Forum Discussion
SalishSeaSecurity
Altostratus
AltostratusrSeries and tenant upgrades
I manage four r5900 appliances, hosting 16 tenants. The appliances are running F5OS-A 1.5.0; the tenants all run BIG-IP 15.1.10.2. We all know, of course, that the most recent QSN was released today. Normally, I'd upgrade everything to the latest version. However, where F5OS-A 1.7.0 is concerned, there is a "Known Issue" that raises a big red flag. In the release notes,
1380705-1 : BIG-IP tenant is stuck during boot up after doing tenant upgrade from 15.1.x to 17.1.x
The issue description says this will not happen with every tenant. But it just has to happen once to ruin a day, right?
In the past, I have always upgraded the appliance OS before upgrading the tenants. That just seemed to make sense. Given this issue, though, I am considering upgrading all of the tenants to BIG-IP 17.1.1.3 first, then upgrading the appliances to F5OS-A 1.7.0. Does anybody know of any pitfalls to this approach?
- RedWave25
Nimbostratus
Just a friendly reminder to never install or run any versions that ends with .0. F5 support will tell you the same thing.
SalishSeaSecurityIn the end, I did not upgrade F5OS for that very reason: too many "known issues".
- Jeffrey_Granier
Employee
Hi Jason,
Agree with identifying the RCA and please ask your current TAC case owner to confirm if this Observing tenant pods are stuck in pending state after upgrade is the bug. If so this issue is fixed in F5OS 1.7.0.
- SalishSeaSecurity
I was referring to a different bug. (Can we call it a 'bug' if it has no BT#?) It's called out in the 1.7.0 release notes here: https://techdocs.f5.com/kb/en-us/products/f5os-a/releasenotes/related/relnote-supplement-f5os-a-1-7-0.html#A1380705-1
Maybe it isn't a 'bug' because there is a workaround? Thank you, but I don't want a workaround at 2 a.m. on a Sunday ;-)
- Jeffrey_Granier
Hopefully the next version of F5OS will have this fixed.
- Jeffrey_Granier
Hello,
It is indeed best practice to upgrade F5OS first before upgrading the tenants. However, to avoid the risk of any BIG-IP tenant getting stuck during the boot-up, it may be more practical to perform the tenant upgrades to version 17 first then do the F5OS upgrades. Of course, be mindful of what security exposure (QSN related) you have on F5OS 1.5.0 , that should weigh heavily on the decision to change the order of upgrades for this scenario.
- SalishSeaSecurity
Thank you, Jeffrey. I'm sure others beside myself would appreciate it if F5 would address the boot up issue in a future release of F5OS-A. Regarding the current QSN, changing the upgrade order does not significantly increase the risk to the appliances, compared to not upgrading at all.
-- Jason
