Procedure

1. Log in to the undercloud as the stack user.

2. Source the stackrc file:

   $ source ~/stackrc

3. Edit your overcloud subscription management environment file, which is the file that contains the RhsmVars parameter. The default name for this file is usually rhsm.yml.

4. Check if your subscription management configuration includes the rhsm_release parameter. If the rhsm_release parameter is not present, add it and set it to 8.4:

   parameter_defaults:
     RhsmVars:
       …​
       rhsm_username: "myusername"
       rhsm_password: "p@55w0rd!"
       rhsm_org_id: "1234567"
       rhsm_pool_ids: "1a85f9223e3d5e43013e3d6e8ff506fd"
       rhsm_method: "portal"
       rhsm_release: "8.4"

5. Save the overcloud subscription management environment file.

6. Create a static inventory file of your overcloud:

   $ tripleo-ansible-inventory --ansible_ssh_user heat-admin --static-yaml-inventory ~/inventory.yaml

   If you use an overcloud name that is different to the default overcloud name of overcloud, set the name of your overcloud with the --plan option.

7. Create a playbook that contains a task to lock the operating system version to RHEL 8.4 on all nodes:

   $ cat > ~/set_release.yaml <<'EOF'
   - hosts: all
     gather_facts: false
     tasks:
       - name: set release to 8.4
         command: subscription-manager release --set=8.4
         become: true
   EOF

8. Run the set_release.yaml playbook:

   $ ansible-playbook -i ~/inventory.yaml -f 25 ~/set_release.yaml --limit <undercloud>,<Controller>,<Compute>

   • Use the --limit option to apply the content to all RHOSP nodes. Replace <undercloud>, <Controller>, <Compute> with the Ansible groups in your environment that contain those nodes.
   • You cannot run this playbook against Ceph Storage nodes if you are using a different subscription for these nodes.

Procedure

1. Log in to the undercloud as the stack user.

2. Source the stackrc file:

   $ source ~/stackrc

3. Edit your overcloud subscription management environment file, which is the file that contains the RhsmVars parameter. The default name for this file is usually rhsm.yml.

4. Check the rhsm_repos parameter in your subscription management configuration. If this parameter does not include the TUS repositories, change the relevant repositories to the TUS versions:

   parameter_defaults:
     RhsmVars:
       rhsm_repos:
         - rhel-8-for-x86_64-baseos-tus-rpms
         - rhel-8-for-x86_64-appstream-tus-rpms
         - rhel-8-for-x86_64-highavailability-tus-rpms
         - ansible-2.9-for-rhel-8-x86_64-rpms
         - openstack-16.2-for-rhel-8-x86_64-rpms
         - rhceph-4-tools-for-rhel-8-x86_64-rpms
         - fast-datapath-for-rhel-8-x86_64-rpms

5. Save the overcloud subscription management environment file.

6. Create a static inventory file of your overcloud:

   $ tripleo-ansible-inventory --ansible_ssh_user heat-admin --static-yaml-inventory ~/inventory.yaml

   If you use an overcloud name that is different to the default overcloud name of overcloud, set the name of your overcloud with the --plan option.

7. Create a playbook that contains a task to set the repositories to RHEL 8.4 TUS on all nodes:

   $ cat > ~/change_tus.yaml <<'EOF'
   - hosts: all
     gather_facts: false
     tasks:
       - name: change to tus repos
         command: subscription-manager repos --disable=rhel-8-for-x86_64-baseos-eus-rpms --disable=rhel-8-for-x86_64-appstream-eus-rpms --disable=rhel-8-for-x86_64-highavailability-eus-rpms --enable=rhel-8-for-x86_64-baseos-tus-rpms --enable=rhel-8-for-x86_64-appstream-tus-rpms --enable=rhel-8-for-x86_64-highavailability-tus-rpms
         become: true
   EOF

   • If your environment includes standard repositories, disable the following repositories:

     • rhel-8-for-x86_64-baseos-rpms
     • rhel-8-for-x86_64-appstream-rpms
     • rhel-8-for-x86_64-highavailability-rpms

8. Run the change_tus.yaml playbook:

   $ ansible-playbook -i ~/inventory.yaml -f 25 ~/change_tus.yaml --limit <undercloud>,<Controller>,<Compute>

   • Use the --limit option to apply the content to all Red Hat OpenStack Platform nodes. Replace <undercloud>, <Controller>, <Compute> with the Ansible groups in your environment that contain those nodes.
   • You cannot run this playbook against Ceph Storage nodes if you are using a different subscription for these nodes.

