Disabling / enabling gateway in cluster, using a non-interactive script and a service principal

[yfontana]

Hi,

I'm trying to write a script that can be used to disable/enable a gateway within a cluster, using a service principal. This script is to be called by other scripts performing maintenance on the servers that the gateway are installed on (applying Windows server updates for example).

The general process is this: disable gateway ==> wait until dataset refreshes running on gateway are finished (or until timeout) ==> apply updates, reboot server ==> enable gateway

Applying this process sequentially to different gateways in a cluster results in updates being applied with no downtime and no interrupted dataset refreshes (unless a refresh is too long and hits the timeout mentioned above).

My issue is that I'm not finding a way to do the parts in bold (disable/enable gateway) with both:

1. No manual intervention
2. A service principal

Here are the options that I've explored:

• The OnPremisesDataGatewayHAMgmt PowerShell module: the Set-OnPremisesDataGateway cmdlet allows disabling/enabling a gateway in a cluster, however the module only allows interactive authentication (at least as far as I can tell). The module also only works with PowerShell 5, which makes me think it may be obsoleted at some point.
• The DataGateway module: recommended by Microsoft as a replacement for OnPremisesDataGatewayHAMgmt on PS7. Has more functions, and allows service principal authentication, but doesn't seem to have a cmdlet to disable/enable a gateway in a cluster.
• Looking at the code of OnPremisesDataGatewayHAMgmt cmdlets, I was able to hack something that authenticates non-interactively, and then calls the same APIs as the module to disable/enable gateways. This works fine, but not with a service principal: the API endpoints (which look like https://wabi-west-europe-b-primary-redirect.analysis.windows.net/unifiedgateway/gatewayclusters/{gat...}) don't seem to accept a bearer token generated with a call with grant_type = client_credentials to the OAuth2.0 login API (only works with a token generated with a call with grant_type = password)

Any idea on how I can do this?

Are there better ways to automatically apply updates to gateway servers without interrupting dataset refreshes?

[lbendlin]

Define "interrupting".  The standard procedure is that the Power BI service will award the refresh job to a different cluster member if the original one goes offline.  So yes, there will be a delay, but not really an interruption.

I am not sure this gateway maintenance job should be automated at all. A lot of the Windows updates require a restart, and trying to update gateway versions automatically WILL result in tears, lots of tears. 

So yes, by all means, apply the updates sequentially,  but don't bother with taking cluster members offline etc.

[yfontana]

By "interrupting" a dataset refresh I mean that if a gateway server is rebooted without making sure that no refreshes were running on it, this may result in failed refreshes.

Is there any way to take a gateway offline while making sure that all running refreshes on that gateway finish, other than what I described in my original post (disabling the gateway in its cluster, then waiting until all running refreshes are over) ?

I agree that gateway updates should probably not be applied automatically, but this wouldn't be used for that. It would mainly be used to automate Windows updates.

[lbendlin]

this may result in failed refreshes.

Do you have evidence? In my experience another cluster member completes the mashups without the requestor even noticing (apart from the longer than usual timing).

[yfontana]

Someone else reported that behavior to me (and asked me to come up with a solution). I'll run some tests myself, maybe the person misunderstood what was happening.