Skip to content
CA API Gateway - 9.3
Documentation powered by DocOps

Auto-Provision a Migration Bundle

Last update December 8, 2017

Auto-provisioning a migration bundle lets you bootstrap configurations onto a CA API Gateway in a consistent manner. The migration bundles are imported on startup, after the Gateway license has auto-provisioned successfully (see Auto-Provision a Gateway License). For information on creating migration bundles, see the Gateway Migration section.

This topic applies to these Gateway form factors: Appliance, Virtual Appliance, and Container.

Note the following about migration bundles:

  • If you create a bootstrap bundle that contains HTTP listen ports, the default HTTP listen ports (2124, 8080, 8443 and 9443) will not be created. It is assumed that you will be using the specified HTTP ports and not the default ones.
  • (Advanced tip) For migration bundles that includes encrypted secrets, the cluster passphrase must match the passphrase used to generate the migration bundle. The passphrase can be specified during export time with the header parameter "L7-key-passphrase" or the "encryptUsingClusterPassphrase" query parameter to use the cluster passphrase. For more information, see "Step 2: Safely Migrate Policy Passwords and Other Secrets" in Determine Security for Migrations.


To auto-provision a migration bundle for an Appliance or Virtual Appliance Gateway:

  1. Open a privileged shell.
  2. Create the target directory:

    # mkdir -p /opt/SecureSpan/Gateway/node/default/etc/bootstrap/bundle

  3. Set the appropriate permissions:

    # chmod -R 775 /opt/SecureSpan/Gateway/node/default/etc/bootstrap/bundle

  4. Copy the migration bundle(s) into the /opt/SecureSpan/Gateway/node/default/etc/bootstrap/bundle directory.

    Tips: (1) Bundles must end with .bundle as a file extension. (2) For the Gateway to fail at startup when a bundle import fails, the bundles must have the .req.bundle file extension.

  5. Restart the Gateway service:

    # service ssg restart

  6. (Optional) Once the migration bundle is auto-provisioned, you may remove the bundle directory created in step 2:

    # rm -rf /opt/SecureSpan/Gateway/node/default/etc/bootstrap/bundle

The migration bundle is now imported.

Auto-Provision Container Gateways

For information on how to auto-provision a migration bundle for the Container Gateway, see "Creating a Derived Docker Image" in Customize the Container Gateway. The instructions in the Dockerfile perform the auto provision.

Was this helpful?

Please log in to post comments.