pre-upgrade¶
collect-flavors-and-verify-profiles¶
Collect and verify role flavors.
This validation checks the flavors assigned to roles exist and have the correct capabilities set.
hosts: undercloud
groups: pre-upgrade
parameters:
roles: collect_flavors_and_verify_profiles
Role documentation
compute-tsx¶
RHEL8.x kernel flag for Compute nodes validation.
RHEL-8.3 kernel disabled the Intel TSX (Transactional Synchronization Extensions) feature by default as a preemptive security measure, but it breaks live migration from RHEL-7.9 (or even RHEL-8.1 or RHEL-8.2) to RHEL-8.3.
Operators are expected to explicitly define the TSX flag in their KernelArgs for the compute role to prevent live-migration issues during the upgrade process.
This also impacts upstream CentOS systems.
hosts: nova_libvirt
groups: pre-upgrade, pre-system-upgrade, pre-overcloud-prepare, pre-overcloud-upgrade, pre-overcloud-converge, pre-update, pre-update-prepare, pre-update-run, pre-update-converge
parameters:
compute_tsx_debug: False
compute_tsx_warning: False
roles: compute_tsx
Role documentation
container-status¶
Ensure container status.
Detect failed containers and raise an error.
hosts: undercloud, allovercloud
groups: backup-and-restore, pre-upgrade, pre-update, post-deployment, post-upgrade
parameters:
roles: container_status
Role documentation
containerized-undercloud-docker¶
Verify docker containers are up and ports are open.
Ensure relevant docker containers are up and running, with ports open to listen. We iterate through a list of container names and ports provided in defaults, and ensure the system has those available.
hosts: undercloud
groups: post-deployment, pre-upgrade
parameters:
open_ports: [111, 873, 3000, 3306, 4369, 5000, 5050, 5672, 6000, 6001, 6002, 6379, 6385, 8000, 8004, 8080, 8088, 8774, 8775, 8778, 8787, 8888, 8989, 9000, 9292, 9696, 11211, 15672, 25672, 35357, 39422, {‘port’: 22, ‘search_regex’: ‘OpenSSH’}]
running_containers: [‘glance_api’, ‘heat_api’, ‘heat_api_cfn’, ‘heat_api_cron’, ‘heat_engine’, ‘ironic_api’, ‘ironic_conductor’, ‘ironic_inspector’, ‘ironic_inspector_dnsmasq’, ‘ironic_neutron_agent’, ‘ironic_pxe_http’, ‘ironic_pxe_tftp’, ‘iscsid’, ‘keystone’, ‘keystone_cron’, ‘logrotate_crond’, ‘memcached’, ‘mistral_api’, ‘mistral_engine’, ‘mistral_event_engine’, ‘mistral_executor’, ‘mysql’, ‘neutron_api’, ‘neutron_dhcp’, ‘neutron_l3_agent’, ‘neutron_ovs_agent’, ‘nova_api’, ‘nova_api_cron’, ‘nova_compute’, ‘nova_conductor’, ‘nova_metadata’, ‘nova_placement’, ‘nova_scheduler’, ‘rabbitmq’, ‘swift_account_auditor’, ‘swift_account_reaper’, ‘swift_account_replicator’, ‘swift_account_server’, ‘swift_container_auditor’, ‘swift_container_replicator’, ‘swift_container_server’, ‘swift_container_updater’, ‘swift_object_auditor’, ‘swift_object_expirer’, ‘swift_object_replicator’, ‘swift_object_server’, ‘swift_object_updater’, ‘swift_proxy’, ‘swift_rsync’, ‘tripleo_ui’, ‘zaqar’, ‘zaqar_websocket’]
roles: containerized_undercloud_docker
Role documentation
image-serve¶
Verify image-serve service is working and answering.
Ensures image-serve vhost is configured and httpd is running.
hosts: undercloud
groups: backup-and-restore, pre-upgrade, post-deployment, post-upgrade
parameters:
roles: image_serve
Role documentation
ironic-boot-configuration¶
Check Ironic boot configuration.
Check if baremetal boot configuration is correct.
hosts: undercloud
groups: pre-deployment, pre-upgrade
parameters:
roles: ironic_boot_configuration
Role documentation
node-health¶
Node health check.
Check if all overcloud nodes can be connected to before starting a scale-up or an upgrade.
hosts: undercloud
groups: pre-upgrade
parameters:
roles: node_health
Role documentation
nova-libvirt-version¶
Check correctness of installed nova-libvirt version.
Detect if installed nova-libvirt satisfies constraints.
hosts: Compute
groups: pre-upgrade, pre-update
parameters:
roles: nova_libvirt_version
Role documentation
nova-status¶
Nova Status Upgrade Check.
