import { useEffect, useRef } from 'react'; export const upp_META = { // EdgeConnect upgrade-path planner. // Paste this whole file into ReadMe: Settings > Custom Components, // name it UpgradePathPlanner, then put the UpgradePathPlanner tag on a page. // // GENERATED by docs/tools/readme-component/build-planner-component.ps1 from // docs/tools/upgrade-path/upgrade-path-planner-v1.html, which is generated in // turn by build-planner.ps1. That generator is the source of truth for every // version number here. Do not edit this file - a hand edit is overwritten on // the next build and fails the staleness gate in the meantime. // // The engine is the ORIGINAL script, transplanted rather than rewritten, and a // gate runs every generated case through both forms and compares the output // character for character. Its element ids are prefixed so they cannot collide // with the page around it, and its stylesheet is confined to this container. generator: 'build-planner-component.ps1', }; export const upp_STYLES = ` .upp { --blue:#0055DA; --blue-bg:#E3F1FF; --amber-text:#A85700; --amber:#D36D00; --amber-bg:#FFF3DD; --amber-pill:#FFC53D; --amber-ink:#4A3200; --green:#006750; --green-bg:#E1F2ED; --red:#C7111F; --red-bg:#FDE7E9; --purple:#7630EA; --purple-bg:#F2E7FF; --hpe:#01A982; --hpe-deep:#017F62; --ink:#3E4550; --ink-strong:#292D3A; --ink-weak:#606A70; --line:#B1B9BE; --line-weak:#D4D8DB; --soft:#F7F7F7; color-scheme: light; } @font-face { font-family:'HPE Graphik'; font-weight:400; font-display:swap; src:url('https://www.hpe.com/content/dam/hpe/fonts/graphik/HPEGraphik-Regular-Web.woff2') format('woff2'); } @font-face { font-family:'HPE Graphik'; font-weight:500; font-display:swap; src:url('https://www.hpe.com/content/dam/hpe/fonts/graphik/HPEGraphik-Medium-Web.woff2') format('woff2'); } @font-face { font-family:'HPE Graphik'; font-weight:600; font-display:swap; src:url('https://www.hpe.com/content/dam/hpe/fonts/graphik/HPEGraphik-Semibold-Web.woff2') format('woff2'); } .upp * {box-sizing:border-box;font-family:inherit!important} .upp {margin:0;padding:0 20px 60px;font:15px/1.5 'HPE Graphik',Arial,Helvetica,sans-serif;color:var(--ink);background:#fff;max-width:1080px;margin-inline:auto} .upp .masthead {border-top:5px solid var(--hpe);padding-top:22px;margin-bottom:22px} .upp .brand {margin:0 0 14px} .upp .brand svg {display:block;height:34px;width:auto} @media print{.upp .brand svg {height:28px}} .upp h1 {font-size:28px;font-weight:500;color:var(--ink-strong);margin:0 0 4px;letter-spacing:-.01em} .upp h2 {font-size:20px;font-weight:500;color:var(--ink-strong);margin:34px 0 10px;padding-bottom:6px;border-bottom:1px solid var(--line-weak)} .upp h3 {font-size:15px;font-weight:600;color:var(--ink-strong);margin:18px 0 6px} .upp p {margin:8px 0} .upp .sub {color:var(--ink-weak);margin:0} .upp table {border-collapse:collapse;width:100%;margin:10px 0 4px;font-size:14px} .upp th, .upp td {border:1px solid var(--line-weak);padding:7px 9px;text-align:left;vertical-align:top} .upp th {background:var(--soft);font-weight:600;color:var(--ink-strong)} .upp td.n {width:34px;text-align:center;font-weight:600;color:var(--blue)} .upp th.sg {width:104px} .upp th.sg-d {width:88px} .upp td.sg {padding:7px 6px} .upp .sig {width:100%;box-sizing:border-box;border:0;border-bottom:1px solid var(--line);background:transparent; font:inherit;font-size:12.5px;padding:9px 1px 2px;color:var(--ink-strong)} .upp .sig:focus {outline:0;border-bottom:1px solid var(--hpe);box-shadow:0 1px 0 0 var(--hpe)} .upp code {background:var(--soft);padding:1px 5px;border-radius:3px; font-family:Consolas,"Courier New",monospace!important; font-size:13px!important;font-weight:400!important;font-style:normal; letter-spacing:normal!important;word-spacing:normal!important; font-stretch:normal!important;font-variant:normal!important; line-height:1.5;vertical-align:baseline;white-space:nowrap;color:var(--ink)} .upp .form {background:var(--soft);border:1px solid var(--line-weak);border-radius:8px;padding:18px 20px} .upp .grid {display:flex;flex-wrap:wrap;gap:22px} .upp .fld {flex:1 1 200px;min-width:190px} .upp label.lbl {display:block;font-weight:600;font-size:13px;margin-bottom:5px;color:var(--ink-strong)} .upp .fhint {font-size:12px;margin-top:4px;color:var(--ink)} .upp .fhint code {font-size:12px;padding:0 3px} .upp input[type=text], .upp select {width:100%;padding:7px 9px;border:1px solid var(--line);border-radius:5px;font:inherit;font-size:14px;background:#fff;color:var(--ink)} .upp input[type=text]:focus, .upp select:focus {outline:2px solid var(--hpe);outline-offset:1px;border-color:var(--hpe)} .upp input.bad {border-color:var(--red);background:var(--red-bg)} .upp .checks {margin-top:16px;padding-top:14px;border-top:1px solid var(--line-weak)} .upp .checks .cg {display:flex;flex-wrap:wrap;gap:8px 22px;margin-top:6px} .upp .checks label {font-size:14px;display:flex;align-items:center;gap:6px} .upp .checks label.off {opacity:.4;cursor:not-allowed} .upp .checks label.off input {cursor:not-allowed} .upp .na {font-size:12px;color:var(--ink-weak);font-style:italic} .upp .hint {font-size:12.5px;color:var(--ink-weak);margin-top:4px} .upp .btns {margin-top:18px;display:flex;gap:10px;align-items:center;flex-wrap:wrap} .upp button {font:inherit;font-size:14px;font-weight:600;padding:8px 18px;border-radius:6px;border:1px solid var(--hpe-deep);background:var(--hpe-deep);color:#fff;cursor:pointer} .upp button.sec {background:#fff;color:var(--ink-strong);border-color:var(--line)} .upp button:disabled {opacity:.45;cursor:not-allowed} .upp .copied {font-size:13px;color:var(--green);font-weight:600} .upp .callout {border-left:5px solid var(--blue);background:var(--blue-bg);padding:12px 14px;border-radius:0 6px 6px 0;margin:12px 0} .upp .callout.warn {border-color:var(--amber);background:var(--amber-bg)} .upp .callout.stop {border-color:var(--red);background:var(--red-bg)} .upp .callout.ok {border-color:var(--green);background:var(--green-bg)} .upp .pill {display:inline-block;padding:2px 10px;border-radius:11px;font-size:12.5px;font-weight:600;white-space:nowrap;letter-spacing:.2px} .upp .pill.yes {background:var(--red);color:#fff;box-shadow:0 0 0 1px var(--red)} .upp .pill.no {background:var(--green-bg);color:var(--green);box-shadow:0 0 0 1px var(--green)} .upp .pill.chk {background:var(--amber-pill);color:var(--amber-ink);box-shadow:0 0 0 1px var(--amber)} .upp .pill.rtd {background:var(--blue-bg);color:var(--blue);box-shadow:0 0 0 1px var(--blue)} .upp .pill.irr {background:var(--purple);color:#fff;box-shadow:0 0 0 1px var(--purple)} .upp .pill.rev {background:#fff;color:var(--amber-text);box-shadow:0 0 0 1.5px var(--amber)} .upp tr.r-rev td {background:var(--amber-bg)} .upp tr.r-irr td {background:var(--purple-bg)} .upp tr.r-yes td {background:var(--red-bg)} .upp tr.r-chk td {background:var(--amber-bg)} .upp .done {background:var(--green-bg)} .upp ul {margin:8px 0;padding-left:22px} .upp li {margin:5px 0} .upp .url {font-family:Consolas,"Courier New",monospace!important;font-size:12.5px!important; font-weight:400!important;letter-spacing:normal!important;word-spacing:normal!important; font-stretch:normal!important;font-variant:normal!important;line-height:1.5; color:var(--ink-weak);word-break:break-all} .upp footer {margin-top:44px;padding-top:12px;border-top:1px solid var(--line-weak); font-family:'HPE Graphik',Arial,Helvetica,sans-serif;font-size:12.5px; letter-spacing:normal;color:var(--ink-weak)} .upp .chg {margin-top:40px;font-family:'HPE Graphik',Arial,Helvetica,sans-serif;font-size:12.5px; letter-spacing:normal;color:var(--ink-weak)} .upp .chg>summary {cursor:pointer;font-weight:600;color:var(--ink-weak)} .upp .chg table {border-collapse:collapse;margin-top:10px;width:100%} .upp .chg td {border-top:1px solid var(--line-weak);padding:6px 10px 6px 0;vertical-align:top; font-size:12.5px;line-height:1.5} .upp .chg td.d {white-space:nowrap;color:var(--ink-weak)} .upp .chg td.r {white-space:nowrap;font-weight:600} .upp .intro {margin:0 0 26px;padding:16px 20px 16px 22px;border-left:3px solid var(--hpe-green); background:var(--bg-weak,#f7f7f7);font-family:'HPE Graphik',Arial,Helvetica,sans-serif; letter-spacing:normal} .upp .intro ul {margin:0;padding-left:20px} .upp .intro li {font-size:13.5px;line-height:1.6;margin:0 0 7px} .upp .intro li:last-child {margin-bottom:0} .upp .intro li b {font-weight:600} @media print{.upp .intro {display:none}} .upp #upp-out {display:none} @media print{.upp .form, .upp .btns {display:none}.upp #upp-out {display:block!important}.upp .masthead {border-top-color:#000} .upp .sig {border-bottom-color:#000;-webkit-print-color-adjust:exact;print-color-adjust:exact}} .upp { padding: 0; margin-inline: auto; } `; export const upp_MARKUP = ` \x3cdiv class="intro"> \x3cul> \x3cli>\x3cb>Reload the page before you plan.