Updating the Orchestrator configuration

Update the Orchestrator configuration. Make sure to review the following:

• Custom configuration from UiPath.Orchestrator.dll.config
• Any web.config settings.
• Storage (packages, execution media, and buckets data) - mostly applicable to Storage.Type=FileSystem
• Custom NLog targets.
• Custom credential stores.
• Encryption key per tenant configuration.

You can simplify many of the following steps by using the provided Orchestrator Configurator Tool.

The orchestrator_configurator.sh bash tool can update the Orchestrator custom config map and upload files to the Orchestrator well-known blob storage locations. Use the -y parameter to skip confirmation of the proposed actions.

Configuring web.config

Edit the orchestrator-customconfig config map using a tool such as Lens or kubectl.

Configure the request limit in the values.json file. The Orchestrator deployment should restart automatically after this configuration change.

{
  "Kestrel": {
    "Limits": {
      "MaxRequestBodySize": 314572800
    }
  }

Configuring appSettings

The appSettings.custom.json file edited in the pre-migration steps now contains all the customization needed in the appSettings section. You need to place this .json file in the orchestrator-customconfig config map, in the values.json file, under the appSettings key.

{
    "ExampleSetting.Enabled": true,
    "ExampleSetting.Type": "BasicExample",
    "ExampleSetting.Count": 3
}

The Orchestrator Configurator Tool can merge the keys in the custom appSettings with the keys already present in the config map. You can upload the app settings using the -c|--app-settings parameter:

./orchestrator-configurator.sh -c appSettings.custom.json

If using the configurator tool, go through all the steps to gather all required appSettings overrides, and run the script once at the end.

Configuring storage

If you're moving from FileSystem storage to Orchestrator's storage provider, use the Orchestrator Configurator Tool to transfer the storage content.

Upload the files using the -s|--storage-folder parameter in the Orchestrator Configurator Tool, where path is the parent folder. Replace the path with the folder's location where your files are stored. To determine the path, check the Storage.Path parameter in UiPath.Orchestrator.dll.config.

To ensure it's the correct folder, it should contain this hierarchy:

• One folder named Orchestrator-Host\Libraries.

• One folder for each tenant, named Orchestrator-[tenantKey].

./orchestrator-configurator.sh -s path

The command uploads the contents of the path folder to the configured storage provider.

Note:

• The Orchestrator Configurator tool only supports CEPH, S3 (or compatible), or Azure Blob Storage. For any other storage, copy the content to the new location manually.

To use network FileStore, edit the Orchestrator ArgoCD app parameters, and set the following:

• storage.type = smb
• storage.smb.domain
• storage.smb.password
• storage.smb.source
• storage.smb.username
• storage.smb.size

To configure other storage options, edit the Orchestrator ArgoCD app parameters and set the following:

• storage.type to the desired provider. The value is case-sensitive. The possible values are: Azure, AWS, Minio.
• storage.connectionString

Overview of the Orchestrator app storage settings:

Configuring one bucket to store all tenants

If you are using external storage buckets, you can instruct Orchestrator to store data in a single external bucket without assigning it administrative permissions to the external storage account by using the --use-external-storage flag.

Configuring Azure/Amazon S3 storage buckets

Orchestrator web browser access to Amazon and Azure storage buckets can be restricted due to the same-origin policy on the provider side. Successfully accessing the content of such a bucket requires you to configure the respective provider to allow cross-origin requests from Orchestrator.

See instructions on how to configure each provider to allow cross-origin requests from Orchestrator.

Configuring NLog

To install NLog extensions, they need to be copied in Ceph, in the uipath bucket. The Orchestrator pod will then be able to load them at startup. You also need to place the configuration in orchestrator-customconfig in the nlog.json file.

The configurator can do this with the -n|--nlog-extensions-folder and -l|--nlog-config-file parameters.

./orchestrator-configurator.sh -n nlogextensions -l nlog.custom.json

The plugins will be available in the Orchestrator pod at the local path /var/orchestrator/plugins/nlog. The configurator automatically updates the assemblyFile paths, prepending the plugins path to them.

Configuring credential stores

Credential stores configuration changes are included in appsettings.custom.json, so there are no more required configuration updates.

To make the changes manually, place them in the values.json file of orchestrator-customconfig under the appSettings section.

If secure stores assemblies are also required, then you must place them in any Orchestrator pod at the /var/orchestrator/plugins/securestore/ path.

The Orchestrator Configurator Tool can do that using the -p|--securestore-plugins-folder parameter:

./orchestrator-configurator.sh -p securestoreplugins

Configuring encryption key

To configure the encryption key, replace it in the orchestrator-generated-secrets Kubernetes secret by overwriting the value of APPSETTINGS__EncryptionKey. To do this, run the following command:

ENCRYPT_KEY=$(echo <key>|base64 -w 0)
kubectl -n uipath patch secret orchestrator-generated-secrets --type='json' \
-p="[{'op': 'replace', 'path': '/data/APPSETTINGS__EncryptionKey', 'value':'$ENCRYPT_KEY'}]"

Note: Make sure to replace <key> with the value of the key retrieved from UiPath.Orchestrator.dll.config.

Configuring encryption key per tenant

To migrate the encryption key per tenant, take the following steps:

1. Add the AzureKeyVault settings and the certificate in the ArgoCD UI, as parameter overrides for the Orchestrator application.
   • encryptionKeyPerTenant.certificateBase64
   • encryptionKeyPerTenant.certificatePassword
   • encryptionKeyPerTenant.clientId
   • encryptionKeyPerTenant.directoryId
   • encryptionKeyPerTenant.vaultAddress
   1. Use the values from the following configuration keys (referenced in the preparation steps):
      • Azure.KeyVault.VaultAddress
      • Azure.KeyVault.ClientId

      • Azure.KeyVault.DirectoryId

   2. Convert the certificate to base64 and use it as a parameter override. To convert it, use the following command:

      PowerShell:

      [convert]::ToBase64String((Get-Content -path "path_to_certificate" -Encoding byte))

      Shell:

      base64 [_path_to_certificate_]

2. Apply the Orchestrator ArgoCD app parameter overrides, and then run the Orchestrator Configurator Tool.
3. Once the new configuration is reflected in ArgoCD, wait until the application is synced again.
4. Enable the EncryptionKeyPerTenant feature as follows:
   • use the two settings placed in appSettings.custom.json and run the Orchestrator Configurator Tool;
   • or manually in the orchestrator-customconfig, in the appConfig section of the values.json file.

   "EncryptionKeyPerTenant.Enabled": "true", "EncryptionKeyPerTenant.KeyProvider": "AzureKeyVault",

5. Restart the Orchestrator Automation Suite deployment from the cluster for the changes to take effect.
   Note: SMTP settings in Identity Server are not encrypted with the per-tenant key. Once the migration is complete, make sure to re-enter the SMTP password in the Automation Suite portal.