Government Community Cloud v9 Upgrade
OneStream is preparing to release version v9 for our Government Community Cloud customers. This document is a guide to the v9 upgrade process. A v9 upgrade is identified as an upgrade from a pre-v9 version to a v9 version. The designated FedRAMP authorized platform release will be v9 which will be made available to GCC customers later this year.
Process
Overview:
The v9 upgrade has infrastructure and software changes that impact applications and integrations. We will migrate from your existing infrastructure to the new v9 architecture. To prepare our customers for this process, we are providing the pre-requisites for upgrade in advance of the release. See Pre-requisites heading below.
In the coming months, GCC customers will be asked to submit a Software Upgrade request in ServiceNow. When the upgrade request is submitted, it will open a Support Case to capture the outputs of the items in the Pre-requisites section below. You will be notified when this is available.
Once the pre-requisites are submitted, a OneStream project manager will meet with you to plan a timeline of activities. They will be assigned to the Case, available to meet and assist throughout the process.
We will provide a mirrored v9 instance for configuration and testing before your go-live. An application copy is made from your pre-v9 instance to your mirrored v9 instance. The configuration and testing period is timeboxed to 2-3 weeks.
The scope of work for the test instance is configuration (for example, SIC setup or business rule compilation updates) and functional testing. We will have you compile your business rules in v9 to determine if there are any new errors resulting from the more stringent .NET 8 compiler. Experts from OneStream will be available via the Case to assist. You should also test all functionality that may not be discovered via business rule compilation. During testing, keep a log of any updates you made to the v9 test instance to remediate issues.
When testing is completed, we will schedule your go-live. This is a 4–48-hour process (you will be given a more precise estimate following a database size analysis) of downtime where we copy your live databases to the v9 instances. Weekends and evenings are available. As a final step, you will re-apply the updates discovered during testing, referencing the list you generated. After go-live, your pre-v9 instances are no longer accessible; you will be live in v9.
Further information:
Book time with our GCC v9 upgrade team for a presentation and discussion on the v9 upgrade process by using this link. We kindly request that you submit your Software Upgrade a week before the booking time so that we can prepare by reviewing your specific pre-requisites.
Pre-requisites
When a v9 Software Upgrade request is submitted, it will open a Case called Cloud Migration Readiness that includes intake forms for the pre-requisite action items described below. We have attempted to put together a comprehensive list of all impacts, but given the customizable nature of OneStream, there may be additional impacts uncovered in testing.
We recommend you begin work on these pre-requisite items now. If additional assistance is required before the Cloud Migration Readiness Case can be opened, please open a Case.
Please note that these pre-requisites are based on expected approvals for our GCC program. The 3PAO assessment is pending.
Important: We recommend customers submit their v8+ Software Upgrade in the Service Catalog to review their specific pre-requisites on the Action items tab of the Cloud Migration Readiness Case prior to reviewing this document. Pre-requisites #1 and #2 will appear as ‘Authentication’ and ‘Data Connections’ Action Items only if they apply to you. Pre-requisites #3, #5, and #6 are referenced in the ‘Customer Specifications’ Action Item. Pre-requisite #4 should be reviewed by all customers.
1. OneStream IdentityServer
Customers upgrading to Platform v9 will be migrated to OneStream’s modern IdentityServer OIS authentication technology. Your identity provider continues to be supported, but a change on our side requires that your IT create or edit (depending on identity provider – see Configuration Guides below) the authentication configuration for each OneStream instance.
You are impacted by this pre-requisite if you see the ‘Authentication’ item on the Action Items tab of your Cloud Migration Readiness Case. (Opened when customers submit v8+ Software Upgrade.)
Pre-requisite steps:
- Complete any necessary technical reviews by your IT
- Have your IT configure the new authentication configuration for each of your OneStream instances, referencing the Configuration Guide below per your identity provider and protocol. (See Configuration Process Detail below.)
- Submit the values gathered in the form of the last page of the Configuration Guide to us via the ‘Authentication’ action item in your v9 Cloud Migration Readiness Case.
Configuration details:
Provide your IT with the Configuration guide and sitenames listed in your Authentication item.
- Your site name is [sitename].onestreamcloud.com, per instance. For DoD customers, your sitename is [sitename].onestream.mil.
- Additionally, because we are providing you with a duplicated instance for testing, configure [sitename-temp].onestreamcloud.com for each instance. This will ensure you are prepared to access both your testing instances and your final instances after go-live.
- Example:
- Your site names are ‘govcustomer’ and ‘govcustomer-test’.
- The sitenames to configure for v9 are ‘govcustomer’, ‘govcustomer-test’, ‘govcustomer-temp’, and ‘govcustomer-test-temp'.
We recommend taking a screenshot of each redirect URL and attaching it to Authentication action item submission. This reduces the risk of error and aids troubleshooting.
NIPR NET customers will also require a new CSR to be generated for the duplicate Production. This will be provided on your Cloud Migration Readiness Case.
Configuration Guides:
- Open ID Connect
- OIS SAML (with any identity provider)
Reference:
- General documentation
-
- Note: disregard the section about configuring within OneStream; for our upgrade purposes, we require it in advance of the instance creation. Use the appropriate Configuration Guide below.)