\x3c/b> Guidance moves as release notes publish. The build stamp and date are in the footer, and the change history beside it says what moved.\x3c/li> \x3cli>\x3cb>Give exact builds, not release lines.\x3c/b> One patch digit changes the plan - 9.4.8 and 9.4.9 route differently. Read the Orchestrator's own version, and the lowest appliance version, from the Orchestrator.\x3c/li> \x3cli>\x3cb>Answer both ends.\x3c/b> The Orchestrator and the appliances are planned together. Several steps exist only because of what the other side is running.\x3c/li> \x3cli>\x3cb>Say how the Orchestrator is hosted.\x3c/b> Self-hosted on CentOS, self-hosted on Rocky Linux, or Cloud/OaaS. CentOS adds a migration ahead of everything else; OaaS removes the VM steps entirely.\x3c/li> \x3cli>\x3cb>Tick everything true of the Fabric, and name every release line you have.\x3c/b> Anything left unticked is reported as a check rather than ruled out, and a line you do not name does not get its own route.\x3c/li> \x3cli>\x3cb>Every step cites the release note that requires it.\x3c/b> Follow the link when a change board asks why a hop is in the plan.\x3c/li> \x3c/ul> \x3c/div> \x3cdiv class="form"> \x3cdiv class="grid"> \x3cdiv class="fld"> \x3clabel class="lbl" for="upp-orch">Orchestrator version\x3c/label> \x3cinput type="text" id="upp-orch" placeholder="9.4.2" autocomplete="off" /> \x3cdiv class="fhint">Three parts, with the dots — \x3ccode>9.4.2\x3c/code>\x3c/div> \x3c/div> \x3cdiv class="fld"> \x3clabel class="lbl" for="upp-ecos">ECOS version – lowest in the Fabric\x3c/label> \x3cinput type="text" id="upp-ecos" placeholder="9.4.2.5" autocomplete="off" /> \x3cdiv class="fhint">Four parts, with the dots — \x3ccode>9.4.2.5\x3c/code>\x3c/div> \x3c/div> \x3cdiv class="fld"> \x3clabel class="lbl" for="upp-host">How the Orchestrator is hosted\x3c/label> \x3cselect id="upp-host"> \x3coption value="oaas">Cloud / OaaS\x3c/option> \x3coption value="rocky">Self-hosted on Rocky Linux\x3c/option> \x3coption value="centos">Self-hosted on CentOS\x3c/option> \x3c/select> \x3c/div> \x3cdiv class="fld"> \x3clabel class="lbl" for="upp-target-orch">Orchestrator finishes at\x3c/label> \x3cselect id="upp-target-orch">\x3c/select> \x3c/div> \x3cdiv class="fld"> \x3clabel class="lbl" for="upp-target-ecos">EdgeConnect finishes at\x3c/label> \x3cselect id="upp-target-ecos">\x3c/select> \x3c/div> \x3cdiv class="fld"> \x3clabel class="lbl" for="upp-tunnel">Tunnel mode\x3c/label> \x3cselect id="upp-tunnel"> \x3coption value="udp">IPSec UDP\x3c/option> \x3coption value="ipsec">IPSec IKE\x3c/option> \x3coption value="unsure">Not sure\x3c/option> \x3c/select> \x3c/div> \x3c/div> \x3cdiv class="checks"> \x3clabel class="lbl">Tick anything that is true of this Fabric\x3c/label> \x3cdiv class="cg"> \x3clabel>\x3cinput type="checkbox" id="upp-f-fips" /> FIPS or CC mode is on\x3c/label> \x3clabel>\x3cinput type="checkbox" id="upp-f-radius" /> RADIUS or TACACS+ authentication in use\x3c/label> \x3clabel id="upp-l-stats">\x3cinput type="checkbox" id="upp-f-stats" /> Self-hosted Statistics Collector\x3cspan id="upp-stats-na" class="na" style="display:none">(HPE migrates this)\x3c/span>\x3c/label> \x3clabel>\x3cinput type="checkbox" id="upp-f-cert" /> Certificate-based IPSec tunnels\x3c/label> \x3clabel>\x3cinput type="checkbox" id="upp-f-aws" /> EC-V in AWS\x3c/label> \x3clabel>\x3cinput type="checkbox" id="upp-f-ecvmem" /> EC-V with 4 GB memory, or customized System Limits\x3c/label> \x3clabel>\x3cinput type="checkbox" id="upp-f-ecus" /> EC-US appliances present\x3c/label> \x3clabel>\x3cinput type="checkbox" id="upp-f-ecxs" /> EC-XS appliances present\x3c/label> \x3clabel>\x3cinput type="checkbox" id="upp-f-ec10150" /> EC-10150 appliances present\x3c/label> \x3clabel>\x3cinput type="checkbox" id="upp-f-boost" /> WAN optimization (Boost) in use\x3c/label> \x3clabel>\x3cinput type="checkbox" id="upp-f-zscaler" /> Zscaler integration configured in Orchestrator\x3c/label> \x3clabel>\x3cinput type="checkbox" id="upp-f-restapi" /> Anything talks to Orchestrator over the REST API\x3c/label> \x3clabel>\x3cinput type="checkbox" id="upp-f-awswan" /> AWS subscription for WAN automation\x3c/label> \x3c/div> \x3cp class="hint">Anything left unticked is reported as \x3cstrong>Check\x3c/strong>, not ruled out. The last three are integrations, not Fabric state: they do not change the route, but each has a published way of spoiling the window.\x3c/p> \x3c/div> \x3cdiv class="checks"> \x3clabel class="lbl">Does the Fabric span more than one release line?\x3c/label> \x3cdiv class="cg"> \x3clabel>\x3cinput type="checkbox" id="upp-f-mixed" /> Yes — appliances sit on more than one release line\x3c/label> \x3c/div> \x3cdiv id="upp-mixed-box" style="display:none"> \x3cp class="hint">Give the \x3cstrong>lowest\x3c/strong> build on each line you have, separated by commas — any line, so \x3ccode>9.1.4.0, 9.3.4.0\x3c/code> is a normal answer. The floors an Orchestrator on 9.7 needs are \x3cem>per line\x3c/em>, so the lowest number overall is not the lowest risk: a fleet on 9.4.8.1 plus a handful on 9.5.7.1 looks safe from the 9.4 figure, and the 9.5.7.1 boxes are the ones stranded. Naming them also gets each group its own route.\x3c/p> \x3cdiv class="fld"> \x3clabel class="lbl" for="upp-m-list">The lowest build on each line you have\x3c/label> \x3cinput type="text" id="upp-m-list" placeholder="9.1.4.0, 9.3.4.0, 9.5.7.1" autocomplete="off" /> \x3c/div> \x3c/div> \x3c/div> \x3cdiv class="checks"> \x3clabel class="lbl">Output format\x3c/label> \x3cdiv class="cg"> \x3clabel>\x3cinput type="checkbox" id="upp-f-signoff" /> Format as a change record — add sign-off columns\x3c/label> \x3c/div> \x3cp class="hint">Adds \x3cstrong>Assessed by\x3c/strong> and \x3cstrong>Accepted by\x3c/strong> to the risks, and \x3cstrong>Tech\x3c/strong>, \x3cstrong>Supervisor\x3c/strong> and \x3cstrong>Date done\x3c/strong> to each step. Type into them and print to PDF, or print blank and sign in ink.\x3c/p> \x3c/div> \x3cdiv class="btns"> \x3cbutton id="upp-go">Build the plan\x3c/button> \x3cbutton id="upp-copy" class="sec" disabled>Copy\x3c/button> \x3cbutton id="upp-dl-html" class="sec" disabled>Download HTML\x3c/button> \x3cbutton id="upp-dl-md" class="sec" disabled>Download Markdown\x3c/button> \x3cspan id="upp-copied" class="copied" style="display:none">Copied\x3c/span> \x3c/div> \x3c/div> \x3cdiv id="upp-err">\x3c/div> \x3cdiv id="upp-out">\x3c/div> \x3cdetails class="chg"> \x3csummary>What has changed in this guidance\x3c/summary> \x3ctable> \x3ctbody> \x3ctr>\x3ctd class="d">15 OCT 2026\x3c/td>\x3ctd class="r">ECOS 9.6.4.1 Rev A\x3c/td>\x3ctd>Appliances now land on 9.6.4.1, the newest 9.6 build, whether passing through to 9.7 or holding at 9.6. It needs the Orchestrator on 9.6.4 or later, or 9.7.1 or later, before it can be pushed.\x3c/td>\x3c/tr> \x3ctr>\x3ctd class="d">07 OCT 2026\x3c/td>\x3ctd class="r">Orchestrator 9.7.1 Rev F\x3c/td>\x3ctd>An appliance on 9.4.0.0 or later that sits below its band is still managed, as long as it can reach the Cloud Portal. The bands themselves have not moved.