▤ Stackers Network

Learn OpenStack · operations/upgrades

Upgrade: 2025.2 (Flamingo) → 2026.1 (Gazpacho)

This is a sequential upgrade from 2025.2 to 2026.1. Because 2025.2 is not a SLURP release, operators on 2025.2 must upgrade sequentially — there is no skip available. This is a single-hop upgrade and follows the standard upgrade procedure.

Pre-Upgrade Steps

1. Complete Online Data Migrations on 2025.2

All online data migrations must be complete before installing 2026.1 packages.

# Nova — repeat until output shows 0 rows migrated
nova-manage db online_data_migrations
nova-manage db online_data_migrations  # run again to confirm 0

# Cinder — repeat until output shows 0 rows migrated
cinder-manage db online_data_migrations
cinder-manage db online_data_migrations

# Ironic (if deployed)
ironic-dbsync online_data_migrations
ironic-dbsync online_data_migrations

2. Address Deprecations from 2025.2

Options deprecated in 2025.2 may be removed in 2026.1. Scan service logs for deprecation warnings:

for svc in nova-api nova-conductor neutron-server cinder-api glance-api keystone heat-api; do
  echo "=== $svc ==="
  journalctl -u "$svc" --since "60 days ago" | grep -i deprecat | sort -u | tail -10
done

Check the 2026.1 release notes for removed options: - Nova: https://docs.openstack.org/releasenotes/nova/2026.1.html - Neutron: https://docs.openstack.org/releasenotes/neutron/2026.1.html - Cinder: https://docs.openstack.org/releasenotes/cinder/2026.1.html - Keystone: https://docs.openstack.org/releasenotes/keystone/2026.1.html - Glance: https://docs.openstack.org/releasenotes/glance/2026.1.html

3. Back Up Databases

for db in keystone nova nova_api nova_cell0 neutron cinder glance heat barbican designate ironic magnum octavia manila; do
  mysqldump --single-transaction --routines --triggers "$db" > "/backup/${db}-2025.2-pre-upgrade.sql"
  echo "Backed up $db"
done

4. Back Up Configuration

tar czf /backup/openstack-config-2025.2-pre-upgrade.tar.gz \
  /etc/keystone \
  /etc/nova \
  /etc/neutron \
  /etc/cinder \
  /etc/glance \
  /etc/heat \
  /etc/horizon \
  /etc/octavia \
  /etc/designate \
  /etc/barbican \
  /etc/ironic \
  /etc/magnum \
  /etc/manila

5. Back Up Keystone Keys

tar czf /backup/keystone-keys-2025.2-pre-upgrade.tar.gz \
  /etc/keystone/fernet-keys/ \
  /etc/keystone/credential-keys/

6. Verify Current Health

openstack compute service list
openstack network agent list
openstack volume service list
openstack token issue

All services must be up. Resolve any down services before proceeding.

Breaking Changes

General Patterns for 2026.1

Check release notes for version-specific breaking changes. General areas to verify:

  • Removed config options: Options deprecated in 2025.1 and 2025.2 are candidates for removal in 2026.1. Run nova-manage --help, neutron-server --help, etc. on the new packages to verify your config options still exist.
  • Policy changes: oslo.policy enforce_scope and enforce_new_defaults may have changed defaults. Review the policy enforcement section of each service's release notes.
  • API microversion changes: Verify any automation or SDKs your team uses do not rely on microversions or behaviors changed in 2026.1.

Nova-Specific

  • Check for any cells v2 migration changes — if you have multiple cells, verify cell mapping commands.
  • Check nova-compute RPC versioning — 2026.1 may drop support for computing with 2024.x nodes.
  • Verify live migration configuration has not changed.

Neutron-Specific

  • If using ML2/OVN: verify minimum required OVN version for 2026.1 and upgrade OVN packages first if needed.
  • Check for any changes to the [ovn] or [ml2_type_geneve] configuration sections.
  • Verify RBAC for network resources (admin_external_net_info, rbac_policy) has not changed in ways affecting your tenants.

Cinder-Specific

  • Verify your storage backend driver is still supported in 2026.1 — some drivers are periodically deprecated or removed.
  • Check for changes to the multi-backend configuration format.

Keystone-Specific

  • Verify credential encryption keys are intact after upgrade — Keystone will fail to start if credential-keys are missing.
  • Check for changes to the [fernet_tokens] or [token] sections.

Upgrade Execution

Infrastructure

# Upgrade RabbitMQ and MariaDB per their upgrade guides
# Verify Galera after MariaDB upgrade:
mysql -u root -p -e "SHOW STATUS LIKE 'wsrep_cluster_size';"
mysql -u root -p -e "SHOW STATUS LIKE 'wsrep_local_state_comment';"

Keystone

systemctl stop apache2  # or your WSGI server

apt-get install --only-upgrade keystone python3-keystone
# or: dnf upgrade openstack-keystone python3-keystone

