changing_ovn_image_version.md

Changing OVN Image Versions in RHOSO

Overview

The OVN DB server image version is controlled by the OpenStackVersion CR via the customContainerImages field. Changing it causes the openstack-operator to update the OVNDBCluster CRs, which triggers the ovn-operator to roll the StatefulSet pods.

Finding Available Images

The images.paas.redhat.com registry (used in CI/test environments) lists available tags:

podman search images.paas.redhat.com/podified-rhos18-rhel9/openstack-ovn-nb-db-server --list-tags

The registry.redhat.io registry (official releases) requires authentication via the cluster pull secret:

AUTH=$(oc get secret pull-secret -n openshift-config \
    -o jsonpath="{.data.\.dockerconfigjson}" | base64 -d | \
    python3 -c "import json,sys,base64; d=json.load(sys.stdin); \
    auth=d['auths']['registry.redhat.io']['auth']; \
    print(base64.b64decode(auth).decode())")
USER=$(echo $AUTH | cut -d: -f1)
PASS=$(echo $AUTH | cut -d: -f2-)
podman login registry.redhat.io -u "$USER" -p "$PASS"

podman search registry.redhat.io/rhoso/openstack-ovn-nb-db-server-rhel9 --list-tags

Checking the OVN Schema Version of an Image

podman run --rm <image> cat /usr/share/ovn/ovn-nb.ovsschema | \
    python3 -c "import json,sys; d=json.load(sys.stdin); print(d['version'])"

For example:

# 18.0.1 — schema 7.3.0
podman run --rm registry.redhat.io/rhoso/openstack-ovn-nb-db-server-rhel9:18.0.1 \
    cat /usr/share/ovn/ovn-nb.ovsschema | \
    python3 -c "import json,sys; d=json.load(sys.stdin); print(d['version'])"

# Current — schema 7.12.0
podman run --rm images.paas.redhat.com/podified-rhos18-rhel9/openstack-ovn-nb-db-server:5eb57f57b47cf248b8c6841ea0905c1c \
    cat /usr/share/ovn/ovn-nb.ovsschema | \
    python3 -c "import json,sys; d=json.load(sys.stdin); print(d['version'])"

Checking the Current Image

oc get openstackcontrolplane controlplane -n openstack \
    -o jsonpath="{.status.containerImages.ovnNbDbclusterImage}"
oc get openstackcontrolplane controlplane -n openstack \
    -o jsonpath="{.status.containerImages.ovnSbDbclusterImage}"

Changing the Image

Patch the OpenStackVersion CR customContainerImages field. The openstack-operator will propagate the change to the OVNDBCluster CRs and the pods will be restarted.

NB_IMAGE=<new NB image>
SB_IMAGE=<new SB image>

oc patch openstackversion controlplane -n openstack --type=merge -p \
    "{\"spec\":{\"customContainerImages\":{\"ovnNbDbclusterImage\":\"${NB_IMAGE}\",\"ovnSbDbclusterImage\":\"${SB_IMAGE}\"}}}"

Example: Switch to RHOSO 18.0.1

oc patch openstackversion controlplane -n openstack --type=merge -p \
    '{"spec":{"customContainerImages":{"ovnNbDbclusterImage":"registry.redhat.io/rhoso/openstack-ovn-nb-db-server-rhel9:18.0.1","ovnSbDbclusterImage":"registry.redhat.io/rhoso/openstack-ovn-sb-db-server-rhel9:18.0.1"}}}'

Example: Switch back to current CI image

oc patch openstackversion controlplane -n openstack --type=merge -p \
    '{"spec":{"customContainerImages":{"ovnNbDbclusterImage":"images.paas.redhat.com/podified-rhos18-rhel9/openstack-ovn-nb-db-server:5eb57f57b47cf248b8c6841ea0905c1c","ovnSbDbclusterImage":"images.paas.redhat.com/podified-rhos18-rhel9/openstack-ovn-sb-db-server:5eb57f57b47cf248b8c6841ea0905c1c"}}}'

Notes

• Changing the image does not immediately restart pods. The openstack-operator must reconcile first, then the ovn-operator rolls the StatefulSet.
• If the new image has a different OVN schema version, check_and_convert_db will detect the mismatch on pod startup and run a schema conversion (with backup if the patched operator code is deployed).
• The NB and SB images must be changed together as they share the same RHOSO release.
• The SB image key is ovnSbDbclusterImage (note: Sb not SB).
• Pods must be scaled to 0 and back to trigger a restart with the new image if the StatefulSet does not roll automatically.