\x3c/td>\x3c/tr> \x3ctr>\x3ctd class="d">23 SEP 2026\x3c/td>\x3ctd class="r">ECOS 9.5.9.0 and 9.6.4.0 Rev D\x3c/td>\x3ctd>An appliance landing on the 9.4.9 or 9.5.9 line needs its Orchestrator on 9.4.11, 9.5.9, 9.6.4 or 9.7.1 first. The Orchestrator now moves ahead of the appliances.\x3c/td>\x3c/tr> \x3ctr>\x3ctd class="d">23 SEP 2026\x3c/td>\x3ctd class="r">Orchestrator 9.6.4 Rev D\x3c/td>\x3ctd>Plans land appliances on 9.4.9.0 or 9.5.9.0, the builds carrying the stats-upload fix, rather than stopping at the published minimum.\x3c/td>\x3c/tr> \x3ctr>\x3ctd class="d">15 SEP 2026\x3c/td>\x3ctd class="r">HPE techdocs, CentOS to Rocky Linux\x3c/td>\x3ctd>An Orchestrator already on 9.4.x and still on CentOS migrates to Rocky Linux at the build it is on now, before any further upgrade.\x3c/td>\x3c/tr> \x3ctr>\x3ctd class="d">14 SEP 2026\x3c/td>\x3ctd class="r">ECOS 9.7.0.0 Rev H\x3c/td>\x3ctd>Appliances pass through 9.6.4.0 on the way to 9.7. 9.6.3.1 remains the lowest build that will take the 9.7 image.\x3c/td>\x3c/tr> \x3ctr>\x3ctd class="d">14 SEP 2026\x3c/td>\x3ctd class="r">HPE engineering, 11 SEP 2026\x3c/td>\x3ctd>End of Maintenance for the 9.6 stream moved out to 31 DEC 2026.\x3c/td>\x3c/tr> \x3c/tbody> \x3c/table> \x3c/details> \x3cfooter>Version 1 | Rev 16OCT2026 1222 | build da45cc\x3c/footer> `; export const upp_init = (ROOT_EL, HOST_EL) => { var RULES = {"caveat":{"head":"A planning aid, not a substitute for the release notes.","body":"Every version here traces to a release-note sentence; the tool cannot invent a hop or a URL. It reasons only from what you typed, so confirm the current GA build and read each hop's notes before you schedule.","linkGuide":"release-notes"},"scope":{"minOrch":"8.0.0","minEcos":"8.0.0","belowScope":"This planner covers Fabrics on 8.x or later on both sides. Below that there is no drawn route at all - use the full two-level upgrade chart instead."},"constants":{"bootLoopLine94MaxPatch":2,"bootLoopExtra":["9.5.0.0","9.5.1.0"],"bootLoopDefect":"76032","bootLoopFixed94":"9.4.2.5","brickFloors":{"9.3":"9.3.6.0","9.4":"9.4.4.0","9.5":"9.5.2.0"},"rockyCapableFrom":{"9.1":"9.1.9","9.2":"9.2.10","9.3":"9.3.3","9.4":"9.4.2"},"rockyRequiredFrom":{"9.4":"9.4.9","9.5":"9.5.7","9.6":"9.6.2"},"radiusMsgAuthFrom":"9.5.4.2","cifsRemovedFrom":"9.3.0.0","logFacilityStrictBelow":"9.4.0.0","orchLeadFloors":{"9.4":"9.4.8.0","9.5":"9.5.8.0","9.6":"9.6.3.0"},"orch97HardFloor":"9.4.0.0","orch97CannotManageSentence":"Otherwise, the appliance cannot be managed by Orchestrator 9.7.0 and later releases.","orch97CloudPortalSentence":"An appliance running a version earlier than 9.4.8.0, 9.5.8.0, 9.6.3.0, or 9.7.0.0 needs connectivity to the Cloud Portal for Orchestrator 9.7.0 and later releases to manage it.","oaasSelfServiceFrom":"9.1.0","ecosNeedsOrchByLine":{"9.4":"9.4.5","9.5":"9.5.4","9.6":"9.6.2","9.7":"9.7.1"},"ecosNeedsOrchByBuild":[["9.7.1.0","9.7.1"],["9.7.0.0","9.7.0"],["9.6.4.1","9.6.4"],["9.6.2.0","9.6.2"],["9.6.1.0","9.6.1"],["9.6.0.0","9.6.0"],["9.5.9.0","9.5.9"],["9.5.4.0","9.5.4"],["9.5.2.0","9.5.2"],["9.5.1.0","9.5.1"],["9.5.0.0","9.5.0"],["9.4.9.0","9.4.11"],["9.4.5.0","9.4.5"],["9.4.4.0","9.4.4"],["9.4.3.0","9.4.3"],["9.4.2.0","9.4.2"],["9.4.1.0","9.4.1"],["9.3.0.0","9.3.0"],["9.2.3.0","9.2.4"],["9.2.1.0","9.2.1"],["9.2.0.0","9.2.0"],["9.1.1.0","9.1.1"],["9.1.0.0","9.1.0"],["9.0.3.0","9.0.4"],["9.0.2.0","9.0.3"],["9.0.1.0","9.0.2"],["9.0.0.0","9.0.0"]],"ecosNeedsOrchCrossStream":{"9.4.9.0":{"9.4":"9.4.11","9.5":"9.5.9","9.6":"9.6.4","9.7":"9.7.1"},"9.5.9.0":{"9.5":"9.5.9","9.6":"9.6.4","9.7":"9.7.1"},"9.6.4.0":{"9.6":"9.6.4","9.7":"9.7.1"},"9.6.4.1":{"9.6":"9.6.4","9.7":"9.7.1"}},"orchStagingByLine":{"9.4":"9.4.11","9.5":"9.5.9","9.6":"9.6.4"},"orch952Trap":{"from":"9.4.3","mustReach":"9.5.2"},"sshCiphersFrom":{"9.4":"9.4.3","9.5":"9.5.0"},"ecosFloorsNotOrch":["9.5.8","9.6.3"],"libssl956":{"orchFrom":"9.4.9","blocked":"9.5.6","useInstead":"9.5.7"},"libssl961":{"orchFrom":["9.4.9","9.5.7"],"blocked":"9.6.1","useInstead":"9.6.2"},"lilyPadFloor":"9.6.3.1","lilyPad":"9.6.4.1","awsNetworkManager":{"orchFrom":"9.5.3"},"oneWayDoor":"9.6.0","ecosCommsFloor":"8.3.2.0","verifyImageSigExemptFrom":"8.3.3.0","ec10150":{"part":"3510332","floor":"9.5.3.0","ships":"9.5.3.2","barredLine":"9.4"},"hardware":{"ecUs97":"201106-001, -002, -003 and -004","ecXs95":"200889-001, -002 and 200900-001, -002","ecXs97":"200889-003, -005, -006, -008 and 200900-003, -005, -006, -007, -008"}},"level1":{"entryOrch":"9.4.11","entryEcos":"9.4.9.0","belowLine":"9.4","belowLineWhy":["What actually puts a Fabric on Level 1 is being below the 9.4 line, not being","below 9.4.8. A Fabric already on 9.4.x is inside the 9.4-to-9.7 chart's own scope","and goes direct - routing it through 9.4.8 first would invent a hop nobody asked","for. Below 9.4 there is no drawn route to 9.5 or 9.7 at all except through the","Level 1 entry state, so the prologue is required."],"orch8Final":"8.10.23","ecos8Baseline":"8.1.9.21","ecos8Final":"8.3.8.0","staging":{"byLine":{"9.1":"9.1.10","9.2":"9.2.12","9.3":"9.3.3","9.4":"9.4.2"},"exact":["9.4"],"default":"9.2.12","defaultWhy":"suggested - the best tested path"},"antiReplay":{"source":"The ECOS IPSec UDP ESN anti-replay compatibility matrix, reprinted verbatim under Top items in every mirrored ECOS release note. Columns and rows: 9.4.1.0+, 9.3.2.0+, 9.2.8.0+, 9.1.10.0+ all interoperate with each other, and none of them interoperate with 9.2.2.x-9.2.7.x or 9.1.2.x-9.1.9x.","belowMatrix":"The matrix starts at 9.1.2 - it says nothing at all about anything below that. Such a build is unknown, not affected. Do not read the bottom of the affected range as if it extended downwards.","safeFloors":{"9.1":"9.1.10.0","9.2":"9.2.8.0","9.3":"9.3.2.0","9.4":"9.4.1.0"},"safeAbove":"9.4.1.0","safeAboveWhy":["The per-line floors only name lines the vendor's matrix enumerates, so a","Fabric on 9.5 or later matches no line and would otherwise fall through to","'unknown' - an amber Check on every modern Fabric, which is noise. 9.4.1.0 is","the highest floor in the matrix, so at or above it the gap cannot arise on any","line and the risk is genuinely ruled out."],"affected":[{"line":"9.1","from":"9.1.2","below":"9.1.10.0"},{"line":"9.2","from":"9.2.2","below":"9.2.8.0"}],"fix":"Disable IPSec key rotation OR anti-replay on all labels before you start, and re-enable only once every appliance is on a build in the matrix's interoperating set - 9.1.10.0+, 9.2.8.0+, 9.3.2.0+ or 9.4.1.0+.","how":"\x3cstrong>Either\x3c/strong> disable key rotation: \x3cstrong>1.\x3c/strong> Go to \x3cstrong>Support > Reporting > IPSec UDP Status\x3c/strong> and check every appliance shows \x3cstrong>Yes\x3c/strong> in the Active Key column. \x3cstrong>2.\x3c/strong> Go to \x3cstrong>Configuration > Overlays & Security > Security > IPSec Key Rotation\x3c/strong> and clear the \x3cstrong>Enable Key Rotation\x3c/strong> check box — this triggers one final key generation and distribution. \x3cstrong>3.\x3c/strong> Check the Active Key column again and wait until every appliance shows Yes; starting the upgrades before that key lands is what drops tunnels. \x3cstrong>4.\x3c/strong> Run the appliance upgrades. \x3cstrong>5.\x3c/strong> Return to the same screen and select \x3cstrong>Enable Key Rotation\x3c/strong>.\x3cbr>\x3cbr>\x3cstrong>Or\x3c/strong> disable anti-replay: in \x3cstrong>Orchestrator > Orchestrator Server > Tools > Tunnel Settings\x3c/strong>, click \x3cstrong>IPSec\x3c/strong>, set the \x3cstrong>IPSec anti-replay window\x3c/strong> dropdown to \x3cstrong>Disable\x3c/strong> and click \x3cstrong>Save\x3c/strong>. This bounces every existing tunnel once, so do it inside the window."