This article describes how to upgrade Openshift platform (with CRI-O configuration - 4.x) if you have Compute Defenders deployed. Compute Defenders modify crio.conf file outside of Machine Config Operator and this can result in Openshift upgrade to fail if proper steps are not followed as documented below. Note that Defenders only modify cri.conf without editing the Machine Config. Thus, the machine config runtime can be used

Please contact your support team for any questions or concerns prior to following these steps.

It is important to note the version of Compute when your Defenders were first deployed in your Openshift environment.

Defenders first deployed prior to 20.09.xx versions

In releases prior to 20.09.xx, Compute did not revert the original copy of crio.conf and hence the following steps must be followed manually prior to upgrading Openshift platform.

Procedure for restoring crio.conf files PRIOR to Openshift upgrade

Step 1:

Make a backup of the container runtimes. The original crio.conf can be extracted from machineconfig.

$ oc get machineconfig 01-worker-container-runtime -o yaml > 01-worker-container-runtime-$(date +%F).yaml
$ oc get machineconfig 01-master-container-runtime -o yaml > 01-master-container-runtime-$(date +%F).yaml

Step 2:

Uninstall Compute Defenders from the environment.

Step 3:

Restore the container runtimes obtained from Step 1.

oc apply -f 01-worker-container-runtime-xx.yaml
oc apply -f 01-master-container-runtime-xx.yaml

Step 4:

Verify that the MCO (Machine Config Operator) is not reporting a 'not desired' state.

oc get clusteroperator machine-config

You can now upgrade your Openshift cluster and then re-install Compute Defenders after the upgrade is successful.

Defenders deployed after 20.09.xx versions

In releases starting 20.09.xx version, Compute creates a backup of original crio.conf file as soon as it is deployed. When uninstalled, the original crio.conf file is replaced in its location.

Step 1:

Uninstall Compute Defenders on openshift cluster prior to upgrade

Step 2:

Upgrade Openshift cluster

Step 3:

Install Compute Defenders again