# Merge configuration changes
diff /etc/keystone/keystone.conf /etc/keystone/keystone.conf.dpkg-new || true

keystone-manage db_sync

systemctl start apache2
openstack token issue
openstack endpoint list

Glance

systemctl stop glance-api

apt-get install --only-upgrade glance python3-glance

glance-manage db_sync

systemctl start glance-api
openstack image list

Cinder

systemctl stop cinder-api cinder-scheduler cinder-volume cinder-backup

apt-get install --only-upgrade cinder-api cinder-volume cinder-scheduler cinder-backup python3-cinder

cinder-manage db sync

systemctl start cinder-api cinder-scheduler cinder-volume cinder-backup

# Run online data migrations
cinder-manage db online_data_migrations

Neutron

systemctl stop neutron-server

apt-get install --only-upgrade neutron-server neutron-plugin-ml2 python3-neutron
# Also upgrade agent packages on network and compute nodes:
# apt-get install --only-upgrade neutron-openvswitch-agent neutron-l3-agent neutron-dhcp-agent neutron-metadata-agent

neutron-db-manage upgrade heads

systemctl start neutron-server
# Start agents on network/compute nodes after verifying neutron-server is healthy

Nova

# Phase 1: Pin RPC versions for rolling upgrade
# Add to /etc/nova/nova.conf:
# [upgrade_levels]
# compute = auto
systemctl restart nova-conductor nova-scheduler

# Phase 2: Upgrade control plane
systemctl stop nova-api nova-conductor nova-scheduler nova-novncproxy

apt-get install --only-upgrade nova-api nova-conductor nova-scheduler nova-novncproxy python3-nova

nova-manage api_db sync
nova-manage db sync

systemctl start nova-api nova-conductor nova-scheduler nova-novncproxy

# Phase 3: Upgrade compute nodes one at a time
# On each compute node:
systemctl stop nova-compute
apt-get install --only-upgrade nova-compute python3-nova
systemctl start nova-compute
# Verify: openstack compute service list | grep "$(hostname)"

# Phase 4: Online data migrations (run after all compute nodes upgraded)
nova-manage db online_data_migrations
# Repeat until: 0 rows migrated

# Phase 5: Remove RPC pin
# Remove [upgrade_levels] from /etc/nova/nova.conf
systemctl restart nova-conductor nova-scheduler

Placement

systemctl stop placement-api  # or apache2 if running via WSGI

apt-get install --only-upgrade placement python3-placement

placement-manage db sync

systemctl start placement-api
openstack resource provider list

Heat

systemctl stop heat-api heat-engine heat-api-cfn

apt-get install --only-upgrade heat-api heat-engine python3-heat

heat-manage db_sync

systemctl start heat-api heat-engine heat-api-cfn

Octavia

systemctl stop octavia-api octavia-worker octavia-health-manager octavia-housekeeping

apt-get install --only-upgrade octavia-api octavia-worker octavia-health-manager octavia-housekeeping python3-octavia

octavia-db-manage upgrade head

systemctl start octavia-api octavia-worker octavia-health-manager octavia-housekeeping
openstack loadbalancer provider list

Designate

systemctl stop designate-api designate-central designate-worker designate-producer designate-mdns

apt-get install --only-upgrade designate python3-designate

designate-manage database sync

systemctl start designate-api designate-central designate-worker designate-producer designate-mdns

Barbican

systemctl stop barbican-api barbican-worker

apt-get install --only-upgrade barbican python3-barbican

barbican-manage db upgrade

systemctl start barbican-api barbican-worker

Ironic

systemctl stop ironic-api ironic-conductor

apt-get install --only-upgrade ironic python3-ironic

ironic-dbsync upgrade
ironic-dbsync online_data_migrations

systemctl start ironic-api ironic-conductor

Magnum

systemctl stop magnum-api magnum-conductor

apt-get install --only-upgrade magnum python3-magnum

magnum-db-manage upgrade

systemctl start magnum-api magnum-conductor

Manila

systemctl stop manila-api manila-scheduler manila-share

apt-get install --only-upgrade manila python3-manila

manila-manage db sync

systemctl start manila-api manila-scheduler manila-share

Post-Upgrade Verification

# Core service health
openstack compute service list
openstack network agent list
openstack volume service list

# Authentication
openstack token issue

# Image service
openstack image list

# Placement
openstack resource provider list
openstack allocation candidate list --resource VCPU=1,MEMORY_MB=512,DISK_GB=10

# Test full instance lifecycle
openstack server create \
  --flavor m1.tiny \
  --image cirros \
  --network shared \
  --wait \
  upgrade-verify-test

openstack server show upgrade-verify-test -f value -c status
# Expected: ACTIVE

openstack server delete upgrade-verify-test --wait

# Check for new deprecation warnings (relevant to the next upgrade)
journalctl -u nova-api | grep -i deprecat | tail -20
journalctl -u neutron-server | grep -i deprecat | tail -20
journalctl -u cinder-api | grep -i deprecat | tail -20

Configuration Cleanup

# Confirm no upgrade_levels sections remain
grep -r "upgrade_levels" /etc/nova/ /etc/cinder/

# Remove dpkg backup files after confirming stable
find /etc/keystone /etc/nova /etc/neutron /etc/cinder /etc/glance \
  \( -name "*.dpkg-old" -o -name "*.rpmsave" \) -print

# Address any deprecation warnings found above before the next upgrade cycle

After a successful upgrade to 2026.1, this system is now on a SLURP release. The next upgrade can be to 2026.2 (sequential) or directly to 2027.1 (SLURP path, when available).