Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
 

How to Backup and Restore Contrail Databases Using the OpenStackClient 16.1 Director Deployment

The document explains how to back up and restore the Contrail databases—Cassandra and Zookeeper—in JSON format. It focuses on scenarios where Contrail Networking operates in OpenStack-orchestrated environments deployed using the Red Hat OpenStack 16.1 director.

If you are deploying Contrail Networking in an OpenStack-orchestrated environment and are using an OpenStack 13-based or Ansible deployer for the deployment, see How to Backup and Restore Contrail Databases in JSON Format in Openstack Environments Using the Openstack 13 or Ansible Deployer.

Contrail Networking initially supports Openstack environments through the Openstack 16.1 director deployment in Contrail Networking Release 2008. See Contrail Networking Supported Platforms for a matrix that outlines the compatibility of Contrail Networking releases with orchestration platforms and deployers.

Before You Begin

You must complete the backup and restore procedure for nodes running the same Contrail Networking release. This procedure backs up only the Contrail Networking databases and excludes instructions for backing up orchestration system databases.

CAUTION:

Database backups must be consistent across all systems because the state of the Contrail database is associated with other system databases, such as OpenStack databases. Database changes associated with northbound APIs must be stopped on all the systems before performing any backup operation. For example, you might block the external VIP for northbound APIs at the load balancer level, such as HAproxy.

Administrators must ensure database backups remain consistent across all systems because the state of the Contrail database depends on other system databases, such as OpenStack databases. Before performing any backup operation, administrators must stop database changes associated with northbound APIs on all systems. For example, administrators might block the external VIP for northbound APIs at the load balancer level, such as HAproxy.

Simple Database Backup in JSON Format

This procedure provides a simple database backup in JSON format. This procedure is performed using the db_json_exim.py script located inside the config-api container in /usr/lib/python2.7/site-packages/cfgm_common on the controller node.

To perform this database backup:

  1. From a controller node, ensure the db_json_exim.py script is available:

  2. Log into one of the contrail controller nodes. Create the /tmp/db-dump directory on any of the contrail controller node hosts.

    Note:

    /tmp/db-dump is a user-defined directory name. You can assign any name to a directory.

  3. On the same contrail controller node, copy the contrail-api.conf file from the container to the host.

    The Cassandra database instance on any contrail controller node includes the complete Cassandra database for all contrail controller nodes in the cluster. Steps 2 and 3, therefore, only need to be performed on one contrail controller node.

  4. On all Contrail controller nodes, stop the following Contrail configuration services:

    This step must be performed on each individual controller node in the cluster.

  5. On all nodes hosting Contrail Analytics containers, stop the following analytics services:

    This step must be performed on each individual analytics node in the cluster.

  6. Return to the contrail controller node where you performed steps 2 and 3.

    Use the podman images command to list the name or ID of the config api image.

    Example:

  7. From the same contrail controller node, start the config api container by pointing the entrypoint.sh script to the /bin/bash directory then mapping /tmp/db-dump directory from the host to the /tmp directory inside the container. You perform this step to ensure that the API services are not started on the contrail controller node.

    Enter the -v /etc/contrail/ssl:/etc/contrail/ssl:ro command option when cassandra_use_ssl is used as the api-server configuration parameter to ensure TLS certificates are mounted to the Contrail SSL directory. This mounting ensures that the backup procedure succeeds in environments with endpoints that require TLS authentication.

    Example:

    Note:

    The cluster is TLS-enabled if TLS-related files are used during Contrail Networking deployment. The TLS-related files are part of the deployment script. These are custom files and can have any name. For example:

  8. From the container created on the contrail controller node, use the db_json_exim.py script to backup data in JSON format. The db dump file will be saved in the /tmp/db-dump/ directory on this contrail controller node. Example:

    The Cassandra database instance on any contrail controller node includes the complete Cassandra database for all contrail controller nodes in the cluster. You, therefore, only need to perform step 4 through 6 from one of the contrail controller nodes.

  9. (Optional. Recommended) From the same contrail controller node, enter the cat /tmp/db-dump.json | python -m json.tool | less command to view a more readable version of the file transfer.

  10. From the same contrail controller node, exit out of the config api container. This will stop the container.

  11. On each contrail controller node, start the following configuration services:

    This step must be performed on each individual contrail controller node.

