TripleO project has been retired[1]. Remove the migration tool
implemented specifically for TripleO deployments.
Change-Id: I32775a0aa963b65a3900a87f28a88ab63901a8a0
If the BACKUP_MIGRATION_IP is set to a different IP outside of
the default nets[1] set in the “openstack overcloud backup”
playbook setup_nfs role[2]. Then the NFS will fail to mount
directories during the backup, because they will not be
reachable | permitted.
This change simply adds a new variable
BACKUP_MIGRATION_CTL_PLANE_CIDRS into the ovn_migration script
to allow the user to overwrite the extra-var used for
Openstack overcloud backup --setup-nfs command.
[1] e281ae7624/tripleo_ansible/roles/backup_and_restore/defaults/main.yml (L47)
[2] e281ae7624/tripleo_ansible/roles/backup_and_restore/tasks/setup_nfs.yml (L127)
Change-Id: I160dfc4e893b93ac7a40e19b3dd6b89750dac57d
The package name and url need to update.
- Update package from "python-neutron-ovn-migration-tool" and
"python-neutron" to "openstack-neutron-ovn-migration-tool" and
"openstack-neutron".
- Update url from "github" to "opendev"
Change-Id: I41ba7d6929b28317622dbf868f265eab4c6fd84e
The patch stops all running neutron-server processes before syncing
database from Neutron to OVN. Then it creates a new container to execute
the sync in and after it is done the container is removed.
Change-Id: Ifa439a536572efb72ccefde128fa186fc2f73bef
setup-mtu-t1 argument name is misleading as it suggest that
it will do something with the MTU value, but it really just reduces
DHCP agent t1 timer. The fact that this commnad will have a side
effect of getting a new MTU value from DHCP should not be part
of the argument name. This is based on customer's feedback.
I am keeping backward compatibility for setup-mtu-t1 argument
in order not to break any existing tools that might depend on it.
Change-Id: I939b21fa998c80cf921efeae3e8fa8c2b4ef4f50
As a failsave the migration code can create a backup of
the controllers to use in case that the migration fails
and leaves the environment on a unusable state.
The revert plan has two stages:
1- Backup stage: included on the current ovn-migration.yml.
Can be configured using the env variable CREATE_BACKUP
(True by default). This stage will run the new ansible
role, recovery-backup.
It will store the backup on `/ctl_plane_backup` on the host
where the BACKUP_MIGRATION_IP belongs to (can be modified by
modifing the env var).
In order to restore the controllers, boot them using the iso created
by ReaR (stored in /ctl_plane_backup) and perform `automatic recover`
2- Revert stage: this stage has its own ansible playbook (revert.yml)
This playbook will clean the environment from all the OVN ressources
that could had been created (breaking the data plane connectivity)
to leave the environment in a stage where an overcloud deploy with
the OVS templates can be run.
Note: If the user creates new resources after running the backup stage
and then performs the recovery of the controllers, those resources will
be lost.
Change-Id: I7093f6a5f282b06fb2267cf2c88c533c1eae685d
The second tripleo-update call was there only to update back integration
bridge variable. However the action did the whole deploy for all nodes
in the environment, which can take hours to finish. This patch relies on
other patch in THT that sets br-int as default value. This way once
ovn-extras.yml is not used and the integration bridge is not overriden,
we no longer need to update tripleo about the value so it's safe to
remove the second call.
Depends-On: https://review.opendev.org/c/openstack/tripleo-heat-templates/+/847402
Change-Id: I7455852898bb6e9698ecf5261d4401bc5077c506
Signed-off-by: Jakub Libosvar <libosvar@redhat.com>
There was a code that worked around a bug in openvswitch. The bug was
fixed in openvswitch 2.13 and we no longer use that version. It's safe
to be removed now.
Change-Id: I8d0e1dac4f6a6d201e29863cc76db3f1ff8595ae
Signed-off-by: Jakub Libosvar <libosvar@redhat.com>
IPv4 and IPv6 have different utility in iptables. This patch adds use of
ip6tables the same way as previously used iptables.
Change-Id: I1e8ef2749ac5705563e539a5e9f02c63347b5dbe
Signed-off-by: Jakub Libosvar <libosvar@redhat.com>
After migration there is one side of patch port on the integration
bridge. It has no impact on functionality but it's better to remove it.