}},"targets":[{"id":"9.4","label":"Hold at 9.4","orch":"9.4.11","ecos":"9.4.9.0","class":"LSR","eom":"30 JUN 2027","why":"9.4 is a Long Supported Release and this is the shortest route there is - the Orchestrator leads, the appliances follow, and nothing else. It never touches 9.6, so the one-way door, the mandatory ECOS stepping stone and every 9.6 behavior change are all avoided. It is a genuine resting point, not a staging build, and nothing spent getting here is undone when you later move on."},{"id":"9.5","label":"Hold at 9.5","orch":"9.5.9","ecos":"9.5.9.0","class":"LSR","eom":"30 SEP 2027","why":"9.5 is a Long Supported Release. The route is two moves, it skips the ECOS 9.6.3.1 hop and the one-way door at Orchestrator 9.6.0 entirely, and nothing spent getting here is undone when you later go on to 9.7."},{"id":"9.6","label":"Hold at 9.6","orch":"9.6.4","ecos":"9.6.4.1","class":"SSR","eom":"31 DEC 2026","why":"9.6 is a Short Supported Release, and neither chart offers it as a resting point - they pass through it. Choose it only if something specific to 9.6 is wanted, because it costs the one-way door at Orchestrator 9.6.0 on the way in and it is the shortest-lived of the four streams. Nothing spent getting here is wasted: 9.6.4.1 is already above the mandatory ECOS stepping stone the 9.7 route uses, so moving on later is one more Orchestrator hop and one more appliance hop."},{"id":"9.7","label":"Finish at 9.7","orch":"9.7.1","ecos":"9.7.1.0","class":"LSR","eom":"not yet published","ga":true,"why":"9.7 is a Long Supported Release and leaves you current. It costs the mandatory ECOS 9.6.3.1 hop and crossing the one-way door at Orchestrator 9.6.0."}],"streams":{"9.4":{"class":"LSR","eom":"30 JUN 2027"},"9.5":{"class":"LSR","eom":"30 SEP 2027"},"9.6":{"class":"SSR","eom":"31 DEC 2026"},"9.7":{"class":"LSR","eom":"not yet published"}},"eomMeaning":"After that date the systems keep running normally; what stops is new builds on that branch, so fixes and CVE patches then arrive only on the newer streams.","preflight":[{"id":"hardware","when":"always","action":"Confirm every appliance model can reach the target","detailByTarget":{"9.4":null,"9.5":"Some EC-XS part numbers are not supported on ECOS 9.5 or later. Check the label on each appliance, not the model name — plenty of EC-XS are unaffected. The numbers are below.","9.6":"The EC-XS list that starts at 9.5 reads \x3cem>or later\x3c/em> and still applies; a second group is unsupported on 9.6 without the software stopping you. Check the label, not the model name — the numbers are below.","9.7":"Three lists apply — seventeen part numbers, thirteen of them EC-XS. A fleet checked before 9.7.0.0 published was checked against four of them, so check it again, by the label on each appliance. The numbers are below."},"howByTarget":{"9.4":null,"9.5":"\x3cstrong>Not supported on ECOS 9.5 or later — EC-XS:\x3c/strong> 200889-001, 200889-002, 200900-001, 200900-002.\x3cbr>\x3cbr>The EC-US restriction starts at 9.7 and does not apply here. There is no sequencing around this: an appliance on the list is replaced, or stays behind on an earlier release while the rest of the Fabric moves.","9.6":"\x3cstrong>Not supported on ECOS 9.5 or later — EC-XS:\x3c/strong> 200889-001, 200889-002, 200900-001, 200900-002.\x3cbr>\x3cbr>\x3cstrong>Also not supported on 9.6, though the software will not stop you — EC-US:\x3c/strong> 201106-001, 201106-002, 201106-003, 201106-004, and the 8 GB \x3cstrong>EC-XS:\x3c/strong> 200889-003, 200889-005, 200889-006, 200889-008, 200900-003, 200900-005, 200900-006, 200900-007, 200900-008. HPE's Hardware/ECOS Compatibility Matrix marks these \x3cem>N/A (not enforced)\x3c/em> on the 9.6 line: unsupported, but the install is not blocked. That is not permission — it only means nothing fails loudly. At 9.7 they become a flat N/A.\x3cbr>\x3cbr>There is no sequencing around this: an appliance on these lists is replaced, or stays behind on an earlier release while the rest of the Fabric moves.","9.7":"\x3cstrong>Not supported on ECOS 9.7 or later — EC-US:\x3c/strong> 201106-001, 201106-002, 201106-003, 201106-004.\x3cbr>\x3cbr>\x3cstrong>Not supported on ECOS 9.5 or later — EC-XS:\x3c/strong> 200889-001, 200889-002, 200900-001, 200900-002. That list reads \x3cem>or later\x3c/em>, so it is still in force at 9.7.\x3cbr>\x3cbr>\x3cstrong>Not supported on ECOS 9.7 or later — EC-XS:\x3c/strong> 200889-003, 200889-005, 200889-006, 200889-008, 200900-003, 200900-005, 200900-006, 200900-007, 200900-008.\x3cbr>\x3cbr>\x3cstrong>Seventeen numbers in all, and thirteen of them are EC-XS — not nine.\x3c/strong> The two EC-XS lists compound: checking only the 9.7 list quietly passes four appliances that went out of support at 9.5. There is no sequencing around this — an appliance on any of the three lists is replaced, or stays behind on an earlier release while the rest of the Fabric moves."}},{"id":"verify-image-signature","when":"verifyImageSig","action":"Turn OFF Verify Image Signature","detail":"Needed because these appliances are below ECOS 8.3.3.0 — the notes exempt anything upgrading from 8.3.3.0 or later.","how":"Orchestrator > Advanced Security Settings. Turn it back on once every appliance has landed on its final build."},{"id":"boot-loop","when":"bootLoop","action":"Turn OFF Verify System Files Integrity AND FIPS/CC, and reset the Logging template facilities","detail":"All three, before you upgrade. Leave one on and the appliance can boot-loop; recovery is a serial console and an alternate partition from the GRUB menu, and a cloud EC-V has no serial console.","how":"The checkbox is under Configuration > Overlays & Security > Security > Advanced Security Settings; FIPS and CC mode trigger the same integrity check on their own, so they come off with it. Then under Configuration > Templates & Policies > Templates open the Logging template and put Log Facilities Configuration back to its defaults - System local1, Audit local0, Firewall local2, IDS/IPS Events local3 - because a syslog file in the wrong place is the defect. Turn the checkbox and FIPS/CC back on once every appliance is on a fixed build."},{"id":"backup","when":"selfHosted","action":"Back up the Orchestrator","detail":"Before the first upgrade and again before each later hop. An Orchestrator can only be restored from a backup taken on the same release, so a backup taken at the start covers only the first hop.","how":"This is the Orchestrator's own backup, not the appliance configuration backup. On a self-hosted Orchestrator it is a scheduled job to a target set up in the initial configuration wizard, so confirm it is working: check a recent backup exists and that you can retrieve it from the target.\x3cbr>\x3cbr>Recovery is manual, from the Orchestrator CLI: stop the service, relink \x3ccode>/home/gms/gms\x3c/code> to the previous version's directory, run \x3ccode>restore.sh\x3c/code>, and start the service again. The exact commands are in the Recover from a failed SD-WAN Orchestrator upgrade section of the Orchestrator release notes."},{"id":"backup-oaas","when":"oaas","action":"No Orchestrator backup step - HPE managed"}],"conditional":[{"id":"cert-ipsec-psk","phase":"pre","gate":"certToPsk","action":"Switch \x3cstrong>certificate-based IPSec tunnels\x3c/strong> to pre-shared keys","detail":"Before the first appliance moves. A certificate-based fabric tunnel drops when one end reaches 9.7 and the far end is still on an older build, so the exposure is the whole rollout window, not one hop.","who":"You - from Orchestrator."},{"id":"radius-msg-auth","phase":"pre","gate":"radiusMsgAuth","action":"Confirm the \x3cstrong>RADIUS server\x3c/strong> sends the message-authenticator attribute","detail":"Fix the server before the appliances land. From ECOS 9.5.4.2 the notes warn that RADIUS communications could be dropped where the server does not send the attribute — it presents as administrators locked out, not a failed upgrade.","who":"You - on the RADIUS server, not in Orchestrator."