Avi upgrade to 31.2.1 may fail at MigrateConfig
Article ID: 418868
Updated On:
Products
VMware Avi Load Balancer
Issue/Introduction
The upgrade to 31.2.1 may fail at the MigrateConfig task.
Run below command in the CLI to get the details of the upgrade failure:
show upgrade status detailEnvironment
Avi Version 31.2.1
Cause
Below output may be seen on the upgrade status detail command.
| sub_events[1] | |
| ip | node1.controller.local |
| start_time | 2025-10-31 21:07:57 |
| end_time | 2025-10-31 21:13:27 |
| status | False |
| message | UC::[Fri Oct 31 21:13:27 2025]Error while running task:MigrateConfig |
| | UC::Unable to complete task MigrateConfig on ['node1.controller.local'].::UC |
| | Traceback (most recent call last): |
| | File "/opt/avi/python/lib/avi/upgrade/upgrade_tasks.py", line 334, in start |
| | self.run() |
| | File "/opt/avi/python/lib/avi/upgrade/upgrade_tasks.py", line 635, in run |
| | self.run_remote_command(cmd, self.hosts) |
| | File "/opt/avi/python/lib/avi/upgrade/upgrade_tasks.py", line 614, in run_remo |
| | te_command |
| | raise RuntimeError(msg) |
| | RuntimeError: UC::Unable to complete task MigrateConfig on ['node1.controller.lo |
| | cal'].::UC |
| | .::UC |
| duration | 330 sec |
| sub_tasks[1] | [Fri' Oct 31 09:07:58 PM UTC '2025] Flush database except cluster-config. |
| sub_tasks[2] | [Fri' Oct 31 09:07:58 PM UTC '2025] Sign se.pkg. |
| sub_tasks[3] | [Fri' Oct 31 09:10:23 PM UTC '2025] Start Runtime Persistent Store. |
| sub_tasks[4] | [Fri' Oct 31 09:10:24 PM UTC '2025] Migrate Metrics data to current version. |
| sub_tasks[5] | [Fri' Oct 31 09:10:27 PM UTC '2025] Migrate configuration from previous to curr |
| | ent version. |
| sub_tasks[6] | [Fri' Oct 31 09:11:52 PM UTC '2025] Importing Configuration. |
| sub_tasks[7] | [Fri Oct 31 21:13:27 2025]Error while running task:MigrateConfig |
| | UC::Unable to complete task MigrateConfig on ['node1.controller.local']. |
| sub_tasks[8] | Unable to complete task MigrateConfig on ['node1.controller.local']. |
If the upgrade has failed and rolled back, the logs will be moved to the previous partition.
cd /host
ls -lrth # To see which of root1 and root2 directories is the prev partition.
Below logs in portal-webapp.log in the prev partition (/host/<root1/root2>/var/lib/avi/log/portal-webapp.log), indicating an error occurred while migrating config for an SSLProfile attached to a Pool referred by a VS.
[2025-10-31 21:13:15,762] ERROR [serializers._resolve_refers_uri:253] ^[[31m{}^[[0m[2025-10-31 21:13:15,765] ERROR [export_import._import_objects:572] ^[[31mTraceback (most recent call last): File "/opt/avi/python/lib/avi/config_migration/export_import.py", line 559,
.
.
.
File "/usr/local/lib/python3.12/dist-packages/django/db/models/query.py", line 633, in get raise self.model.DoesNotExist(api.models_pool.Pool.DoesNotExist: Pool matching query does not exist.^[[0m[2025-10-31 21:13:17,545] ERROR [export_import._import_object_list:2327] ^[[31mImport configuration failed importing VirtualService with the following errors: [('vs-example', 'virtualservice-xxxx-xxxx-xxxx', 'Pool matching query does not exist.')]^[[0m
[2025-10-31 21:13:13,046] ERROR [serializers._resolve_refers_uri:253] ^[[31m{}^[[0m[2025-10-31 21:13:13,053] ERROR [export_import._import_objects:572] ^[[31mTraceback (most recent call last): File
.
.
[[0m[2025-10-31 21:13:13,196] ERROR [export_import._import_object_list:2327] ^[[31mImport configuration failed importing Pool with the following errors: [('example-Pool', 'pool-xxxx-xxxx-xxxx', 'SSLProfile matching query does not exist.')]^[[0m
[2025-10-31 21:12:00,803] ERROR [export_import._import_objects:572] ^[[31mTraceback (most recent call last): File "/opt/avi/python/lib/avi/config_migration/export_import.py", line 559, in .
.
.
raise Exception("Enum field='%s' value=%s' was deprecated in '%s' and is no "Exception: Enum field='cipher_enums' value=TLS_RSA_WITH_3DES_EDE_CBC_SHA' was deprecated in '31.2.1' and is no longer supported^[[0m
[2025-10-31 21:12:00,804] ERROR [export_import._import_object_list:2327] ^[[31mImport configuration failed importing SSLProfile with the following errors: [('EXAMPLE', 'sslprofile-xxxx-xxxx-xxxx', "Enum field='cipher_enums' value=TLS_RSA_WITH_3DES_EDE_CBC_SHA' was deprecated in '31.2.1' and is no longer supported")]^[[0m
The migration fails as the SSLProfile contains a deprecated cipher (TLS_RSA_WITH_3DES_EDE_CBC_SHA) which is no longer supported in 31.2.1
Resolution
Before the upgrade, make sure to remove the deprecated cipher from all the SSLProfiles.
Feedback
Yes
No
Powered by