  12. On each contrail analytics node, start the following analytics services:

    This step must be performed on each individual contrail analytics node.

  13. On each contrail controller node, enter the contrail-status command to confirm that services are in the active or running states.

    Note:

    Some command output and output fields are removed for readability. Output shown is from a single node hosting configuration and analytics services.

Restore Database from the Backup in JSON Format

This procedure outlines steps to restore Contrail configuration databases— Cassandra and ZooKeeper databases— on a three-node config-database cluster from a simple database backup JSON file. For example, a file produced by db_json_exim.py export.

It covers containerized deployments where Contrail runs as Docker containers managed with Docker or Docker Compose. It also covers TripleO deployments, where OpenStack 16.1 director manages containers with Podman and services with Systemd.

Note:

Commands for both deployment types are provided in every step. A DOCKER block is for containerized deployments managed with docker and a TRIPLEO block is for Openstack 16.1 director deployments, which use podman and systemd. Run only the variant that matches your network deployment.

Note:

Throughout this procedure, Node1 is the "seed" node where you run the import. Node2 and Node3 are the other two config-database nodes. Each step has a RUN ON badge. ALL THREE NODES means run the code block on node1, node2, and node3. A node1 / node2 / node3 badge means run it only on that specific node.

Prerequisites

Before you begin to restore the databases, you need to ensure that the following prerequisites are fulfilled:

  • All three configuration database nodes are reachable, and you can run Docker commands (or Podman for TripleO) on each one.

  • The backup file, db-dump.json, is present on node1 under /tmp/db-dump/ . Copy the contrail-api.conf file into the same directory.

  • All nodes are running the same Contrail Networking release as the release the backup was taken from.

CAUTION:
This procedure deletes the existing Cassandra database and ZooKeeper database data on all three nodes. Ensure a verified backup JSON file is available and database changes from northbound APIs are halted before starting the procedure. The state of the Contrail database is associated with other system databases, such as OpenStack platform, so backups must be consistent across all systems.

Steps to Restore Database

To restore a system from a backup JSON file:

  1. Copy the contrail-api.conf file [Run on: Node1]

    Export the contrail-api.conf file to the host. Create the dump directory and copy the file out of the running config-api container. Because the Cassandra database on any one node holds the complete data for the cluster. This process is required on a single node, such as Node1, or any controller node in a TripleO deployment.

    Docker

    TRIPLEO (podman/systemctl)

    Note: Place the backup file, db-dump.json, in the /tmp/db-dump/ directory on Node1 so both files are available to the import container in Step 7.
  2. Stop All Contrail Services [Run on: ALL THREE NODES]

    Stop all Contrail services before updating the databases. Ensure no data is being written to Cassandra or ZooKeeper during the wipe and restore process. Stop the application services, analytics services, and control services followed by the databases.

    Docker

    TRIPLEO (podman/systemctl)

  3. Wipe ZooKeeper Data [Run On: ALL THREE NODES]

    Empty ZooKeeper’s data directory on all three nodes. On a three-node ensemble, wiping a single node is not enough because the wiped node re-syncs old data from the leader. This must be done on all three nodes while every ZooKeeper remains stopped.

    Docker

    TRIPLEO (podman/systemctl)

    Note:

    The cp line is an optional single-use backup of the current ZooKeeper data. Skip this step if a reliable backup already exists.

  4. Wipe Cassandra Data [Run On: ALL THREE NODES]

    A Cassandra node stores its data in two volumes, and both must be cleared:

    • Named volume: /var/lib/cassandra/data — the SSTables, including system.peers_v2 and system.local (the ring and host_id).

    • Anonymous volume: /var/lib/cassandra — the commitlog/ , hints/, and saved_caches/directories.

    Clearing only the data directory is insufficient. On startup, the commitlog replays and rewrites the old ring, including the host_ids of other nodes, causing the node to boot with the other two marked as DN (down) and “schema unreachable.” You must clear the commitlog, hints, and saved_caches as well.

    Stop the Cassandra container, then use a throwaway container with --volumes-from to mount both volumes at their fixed in-container paths. This approach ensures the same command works on every node without requiring host path lookups.

