Install and initialize AIM service on all Neutron controller nodes.

1. Install AIM and other packages needed by the Cisco ACI OpenStack Unified Plug-in:

   Example:

   # yum -y install aci-integration-module acitoolkit apicapi openstack-dashboard-gbp openstack-heat-gbp python-django-horizon-gbp python-gbpclient python-semantic_version openstack-neutron-gbp

2. Run the AIM DB migration script, using the Neutron configuration.

   This step only needs to be done once, and does not need to be repeated on all of the controllers.

   Example:

   # aimctl -c /etc/neutron/neutron.conf db-migration upgrade

3. Run the script that creates the AIM configuration from the existing Neutron configuration:

   Example:

   # support_tool aim-config –-config-file /etc/neutron/neutron.conf –-config-file /etc/neutron/plugins/ml2/ml2_conf.ini

   Inspect the /etc/aim/aim.conf and /etc/aim/aimctl.conf files. Verify that the configuration for VMM domains, physical domains, physlinks, and other states was successfully migrated from the Neutron configuration files to the AIM configuration files. If the respective state was not present in the legacy configuration files, then you must add this state manually. Add any static path bindings that need to be preserved to the configuration file.

4. From a single controller, install the AIM configuration:

   This command needs to be run only once.

   Example:

   # aimctl config replace

Start the AIM service.

# systemctl start aim-event-service-rpc
# systemctl start aim-event-service-polling
# systemctl start aim-aid

From a single controller, create the infrastructure from AIM configuration file.

# aimctl infra create

From a single controller, update AIM with the new VMM domains, the new system-id, or both.

# aimctl manager load-domains

After you have installed AIM service successfully on all Neutron nodes, shut it down.

# systemctl stop aim-event-service-rpc
# systemctl stop aim-event-service-polling
# systemctl stop aim-aid

On all nodes, update the OpFlex Agent with changes to their VMM domain.

1. Retrieve the OpFlex agent VMM domain configuration.

   Example:

   # support_tool get-domains –-credentials-file ~/keystonerc_admin –-config-directory /etc/opflex-agent-ovs/conf.d –-output-file ~/opflex-agent-conf.txt

2. Update the OpFlex agent configuration to use any new VMM domains, after editing the mapping file.

   The default filename is: opflex_hosts.txt.

   Example:

   # support_tool update-domains –-credentials-file ~/keystonerc_admin –-config-directory /etc/opflex-agent-ovs/conf.d –-output-file ~/opflex-agent-conf.txt

Get UUIDs of the external networks that will be migrated and their names by using the following command: # neutron net-list --router:external True -c id -f value -c name -f value

On all hosts running OpFlex agents, shut down the Neutron OpFlex agent:

# systemctl stop neutron-opflex-agent

Shut down the Neutron server on all OpenStack controllers:

# systemctl stop neutron-server

Back up the current state.

1. Back up the current Neutron database.

2. Back up the current Cisco APIC configuration.

Prepare Neutron to use the Cisco ACI OpenStack Unified Plug-in.

1. Keep track of any existing Cisco ACI tenants and contracts in common user used by this OpenStack instance.

2. Reconfigure the Neutron configuration file to use the new plug-in:

   Example:

   # support_tool toggle-config --toggle new –-config-file /etc/neutron/neutron.conf –-config-file /etc/neutron/plugins/ml2/ml2_conf.ini

3. Update configuration file to use a different system-id, new VLAN pool, and the same attachabile entity profile (AEP) as the previous OpenStack cluster.

4. Provide the Neutron external networks that require migration.

   Providing the Neutron external networks is done in the Neutron configuration files, using the migrate_ext_net_dns option under the [ml2_apic_aim] section. The migrate_ext_net_dns configuration option requires a comma-separated list of mappings. Each mapping is a Neutron external network UUID followed by the DN of the network under an L3Out policy in Cisco APIC.

   The UUID of the external networks was retrieved previously, and the DNs of the network under the L3Out policy can be retrieved from AIM using the following command:

   # aimctl manager external-network-get -p <APIC tenant name> <L3 Out Policy Name> <Network name under L3 Out Policy>| grep resource_dn | awk '{print $2}'

   Example:

   The following command retrieves the DN for the l3out_2_net Network under the L3Out policy named l3out-2 in the common tenant:

   # aimctl manager external-network-get common l3out-2 l3out_2_net -p | grep resource_dn | awk '{print $2}'

   Example:

   The following is an example of what this configuration would look like, given two Neutron external networks named l3out-1 and l3out-2:

   [ml2_apic_aim] 
   migrate_ext_net_dns = a759a910-be33-4e09-85f0-741b6ea48c1f: uni/tn-common/out-l3out-1, fba9b7b0-f492-4140-aacb-2c98a9abadf6: uni/tn-common/out-l3out-2”
   

Run the validation tool in check mode.

# gbp-validate –-norepair --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugins/ml2/ml2_conf.ini 

Run the validation tool in repair mode.

# # gbp-validate –-repair --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugins/ml2/ml2_conf.ini 

On all the nodes, shut down the OpFlex agent.

1. Stop the OpFlex agent:

   Example:

   # systemctl stop opflex-agent

On one compute node at a time, execute the following substeps in sequence.

1. Restart the OpFlex agent and wait about 60 seconds:

   Example:

   # systemctl start opflex-agent

   The 60 seconds wait period is a general estimate. This number varies with the installation size.

2. Restart the Neutron OpFlex agent:

   Example:

   # systemctl start neutron-opflex-agent

Start AIM and neutron-server.

1. Start AIM:

   Example:

   # systemctl start aim-event-service-rpc
   # systemctl start aim-event-service-polling
   # systemctl start aim-aid

2. In step 11b, the support_tool toggle-config command sets the agent_down_time parameter to a large value so that port-binding would succeed during the upgrade to the Cisco ACI OpenStack Unified Plug-in. Set this parameter to the value used before running this command, in order to use the intended agent_down_time value. (The default is 60 seconds.)

3. Start the Neutron server:

   Example:

   # systemctl start neutron-server

Delete the subnets of the old bridge domain used for L3out policies.

Associate any new VMM domains with the AEP.

Verify the following:

1. Connectivity: L2 and L3 connectivity for a sample VM on each compute node.

2. Security groups after migration are now enforced by OVS, not IP tables.

3. DHCP and metadata usage when creating a new VM.

4. Floating IP and SNAT connectivity, where applicable.

5. Static paths configured in step 1c.

6. Usage of pre-existing contracts with new endpoint groups (EPGs), if applicable.

7. LBaaS usage after migration, if applicable.

Remove association of the older VMM domains with the AEP.

Clean up the remaining resources on Cisco APIC.

1. Delete the VMM with the older system ID.

2. Delete old Cisco APIC configuration or association saved in step 11a.