Change-Id: Icfa2d94e123268679cf152e00e2e3d45162f10b1
Signed-off-by: Jakub Libosvar <libosvar@redhat.com>
Previously the migration playbook continued even if tripleo deploy
failed which damaged the environment even more. This patch will make the
task fail if deploy fails too. There are also other commands which
return code was ignored.
Change-Id: Ib27fa676e126503eacb97b24e95aa7cd2982adab
Signed-off-by: Jakub Libosvar <libosvar@redhat.com>
On OSP17 there are some ml2 ovs services that are not
present on some computes eventhought is defined on the
ansible service facts.
This patch will ensure that only those services that are
actually running will be stopped.
Change-Id: I94f0832d09d263837262ada109a567e864915a1a
Before this patch, when migrating from ML2/OVS to ML2/OVN, we
removed the VIF details that are not used by OVN. However, this
changes how the VIFs are plugged if the hybrid iptables firewall
was used.
In order to not break the migration, we want to keep whatever
plugging was used in ML2/OVS. For this reason, this patch is
leaving the VIF details untouched.
The consequence is that, after migration, whatever workloads
used the hybrid plugging will remain like that. Newly created
VIFs will be plugged to the OVS bridge directly. As a result,
the migration to OVN won't require moving to the OVS firewall
first while in ML2/OVS.
This patch is also removing the constraint that prevented the
migration if the hybrid firewall was used.
Signed-off-by: Daniel Alvarez Sanchez <dalvarez@redhat.com>
Change-Id: Iad4fae7af54cc502ac0ba02a911cdd4fefa13535
[1] Updated the migration script to check for config-download
directory instead of stack, but missed update the Error
message.
check_stack function is renamed to check_source_inventory
as now it only checks for source inventory instead of heat
stack.
If source inventory file doesn't exist the script
will report Error message and exit.
This is follow up of [1].
[1] https://review.opendev.org/c/openstack/neutron/+/834925
Related-Bug: #1966099
Change-Id: I2416fba50fc495da4d59a3f335f33d831ca6e91d
The validation is intended mostly for tests and don't make much sense
when running the migration in production because likely there are
already running workloads. This patch changes the default to False so
migration validation must be explicitly asked for.
Change-Id: I5470f61a5e0b55bf682526208c3f57dc0ca6ffd5
Signed-off-by: Jakub Libosvar <libosvar@redhat.com>
tripleo-ansible-inventory stopped working in Wallaby. However, TripleO
now stores the needed ansible-inventory on the undercloud filesystem.
This patch switches from dynamic generation of the Ansible inventory to
use of the already existing inventory file. Fortunately, the format of
the file remained the same as the generated one, so no other changes in
parsing are required.
Closes-Bug: #1966099
Change-Id: I3bdf878617fbe962d56ebb66d59ae7edeb9b7c38
Signed-off-by: Jakub Libosvar <libosvar@redhat.com>
It's a common practice to have /tmp/ mounted separately with noexec
option. This effectively means no scripts can be executed from the
filesystem mounted to /tmp.
This patch explicitly calls sh binary to execute scripts from /tmp and
removes the executable flag from the scripts.
Closes-Bug: #1965183
Change-Id: I2f9cd67979a8a75848fcdd7a8c3bb56dd3590473
Signed-off-by: Jakub Libosvar <libosvar@redhat.com>
During the clone-br-int the interfaces sg- (SNAT)
and the interfaces fg- (FIP) are cloned. But this
is not necessary, since this kind of interfaces
are useless on OVN (OVN uses OpenFlow).
Change-Id: I3cd74d1d4fca9add50b0700a82b8e8a16140f085
Port status, server status and server console log output are printed
when the create-resources.sh script fails during the OVN migration
Example: OVN migration fails because SSH connection is not possible,
after ping successfully replied - probably a metadata issue and having
the console logs could help to identify it
Change-Id: I83e55203907526caf44ba34cd38241eccf70adb3
After stopping and deleting the services if this role is runned
again it could fail bc systemd has still some ovs services loaded
(eventhough the service is stopped) this will cause that ansible
will try to delete again and fail while trying to disable and
delete the service.
Change-Id: If51d7f25375768f8c60492c84d84e91d91886025
While migrating from OVS to OVN one of the steps of the migration
is clean all the OVS trunk ports, this will fail if the environment
does not have any trunk ports configured.
This will do a comprovation in order to know if it's necessary
to clean them or not.
