtained after installing services. If not, update the CA certificates and regenerate the hybrid configuration file after restarting the service.

  1. Log in to your Kubernetes cluster.
  2. Run the command to update the standalone Controller properties:
    CODE 
    appdcli run bootstrap_hybrid

    This command configures the anomaly-detection, Kafka, schema-registry, and hybrid service properties on the standalone Controller. Review the command output and confirm that URLs and node-port addresses match your environment.

    CODE 
    Key: anomaly.detection.enabled, Value: true
Key: anomaly.detection.deployed.onprem, Value: true
Key: controller.id, Value: onprem
Key: controller.unique.id, Value: onprem
Key: anomaly.detection.kafka.consumer.group.id, Value: pi-alarmservice-transition-consumer-group-onprem
Key: anomaly.detection.kafka.consumer.topic, Value: pi-alarmservice-transition-onprem
Key: anomaly.detection.kafka.producer.topic, Value: metadata-lifecycle-events
Key: anomaly.detection.onprem.output.topic, Value: blitz-processed-metrics
Key: anomaly.detection.schema.registry.enabled, Value: true
Key: anomaly.detection.consumer.schema.registry.url, Value: https://10.0.0.1.nip.io/schemaregistry
Key: anomaly.detection.producer.schema.registry.url, Value: https://10.0.0.2.nip.io/schemaregistry
Key: anomaly.detection.kafka.consumer.bootstrap.servers, Value: 10.0.0.1:32101
Key: anomaly.detection.kafka.producer.bootstrap.servers, Value: 10.0.0.2:32102
Key: anomaly.detection.kafka.producer.ssl.enabled, Value: true
Key: anomaly.detection.kafka.consumer.ssl.enabled, Value: true
Key: anomaly.detection.service.url, Value: https://10.0.0.1.nip.io/pi

    Alternatively, you can access the administration console by using the Kubernetes cluster IP address and manually edit each parameter.

    Note: Changes do not take effect until you restart the Controller.

Configure the Standalone Controller for Hybrid Connectivity

Complete these checks before running the script:

  • Extract the generated hybrid-config archive on the Controller host.
  • Run the script from inside the extracted hybrid-config directory.

  • Identify the actual Controller home: The directory containing db/, tools/, and appserver/.

    Tip: /home/appdynamics/appdynamics/platform/controller. The suggested default is /opt/appdynamics/platform/product/controller, but the installation path can vary.
  • Obtain the DNS name configured as hybrid.mysql.dbHost in the Virtual Appliance.
  • Use an account with permission to update the Controller and MySQL certificate files.

Controller home example: /home/appdynamics/appdynamics/platform/controller. The suggested default is /opt/appdynamics/platform/product/controller, but the installation path can vary.

  1. Change to the extracted configuration directory and run the script:
    CODE 
    cd ~/hybrid-config
bash configure.sh
  2. Enter the actual Controller home when prompted:
    CODE 
    Controller home [/opt/appdynamics/platform/product/controller]: /path/to/platform/controller
    Note: If the Controller home is rejected, verify that the directory contains db/db.cnf.
  3. Review the proposed changes, then enter y to continue:
    CODE 
    This operation will:
  - Replace the Kafka and Schema Registry client truststores
  - Update the Controller CA truststore
  - Write obfuscated Kafka producer and consumer configuration
  - Replace the MySQL server certificate after creating a backup

Continue? [y/N]: y
  4. Confirm the reachable Controller address.
    The script detects a local IPv4 address. Confirm that the Virtual Appliance cluster can reach this address. Enter n to provide a different address.
    PYTHON 
    Detected Controller IP: 192.0.2.10
Is this address reachable from the Virtual Appliance cluster? [Y/n]: y
  5. Provide the hybrid database DNS name.
    Enter the exact hostname configured as hybrid.dbHost. The script adds this value to the MySQL certificate Subject Alternative Name (SAN).
    CODE 
    DNS name [192.0.2.10.nip.io]: controller.example.com

Keystore password behavior: The script first tries the standard keystore password, changeit. If that password cannot open the existing Controller CA truststore, the script prompts securely for the configured password. Typed password characters are not displayed.

The selected password is used consistently for:

  • The Kafka client truststore.
  • The Schema Registry client truststore.
  • The existing Controller CA truststore.
  • The truststore-password fields in the obfuscated producer and consumer configurations.
Note: If the keystore password is rejected, provide the password currently configured for appserver/jetty/etc/cacerts.jks.

Changes made by the script:

Item Location relative to Controller home Action
Kafka client truststore pi-kafka-ssl-config/kafka.client.truststore.jks Created or replaced using kafka-ca.crt.
Schema Registry client truststore pi-kafka-ssl-config/schema-registry.client.truststore.jks Created or replaced using schema-registry-ca.crt.
Controller CA truststore appserver/jetty/etc/cacerts.jks Replaces the k8s-cluster alias with schema-registry-ca.crt.
Kafka client configurations pi-kafka-ssl-config/AnomalyDetectionKafka* Writes obfuscated producer and consumer configuration.
MySQL server certificate Database data directory from db/db.cnf Generates a 365-day certificate containing the supplied DNS SAN.
Before replacement, the script creates timestamped backups of the Controller CA truststore and the existing MySQL server certificate. The final summary displays the complete backup paths.
Note: Use the timestamped backup paths printed by the script when following an approved rollback procedure.

If the configuration is successful, the following message will be displayed:

CODE 
Hybrid Controller configuration completed successfully.
Important:

After the script completes successfully, restart the Controller and its MySQL service. The Controller truststore and MySQL certificate changes do not take effect until the affected services are restarted.

Restart the Standalone Controller

Restart the Standalone Controller and MySQL service after completing configuration changes.

  • Run the following command to restart the standalone Controller:
    CODE 
    cd ~/appdynamics/platform/product/controller/bin/
./controller.sh stop
./controller.sh start

    This command also restarts the MySQL service.

    Alternatively, you can restart the controller from Enterprise Console. See Start or Stop the Controller.

  • For high-availability scenario, you must use Enterprise Console to restart the controller. See Start or Stop the Controller.