Step 1

Navigate to the folder where the tar file was downloaded. As an example, consider the Crosswork Infrastructure signed patch image signed-cw-na-infra-patch-7.1.1-28-release-250922.tar.gz for this procedure.

Step 2

Extract the signed file using this command.

tar -xzvf signed-cw-na-infra-patch-7.1.1-28-release-250922.tar.gz

README
cw-na-infra-patch-7.1.1-28-release-250922.tar.gz
cw-na-infra-patch-7.1.1-28-release-250922.tar.gz.signature
CW-CCO_RELEASE.cer
cisco_x509_verify_release.py3
cisco_x509_verify_release.py

Step 3

Validate the extracted patch file using this command.

python3 cisco_x509_verify_release.py3 -e <.cer file> -i <.tar.gz file> -s <.tar.gz.signature file> -v dgst -sha512

 Note

You must include this command as a single line, and the tool will wrap it according to the screen width.

Example:

python3 cisco_x509_verify_release.py3 -e CW-CCO_RELEASE.cer -i cw-na-infra-patch-7.1.1-28-release-250922.tar.gz -s cw-na-infra-patch-7.1.1-28-release-250922.tar.gz.signature -v dgst -sha512

Output:

Retrieving CA certificate from http://www.cisco.com/security/pki/certs/crcam2.cer ...
Successfully retrieved and verified crcam2.cer.
Retrieving SubCA certificate from http://www.cisco.com/security/pki/certs/innerspace.cer ...
Successfully retrieved and verified innerspace.cer.
Successfully verified root, subca and end-entity certificate chain.
Successfully fetched a public key from CW-CCO_RELEASE.cer.
Successfully verified the signature of cw-na-infra-patch-7.1.1-28-release-250922.tar.gz using CW-CCO_RELEASE.cer

Step 4

Repeat these steps for each patch file you plan to install.

Step 1

Make the script executable.

Step 2

Apply the kube-proxy patch.

Step 3

Optional commands:

Step 1

Create a new backup if you do not already have one.

Step 2

From the main menu, choose Administration > Crosswork Manager. The Crosswork Summary page is displayed with Crosswork Cluster and Crosswork Platform Infrastructure tiles.

Step 3

Click the System Management tab.

Step 4

Click Add OS patch. In the popup window choose either URL or SCP as your preferred protocol. Based on your selection, fill in the additional fields with the required information. Click Add to proceed.

Step 5

Click System Management > Job History to monitor the status of each job. For details on each node’s operation, open the Job Details page.

Step 6

Once jobs complete successfully, check that the newly added OS patch is listed under the System updates tab.

Step 7

To upgrade an installed OS patch, use the Upgrade button in the System updates tab.

Step 8

(Optional) To see patch details, select the patch file and click Package details. You’ll see information such as package name, version, and description.

Step 9

(Optional) After all jobs are completed successfully, verify the updated package list for each node by navigating to Administration > Crosswork Manager > System Summary > <Node-Name> > View details > Package details tab.

Step 1

Check the health status of your system. If any components are unhealthy or degraded, resolve the issues or contact your Cisco Customer Experience representative before proceeding.

Step 2

Click on Administration > Crosswork Management > Application Management tab. The Platform Infrastructure and any applications that are added are displayed here as tiles.

Step 3

Click on the Add File (.tar.gz) option to add the patch file that you extracted. As an example, consider the Platform Infrastructure patch file, cw-na-infra-patch-7.1.1-28-release-250922.tar.gz for this procedure.

Step 4

Enter the relevant information and click Add.

Step 5

Once the patch file is added, you can observe the existing application tile displaying an upgrade prompt. Click the upgrade prompt to install the patch file.

Step 6

In the Upgrade pop-up screen, select the new version that you want to upgrade to, and click Upgrade. Click on Job History to see the progress of the upgrade operation.

Step 7

After the installation is complete, go to Administration > Crosswork Manager and confirm all of the applications are reporting a Healthy status.

Step 8

Repeat steps 2 to 8 to add and install the remaining Crosswork Network Controller application patch files that you need.

Step 1

Enable Geo Redundancy in the UI

1. In the Crosswork Network Controller UI, navigate to Administration > Geo Redundancy Manager. The Geo Redundancy Manager window is displayed.

2. Click Import inventory file. In the Import Inventory File dialog box, click Browse and select the cross cluster inventory file you prepared. Verify the contents of the template file.

3. In this step, you will configure the server for use with Geo Redundancy. This step cannot be undone. Ensure you have already made a backup before proceeding. To activate Geo Redundancy on the server, click Enroll. A service interruption alert is displayed. Click Proceed to continue.

4. You can view the progress from the Jobs window or by clicking the icon.

5. After the inventory upload is completed, repeat steps a to d on the standby clusters.

   The job status will be displayed as Completed. Upon successful inventory upload, the status will be updated in the Geo Redundancy Manager window.

Step 2

Apply the Geo Redundancy Patch (CAPP)

1. In the Crosswork Network Controller UI, navigate to Administration > Crosswork Management > Application Management tab.

2. Click on the Add File (.tar.gz) option to add the patch file. The Add File (tar.gz) via Secure Copy popup window is displayed.

3. Enter the relevant information and click Add.

4. Once the patch file is added, you can observe the existing application tile displaying an upgrade prompt. Click the upgrade prompt to install the patch file.

5. In the Upgrade pop-up screen, select the new version that you want to upgrade to, and click Upgrade. Click on Job History to see the progress of the upgrade operation.

Step 3

After the installation is complete, go to Administration > Crosswork Manager and confirm all of the applications are reporting a Healthy status.

Step 4

Perform steps 2 and 3 on both the active and standby clusters.

Step 1

Install or upgrade NSO function packs.

Step 2

Update the ncs.conf file to enable and configure NSO keepalive settings for stable RESTCONF integration.

<webui>
    <enabled>true</enabled>
    <transport>
      <tcp>
        <enabled>true</enabled>
        <keepalive>true</keepalive>       
        <keepalive-timeout>3600</keepalive-timeout>
      </tcp>
      <ssl>
        <enabled>true</enabled>
         <keepalive>true</keepalive>   
         <keepalive-timeout>3600</keepalive-timeout>
      </ssl>
    </transport>
  </webui>
......
</webui>

Step 3

Restart NSO for the configuration in ncs.conf to take effect.

sudo systemctl restart ncs