},{"id":"zscaler-gre","phase":"pre","gate":"zscalerGre","action":"Confirm the \x3cstrong>Zscaler account has GRE enabled\x3c/strong> before you start","detail":"If the Zscaler integration is configured and the account does not have GRE enabled, the notes say the Orchestrator upgrade fails. One login rules it out.","how":"Check it in the Zscaler admin portal, not in Orchestrator — it is a property of the account, not the integration.","who":"You - in the Zscaler admin portal."},{"id":"restapi-migrate","phase":"pre","gate":"restApiMigrate","action":"Migrate anything that talks to \x3cstrong>Orchestrator's REST API\x3c/strong> first","detail":"Orchestrator 9.3.0 changed most of its APIs to accommodate API-based RBAC, and the note says not to upgrade until your integrations are modified. The Fabric is unaffected; what breaks is monitoring, reporting and automation wired into Orchestrator.","who":"You - wherever the integrations live, not in Orchestrator."},{"id":"aws-wan-automation","phase":"pre","gate":"awsWanAutomation","action":"Confirm the \x3cstrong>AWS subscription can reach AWS Network Manager\x3c/strong>","detail":"Including core network segments. Where the subscription cannot reach AWS Network Manager, the note says the Orchestrator may be unable to complete the upgrade to 9.5.x — part-way, not refused at the start. Unrelated to EC-V instance types.","who":"You - in AWS IAM, not in Orchestrator."},{"id":"aws-imds","phase":"pre","gate":"awsImds","action":"Confirm \x3cstrong>IMDSv1 is still enabled\x3c/strong> on every EC-V in AWS","detail":"EC-V does not support IMDSv2; the notes ask for IMDSv1 to remain enabled for SSH access and appliance initialization. An account tightened to IMDSv2-only since deployment shows up at the reboot — and an EC-V without SSH is a redeploy.","who":"You - in the AWS console, not in Orchestrator.","how":"AWS console > EC2 > Instances > select the EC-V > Actions > Instance settings > Modify instance metadata options. \x3cstrong>IMDSv1 and IMDSv2 (token optional)\x3c/strong> keeps IMDSv1 available; \x3cstrong>IMDSv2 only (token required)\x3c/strong> breaks it. Check every EC-V, and any account-level or Organizations policy that sets it centrally."},{"id":"stats-snapshot","phase":"pre","gate":"statsSnapshot","action":"Snapshot the \x3cstrong>Statistics Collector\x3c/strong> data","detail":"Before the upgrade — there is no way back afterwards. While it runs, do not force a stop or restart of the Orchestrator or the collector: the database upgrade continues after the CLI looks finished.","who":"You - on the Orchestrator."},{"id":"aws-ecv-inventory","phase":"pre","gate":"awsEcvInventory","action":"List every \x3cstrong>EC-V in AWS\x3c/strong> by instance type","detail":"Anything not a c5 is exposed to VXOA-81239 on the way onto the 9.6 line, and an unreachable EC-V in AWS is a redeploy. The build in this plan carries the fix; do not substitute an earlier 9.6 build.","who":"You - in the AWS console."},{"id":"ecv-memory","phase":"pre","gate":"ecvMemory","action":"Grow the \x3cstrong>EC-V memory to 8 GB\x3c/strong>, or test the upgrade in a lab first","detail":"A 4 GB EC-V, or one with customized System Limits, can come up in a continuous reboot after the upgrade. The note asks for a lab test on an identical system first, then more memory or lower limits if it fails.","how":"System Limits are under Maintenance > Software & System Management > System Limits. The note is explicit: if the EC-V currently has 4 GB, increase it to 8 GB.","who":"You - on the hypervisor."},{"id":"mschap-auth","phase":"pre","gate":"mschapSwitch","action":"Move Orchestrator logins off \x3cstrong>MSCHAP\x3c/strong>","detail":"Before the Orchestrator crosses 9.4.1. Affects TACACS+ with MSCHAP and RADIUS with MSCHAP, MSCHAPv2 or EAP-MSCHAPv2; anything else is unaffected. It locks administrators out rather than failing the upgrade, so confirm a second way in first.","how":"Use PAP or CHAP, or OAUTH or SAML.","who":"You - on the authentication server."},{"id":"log-facilities","phase":"pre","gate":"logFacilities","action":"Check the \x3cstrong>Logging template's Log Facilities\x3c/strong> do not overlap","detail":"Before the first appliance moves. Field-observed: builds below 9.4 ignore an overlap, later ones reject it, and the template push then fails, seen only in the audit log. Orchestrator 9.4+ blocks a new overlap but keeps an old one.","how":"Under Configuration > Templates & Policies > Templates, open the Logging template and read Log Facilities Configuration. Each of System, Audit, Firewall and IDS/IPS Events should have a facility of its own. The defaults are already distinct — System local1, Audit local0, Firewall local2, IDS/IPS Events local3 — so putting them back is the simplest fix. Save and push before the window. If an appliance has already moved, a failed push of this template shows in the Orchestrator audit log.","who":"You - from Orchestrator."},{"id":"cifs-accel-off","phase":"pre","gate":"cifsAccelOff","action":"Turn off \x3cstrong>CIFS Protocol Acceleration\x3c/strong> in the Optimization Policies template","detail":"Before the first appliance crosses 9.3.0.0, where CIFS Protocol Acceleration is removed. Boost still TCP-optimizes CIFS/SMB traffic once CIFS Protocol Acceleration is off. Field-observed: left on, that traffic is not optimized at all.","how":"Under Configuration > Templates & Policies > Templates, open the Optimization Policies template and turn off CIFS Protocol Acceleration on every rule that sets it. Save and push before the window. From ECOS 9.3.0.0 CIFS Protocol Acceleration is removed from the software, so turning CIFS Protocol Acceleration off loses nothing. With it off, Boost L4 TCP-optimizes CIFS traffic, as the notes describe.","who":"You - from Orchestrator."},{"id":"cert-ipsec-restore","phase":"post","gate":"certToPsk","action":"Put the \x3cstrong>certificate-based IPSec tunnels\x3c/strong> back on certificates","detail":"Only once every appliance has landed on the target — the incompatibility is between an upgraded appliance and one still behind, so it ends when nothing is left behind.","who":"You - from Orchestrator."},{"id":"stats-migrate","phase":"post","gate":"statsMigrate","action":"Run the \x3cstrong>Stats Collector migration scripts\x3c/strong>","detail":"After the Orchestrator crosses 9.6.0. Hourly, daily and monthly stats carry across only if you do; minute stats do not, and unmigrated stats age out after three months.","how":"The scripts and their order are in the \x3cstrong>Upgrade Orchestrator or Statistics Collector\x3c/strong> guide, listed under Guides below — the notes point there and name no command themselves. The notes say to take the snapshot first (the step above); the scripts are what transfer the older hourly, daily and monthly stats. New minute stats start at once and are available within 24 hours; the older minute stats are not migrated by any script. The notes also offer a support case for the migration.","who":"You - on the Orchestrator."}],"closeout":[{"id":"verify-image-signature-on","when":"verifyImageSig","action":"Turn \x3cstrong>Verify Image Signature\x3c/strong> back on","detail":"Only because the plan turned it off. Once every appliance has landed on its final build, not between hops.","how":"The same place it was turned off: \x3cstrong>Orchestrator > Advanced Security Settings\x3c/strong>. It is Orchestrator-wide, so leaving it off weakens every appliance, not just the upgraded ones."