▤ Stackers Network

Learn OpenStack · operations/upgrades

Upgrade: 2025.1 (Epoxy) → 2026.1 (Gazpacho) — SLURP Path

This is the SLURP upgrade path. 2025.1 (Epoxy) and 2026.1 are both SLURP releases. Operators on 2025.1 may upgrade directly to 2026.1, skipping 2025.2 entirely. This is the recommended path for operators who want to reduce upgrade frequency.

If you are on 2025.2, you cannot use this guide. You must follow 2025.2-to-2026.1.md instead — 2025.2 is not a SLURP release and cannot skip to 2026.1 via the SLURP mechanism.

SLURP Path Special Considerations

Because this upgrade skips an entire release, the version delta is larger than a sequential upgrade. Before starting:

  1. All online data migrations from 2025.1 must be fully complete. SLURP upgrades do not allow a mid-path completion of migrations — all must be done before the first 2026.1 package is installed.
  2. All deprecations from both 2025.1 and 2025.2 release notes must be addressed. The 2026.1 release may remove options that were merely deprecated (not removed) in 2025.2.
  3. Review the release notes for both 2025.2 and 2026.1. Even though you are not installing 2025.2, its upgrade notes list changes that are inherited by 2026.1.
  4. Database schema compatibility. The 2025.1 DB schema must be compatible with the 2026.1 migration chain. The SLURP migration path is tested upstream, but verify in a non-production environment first.

Pre-Upgrade Steps

1. Complete All Online Data Migrations on 2025.1

This step is mandatory for SLURP and must be done while still running 2025.1 packages.

# Nova — repeat until 0 rows migrated
nova-manage db online_data_migrations
nova-manage db online_data_migrations  # run again to confirm 0

# Cinder — repeat until 0 rows migrated
cinder-manage db online_data_migrations
cinder-manage db online_data_migrations  # run again to confirm 0

# Ironic (if deployed)
ironic-dbsync online_data_migrations
ironic-dbsync online_data_migrations

2. Address Deprecations from Both 2025.1 and 2025.2 Release Notes

Review deprecation warnings in current service logs:

for svc in nova-api nova-conductor neutron-server cinder-api glance-api keystone heat-api; do
  echo "=== $svc ==="
  journalctl -u "$svc" --since "60 days ago" | grep -i deprecat | sort -u | tail -10
done

Check release notes for removed config options: - 2025.2 upgrade notes (changes inherited by 2026.1): https://docs.openstack.org/releasenotes/ - 2026.1 upgrade notes: https://docs.openstack.org/releasenotes/

Pay particular attention to: - Removed oslo.config options in each service - Changed policy defaults (oslo.policy scope enforcement) - API microversion deprecations

3. Back Up Databases

for db in keystone nova nova_api nova_cell0 neutron cinder glance heat barbican designate ironic magnum octavia manila; do
  mysqldump --single-transaction --routines --triggers "$db" > "/backup/${db}-2025.1-slurp-pre-upgrade.sql"
  echo "Backed up $db — $(wc -c < /backup/${db}-2025.1-slurp-pre-upgrade.sql) bytes"
done

4. Back Up Configuration

tar czf /backup/openstack-config-2025.1-slurp-pre-upgrade.tar.gz \
  /etc/keystone \
  /etc/nova \
  /etc/neutron \
  /etc/cinder \
  /etc/glance \
  /etc/heat \
  /etc/horizon \
  /etc/octavia \
  /etc/designate \
  /etc/barbican \
  /etc/ironic \
  /etc/magnum \
  /etc/manila

5. Back Up Keystone Fernet and Credential Keys

tar czf /backup/keystone-keys-2025.1-slurp-pre-upgrade.tar.gz \
  /etc/keystone/fernet-keys/ \
  /etc/keystone/credential-keys/

6. Verify Current Health

openstack compute service list
openstack network agent list
openstack volume service list
openstack token issue

Resolve any down services before proceeding. A SLURP upgrade with unhealthy services is significantly harder to diagnose.

7. Verify Galera and RabbitMQ

# Galera
mysql -u root -p -e "SHOW STATUS LIKE 'wsrep_cluster_size';"
mysql -u root -p -e "SHOW STATUS LIKE 'wsrep_local_state_comment';"
# Expect: Synced

# RabbitMQ
rabbitmqctl cluster_status
rabbitmqctl list_alarms
# Expect: no alarms

Breaking Changes to Review

Changes Inherited from 2025.2

Check the 2025.2 release notes for breaking changes even though you will not install 2025.2. The 2026.1 release incorporates all 2025.2 changes. Key areas:

  • Nova: Check for any removed virt driver options, scheduler filter renames, or cell-related config changes.
  • Neutron: Check for ML2 plugin config changes, agent config renames, and OVN compatibility requirements.
  • Cinder: Check for backend driver renames or removed options.
  • Keystone: Check for removed token provider options, policy enforcement scope changes.

Changes in 2026.1

Check the 2026.1 release notes for each service. Key areas to review:

  • Nova: Check nova --version → nova-manage --version changes; verify any new required config sections.
  • Neutron: If using OVN, check minimum OVN version compatibility with 2026.1.
  • Cinder: Check for changes to the multi-backend config format.
  • Placement: Verify the placement API endpoints are correctly configured — placement was fully separated from Nova several releases ago.

Policy Enforcement

Starting with recent releases, oslo.policy scope enforcement ([oslo_policy] enforce_scope = true) and new defaults (enforce_new_defaults = true) are increasingly the upstream default. Verify your policy files against the new defaults before upgrading, or explicitly set enforce_scope = false and enforce_new_defaults = false during the upgrade and plan to address later.