    Docker

    Verify both locations are empty (both must report 0):

    Example output:

    Note:

    Host-path fallback (Docker). If you prefer to delete from the host instead of using a temporary container, find the host paths with docker inspect and delete within those paths the following code:

    TripleO

    Clear the same set of Cassandra directories on each controller. The host bind mount /var/lib/contrail/config_cassandra maps to /var/lib/cassandra inside the container, so remove data/, commitlog/, hints/, and saved_caches/ beneath it:

  5. Start Cassandra One Node at a Time

    Bring the cluster up in order and verify each node before adding the next. Node1 is the seed. If you start Node2 or Node3 while they still contain outdated data, the seed recalculates the old ring through gossip. Start the seed alone first and confirm it shows only itself—with zero ghost peers—before starting the other nodes.

    1. Start the seed alone [Node1]

      On Node1, start Cassandra and wait until the native transport is up:

      Docker

      Confirm the seed shows only Node1—a single UN line with zero DN or UJ ghost rows. If any ghost rows appear here, stop and re-wipe that peer (repeat Step 4); the peer was not clean.

      Example output:

    2. Start Node2

      Start Cassandra on Node2, and then from Node1, confirm Node1 and Node2 are both UN before continuing:

      Docker

    3. Start Node3

      The process transitions through UJ joining first. Then, from Node1, verify that all three nodes are in the UN state and that the schema is consistent with a single version.

      Docker

      Example Output

      TripleO

      The same one-at-a-time rule applies. Start the Cassandra service on Node1 first and wait until the node tool status reports Node1 as UN with no inactive peers. Repeat the process on Node2 and Node3, verifying each node's status before proceeding to the next:

      TRIPLEO (podman/systemctl)

  6. Start ZooKeeper [Run On: ALL THREE NODES]

    Start ZooKeeper on all three nodes after Cassandra confirms all nodes are UN.

    Docker

    Wait for the ZooKeeper ensemble to elect a leader and sync the followers before importing. The import writes thousands of znodes, so the ensemble must be settled first. A 180 second margin is safe for a three-node ensemble.

    TripleO

    Start the ZooKeeper services on the configuration and analytics controllers.

    TRIPLEO (podman/systemctl)

    Note:

    Optional. Check— one leader and two follower nodes across the three hosts:

  7. Import the Database Dump [Run On: Node1]

    Run the import on Node1, the seed node where the dump file resides. First, locate the config-api image for this deployment (the tag and registry vary). It is the image used by the running config-api-1 container. Use docker inspect to identify the image, even if the container is currently stopped.

    Docker

    Launch that image as a shell, mounting the dump directory and the SSL directory, then run an import inside the container. The -v /etc/contrail/ssl:/etc/contrail/ssl:ro mount supplies the TLS certificates needed when cassandra_use_ssl is enabled:

    Example Output

    TripleO

    The equivalent uses podman. The import prints the same INFO lines shown above:

    TRIPLEO (podman / systemctl)

  8. Start All Contrail Services [Run On: ALL THREE NODES]

    After the import completes, restart all services on each of the three nodes:

    Docker

    TRIPLEO (podman/systemctl)

  9. Post-Restore Kafka Fix [Run On: ALL THREE NODES]

    After a restore, the collector commonly reports a Kafka connection error such as:

    Symptom

    Because ZooKeeper was wiped and restored, the ZooKeeper topic IDs no longer match the partition.metadata stamps in Kafka’s on-disk log directory ( /tmp/kafka-logs, the container’s temporary overlay file system). A plain Docker restart does not clear that directory, which is why the problem persists. Wiping it and restarting is equivalent to up --force-recreate but keeps the container. This step is harmless to run regardless, so always run it:

    Docker

    Note:

    More surgical variant (Docker). To keep existing UVE data and drop only the topic-id stamp, delete just the partition.metadata files instead:

    TRIPLEO (podman/systemctl)

Verify the Restore

Confirm the cluster is healthy. On each node, verify that the configuration, control, analytics, and configuration database containers are running:

Docker

From Node1, verify Cassandra displays all three nodes UN and a single schema version:

TripleO confirm services are in the active states or running states with contrail-status on each controller and analytics node.

TRIPLEO (podman/systemctl)

Finally, confirm the restored objects are visible in the Contrail Networking web UI or through the API, and that the collector does not report the Kafka connection error in Step 9.