},{"id":"rbac-review","when":"orchUpgraded","action":"Review the \x3cstrong>RBAC roles\x3c/strong> in Orchestrator","detail":"The upgrade does not add new menus to existing roles, so a role that was complete before can be missing screens after. Walk every custom role, not just your own.","how":"\x3cstrong>Orchestrator > Role Based Access Control\x3c/strong>, then \x3cstrong>Manage RBAC Roles\x3c/strong>. Edit each role in turn and work through \x3cstrong>all six tabs\x3c/strong> — Monitor, Configuration, Administration, Orchestrator, Support and Miscellaneous — because a new menu appears only on the tab it belongs to. Tick what is missing, or use \x3cstrong>Select all\x3c/strong>, then \x3cstrong>Save\x3c/strong>. Do not skip a role because of its name: a role called \x3cem>SuperAdmin\x3c/em> can have gaps like any other.","who":"You - Orchestrator administrator"}],"preWindow":[{"side":"ecos","crosses":"9.1.0.0","at":"ECOS 9.1.0.0","what":"EdgeHA through a switch needs an extra VLAN.","detail":"If the EdgeHA link runs through a switch rather than back to back, configure at least one extra VLAN between the EdgeHA components on the switch before the appliances cross. Nothing warns you beforehand."},{"side":"orch","crosses":"9.1.0","at":"Orch 9.1.0","what":"A drop-only hub Internet Breakout policy starts dropping.","detail":"Where a hub internet breakout policy is explicitly configured and its only action is Drop, hub appliances may start dropping internet traffic after the Orchestrator reaches 9.1.0. Give those policies a real action first."},{"side":"ecos","crosses":"9.3.0.0","at":"ECOS 9.3.0.0","what":"Previous CDP configuration is removed.","detail":"Crossing into 9.3 moves discovery to the discoveryd framework and removes the old CDP configuration. CDP and LLDP have to be reconfigured on Orchestrator afterwards, so plan that into the window."},{"side":"ecos","crosses":"9.3.0.0","at":"ECOS 9.3.0.0","what":"Passthrough LAN-to-LAN flows change direction.","detail":"A LAN-to-LAN flow through an interface passthrough tunnel was W2L before 9.3.0.0 and is L2W from it. Adjust the configured routes and their route tags to match; the flag on the intended routes must be FROM LAN or ANY."},{"side":"ecos","crosses":"9.3.0.0","at":"ECOS 9.3.0.0","what":"Non-default segments stop sharing routes without a route map.","detail":"Before 9.3.0.x a non-default segment with no route map mirrored the default segment's redistribution; from it, no map means no routes shared. Check every non-default segment has a map, or create one via Route templates."},{"side":"ecos","crosses":"9.6.0.0","at":"ECOS 9.6.0.0","what":"Manual IKE tunnels behind NAT need explicit IKE_IDs.","detail":"Where NAT sits between the endpoints, a manually created third-party or fabric IKE tunnel with blank IKE_IDs comes up DOWN — there is no wildcard pre-shared-key lookup any more. Orchestrated tunnels set IKE_IDs themselves; check the hand-built ones."},{"side":"ecos","crosses":"9.6.0.0","at":"ECOS 9.6.0.0","what":"Flow-redirection clusters have to be upgraded together.","detail":"For flow redirection to keep working, every EdgeConnect in a cluster has to come up from 9.5.x.x or earlier together. Splitting a cluster across windows breaks redirection until the last member lands."},{"side":"orch","needsMove":true,"toAtLeast":"9.4.2","at":"Any Orchestrator upgrade","what":"Scheduled Reports need internet access during the upgrade.","detail":"Orchestrator fetches libraries for Scheduled Reports while it upgrades. If the firewall blocks it, the upgrade still succeeds and Scheduled Reports fail afterwards. Open the access first."},{"side":"orch","crosses":"9.5.3","at":"Orch 9.5.3","what":"Stale Zscaler location rules are silently removed.","detail":"Zscaler location and sublocation gateway rules that reference stale appliances, network interfaces or firewall zones are removed on upgrade, silently. Review the sublocation rules first."},{"side":"ecos","crosses":"9.4.3.5","fromAtMost":"9.2.2.0","at":"ECOS 9.4.3.5","what":"Long route-map prefix match strings are truncated.","detail":"From 9.4.3.5 a route map's prefix match string is limited to 479 characters, roughly 20 to 25 prefixes. Coming from 9.2.2.0 or earlier, anything longer is silently cut and the route map left incomplete. Shorten the strings first, or afterwards delete the truncated field and add the rule again."},{"side":"ecos","fromPrefix":"8.1.7","needsMove":true,"at":"ECOS 8.1.7.x","what":"Peer priority values of zero must be set before you upgrade.","detail":"Upgrading from 8.1.7.x, the note says peer priority values must not be zero and must be set to appropriate positive integers first — a change to the running configuration before the window, not after."},{"side":"orch","fromAtLeast":"9.5.3","needsMove":true,"at":"Orch 9.5.3+","what":"The image cannot be delivered by URL or HTTP server.","detail":"Defect 34389, open from 9.5.3 through 9.7.1: because of an issue with integrity checks, upgrades cannot be performed by downloading the Orchestrator image from Salesforce and uploading it to an HTTP server, or by using the URL. It changes how you get the image onto the box, not the route."},{"side":"orch","crosses":"9.7.0","at":"Orch 9.7.0","what":"Multicast and full IPSec Suite B are limited on 9.7.","detail":"Multicast cannot be used in Orchestrator 9.7.0 because additional testing is still needed to support segmentation; the limitation will be removed in a future 9.7.x release. IPSec Suite B is not fully supported in 9.7.1. The 9.7.1 note carries both. Neither blocks the upgrade — if either is in use, check the notes for the exact 9.7.x build."}],"risks":[{"id":"anti-replay","risk":"Anti-replay interop gap during the appliance rollout","detail":"An IPSec UDP ESN anti-replay mismatch: ECOS 9.1.2.x-9.1.9.x and 9.2.2.x-9.2.7.x do not interoperate with 9.4.1.0+ mid-rollout, so tunnels drop between appliances that have moved and appliances that have not. Both conditions must be true: an affected build AND tunnel mode IPSec UDP."},{"id":"fips","risk":"FIPS blocks an Orchestrator on 9.4+ from reaching old appliances","detail":"An Orchestrator on 9.4 or later with FIPS on negotiates only FIPS-compliant ciphers, so ECOS 9.3.x or earlier cannot connect. It presents as appliances going unreachable, not as an upgrade failure, and it also stops an RMA appliance phoning home at ZTP."},{"id":"verify-image-signature","risk":"Verify Image Signature blocks the ECOS upgrade","detail":"An Orchestrator-wide setting under Advanced Security Settings that stops an appliance installing a new image — an Orchestrator setting blocking an ECOS upgrade, so it appears in no appliance-side runbook. Every ECOS note says to disable it, and every one exempts appliances upgrading from 8.3.3.0 or later."},{"id":"boot-loop","risk":"Boot loop on upgrade (defect 76032)","detail":"Verify System Files Integrity or FIPS/CC left enabled on ECOS 9.4.0.x through 9.4.2.4, 9.5.0.0 or 9.5.1.0; the defect is fixed in 9.4.2.5. Recovery is serial console only, and the exposure stands on those builds, not only at upgrade time."},{"id":"log-facilities","risk":"Logging template push fails after leaving a build below 9.4","detail":"Field-observed, not in the notes. Below 9.4 an overlap in the Logging template's Log Facilities is ignored; on later 9.4 and 9.5 builds it is rejected and the template push fails, seen only in the audit log. Orchestrator 9.4+ will not save a new overlap but keeps an existing one."},{"id":"brick-floor","risk":"Appliance bricked by a direct jump into 9.6 or 9.7","detail":"From below ECOS 9.4.4.0 or 9.5.2.0 a jump straight to 9.6 or 9.7 bricks the appliance. Scoped to 9.6/9.7 targets only."},{"id":"orch-lead-floor","risk":"Orchestrator 9.7 manages older appliances only through the Cloud Portal","detail":"Below ECOS 9.4.8.0, 9.5.8.0 or 9.6.3.0 on its line an appliance is managed by Orchestrator 9.7 only while the Cloud Portal is reachable (9.7.1 Rev F); below 9.4.0.0 not at all. The plan does not rely on the Portal, so those appliances move BEFORE the Orchestrator does. The lowest appliance in the Fabric decides."},{"id":"one-way-door","risk":"No downgrade once the Orchestrator passes 9.6.0","detail":"There is no way back. This is why the backup comes before any of it."},{"id":"libssl-956","risk":"Orchestrator 9.4.9+ cannot upgrade to 9.5.6","detail":"Use 9.5.7 or later. Matters most on OaaS, where 9.5.6 sits in the same dropdown as every other build."