Procedure

1. Log in to the undercloud as the stack user.

2. Source the stackrc file:

   $ source ~/stackrc

3. Edit your overcloud subscription management environment file, which is the file that contains the RhsmVars parameter. The default name for this file is usually rhsm.yml.

4. Check the rhsm_repos parameter in your subscription management configuration. If the rhsm_repos parameter uses the RHOSP 16.1 and Ansible 2.8 repositories, change the repository to the correct versions:

   parameter_defaults:
     RhsmVars:
       rhsm_repos:
         - rhel-8-for-x86_64-baseos-tus-rpms
         - rhel-8-for-x86_64-appstream-tus-rpms
         - rhel-8-for-x86_64-highavailability-tus-rpms
         - ansible-2.9-for-rhel-8-x86_64-rpms
         - openstack-16.2-for-rhel-8-x86_64-rpms
         - fast-datapath-for-rhel-8-x86_64-rpms

5. Save the overcloud subscription management environment file.

6. Create a static inventory file of your overcloud:

   $ tripleo-ansible-inventory --ansible_ssh_user heat-admin --static-yaml-inventory ~/inventory.yaml

   If you use an overcloud name that is different to the default overcloud name of overcloud, set the name of your overcloud with the --plan option.

7. Create a playbook that contains a task to set the repositories to RHOSP 16.2 on all RHOSP nodes:

   $ cat > ~/update_rhosp_repos.yaml <<'EOF'
   - hosts: all
     gather_facts: false
     tasks:
       - name: change osp repos
         command: subscription-manager repos --disable=openstack-16.1-for-rhel-8-x86_64-rpms --enable=openstack-16.2-for-rhel-8-x86_64-rpms --disable=ansible-2.8-for-rhel-8-x86_64-rpms --enable=ansible-2.9-for-rhel-8-x86_64-rpms
         become: true
   EOF

8. Run the update_rhosp_repos.yaml playbook:

   $ ansible-playbook -i ~/inventory.yaml -f 25 ~/update_rhosp_repos.yaml --limit <undercloud>,<Controller>,<Compute>

   • Use the --limit option to apply the content to all RHOSP nodes. Replace <undercloud>, <Controller>, <Compute> with the Ansible groups in your environment that contain those nodes.
   • You cannot run this playbook against Ceph Storage nodes if you are using a different subscription for these nodes.

9. Create a playbook that contains a task to set the repositories to RHOSP 16.2 on all Ceph Storage nodes:

   $ cat > ~/update_ceph_repos.yaml <<'EOF'
   - hosts: all
     gather_facts: false
     tasks:
       - name: change ceph repos
         command: subscription-manager repos --disable=openstack-16-deployment-tools-for-rhel-8-x86_64-rpms --enable=openstack-16.2-deployment-tools-for-rhel-8-x86_64-rpms --disable=ansible-2.8-for-rhel-8-x86_64-rpms --enable=ansible-2.9-for-rhel-8-x86_64-rpms
         become: true
   EOF

10. Run the update_ceph_repos.yaml playbook:

    $ ansible-playbook -i ~/inventory.yaml -f 25 ~/update_ceph_repos.yaml --limit CephStorage

    Use the --limit option to apply the content to Ceph Storage nodes.

Procedure

1. Log in to the undercloud as the stack user.

2. Source the stackrc file:

   $ source ~/stackrc

3. Create a static inventory file of your overcloud:

   $ tripleo-ansible-inventory --ansible_ssh_user heat-admin --static-yaml-inventory ~/inventory.yaml

   If you use an overcloud name that is different to the default overcloud name of overcloud, set the name of your overcloud with the --plan option.

