Best Practice Updates Query

[dmoiler]

I have several environments deployed at 11.1 at the minute, with security certificates expiring and looking to update them via DSC.

Looking for guidance on best practice for configuration files when updating an existing environment to allow for new certificates to be applied.

Would it be more appropriate to:

1. Update the Existing Deploy DSC Configuration with full install / configuration, modifying only the certificates
2. Minimise the Existing Deploy DSC Configuration, removing installers / unnecessary configurations that are already applied
3. Configure Only option I'm missing / something else?

For option 1 I'm fairly certain it would only modify by installing the updated certificates as all other components were configured a year ago, but am not 100% sure it wouldn't overwrite ay existing content / reinstall to factory. I hope it wouldn't do this, but would be good to confirm before running it!

For option 2 above I'm not 100% that it wouldn't 'undo' configurations already applied during initial install to bring it into alignment with the minimised configuration.

Thanks!

Dean

[cameronkroeker]

Hi @dmoiler,

I recommend option 1 with an addition to using the latest version of the ArcGIS Module. The module is idempotent, meaning it has checks in place where it will skip installing the software, and if the site exists it skips site creation. It will check the existing certificate's thumbprint against the new certificate's thumbprint, if they don't match then it will replace the existing one with the new one. If the thumbprints match it will skip importing it.

https://github.com/Esri/arcgis-powershell-dsc/wiki/Upgrade-PowerShell-DSC-Module-for-ArcGIS

Thanks,
Cameron K.

[dmoiler]

Thanks Cameron, that's what I was hoping would be the recommendation as it keeps a more consistent set of active documentation. I'd seen reference elsewhere that it was idempotent (maybe in the forums / DSC documentation), but it is helpful to have this confirmed.

Thanks!

Dean