.. _upgrade-to-antelope:

======================================
Upgrading OpenStack to 2023.1 Antelope
======================================

.. note::

    The steps described in this guide are required:

    * if you were already using Fleio with an OpenStack release before the OpenStack 2023.1 Antelope release and you
      upgraded OpenStack to Antelope,
    * or you are connecting a non-empty OpenStack 2023.1 Antelope to Fleio. By non-empty we mean that the OpenStack
      cloud already has projects that you want to assign to Fleio services/clients.

    If you are connecting an empty OpenStack 2023.1 Antelope to Fleio, you do not need to apply the steps in this guide.

OpenStack 2023.1 (Antelope) has made some changes to OpenStack roles and Fleio requires the ``admin`` user to have
both ``member`` and ``_member_`` roles in each OpenStack project that is associated and used with a Fleio service
(assuming ``admin`` is the OpenStack administrator user configured in :ref:`Fleio settings<openstack-settings>`).

For an OpenStack project created by the :ref:`client sign-up automation<sign-up-automation>` feature, Fleio
automatically adds two roles. The following steps are needed in the following scenarios:

* You initially installed an OpenStack release before the OpenStack 2023.1 Antelope release and you used Fleio with this
  installation. You later upgraded OpenStack to 2023.1 (Antelope). You probably have OpenStack projects assigned to
  Fleio services. These services may no longer work correctly since the OpenStack projects are missing one of the two
  OpenStack roles.
* You have a non-empty OpenStack 2023.1 (Antelope) installation and you connect it to Fleio for the first time. A
  pre-existing OpenStack project may not work correctly in Fleio after you assign the project to a Fleio service.

To list projects for which the ``admin`` user is missing ``member`` role respectively ``_member_`` role, load the
OpenStack environment variables (so that you can successfully run the ``openstack`` command) and run the following
script.

.. note::

    Running the following two scripts may take quite a lot of time. Depending on how many OpenStack projects you have,
    it may take hours or even days.

Add the following code to a new script file, e.g. ``nano list_missing_roles.sh``:

.. code-block:: bash

    #!/bin/bash

    # The script shows OpenStack projects that are missing "member" role, and "_member_" role respectively

    projects="$(openstack project list -f value -c ID -c Name)"
    missing_member=""
    missing__member_=""

    while IFS="" read -r line || [ -n "$line" ]; do
        project_name="$(echo $line |  cut -d' ' -f2-)"

        if [ "$project_name" = "admin" ]; then
            continue
        fi

        project_id="$(echo $line | cut -d' ' -f1)"

        roles="$(openstack role assignment list --user admin --project $project_id --names -c Role -f value)"
        # replace new lines with spaces
        roles="${roles//$'\n'/ }"
        if [[ ! " $roles " =~ .*\ member\ .* ]]; then
            missing_member="$missing_member $project_id"
        fi
        if [[ ! " $roles " =~ .*\ _member_\ .* ]]; then
            missing__member_="$missing__member_ $project_id"
        fi
    done <<<$(echo "$projects")

    if [ "$missing_member" = "" ]; then
        echo 'admin user has "member" role in all projects'
    else
        echo 'The following projects are missing the "member" role'
        echo "$missing_member"
        echo
    fi

    if [ "$missing__member_" = "" ]; then
        echo 'admin user has "_member_" role in all projects'
    else
        echo 'The following projects are missing the "_member_" role'
        echo "$missing__member_"
    fi


Run ``bash list_missing_roles.sh``. If this shows any OpenStack project missing ``member`` or ``_member_`` role for the
``admin`` user, create the following script to add these roles.

Add the following code to a new script file, e.g. ``nano add_missing_roles.sh``:

.. code-block:: bash

    #!/bin/bash

    # The script adds "member" add "_member_" role for the "admin" user to all OpenStack projects

    projects="$(openstack project list -f value -c ID -c Name)"
    missing_member=""
    missing__member_=""

    while IFS="" read -r line || [ -n "$line" ]; do
        project_name="$(echo $line |  cut -d' ' -f2-)"

        if [ "$project_name" = "admin" ]; then
            continue
        fi

        project_id="$(echo $line | cut -d' ' -f1)"

        roles="$(openstack role assignment list --user admin --project $project_id --names -c Role -f value)"
        # replace new lines with spaces
        roles="${roles//$'\n'/ }"
        if [[ ! " $roles " =~ .*\ member\ .* ]]; then
            missing_member="$missing_member $project_id"
            openstack role add --user admin --project $project_id member
        fi
        if [[ ! " $roles " =~ .*\ _member_\ .* ]]; then
            missing__member_="$missing_member $project_id"
            openstack role add --user admin --project $project_id _member_
        fi
    done <<<$(echo "$projects")

    if [ "$missing_member" = "" ]; then
        echo 'admin user has "member" role in all projects'
    else
        echo 'The "member" role has been added for "admin" user in the following projects:'
        echo "$missing_member"
        echo
    fi

    if [ "$missing__member_" = "" ]; then
        echo 'admin user has "_member_" role in all projects'
    else
        echo 'The "_member_" role has been added for "admin" user in the following projects:'
        echo "$missing__member_"
    fi

To add ``member`` and ``_member_`` role to all OpenStack projects, run ``bash add_missing_roles.sh``.

To confirm that ``admin`` has the two roles in all projects, run ``bash list_missing_roles.sh`` again.