# Upgrade: 2025.2 (Flamingo) → 2026.1 (Gazpacho)

This is a **sequential upgrade** from 2025.2 to 2026.1. Because 2025.2 is not a SLURP release, operators on 2025.2 must upgrade sequentially — there is no skip available. This is a single-hop upgrade and follows the standard upgrade procedure.

---

## Pre-Upgrade Steps

### 1. Complete Online Data Migrations on 2025.2

All online data migrations must be complete before installing 2026.1 packages.

```bash
# Nova — repeat until output shows 0 rows migrated
nova-manage db online_data_migrations
nova-manage db online_data_migrations  # run again to confirm 0

# Cinder — repeat until output shows 0 rows migrated
cinder-manage db online_data_migrations
cinder-manage db online_data_migrations

# Ironic (if deployed)
ironic-dbsync online_data_migrations
ironic-dbsync online_data_migrations
```

### 2. Address Deprecations from 2025.2

Options deprecated in 2025.2 may be removed in 2026.1. Scan service logs for deprecation warnings:

```bash
for svc in nova-api nova-conductor neutron-server cinder-api glance-api keystone heat-api; do
  echo "=== $svc ==="
  journalctl -u "$svc" --since "60 days ago" | grep -i deprecat | sort -u | tail -10
done
```

Check the 2026.1 release notes for removed options:
- Nova: https://docs.openstack.org/releasenotes/nova/2026.1.html
- Neutron: https://docs.openstack.org/releasenotes/neutron/2026.1.html
- Cinder: https://docs.openstack.org/releasenotes/cinder/2026.1.html
- Keystone: https://docs.openstack.org/releasenotes/keystone/2026.1.html
- Glance: https://docs.openstack.org/releasenotes/glance/2026.1.html

### 3. Back Up Databases

```bash
for db in keystone nova nova_api nova_cell0 neutron cinder glance heat barbican designate ironic magnum octavia manila; do
  mysqldump --single-transaction --routines --triggers "$db" > "/backup/${db}-2025.2-pre-upgrade.sql"
  echo "Backed up $db"
done
```

### 4. Back Up Configuration

```bash
tar czf /backup/openstack-config-2025.2-pre-upgrade.tar.gz \
  /etc/keystone \
  /etc/nova \
  /etc/neutron \
  /etc/cinder \
  /etc/glance \
  /etc/heat \
  /etc/horizon \
  /etc/octavia \
  /etc/designate \
  /etc/barbican \
  /etc/ironic \
  /etc/magnum \
  /etc/manila
```

### 5. Back Up Keystone Keys

```bash
tar czf /backup/keystone-keys-2025.2-pre-upgrade.tar.gz \
  /etc/keystone/fernet-keys/ \
  /etc/keystone/credential-keys/
```

### 6. Verify Current Health

```bash
openstack compute service list
openstack network agent list
openstack volume service list
openstack token issue
```

All services must be `up`. Resolve any `down` services before proceeding.

---

## Breaking Changes

### General Patterns for 2026.1

Check release notes for version-specific breaking changes. General areas to verify:

- **Removed config options**: Options deprecated in 2025.1 and 2025.2 are candidates for removal in 2026.1. Run `nova-manage --help`, `neutron-server --help`, etc. on the new packages to verify your config options still exist.
- **Policy changes**: oslo.policy `enforce_scope` and `enforce_new_defaults` may have changed defaults. Review the policy enforcement section of each service's release notes.
- **API microversion changes**: Verify any automation or SDKs your team uses do not rely on microversions or behaviors changed in 2026.1.

### Nova-Specific

- Check for any cells v2 migration changes — if you have multiple cells, verify cell mapping commands.
- Check nova-compute RPC versioning — 2026.1 may drop support for computing with 2024.x nodes.
- Verify live migration configuration has not changed.

### Neutron-Specific

- If using ML2/OVN: verify minimum required OVN version for 2026.1 and upgrade OVN packages first if needed.
- Check for any changes to the `[ovn]` or `[ml2_type_geneve]` configuration sections.
- Verify RBAC for network resources (admin_external_net_info, rbac_policy) has not changed in ways affecting your tenants.

### Cinder-Specific

- Verify your storage backend driver is still supported in 2026.1 — some drivers are periodically deprecated or removed.
- Check for changes to the multi-backend configuration format.

### Keystone-Specific

- Verify credential encryption keys are intact after upgrade — Keystone will fail to start if credential-keys are missing.
- Check for changes to the `[fernet_tokens]` or `[token]` sections.

---

## Upgrade Execution

### Infrastructure

```bash
# Upgrade RabbitMQ and MariaDB per their upgrade guides
# Verify Galera after MariaDB upgrade:
mysql -u root -p -e "SHOW STATUS LIKE 'wsrep_cluster_size';"
mysql -u root -p -e "SHOW STATUS LIKE 'wsrep_local_state_comment';"
```

### Keystone

```bash
systemctl stop apache2  # or your WSGI server

apt-get install --only-upgrade keystone python3-keystone
# or: dnf upgrade openstack-keystone python3-keystone

# Merge configuration changes
diff /etc/keystone/keystone.conf /etc/keystone/keystone.conf.dpkg-new || true

keystone-manage db_sync

systemctl start apache2
openstack token issue
openstack endpoint list
```

### Glance

```bash
systemctl stop glance-api

apt-get install --only-upgrade glance python3-glance

glance-manage db_sync

systemctl start glance-api
openstack image list
```

