Upgrade RHEL 7 to RHEL 8

Documentation
1

Now that RHEL 7 has reached EOL on June 30, 2024, ProComputers has tested the upgrade procedure from RHEL 7 to latest RHEL version 8.10.

To effectively use this documentation article, it’s essential to have a solid working knowledge of RHEL. This includes familiarity with the command line, file system structure, basic file operations, and system configuration.

IMPORTANT: As with any live upgrade, it is very important to prepare well. Make sure you test in advance the upgrade procedure using a test virtual machine. Also, make sure you have backups and/or snapshots of your virtual machine before performing the actual upgrade. PROCOMPUTERS SHALL NOT BE HELD LIABLE FOR ANY LOSS, DAMAGE, OR DISRUPTION RESULTING FROM THE UPGRADE PROCESS. THIS INCLUDES, BUT IS NOT LIMITED TO, DATA LOSS, SERVICE INTERRUPTIONS, OR ANY OTHER ADVERSE EFFECTS THAT MAY ARISE.

The upgrade procedure is based on the Red Hat upgrade documentation from RHEL 7 to RHEL 8 that has been adapted for the ProComputers packaged RHEL 7 images from both Azure Marketplace or AWS Marketplace.

The Red Hat upgrade documentation is trying to cover all possible RHEL 7 installations and scenarios, while this article covers only the situations when latest available versions of ProComputers packaged RHEL 7 images are used. ProComputers has tested the upgrade procedure on plain empty images without any additional software or packages installed.

You should always follow the official Red Hat upgrade documentation if your virtual machine based on the ProComputers packaged RHEL 7 images is highly customized. Furthermore, in case of discrepancies between Red Hat upgrade documentation and this article, the Red Hat documentation takes precedence and shall be followed in all situations.

Follow the steps below in order to perform the upgrade:

  1. Fully update all packages to the latest RHEL 7 version:
$ sudo yum update -y
$ sudo reboot
  1. Enable required RHUI repositories and install required RHUI packages
  • If your virtual machine is running in AWS
$ sudo yum-config-manager --enable rhui-client-config-server-7
$ sudo yum-config-manager --enable rhel-7-server-rhui-extras-rpms
$ sudo yum -y install rh-amazon-rhui-client leapp-rhui-aws
  • If your virtual machine is running in Azure
$ sudo yum-config-manager --enable rhui-microsoft-azure-rhel7
$ sudo yum-config-manager --enable rhui-rhel-7-server-rhui-extras-rpms
$ sudo yum -y install rhui-azure-rhel7 leapp-rhui-azure
  1. Install the Leapp utility:
$ sudo yum install leapp-upgrade -y
  1. Start the pre-upgrade check.

IMPORTANT : This step will always fail, as the default RHEL 7 image doesn’t meet all requirements for migration. The pre-upgrade check will create a /var/log/leapp/leapp-report.txt file that proposes the required remediation steps to be performed before and/or after the upgrade itself, in order to fix the issues.

$ sudo leapp preupgrade --target 8.10 --no-rhsm
[...]
Debug output written to /var/log/leapp/leapp-preupgrade.log

============================================================
                      REPORT OVERVIEW
============================================================

Upgrade has been inhibited due to the following problems:
    1. Missing required answers in the answer file

HIGH and MEDIUM severity reports:
    1. Packages available in excluded repositories will not be installed
    2. GRUB2 core will be automatically updated during the upgrade
    3. Detected custom leapp actors or files.
    4. Difference in Python versions and support in RHEL 8

Reports summary:
    Errors:                      0
    Inhibitors:                  1
    HIGH severity reports:       4
    MEDIUM severity reports:     0
    LOW severity reports:        4
    INFO severity reports:       4

Before continuing consult the full report:
    A report has been generated at /var/log/leapp/leapp-report.json
    A report has been generated at /var/log/leapp/leapp-report.txt

============================================================
                   END OF REPORT OVERVIEW
============================================================

Answerfile has been generated at /var/log/leapp/answerfile
  1. Examine the report in the /var/log/leapp/leapp-report.txt file and manually resolve all the reported problems. Some reported problems contain remediation suggestions. Inhibitor problems prevent you from upgrading until you have resolved them.