Performs a release-specific readiness check before restarting services with new code. This command expects to have complete configuration and access to databases and services within a cell. For example, this check may query the Nova API database and one or more cell databases. It may also make requests to other services such as the Placement REST API via the Keystone service catalog The nova-status upgrade check command has three standard return codes: 0 -> All upgrade readiness checks passed successfully and there is nothing to do. 1 -> At least one check encountered an issue and requires further investigation. This is considered a warning but the upgrade may be OK. 2 -> There was an upgrade status check failure that needs to be investigated. This should be considered something that stops an upgrade.
hosts: nova_api
groups: backup-and-restore, pre-upgrade
parameters:
roles: nova_status
Role documentation
openstack-endpoints¶
Check connectivity to various OpenStack services.
This validation gets the PublicVip address from the deployment and tries to access Horizon and get a Keystone token.
hosts: undercloud
groups: post-deployment, pre-upgrade, post-upgrade, pre-update, post-update
parameters:
roles: openstack_endpoints
Role documentation
repos¶
Check correctness of current repositories.
Detect whether the repositories listed in yum repolist can be connected to and that there is at least one repo configured. Detect if there are any unwanted repositories (such as EPEL) enabled.
hosts: undercloud, allovercloud
groups: pre-upgrade, pre-update
parameters:
roles: repos
Role documentation
stack-health¶
Stack Health Check.
Check if all stack resources are in a ‘COMPLETE’ state before starting an upgrade.
hosts: undercloud
groups: pre-upgrade, post-upgrade
parameters:
roles: stack_health
Role documentation
system-encoding¶
System encoding.
Ensure the local is unicode
hosts: all
groups: pre-deployment, pre-upgrade, pre-update
parameters:
system_encoding_debug: False
roles: system_encoding
Role documentation
tripleo-latest-packages-version¶
Check if latest version of TripleO packages is installed.
Make sure a list of TripleO packages are at its latest version before starting an upgrade.
hosts: undercloud
groups: pre-upgrade
parameters:
packages_list: [‘python{{ ansible_python.version.major }}-tripleoclient’]
roles: check_latest_packages_version
Role documentation
undercloud-disabled-services¶
Verify undercloud services state before running update or upgrade.
Check undercloud status before running a stack update - especially minor update and major upgrade.
hosts: undercloud
groups: backup-and-restore, post-upgrade, pre-upgrade, post-update, pre-update
parameters:
roles: undercloud_disabled_services
Role documentation
undercloud-disk-space-pre-upgrade¶
Verify undercloud fits the disk space requirements to perform an upgrade.
Make sure that the root partition on the undercloud node has enough free space before starting an upgrade http://tripleo.org/install/environments/baremetal.html#minimum-system-requirements
hosts: undercloud
groups: pre-upgrade
parameters:
volumes: [{‘mount’: ‘/var/lib/docker’, ‘min_size’: 10}, {‘mount’: ‘/var/lib/config-data’, ‘min_size’: 3}, {‘mount’: ‘/var’, ‘min_size’: 16}, {‘mount’: ‘/’, ‘min_size’: 20}]
roles: undercloud_disk_space
Role documentation
undercloud-heat-purge-deleted¶
Verify heat-manage purge_deleted is enabled in crontab.
Without a purge_deleted crontab enabled, the heat database can grow very large. This validation checks that the purge_deleted crontab has been set up.
hosts: undercloud
groups: pre-upgrade, pre-update, pre-deployment
parameters:
cron_check: heat-manage purge_deleted
roles: undercloud_heat_purge_deleted
Role documentation
undercloud-ipa-server-check¶
Verify that the IPA server has the right permissions and ACI.
This validation is relevant for systems where TLS Everywhere is enabled.
A new ACI is needed on the FreeIPA server to ensure that certificates with IP SANs can be issued. This ACI will be delivered by default from FreeIPA 4.8.5.
In addition, a new permission is needed to add DNS zones for tripleo-ipa. This permission is an addition to the current permissions for the Nova Host Manager role.
This validation confirms that the new permission and ACI are present.
https://docs.openstack.org/project-deploy-guide/tripleo-docs/latest/features/tls-introduction.html
hosts: undercloud
groups: pre-upgrade, pre-update
parameters:
roles: tls_everywhere
Role documentation
undercloud-service-status¶
Verify undercloud services state before running update or upgrade.
Check undercloud status before running a stack update - especially minor update and major upgrade.
hosts: undercloud
groups: backup-and-restore, post-upgrade, pre-upgrade, post-update, pre-update
parameters:
roles: undercloud_service_status
Role documentation