Also, since this playbook it will only clean the ovn interfaces
it is not necessary to stop the whole migration. If any error
occured while deleting any ovs interface a message will be
printed so the user can take action if necessary.
Change-Id: I6ec0b392b13daa9f64e051fb12b4b97a6c0a1730
Prevent the OVS to OVN migration if any node has the OVS agent
firewall set to "iptables_hybrid". If present, the migration will
exit. This check is implemented in the OVN migration script for
TripleO environments.
Closes-Bug: #1951272
Change-Id: I55f25f56f87bfa2a5e330cdf4c1087e8d4082b29
This change is to include missing OvS DPDK nodes also as part of
ovn-controllers group in hosts_for_migration file.
Change-Id: Ic0727ffdbd1f60574b6d5397177a58172cbd60f0
- Telco usecases requires a flavor which has to contain "extra_specs"
to boot a dpdk instance.
Add the "FLAVOR_NAME" parameter to override the use of the default
flavor used during migration flow.
- Modify the hardcoded server user name (cirros) to use the
"SERVER_USER_NAME" environment variable.
Change-Id: I3d50526d3192cafb673092bc8b22da6c48454434
Currently workload VMs start before subnet is connected to router.
When DVR is enabled this causes sometimes that one of the VMs is not
able to get metadata.
Closes bug: #1947547
Change-Id: Ifd686d7ff452abd1226fbbc97f499e05102e4596
Log the results of the Ansible playbooks by default so that it is easier
to go through them later in case there's something unexpected. The log
is located in $HOME instead of /var/log/ to avoid the need of privileges.
Signed-off-by: Elvira García <egarciar@redhat.com>
Change-Id: Ida2fc11f28200030fff9ddf1e56fc442a2016bab
After migration from ML2/OVS to ML2/OVN trunk subports which were created
by the neutron-ovs-agent to connect br-int with trunk bridges (tbr-)
aren't needed anymore and should be deleted.
Closes-Bug: #1946479
Change-Id: Ib1e3b78597ebdde1aa9d2b242e2005a05a7db89f
After migration from ML2/OVS to ML2/OVN tap ports which were created
by the DHCP agents and router ports (like e.g. qr- or qg-) which were
created by the L3 agents aren't needed at all and should be deleted.
Previously those ports were set to be DOWN only. With this patch
all such ports will be simply deleted from the openvswitch.
Related-bug: #1946479
Change-Id: I74cd5820389c86819c6884d3d61c9b2f7907cc88
Some VMs are created before the ovn mgiration process starts in order to
verify they are healthy after the migration
Sometimes these VMs are not accessible via ssh due to an issue in cirros
0.4.0 that was fixed in a later release [1]
Closes-Bug: #1945299
[1] https://github.com/cirros-dev/cirros/pull/11
Change-Id: Ib133b5e1bed19aeac8514e3c6690ca768991bbd4
OVN migration script fails when VALIDATE_MIGRATION is not set to
True. oc_check_public_network should return successfully in case
VALIDATE_MIGRATION is set to False.
Closes bug: #1942344
Change-Id: Ibd0aea5b4e6bf44803d5d0100cacc17d401b03cc
In DVR environment, there are FG interfaces on nodes. We can delete
those after the migration.
Change-Id: I44967e55213d12af24acbf9561a96afb34548324
Signed-off-by: Jakub Libosvar <libosvar@redhat.com>
The new "migrate" mode for the DB sync utility changes DB contents as
follows:
- it changes vxlan networks to Geneve, including its allocation in
order to avoid future collisions when creating new geneve networks
- it removes settings from ports' vif_details that are no longer
needed, such as hybrid plugging or bridge_name for the trunk bridges
- it sets profile for subports - OVN doesn't use trunk_details but port
profile to store data about trunk. Subports have tag and parent_name
fileds.
Previously, the vxlan to Geneve change was done via ansible role. The
tasks in the role were replaced by the script therefore the role is
removed.
Signed-off-by: Jakub Libosvar <libosvar@redhat.com>
Change-Id: I29a39108d9fddb30050ec63a1cdf6bba0400e136
It turned out there doesn't need to be crudini tool present on the node
running the command. This patch fetches the Neutron conf file instead
and performs an ini lookup over it in order to get the DB connection
string.
Change-Id: Iaf79b8512a920e9f667bd6881d50e8852595fa71
Signed-off-by: Jakub Libosvar <libosvar@redhat.com>