In case of ProComputers packaged RHEL 7 images, the following fixes from the /var/log/leapp/leapp-report.txt must be performed at this step:

  • Missing required answers in the answer file
Risk Factor: high (inhibitor)
Title: Missing required answers in the answer file
Summary: One or more sections in answerfile are missing user choices: remove_pam_pkcs11_module_check.confirm
For more information consult https://red.ht/leapp-dialogs.
Remediation: [hint] Please register user choices with leapp answer cli command or by manually editing the answerfile.
[command] leapp answer --section remove_pam_pkcs11_module_check.confirm=True

Run the proposed remediation command, then check the /var/log/leapp/answerfile that should look like below:

$ sudo leapp answer --section remove_pam_pkcs11_module_check.confirm=True
$ sudo cat /var/log/leapp/answerfile
[remove_pam_pkcs11_module_check]
confirm = True
  1. Start the upgrade itself, then reboot when it is finalized. The process should take 5-10 minutes, depending on how powerful is your virtual machine.
$ sudo leapp upgrade --target 8.10 --no-rhsm
[...]
Debug output written to /var/log/leapp/leapp-upgrade.log

============================================================
                      REPORT OVERVIEW
============================================================

HIGH and MEDIUM severity reports:
    1. Packages available in excluded repositories will not be installed
    2. Detected custom leapp actors or files.
    3. Difference in Python versions and support in RHEL 8
    4. GRUB2 core will be automatically updated during the upgrade
    5. Module pam_pkcs11 will be removed from PAM configuration

Reports summary:
    Errors:                      0
    Inhibitors:                  0
    HIGH severity reports:       4
    MEDIUM severity reports:     1
    LOW severity reports:        4
    INFO severity reports:       4

Before continuing consult the full report:
    A report has been generated at /var/log/leapp/leapp-report.json
    A report has been generated at /var/log/leapp/leapp-report.txt

============================================================
                   END OF REPORT OVERVIEW
============================================================

$ sudo reboot
  1. After the reboot, the virtual machine automatically boots into a RHEL-Upgrade-Initramfs GRUB menu, and will continue the upgrade process from there. It is highly recommended to monitor this process from the console. This is the longest step and should take another 10-15 minutes, depending on how powerful is your your virtual machine. The process is finalized when you see on the console the following:
   23.715992] leapp3[998]: Debug output written to /var/log/leapp/leapp-upgrade.log
[   23.716147] leapp3[998]: ============================================================
[   23.716357] leapp3[998]:                       REPORT OVERVIEW
[   23.716517] leapp3[998]: ============================================================
[   23.716547] leapp3[998]: HIGH and MEDIUM severity reports:
[   23.716575] leapp3[998]:     1. Packages available in excluded repositories will not be installed
[   23.716604] leapp3[998]:     2. Detected custom leapp actors or files.
[   23.716632] leapp3[998]:     3. Difference in Python versions and support in RHEL 8
[   23.716663] leapp3[998]:     4. GRUB2 core will be automatically updated during the upgrade
[   23.716694] leapp3[998]:     5. Some RHEL 7 packages have not been upgraded
[   23.716722] leapp3[998]:     6. Module pam_pkcs11 will be removed from PAM configuration
[   23.716750] leapp3[998]: Reports summary:
[   23.716777] leapp3[998]:     Errors:                      0
[   23.716807] leapp3[998]:     Inhibitors:                  0
[   23.716835] leapp3[998]:     HIGH severity reports:       5
[   23.716863] leapp3[998]:     MEDIUM severity reports:     1
[   23.716891] leapp3[998]:     LOW severity reports:        4
[   23.716918] leapp3[998]:     INFO severity reports:       8
[   23.716947] leapp3[998]: Before continuing consult the full report:
[   23.716975] leapp3[998]:     A report has been generated at /var/log/leapp/leapp-report.json
[   23.717023] leapp3[998]:     A report has been generated at /var/log/leapp/leapp-report.txt
[   23.717056] leapp3[998]: ============================================================
[   23.717084] leapp3[998]:                    END OF REPORT OVERVIEW
[   23.717112] leapp3[998]: ============================================================
[   23.717140] leapp3[998]: Answerfile has been generated at /var/log/leapp/answerfile
[  OK  ] Started Temporary Leapp service which resumes execution after reboot.
  1. After reboot, login to the system and check how the migration went. The login username remains the same with the one before the upgrade.
$ sudo cat /etc/redhat-release
Red Hat Enterprise Linux release 8.10 (Ootpa)

$ sudo uname -r
4.18.0-553.5.1.el8_10.x86_64

Note that .el8_10 is important and the version should not be earlier than 4.18.0-305.