4. Create a playbook that contains a task to set the container-tools module to version 3.0 on all nodes:

   $ cat > ~/container-tools.yaml <<'EOF'
   - hosts: all
     gather_facts: false
     tasks:
       - name: disable default dnf module for container-tools
         command: dnf module reset -y container-tools
         become: true
       - name: set dnf module for container-tools:3.0
         command: dnf module enable -y container-tools:3.0
         become: true
   EOF

5. Run the container-tools.yaml playbook against all nodes:

   $ ansible-playbook -i ~/inventory.yaml -f 25 ~/container-tools.yaml

Procedure

1. Edit the container preparation file. The default name for this file is usually containers-prepare-parameter.yaml.

2. Check the tag parameter is set to 16.2 for each rule set:

   parameter_defaults:
     ContainerImagePrepare:
     - push_destination: true
       set:
         …​
         tag: '16.2'
       tag_from_label: '{version}-{release}'

   Note

   If you do not want to use a specific tag for the update, such as 16.2 or 16.2.2, remove the tag key-value pair and specify tag_from_label only. This uses the installed Red Hat OpenStack Platform version to determine the value for the tag to use as part of the update process.

3. Save this file.

Procedure

1. Log in to the undercloud as the stack user.

2. Source the stackrc file:

   $ source ~/stackrc

3. Edit your custom overcloud SSL/TLS public endpoint file, which is usually named ~/templates/enable-tls.yaml.

4. Remove the NodeTLSData resource from the resource_registry:

   resource_registry:
     OS::TripleO::NodeTLSData: /usr/share/openstack-tripleo-heat-templates/puppet/extraconfig/tls/tls-cert-inject.yaml
     ...

   The overcloud deployment uses a new service in HAProxy to determine if SSL/TLS is enabled.

   Note

   If this is the only resource in the resource_registry section of the enable-tls.yaml file, remove the complete resource_registry section.

5. Save the SSL/TLS public endpoint file.

6. If you are updating from Red Hat OpenStack Platform 16.1, you must update the permissions in Red Hat Identity Manager (IdM) for all pre-update checks to pass. Use ssh to login to the server that is running your IdM, and then run the following commands:

   $ kinit admin
   $ ipa privilege-add-permission 'Nova Host Management' --permission 'System: Modify Realm Domains'

Procedure

1. Log in to the undercloud as the stack user.

2. Source the stackrc file.

   $ source ~/stackrc

3. Log in to a Controller node and run the Pacemaker command to disable fencing:

   $ ssh heat-admin@<controller_ip> "sudo pcs property set stonith-enabled=false"

   Replace <controller_ip> with the IP address of a Controller node. You can find the IP addresses of your Controller nodes with the openstack server list command.

4. In the fencing.yaml environment file, set the EnableFencing parameter to false to ensure that fencing stays disabled during the update process.

Procedure

1. On the undercloud node, log in as the stack user.

2. Source the stackrc file:

   $ source ~/stackrc

3. Update the director main packages with the dnf update command:

   $ sudo dnf update -y python3-tripleoclient* tripleo-ansible ansible

4. Update the undercloud environment with the openstack undercloud upgrade command :

   $ openstack undercloud upgrade

5. Wait until the undercloud update process completes.

6. Reboot the undercloud to update the operating system’s kernel and other system packages:

   $ sudo reboot

7. Wait until the node boots.

Procedure

1. Source the stackrc file:

   $ source ~/stackrc

2. Remove any existing images from the images directory on the stack user’s home (/home/stack/images):

   $ rm -rf ~/images/*

3. Extract the archives:

   $ cd ~/images
   $ for i in /usr/share/rhosp-director-images/overcloud-full-latest-16.2.tar /usr/share/rhosp-director-images/ironic-python-agent-latest-16.2.tar; do tar -xvf $i; done
   $ cd ~

4. Import the latest images into the director:

   $ openstack overcloud image upload --update-existing --image-path /home/stack/images/

5. Configure your nodes to use the new images:

   $ openstack overcloud node configure $(openstack baremetal node list -c UUID -f value)

6. Verify the existence of the new images:

   $ openstack image list
   $ ls -l /var/lib/ironic/httpboot

Procedure

1. Source the stackrc file:

   $ source ~/stackrc

2. Run the update preparation command:

   $ openstack overcloud update prepare \
       --templates \
       --stack <stack_name> \
       -r <roles_data_file> \
       -n <network_data_file> \
       -e <environment_file> \
       -e <environment_file> \
       ...

