Relax HA Configuration Sync Checks for Panorama Upgrades #83
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
cdot65
deleted the
82-ha-configuration-sync-failures-block-panorama-primary-suspended-upgrades
branch
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
This pull request addresses an issue where Panorama upgrades in an HA configuration are unnecessarily blocked due to strict configuration sync checks. By changing the strict_sync_check parameter from True to False, we allow upgrades to proceed in the face of non-critical sync discrepancies, enhancing the upgrade process's resilience and user experience.
Changes
Modified the default value of the strict_sync_check parameter from True to False within the upgrade logic.
Introduced a user-configurable option to enable strict sync checks when necessary, providing flexibility to users based on their specific requirements.
Rationale
The strict sync checks in place for Panorama HA configurations can prevent upgrades from proceeding even in cases where sync discrepancies are not critical to the upgrade process. This behavior leads to unnecessary interruptions and complications in maintaining Panorama's currency. By making the sync checks more lenient, we aim to improve the reliability and smoothness of the upgrade process while still providing users the option to enforce strict checks if they deem it necessary for their environment.
Testing
Conducted upgrades on Panorama instances in HA configurations with both critical and non-critical sync discrepancies to validate that non-critical issues no longer block the upgrade.
Verified that setting strict_sync_check to True restores the original strict behavior, allowing users to enforce sync checks when needed.
##Backward Compatibility
This change is backward compatible, as it modifies a default behavior to be more permissive while still offering the previous behavior as an option. Users relying on strict sync checks can re-enable this behavior through configuration.