### Cinder

```bash
systemctl stop cinder-api cinder-scheduler cinder-volume cinder-backup

apt-get install --only-upgrade cinder-api cinder-volume cinder-scheduler cinder-backup python3-cinder

cinder-manage db sync

systemctl start cinder-api cinder-scheduler cinder-volume cinder-backup

# Run online data migrations
cinder-manage db online_data_migrations
```

### Neutron

```bash
systemctl stop neutron-server

apt-get install --only-upgrade neutron-server neutron-plugin-ml2 python3-neutron
# Also upgrade agent packages on network and compute nodes:
# apt-get install --only-upgrade neutron-openvswitch-agent neutron-l3-agent neutron-dhcp-agent neutron-metadata-agent

neutron-db-manage upgrade heads

systemctl start neutron-server
# Start agents on network/compute nodes after verifying neutron-server is healthy
```

### Nova

```bash
# Phase 1: Pin RPC versions for rolling upgrade
# Add to /etc/nova/nova.conf:
# [upgrade_levels]
# compute = auto
systemctl restart nova-conductor nova-scheduler

# Phase 2: Upgrade control plane
systemctl stop nova-api nova-conductor nova-scheduler nova-novncproxy

apt-get install --only-upgrade nova-api nova-conductor nova-scheduler nova-novncproxy python3-nova

nova-manage api_db sync
nova-manage db sync

systemctl start nova-api nova-conductor nova-scheduler nova-novncproxy

# Phase 3: Upgrade compute nodes one at a time
# On each compute node:
systemctl stop nova-compute
apt-get install --only-upgrade nova-compute python3-nova
systemctl start nova-compute
# Verify: openstack compute service list | grep "$(hostname)"

# Phase 4: Online data migrations (run after all compute nodes upgraded)
nova-manage db online_data_migrations
# Repeat until: 0 rows migrated

# Phase 5: Remove RPC pin
# Remove [upgrade_levels] from /etc/nova/nova.conf
systemctl restart nova-conductor nova-scheduler
```

### Placement

```bash
systemctl stop placement-api  # or apache2 if running via WSGI

apt-get install --only-upgrade placement python3-placement

placement-manage db sync

systemctl start placement-api
openstack resource provider list
```

### Heat

```bash
systemctl stop heat-api heat-engine heat-api-cfn

apt-get install --only-upgrade heat-api heat-engine python3-heat

heat-manage db_sync

systemctl start heat-api heat-engine heat-api-cfn
```

### Octavia

```bash
systemctl stop octavia-api octavia-worker octavia-health-manager octavia-housekeeping

apt-get install --only-upgrade octavia-api octavia-worker octavia-health-manager octavia-housekeeping python3-octavia

octavia-db-manage upgrade head

systemctl start octavia-api octavia-worker octavia-health-manager octavia-housekeeping
openstack loadbalancer provider list
```

### Designate

```bash
systemctl stop designate-api designate-central designate-worker designate-producer designate-mdns

apt-get install --only-upgrade designate python3-designate

designate-manage database sync

systemctl start designate-api designate-central designate-worker designate-producer designate-mdns
```

### Barbican

```bash
systemctl stop barbican-api barbican-worker

apt-get install --only-upgrade barbican python3-barbican

barbican-manage db upgrade

systemctl start barbican-api barbican-worker
```

### Ironic

```bash
systemctl stop ironic-api ironic-conductor

apt-get install --only-upgrade ironic python3-ironic

ironic-dbsync upgrade
ironic-dbsync online_data_migrations

systemctl start ironic-api ironic-conductor
```

### Magnum

```bash
systemctl stop magnum-api magnum-conductor

apt-get install --only-upgrade magnum python3-magnum

magnum-db-manage upgrade

systemctl start magnum-api magnum-conductor
```

### Manila

```bash
systemctl stop manila-api manila-scheduler manila-share

apt-get install --only-upgrade manila python3-manila

manila-manage db sync

systemctl start manila-api manila-scheduler manila-share
```

---

## Post-Upgrade Verification

```bash
# Core service health
openstack compute service list
openstack network agent list
openstack volume service list

# Authentication
openstack token issue

# Image service
openstack image list

# Placement
openstack resource provider list
openstack allocation candidate list --resource VCPU=1,MEMORY_MB=512,DISK_GB=10

# Test full instance lifecycle
openstack server create \
  --flavor m1.tiny \
  --image cirros \
  --network shared \
  --wait \
  upgrade-verify-test

openstack server show upgrade-verify-test -f value -c status
# Expected: ACTIVE

openstack server delete upgrade-verify-test --wait

# Check for new deprecation warnings (relevant to the next upgrade)
journalctl -u nova-api | grep -i deprecat | tail -20
journalctl -u neutron-server | grep -i deprecat | tail -20
journalctl -u cinder-api | grep -i deprecat | tail -20
```

## Configuration Cleanup

```bash
# Confirm no upgrade_levels sections remain
grep -r "upgrade_levels" /etc/nova/ /etc/cinder/

# Remove dpkg backup files after confirming stable
find /etc/keystone /etc/nova /etc/neutron /etc/cinder /etc/glance \
  \( -name "*.dpkg-old" -o -name "*.rpmsave" \) -print

# Address any deprecation warnings found above before the next upgrade cycle
```

After a successful upgrade to 2026.1, this system is now on a SLURP release. The next upgrade can be to 2026.2 (sequential) or directly to 2027.1 (SLURP path, when available).