   Include the following options relevant to your environment:

   • If the name of your overcloud stack is different to the default name overcloud, include the --stack option in the update preparation command and replace <stack_name> with the name of your stack.
   • If you use your own custom roles, include your custom roles (<roles_data>) file (-r).
   • If you use custom networks, include your composable network (<network_data>) file (-n).
   • If you deploy a high availability cluster, include the --ntp-server option in the update preparation command, or include the NtpServer parameter and value in your environment file.
   • Any custom configuration environment files (-e).
3. Wait until the update preparation process completes.

Procedure

1. Source the stackrc file:

   $ source ~/stackrc

2. Run the openstack overcloud external-update run command against tasks that have the container_image_prepare tag:

   $ openstack overcloud external-update run --stack <stack_name> --tags container_image_prepare

Procedure

1. Log into the undercloud as the stack user.

2. Source the stackrc file:

   $ source ~/stackrc

3. Run the openstack overcloud external-update run command against the tasks that have the ovn tag:

   $ openstack overcloud external-update run --stack <stack_name> --tags ovn

   • If the name of your overcloud stack is different from the default stack name overcloud, set your stack name with the --stack option and replace <stack_name> with the name of your stack.
4. Wait until the ovn-controller container update completes.

Procedure

1. Source the stackrc file:

   $ source ~/stackrc

2. Run the update command:

   $ openstack overcloud update run --stack <stack_name> --limit Controller

3. Wait until the Controller node update completes.

Procedure

1. Source the stackrc file:

   $ source ~/stackrc

2. Run the update command:

   $ openstack overcloud update run --stack <stack_name> --limit Compute

3. Wait until the Compute node update completes.

Procedure

1. Source the stackrc file:

   $ source ~/stackrc

2. Run the update command:

   $ openstack overcloud update run --stack <stack_name> --limit ComputeHCI

   • Replace <stack_name> with the name of with the name of your stack. if not specified, the default is overcloud.
3. Wait until the node update completes.

4. Run the Ceph Storage update command:

   $ openstack overcloud external-update run --stack <stack_name> --tags ceph

5. Wait until the Compute HCI node update completes.

Procedure

1. Source the stackrc file:

   $ source ~/stackrc

2. Run the update command:

   $ openstack overcloud update run --stack <stack_name> --limit DistributedComputeHCI

3. Wait until the DistributedComputeHCI node update completes.

4. Run the Ceph Storage update command:

   $ openstack overcloud external-update run --stack <stack_name> --tags ceph

5. Wait until the DistributedComputeHCI node update completes.
6. Use the same process to update DistributedComputeHCIScaleOut nodes.

Procedure

1. Source the stackrc file:

   $ source ~/stackrc

2. Update group nodes.

   To update all nodes in a group:

   $ openstack overcloud update run --limit <GROUP_NAME>

   To update a single node in a group:

   $ openstack overcloud update run --limit <GROUP_NAME> [NODE_INDEX]

   Note

   Ensure that you update all nodes if you choose to update nodes individually.

   The index of the first node in a group is zero (0). For example, to update the first node in a group named CephStorage:

   openstack overcloud update run --limit CephStorage[0]

3. Wait until the node update completes.

4. Run the Ceph Storage container update command to run ceph-ansible as an external process and update the Red Hat Ceph Storage 4 containers:

   $ openstack overcloud external-update run --tags ceph

5. Wait until the Ceph Storage container update completes.

Procedure

1. Source the stackrc file:

   $ source ~/stackrc

2. Run the openstack overcloud external-update run command against tasks that use the online_upgrade tag:

   $ openstack overcloud external-update run --tags online_upgrade

Procedure

1. Log in to the undercloud as the stack user.

2. Source the stackrc file:

   $ source ~/stackrc

3. If fencing is disabled, and you do not run openstack overcloud update converge, then you must re-enable fencing:

   1. Log in to a Controller node and run the Pacemaker command to re-enable fencing:

      $ ssh tripleo-admin@<controller_ip> "sudo pcs property set stonith-enabled=true"

      • Replace <controller_ip> with the IP address of a Controller node. You can find the IP addresses of your Controller nodes with the openstack server list command.
   2. In the fencing.yaml environment file, set the value of the EnableFencing parameter to true.