  1. Check packages left from RHEL 7 and consider removing them.
  • Remove weak modules from old RHEL 7 kernel versions. If you have multiple old kernels, repeat the following step for each kernel.
$ sudo ls -d /lib/modules/*.el7* | xargs -n 1 basename
3.10.0-1160.108.1.el7.x86_64
3.10.0-1160.119.1.el7.x86_64

$ sudo weak-modules --remove-kernel 3.10.0-1160.108.1.el7.x86_64

$ sudo weak-modules --remove-kernel 3.10.0-1160.119.1.el7.x86_64
  • Remove the old RHEL 7 kernel from the boot loader entry. Use the kernel versions listed in the previous step. If you have multiple old kernels, repeat this step for each kernel.
$ sudo kernel-install remove 3.10.0-1160.108.1.el7.x86_64 /lib/modules/3.10.0-1160.108.1.el7.x86_64/vmlinuz

$ sudo kernel-install remove 3.10.0-1160.119.1.el7.x86_64 /lib/modules/3.10.0-1160.119.1.el7.x86_64/vmlinuz
  • Remove old RHEL 7 kernel packages. If you have multiple old kernels, repeat the following step for each kernel.
$ sudo rpm -qa | grep kernel | grep el7
kernel-3.10.0-1160.108.1.el7.x86_64
kernel-3.10.0-1160.119.1.el7.x86_64

$ sudo yum remove -y kernel-3.10.0-1160.108.1.el7.x86_64 
$ sudo yum remove -y kernel-3.10.0-1160.119.1.el7.x86_64
  • Remove any remaining empty directories:
$ sudo rm -r /lib/modules/*el7*
  • Locate remaining RHEL 7 packages and remove them.

During the in-place upgrade, Leapp packages that were installed with the Leapp utility are automatically added to the exclude list to prevent critical files from being removed or updated. After the in-place upgrade, you must remove these Leapp packages from the exclude list before they can be removed from the system.

$ sudo yum config-manager --save --setopt exclude=''

$ sudo rpm -qa | grep -e '\.el[67]'
leapp-0.17.0-1.el7_9.noarch
ustr-1.0.4-16.el7.x86_64
leapp-upgrade-el7toel8-0.20.0-2.el7_9.noarch
python2-leapp-0.17.0-1.el7_9.noarch

$ sudo yum remove -y leapp-0.17.0-1.el7_9.noarch ustr-1.0.4-16.el7.x86_64 leapp-upgrade-el7toel8-0.20.0-2.el7_9.noarch python2-leapp-0.17.0-1.el7_9.noarch
  1. Check the post-upgrade recommended actions in /var/log/leapp/leapp-report.txt file.
  • Difference in Python versions and support in RHEL 8
Risk Factor: high
Title: Difference in Python versions and support in RHEL 8
Summary: In RHEL 8, there is no 'python' command. Python 3 (backward incompatible) is the primary Python version and Python 2 is available with limited support and limited set of packages. If you no longer require Python 2 packages following the upgrade, please remove them. Read more here: https://red.ht/rhel-8-python
Related links:
    - Difference in Python versions and support in RHEL 8: https://red.ht/rhel-8-python
Remediation: [hint] Please run "alternatives --set python /usr/bin/python3" after upgrade

Run the proposed remediation command

$ sudo alternatives --set python /usr/bin/python3
  • Changing SELinux mode to enforcing. During the in-place upgrade process, the Leapp utility sets SELinux mode to permissive. When the system is successfully upgraded, you have to manually change SELinux mode to enforcing.
Risk Factor: low
Title: SElinux will be set to permissive mode
Summary: SElinux will be set to permissive mode. Current mode: enforcing. This action is required by the upgrade process to make sure the upgraded system can boot without beinig blocked by SElinux rules.
Remediation: [hint] Make sure there are no SElinux related warnings after the upgrade and enable SElinux manually afterwards. Notice: You can ignore the "/root/tmp_leapp_py3" SElinux warnings.

Make sure the SELINUX=enforcing is configured in /etc/selinux/config.

$ sudo sed -i 's/^SELINUX=.*$/SELINUX=enforcing/' /etc/selinux/config

$ sudo cat /etc/selinux/config | grep ^SELINUX=
SELINUX=enforcing
  • Force an SElinux auto relabel and reboot
$ sudo touch /.autorelabel

$ sudo reboot
  1. Optionally, remove all remaining upgrade-related data from the system. Before that, check the upgrade logs for any possible error messages.
$ sudo cat /var/log/leapp/leapp-upgrade.log

$ sudo rm -rf /var/log/leapp /root/tmp_leapp_py3 /var/lib/leapp

At this step, if all went well, the upgrade is finalized successfully.

References

For any questions related to this article, please contact ProComputers Support.

Why choose ProComputers?

With over 10 years of experience working with Microsoft Azure, ProComputers provides open-source software bundled together into solutions ready to be launched on-demand in the cloud.

ProComputers is a proud sponsor of the AlmaLinux OS Foundation and the Rocky Enterprise Software Foundation.

Red Hat and CentOS are trademarks or registered trademarks of Red Hat, Inc. or its subsidiaries in the United States and other countries. We are not affiliated with, endorsed by or sponsored by Red Hat or the CentOS Project.

All other trademarks are the property of their respective owners.