},{"id":"libssl-961","risk":"Orchestrator 9.4.9+ or 9.5.7+ cannot upgrade to 9.6.1","detail":"Use 9.6.2 or later. Same dropdown hazard on OaaS."},{"id":"centos","risk":"Orchestrator still on CentOS","detail":"CentOS 7 went end-of-life 30 June 2024 — no security updates. Rocky Linux is required from 9.4.9+, 9.5.7+ and 9.6.2+, so a CentOS Orchestrator cannot reach those builds."},{"id":"hardware-97","risk":"Some EC-US appliances are not supported on ECOS 9.7 or later","detail":"Part numbers 201106-001, -002, -003 and -004. No sequencing solves this: replace them, or leave them behind on an earlier stream."},{"id":"hardware-ecxs","risk":"Some EC-XS appliances are not supported on ECOS 9.5 or 9.7","detail":"Two lists, and the 9.5 one still applies at 9.7, so a fleet going to 9.7 clears both. Check the number on the appliance, not the model name — plenty of EC-XS are unaffected."},{"id":"radius","risk":"RADIUS authentication can be dropped from ECOS 9.5.4.2","detail":"From ECOS 9.5.4.2 the RADIUS server must send message-authenticator, or the notes warn authentication could be dropped. Every ECOS note from that build carries it, so any plan landing at or above it inherits it."},{"id":"stats-collector","risk":"Stats Collector: database change at Orchestrator 9.6.0","detail":"The Distributed Stats Collector collapses onto a single virtual instance on a new database. Minute stats do not carry across; hourly, daily and monthly stats survive only if you run the migration scripts. The notes say that if you will not migrate, do not upgrade to 9.6.0 or later. Does not arise on OaaS."},{"id":"route-selection","risk":"Route selection changes at 9.6.2 - AS-path length now breaks ties","detail":"Two tests are inserted at 9.6.2, so paths that were load-sharing can collapse onto one, and AS-path prepending done for the underlay starts steering the fabric.\x3cbr>\x3cbr>\x3cstrong>Order from 9.6.2:\x3c/strong>\x3cbr>@LADDER@\x3cbr>\x3cbr>Remove the two marked new and you have today's order. Rung 4 sits above rung 5, which is what defeats VRRP Site/Cluster tracking on an HA pair differentiated by Advertise Metric.","ladder":["Longest prefix","AD (lowest)","Metric (lowest)","VRRP state tracking (new)","Peer Priority (lowest, default 1024)","BGP AS-path length (shortest, new)","ECMP (random)"]},{"id":"cert-ipsec","risk":"Certificate-based IPSec tunnels move to pre-shared keys at 9.7","detail":"Convert them before you get there."},{"id":"aws-ecv","risk":"AWS EC-V on a non-c5 instance type unreachable (VXOA-81239)","detail":"Open in ECOS 9.6.3.0 and listed among the issues fixed in the 9.6.3.1 note, so the hop clears it — 9.6.4.1 carries the fix forward, listing it as first resolved in 9.6.3.1. An unreachable EC-V in AWS is a redeploy — there is no serial console. Only older instance types are exposed; c5 and later were never affected."},{"id":"mschap","risk":"MSCHAP logins to Orchestrator stop working at 9.4.1","detail":"TACACS+ with MSCHAP, and RADIUS with MSCHAP, MSCHAPv2 or EAP-MSCHAPv2, all fail from Orchestrator 9.4.1. Switch them to PAP or CHAP, or to OAUTH or SAML."},{"id":"bgp-peer-ip","risk":"Duplicate BGP peer IPs in a segment, from Orchestrator 9.6.0","detail":"From 9.6.0 a BGP peer cannot use the same IP address on two LAN interfaces in the same segment. Audit your neighbors before the window — the notes say what cannot be created, not what happens to a config that already does it."},{"id":"portal-url","risk":"Cloud portal URL - optional move to portal2.silverpeak.cloud","detail":"Not part of the upgrade and not required: staying on portal.silverpeak.cloud is fine and what most estates do. If you do move, it is one-way and every appliance must be on ECOS 9.5.2.0 or later first."},{"id":"ecos-comms-floor","risk":"ECOS below 8.3.2.0 loses contact with a 9.x Orchestrator","detail":"This fixes the order of the 8.x path: the appliances must reach 8.3.2.0 or later before the Orchestrator crosses into 9.x, or they go unmanageable and cannot be upgraded from Orchestrator at all."},{"id":"branch-nat","risk":"Branch NAT with segmentation starts working at 9.6 on both sides","detail":"A gap being closed, not a defect: with segmentation on, branch NAT rules did not function below 9.6, and it takes 9.6 on the Orchestrator and the appliances. Only an estate already running segmentation with rules configured sees a change. Look under Configuration > Networking > NAT for rules scoped to all appliances."},{"id":"ecv-disk","risk":"EC-V needs 60GB of disk to take 9.7","detail":"Against 30GB for hardware appliances. It bites only an EC-V built from an older 30GB OVF and upgraded in place since — the OVF has shipped 60GB for years. Nothing in Orchestrator shows the disk size, and growing it is hypervisor work to schedule, not discover mid-window."},{"id":"ecv-memory","risk":"EC-V on 4 GB, or with customized System Limits, can reboot continuously","detail":"Two triggers, and the second is invisible: nothing in Orchestrator shows the memory or whether anyone changed the limits. The failure is the appliance not coming back, the same class as the brick floor. Standing guidance in every ECOS note from 9.4.3.5."},{"id":"appliance-signing","risk":"With signature verification on, an upgraded appliance takes only HPE-signed builds","detail":"Every ECOS note from 9.4.3.5 carries it: after an appliance is upgraded with image signature verification enabled, it can only be upgraded to newer releases that are signed using the HPE Aruba Networking certificate. That constrains rollback and the next upgrade, not this one. ECOS 9.6.3.1 moves to dual-signature verification, with the classical fallback described as temporary."},{"id":"orch-95-upgrade-trap","risk":"Orchestrator 9.4.3.40537 / 9.4.4.40053 and later must land on 9.5.2 or higher","detail":"Upgrades from those builds to an earlier 9.5.x may not complete. Matters only if you stop on the 9.5 line and pick the build yourself."},{"id":"ssh-ciphers","risk":"Orchestrator backups to SFTP or SCP can break at 9.4.3 / 9.5.0","detail":"The 9.4 line retired ssh-rsa, ssh-dss and the CBC ciphers for backup uploads at 9.4.3; the 9.5 line and later at 9.5.0. If your backup target offers only those, the backup starts failing quietly; the upgrade itself is unaffected. Does not arise on OaaS."},{"id":"db-passwords","risk":"Each Orchestrator VM gets its own database password at 9.6.0","detail":"Self-hosted only. The install scripts stop using shared built-in credentials, so every VM holds a password file that must not be deleted — keep it with the backup, not on the VM alone."},{"id":"96-ssr","risk":"Coming to rest on the 9.6 line","detail":"9.6 is a Short Supported Release, End of Maintenance 31 DEC 2026. The charts pass through 9.6 rather than resting on it. If you stop here, that date is the horizon, and fixes then arrive only on 9.7."},{"id":"zscaler-gre","risk":"Zscaler integration without GRE fails the Orchestrator upgrade","detail":"Where the Zscaler integration is configured, the notes say the upgrade fails outright if the account does not have GRE enabled. It is a property of the account, checked in the Zscaler portal. Present from Orchestrator 9.4.2 onward."},{"id":"restapi-migrate","risk":"REST API integrations break at Orchestrator 9.3.0","detail":"Orchestrator 9.3.0 changed most APIs for API-based RBAC, and the note says not to upgrade until integrations are modified. The Fabric is unaffected; what breaks is monitoring, reporting and automation wired into Orchestrator."},{"id":"aws-wan-automation","risk":"AWS WAN automation without Network Manager access stalls the upgrade","detail":"Where Orchestrator has an AWS subscription for WAN automation, the note says it may be unable to complete the upgrade to 9.5.x without access to AWS Network Manager, including core network segments — it strands part-way rather than refusing to start. Nothing to do with EC-V instance types."