- For further consultation, open a Conversation on the Cloud Migration Readiness Case with the Authentication team.
2. Smart Integration Connector
Smart Integration Connector (SIC) establishes secure connectivity between OneStream Cloud and data sources in your network without a VPN connection. With SIC, you can create and manage network data source integration using OneStream administration interfaces and locally manage database credentials and ancillary files.
SIC transition is a requirement for v9 upgrades for several use cases.
You are potentially impacted by this pre-requisite if you see the Data Connections item on the Action Items tab of your Cloud Migration Readiness Case. (Opened when customers submit v8+ Software Upgrade.)
Use cases for SIC Transition:
- Customers who are using a Virtual Private Network (VPN) to establish data connectivity between a OneStream cloud instance and a local data source. VPN’s will not be supported with v9 or higher.
- Customers referencing drivers hosted by OneStream. Drivers being hosted on OneStream servers will not be supported with v9.
- Examples: ODBC, OLEDB (Oracle), Snowflake, Teradata, Netsuite, SAP, JD Edwards
- Customers who are utilizing DLL’s. DLL’s being hosted on OneStream servers will not be supported with v9.
Pre-requisite steps:
- Complete any necessary technical reviews by your IT
- Create the SIC Server (or be ready to deploy it in short order)
- Install the SIC v9 Local Gateway on the server. You can open a Case to request it securely. Ensure you request the OneStream version that your business users are intending to upgrade to.
- Submit the ‘Data Connections’ action item in your v9 Cloud Migration Readiness Case.
Reference:
- For further consultation, open a Conversation on the Cloud Migration Readiness Case with the Data Connections team.
3. Solutions & Business Rule Changes
There are several substantial changes in v9 that impact business rules and Solutions.
To prepare for these changes, we recommend that you upgrade to v9 compatible Solutions in advance of migration testing. The process includes multiple application copies from your pre-v9 instance (at initial data load and go-live.) If they are not upgraded in the pre-v9 instance, you will need to upgrade them each time your application is copied to v9. Upgrading in advance reduces risk and complexity. You will compile your business rules in the v9 testing instance to uncover errors, if any. We will have OneStream experts available via the Conversation feature on the Case to assist. Many customers choose to leverage a consultant for this work.
Pre-requisite steps:
- Review Impacted Solutions List, below.
- Upgrade to any compatible versions in your pre-v9 instance, ahead of the v9 upgrade.
- Compile your business rules in your pre-v9 instance. We will ask for this on the ‘Customer Specifications’ item of the upgrade Case, when available.
- The purpose is to rule out any existing errors; we want to focus our efforts on v9.
- Prepare a list of your Solutions and their current versions. We will ask for this on the ‘Customer Specifications’ item of the upgrade Case, when available.
- Once the list has been provided, OneStream will return a list of Solutions that you can upgrade in your pre-v9 instance.
Reference:
- Impacted Solutions List (note: may need its own community post as right now it’s an Excel doc)
Business Rules & Workspace Changes in v8+
- For further consultation, contact the v9 upgrade team via the Activity tab of the Cloud Migration Readiness Case.
4. OneStream IP Address Changes
The IP addresses of your instance will change with v9. This has potential impacts you can prepare for. We have attempted to put together a comprehensive list of all impacts, but given the customizable nature of OneStream, there may be additional impacts uncovered in testing.
Pre-requisite steps:
- If you have non-VPN web integrations such as API or SFTP, you may need to account for new additional OneStream IP’s in the relevant system. If you can allow your domains in the relevant system instead ([sitename].onestreamcloud.com), we recommend this. Otherwise, we will provide the new Application Gateway IP once the v9 instances are built at the start of the active migration process.
- If your IT has a strict outbound allow list, for example Cisco Umbrella, ZScaler, or similar products, you may not be able to access the new v9 test instance until they allow it. To prepare for this, review with your IT and ensure for all your site names ([sitename].onestreamcloud.com) that sitename and sitename-temp have been allowed in relevant systems. This will help to ensure that you can access all test instances and live instances.
Cloud Note: Integrations using VPN’s are not accounted for here as they will be replaced by Smart Integration Connector.
Reference:
For further consultation, open a Conversation on the Cloud Migration Readiness Case with the Data Connections team.
5. .NET 8 Desktop Runtime
.NET is the development platform used by OneStream to build the Platform. Prior to v9, OneStream used versions of .NET referred to as .NET Framework versions. The v7.x Platform release used .NET 4.8. OneStream Platform Release v9 or later requires Microsoft .NET 8.
Pre-requisite steps:
- Install .NET 8 Desktop Runtime for all users who will be using the Windows Client*, or prepare to install it in short order
-
- * v9 provides a browser client for end user functionality. Users working solely with the browser client do not need the .NET Desktop Runtime installed.
Reference:
For further consultation, contact the v9 upgrade team via the Activity tab of the Cloud Migration Readiness Case.
6. REST API
There is a potential impact to REST API, but the scope has not been determined yet. For now, determine whether you utilize the REST API as your preparedness item. We will share more information when we have it.
Reference:
For further consultation, contact the v9 upgrade team via the Activity tab of the Cloud Migration Readiness Case.