Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?


Upgrading Contrail Service Orchestration


If your CSO release version is lower than 3.3.1, you have to opt for fresh installation.

Take snapshot of your current configuration, Installer VM and Virtual Route Reflector (VRR) VM from your hypervisor management utility before you proceed with the upgrade process.


The upgrade process is applicable to CSO Release 3.3.1 and later.

This upgrade procedure is independent of the deployment type (trial and production), environment type (non-HA and HA), infrastructure components and microservices used, and the hypervisor type (KVM or VMware ESXi).

Before you begin the upgrade:

  • Ensure that you are in Contrail Service Orchestration (CSO) Release 3.3.1 or later.

  • Ensure the installer Virtual Machine (VM) is up and running.

  • If you are using VMware ESXi VMs, you must create the provision_vm.conf file in the Contrail_Service_Orchestration_4.1.0/confs/ directory.

  • If you are using custom device profile, you must move it to customer_migration.json file /path/ Contrail_Service_Orchestration_4.1.0/ micro_services/data/

    customer_migration.json example:

To upgrade to CSO Release 4.1.0:

  1. Download the CSO Release 4.1.0 installer package from the CSO Download page to the local drive.
  2. Log in to the installer VM as root.
  3. Copy the installer package from your local folder to the installer VM.
    root@host:~/# scp Contrail_Service_Orchestration_4.1.0.tar.gz root@installer VM :/root
  4. On the installer VM, extract the installer package.

    For example, if the name of the installer package is Contrail_Service_Orchestration_4.1.0.tar.gz,

    root@host:~/# tar –xvzf Contrail_Service_Orchestration_4.1.0.tar.gz

    The contents of the installer package are extracted in a directory with the same name as the installer package.

  5. Navigate to the CSO Release 4.1.0 directory in the installer VM.
    root@host:~/# cd Contrail_Service_Orchestration_4.1.0

    (Optional) You can view the list of files in the Contrail_Service_Orchestration_4.1.0.

    root@host:~/Contrail_Service_Orchestration_4.1.0# ls

    The file includes the following scripts:



  6. Run the script.Warning

    Before you upgrade ensure that all ongoing jobs in Administration Portal and Customer Portal are stopped; otherwise, the upgrade process will fail. During the upgrade, you experience a downtime as CSO goes into maintenance mode.

    This script upgrades CSO software to Release 4.1.0. The script puts CSO in maintenance mode; takes a snapshot of running status of all VMs (optional); upgrades all microservices and infrastructure components, if required; performs health checks at various levels; validates whether all VMs, infrastructure components, and microservices are up and running; and puts the CSO in live mode. The script takes a snapshot of all VMs by default.


    The script does not take a snapshot of the Installer VM and Virtual Route Reflector (VRR) VM.

    root@host:~/Contrail_Service_Orchestration_4.1.0# ./


    The password for each infrastructure component is displayed on the console after the upgrade is successful. You must note the password that is displayed on the console as they are not saved in the system. To enhance the password security, the length and pattern for each password is different, the password is encrypted, and passwords in the log file are masked.

    The time taken to complete the upgrade process depends on the hypervisor type and the environment type. All VMs on KVM are shut down while a snapshot is being taken. All VMs on VMware ESXi are up and running while a snapshot is being taken.

    If an error occurs, you must fix the error and rerun the script. When you rerun the script, the script continues to execute from the previously failed step.

    You can view the following log files that are available at root/Contrail_Service_Orchestration_4.1.0/logs:

    • upgrade_console.log

    • upgrade_error.log

    • upgrade.log

  7. (Optional) If you are unable to troubleshoot the error you can roll back to your previous release. Run the script.Note

    You can roll back to the previous release only if you have taken snapshot of VMs before starting the upgrade process.

    root@host:~/Contrail_Service_Orchestration_4.1.0# ./
  8. Run the following commands to upgrade sites created using custom device profile or cloned device profile.

    Access tssm core docker once CSO upgrade is successful.

    docker exec -it <docker bash> bash
    root@csp:/# cd /opt/meta_data/
    cp SRX_Advanced_SDWAN_HUB_option_1_upgrade.yaml <custom_device_profile>_upgrade.yaml

After a successful upgrade, CSO is functional and you can log in to Administrator Portal and Customer Portal.


After successfully upgrading the CSO software, ensure that you download the application signatures before installing signatures on the device. This is a one-time operation after the upgrade.