Upgrade Execution

Follow the service upgrade order from README.md. All steps are the same as a sequential upgrade — the difference is that the packages jump from 2025.1 to 2026.1 directly.

Infrastructure

# Upgrade RabbitMQ, MariaDB, Memcached per their upgrade guides
# After MariaDB upgrade, verify Galera is healthy:
mysql -u root -p -e "SHOW STATUS LIKE 'wsrep_cluster_size';"

Keystone

systemctl stop apache2

apt-get install --only-upgrade keystone python3-keystone
# or: dnf upgrade openstack-keystone python3-keystone

# Merge new config options
diff /etc/keystone/keystone.conf /etc/keystone/keystone.conf.dpkg-new || true

keystone-manage db_sync

systemctl start apache2
openstack token issue
openstack endpoint list

Glance

systemctl stop glance-api

apt-get install --only-upgrade glance python3-glance

glance-manage db_sync

systemctl start glance-api
openstack image list

Cinder

systemctl stop cinder-api cinder-scheduler cinder-volume cinder-backup

apt-get install --only-upgrade cinder-api cinder-volume cinder-scheduler cinder-backup python3-cinder

cinder-manage db sync

systemctl start cinder-api cinder-scheduler cinder-volume cinder-backup

# Online data migrations
cinder-manage db online_data_migrations

Neutron

systemctl stop neutron-server

apt-get install --only-upgrade neutron-server neutron-plugin-ml2 python3-neutron
# Upgrade agent packages on network and compute nodes

neutron-db-manage upgrade heads

systemctl start neutron-server
# Then start agents on network/compute nodes

Nova

# Phase 1: Pin RPC for rolling upgrade
# In /etc/nova/nova.conf:
# [upgrade_levels]
# compute = auto
systemctl restart nova-conductor nova-scheduler

# Phase 2: Upgrade control plane
systemctl stop nova-api nova-conductor nova-scheduler nova-novncproxy

apt-get install --only-upgrade nova-api nova-conductor nova-scheduler nova-novncproxy python3-nova

nova-manage api_db sync
nova-manage db sync

systemctl start nova-api nova-conductor nova-scheduler nova-novncproxy

# Phase 3: Upgrade compute nodes (one at a time, verify after each)
# On each compute node:
systemctl stop nova-compute
apt-get install --only-upgrade nova-compute python3-nova
systemctl start nova-compute
openstack compute service list | grep "$(hostname)"

# Phase 4: Online data migrations
nova-manage db online_data_migrations
# Repeat until: 0 rows migrated

# Phase 5: Remove RPC pin
# Remove [upgrade_levels] from nova.conf
systemctl restart nova-conductor nova-scheduler

Remaining Services

# Heat
systemctl stop heat-api heat-engine heat-api-cfn
apt-get install --only-upgrade heat-api heat-engine python3-heat
heat-manage db_sync
systemctl start heat-api heat-engine heat-api-cfn

# Octavia
systemctl stop octavia-api octavia-worker octavia-health-manager octavia-housekeeping
apt-get install --only-upgrade octavia-api octavia-worker octavia-health-manager octavia-housekeeping python3-octavia
octavia-db-manage upgrade head
systemctl start octavia-api octavia-worker octavia-health-manager octavia-housekeeping

# Designate
systemctl stop designate-api designate-central designate-worker designate-producer
apt-get install --only-upgrade designate python3-designate
designate-manage database sync
systemctl start designate-api designate-central designate-worker designate-producer

# Barbican
systemctl stop barbican-api barbican-worker
apt-get install --only-upgrade barbican python3-barbican
barbican-manage db upgrade
systemctl start barbican-api barbican-worker

# Ironic
systemctl stop ironic-api ironic-conductor
apt-get install --only-upgrade ironic python3-ironic
ironic-dbsync upgrade
ironic-dbsync online_data_migrations
systemctl start ironic-api ironic-conductor

# Magnum
systemctl stop magnum-api magnum-conductor
apt-get install --only-upgrade magnum python3-magnum
magnum-db-manage upgrade
systemctl start magnum-api magnum-conductor

# Manila
systemctl stop manila-api manila-scheduler manila-share
apt-get install --only-upgrade manila python3-manila
manila-manage db sync
systemctl start manila-api manila-scheduler manila-share

Post-Upgrade Verification

# Core services
openstack compute service list
openstack network agent list
openstack volume service list

# Authentication
openstack token issue

# Image service
openstack image list

# Placement
openstack resource provider list
openstack allocation candidate list --resource VCPU=1,MEMORY_MB=512,DISK_GB=10

# Test instance lifecycle
openstack server create \
  --flavor m1.tiny \
  --image cirros \
  --network shared \
  --wait \
  slurp-upgrade-verify-test

openstack server show slurp-upgrade-verify-test -f value -c status
# Expected: ACTIVE

openstack server delete slurp-upgrade-verify-test --wait

Configuration Cleanup After SLURP Upgrade

# Remove RPC version pins (should already be done)
grep -r "upgrade_levels" /etc/nova/ /etc/cinder/

# Remove deprecated options found in logs
journalctl -u nova-api | grep -i "deprecated.*option" | tail -20

# Clean up dpkg backup files
find /etc/keystone /etc/nova /etc/neutron /etc/cinder /etc/glance -name "*.dpkg-old" -delete

# Verify fernet key rotation is working (SLURP does not change key rotation procedure)
keystone-manage fernet_rotate --keystone-user keystone --keystone-group keystone
openstack token issue

After a successful SLURP upgrade to 2026.1, the next valid upgrade path is 2026.1 → 2027.1 (the next SLURP release) or 2026.1 → 2026.2 sequentially.