4. Optional: Run the update finalization command:

   $ openstack overcloud update converge \
       --templates \
       --stack <stack_name> \
       -r <roles_data_file> \
       -n <network_data_file> \
       -e <environment_file> \
       -e <environment_file> \
       ...
       ...

   Include the following options that are relevant to your environment:

   • The fencing.yaml environment file, with the EnableFencing parameter set to true.
   • If the name of your overcloud stack is different to the default name overcloud, include the --stack option in the update preparation command and replace <stack_name> with the name of your stack.
   • If you use custom roles, include your custom roles (<roles_data>) file (-r).
   • If you use custom networks, include your composable network (<network_data>) file (-n).

   • Any custom configuration environment files (-e).

     Wait until the update finalization completes.

Procedure

1. Log in to the node that you want to reboot.

2. Optional: If the node uses Pacemaker resources, stop the cluster:

   [heat-admin@overcloud-controller-0 ~]$ sudo pcs cluster stop

3. Reboot the node:

   [heat-admin@overcloud-controller-0 ~]$ sudo reboot

4. Wait until the node boots.

Verfication

1. Verify that the services are enabled.

   1. If the node uses Pacemaker services, check that the node has rejoined the cluster:

      [heat-admin@overcloud-controller-0 ~]$ sudo pcs status

   2. If the node uses Systemd services, check that all services are enabled:

      [heat-admin@overcloud-controller-0 ~]$ sudo systemctl status

   3. If the node uses containerized services, check that all containers on the node are active:

      [heat-admin@overcloud-controller-0 ~]$ sudo podman ps

Procedure

1. Log in to a Ceph Monitor or Controller node that is running the ceph-mon service, and disable Ceph Storage cluster rebalancing temporarily:

   $ sudo podman exec -it ceph-mon-controller-0 ceph osd set noout
   $ sudo podman exec -it ceph-mon-controller-0 ceph osd set norebalance

   Note

   If you have a multistack or distributed compute node (DCN) architecture, you must specify the cluster name when you set the noout and norebalance flags. For example: sudo podman exec -it ceph-mon-controller-0 ceph osd set noout --cluster <cluster_name>

2. Select the first Ceph Storage node that you want to reboot and log in to the node.

3. Reboot the node:

   $ sudo reboot

4. Wait until the node boots.

5. Log into the node and check the cluster status:

   $ sudo podman exec -it ceph-mon-controller-0 ceph status

   Check that the pgmap reports all pgs as normal (active+clean).

6. Log out of the node, reboot the next node, and check its status. Repeat this process until you have rebooted all Ceph Storage nodes.

7. When complete, log in to a Ceph Monitor or Controller node that is running the ceph-mon service and re-enable cluster rebalancing:

   $ sudo podman exec -it ceph-mon-controller-0 ceph osd unset noout
   $ sudo podman exec -it ceph-mon-controller-0 ceph osd unset norebalance

   Note

   If you have a multistack or distributed compute node (DCN) architecture, you must specify the cluster name when you unset the noout and norebalance flags. For example: sudo podman exec -it ceph-mon-controller-0 ceph osd set noout --cluster <cluster_name>

8. Perform a final status check to verify that the cluster reports HEALTH_OK:

   $ sudo podman exec -it ceph-mon-controller-0 ceph status

Migrating instances workflow

1. Decide whether to migrate instances to another Compute node before rebooting the node.
2. Select and disable the Compute node that you want to reboot so that it does not provision new instances.
3. Migrate the instances to another Compute node.
4. Reboot the empty Compute node.
5. Enable the empty Compute node.