},{"id":"aws-imds","risk":"EC-V in AWS needs IMDSv1 left enabled","detail":"Every ECOS note says EC-V appliances deployed in AWS do not support Instance Metadata Service Version 2, and that customers should ensure IMDSv1 remains enabled to allow SSH access and proper appliance initialization. No upgrade introduces it, but an appliance reboots into it — an account since tightened to IMDSv2-only finds out during your window."},{"id":"cifs-accel","risk":"CIFS/SMB loses optimization at 9.3.0.0 if CIFS Protocol Acceleration is left on","detail":"ECOS 9.3.0.0 removed CIFS Protocol Acceleration from the software; the notes say CIFS traffic can still be L4 TCP-optimized with Boost. Field-observed on 9.3 and 9.4: that needs CIFS Protocol Acceleration turned off in the Optimization Policies template. Left on, the traffic is not optimized at all."},{"id":"ec10150-94","risk":"EC-10150 cannot run the 9.4 line","detail":"HPE's Hardware/ECOS Compatibility Matrix lists part 3510332 as not supported on 9.4, 9.3 or 9.2; its earliest build is 9.5.3.0 and it ships on 9.5.3.2. On a 9.7 route it cuts the other way: these appliances sit on the 9.5 line, so the 9.5.8.0 floor an Orchestrator on 9.7 needs applies, and a box still on its shipping build is below it."},{"id":"mixed-lines","risk":"Appliances on more than one release line","detail":"The Orchestrator 9.7 floors are per release line — 9.4.8.0, 9.5.8.0, 9.6.3.0 — so the lowest build in the Fabric is not the lowest risk: a handful below their floor on another line are left managed only through the Cloud Portal when the Orchestrator crosses. Tick the mixed-line box and give the lowest build on each line."},{"id":"newer-patch","risk":"Land on the newest build in the line you stop at","detail":"Not a defect and not a step. The + on the target means any later build on that line satisfies it with no extra hop. Staying put is legitimate if you are stable and nothing the newer builds fix describes your deployment — but make it a decision."}],"guides":[{"id":"orch-upgrade","name":"Upgrade Orchestrator or Statistics Collector","url":"https://arubanetworking.hpe.com/techdocs/sdwan/docs/orch-install-upgrade/upgrade-orch-or-stats-coll/","where":"Every Orchestrator hop in the plan"},{"id":"centos-rocky","name":"Migrate Orchestrator from CentOS to Rocky Linux","url":"https://arubanetworking.hpe.com/techdocs/sdwan/docs/orch-install-upgrade/migrate-centos-rockylinux/","where":"The Rocky migration only"},{"id":"release-notes","name":"Orchestrator and ECOS release notes","url":"https://arubanetworking.hpe.com/techdocs/sdwan/release-notes/","where":"Confirming the exact build before each hop"},{"id":"whats-new","name":"What is new in Orchestrator","url":"https://arubanetworking.hpe.com/techdocs/sdwan/docs/orch/new/","where":"Before crossing a minor line, especially 9.6"},{"id":"route-selection","name":"Edge Connect route selection - the 9.6.2 order","url":"https://developer.arubanetworks.com/edgeconnect/v0.0.0/docs/peer-priority-routing-options#edge-connect-route-selection","where":"The 9.6 route-selection change - both orders side by side"},{"id":"before-window","name":"Before Outage window checklist","url":"https://developer.arubanetworks.com/edgeconnect/v0.0.0/docs/before-outage-window-checklist","where":"Capturing the before state - routes, BGP, flows, tunnels, reachability"},{"id":"post-window","name":"Post maintenance Window Checklist","url":"https://developer.arubanetworks.com/edgeconnect/v0.0.0/docs/post-maintenance-window-checklist","where":"Comparing against that before state once the window closes"}],"changeLog":[{"date":"15 OCT 2026","ref":"ECOS 9.6.4.1 Rev A","what":"Appliances now land on 9.6.4.1, the newest 9.6 build, whether passing through to 9.7 or holding at 9.6. It needs the Orchestrator on 9.6.4 or later, or 9.7.1 or later, before it can be pushed."},{"date":"07 OCT 2026","ref":"Orchestrator 9.7.1 Rev F","what":"An appliance on 9.4.0.0 or later that sits below its band is still managed, as long as it can reach the Cloud Portal. The bands themselves have not moved."},{"date":"23 SEP 2026","ref":"ECOS 9.5.9.0 and 9.6.4.0 Rev D","what":"An appliance landing on the 9.4.9 or 9.5.9 line needs its Orchestrator on 9.4.11, 9.5.9, 9.6.4 or 9.7.1 first. The Orchestrator now moves ahead of the appliances."},{"date":"23 SEP 2026","ref":"Orchestrator 9.6.4 Rev D","what":"Plans land appliances on 9.4.9.0 or 9.5.9.0, the builds carrying the stats-upload fix, rather than stopping at the published minimum."},{"date":"15 SEP 2026","ref":"HPE techdocs, CentOS to Rocky Linux","what":"An Orchestrator already on 9.4.x and still on CentOS migrates to Rocky Linux at the build it is on now, before any further upgrade."},{"date":"14 SEP 2026","ref":"ECOS 9.7.0.0 Rev H","what":"Appliances pass through 9.6.4.0 on the way to 9.7. 9.6.3.1 remains the lowest build that will take the 9.7 image."},{"date":"14 SEP 2026","ref":"HPE engineering, 11 SEP 2026","what":"End of Maintenance for the 9.6 stream moved out to 31 DEC 2026."}],"beforeYouStart":[{"lead":"Reload the page before you plan.","rest":"Guidance moves as release notes publish. The build stamp and date are in the footer, and the change history beside it says what moved."},{"lead":"Give exact builds, not release lines.","rest":"One patch digit changes the plan - 9.4.8 and 9.4.9 route differently. Read the Orchestrator's own version, and the lowest appliance version, from the Orchestrator."},{"lead":"Answer both ends.","rest":"The Orchestrator and the appliances are planned together. Several steps exist only because of what the other side is running."},{"lead":"Say how the Orchestrator is hosted.","rest":"Self-hosted on CentOS, self-hosted on Rocky Linux, or Cloud/OaaS. CentOS adds a migration ahead of everything else; OaaS removes the VM steps entirely."},{"lead":"Tick everything true of the Fabric, and name every release line you have.","rest":"Anything left unticked is reported as a check rather than ruled out, and a line you do not name does not get its own route."},{"lead":"Every step cites the release note that requires it.","rest":"Follow the link when a change board asks why a hop is in the plan."}]}; var KNOWN_ECOS = ["7.3.0.0","7.3.1.0","7.3.2.0","7.3.3.0","7.3.4.0","7.3.5.0","7.3.6.0","7.3.7.0","7.3.8.0","7.3.9.0","8.0.0.0","8.0.1.0","8.0.10.0","8.0.2.0","8.0.3.0","8.0.4.0","8.0.5.0","8.0.6.0","8.0.7.0","8.0.8.0","8.0.9.0","8.1.4.0","8.1.4.1","8.1.4.10","8.1.4.11","8.1.4.12","8.1.4.13","8.1.4.14","8.1.4.15","8.1.4.16","8.1.4.2","8.1.4.3","8.1.4.5","8.1.4.6","8.1.4.7","8.1.4.8","8.1.4.9","8.1.5.0","8.1.5.1","8.1.5.10","8.1.5.11","8.1.5.12","8.1.5.13","8.1.5.14","8.1.5.15","8.1.5.16","8.1.5.17","8.1.5.18","8.1.5.2","8.1.5.3","8.1.5.4","8.1.5.5","8.1.5.6","8.1.5.7","8.1.5.8","8.1.5.9","8.1.7.0","8.1.7.1","8.1.7.10","8.1.7.11","8.1.7.12","8.1.7.13","8.1.7.14","8.1.7.15","8.1.7.16","8.1.7.17","8.1.7.18","8.1.7.19","8.1.7.2","8.1.7.20","8.1.7.21","8.1.7.22","8.1.7.3","8.1.7.4","8.1.7.5","8.1.7.6","8.1.7.7","8.1.7.8","8.1.7.9","8.1.9.0","8.1.9.1","8.1.9.10","8.1.9.11","8.1.9.12","8.1.9.13","8.1.9.14","8.1.9.15","8.1.9.16","8.1.9.17","8.1.9.18","8.1.9.19","8.1.9.2","8.1.9.20","8.1.9.21","8.1.9.3","8.1.9.4","8.1.9.5","8.1.9.6","8.1.9.7","8.1.9.8","8.1.9.9","8.2.0.0","8.2.1.0","8.3.0.0","8.3.0.10","8.3.0.11","8.3.0.12","8.3.0.13","8.3.0.14","8.3.0.15","8.3.0.16","8.3.0.17","8.3.0.18","8.3.0.19","8.3.0.2","8.3.0.20","8.3.0.3","8.3.0.4","8.3.0.5","8.3.0.6","8.3.0.7","8.3.0.8","8.3.0.9","8.3.1.0","8.3.1.1","8.3.1.2","8.3.1.3","8.3.1.4","8.3.1.5","8.3.1.6","8.3.2.0","8.3.2.1","8.3.2.2","8.3.2.3","8.3.2.4","8.3.3.0","8.3.3.1","8.3.3.2","8.3.3.3","8.3.3.4","8.3.3.5","8.3.3.6","8.3.4.0","8.3.4.1","8.3.4.2","8.3.4.3","8.3.5.0","8.3.6.0","8.3.6.1","8.3.6.2","8.3.7.0","8.3.7.1","8.3.8.0","9.0.0.0","9.0.1.0","9.0.1.1","9.0.2.0","9.0.2.1","9.0.2.2","9.0.2.3","9.0.2.4","9.0.2.5","9.0.2.6","9.0.3.0","9.0.3.1","9.0.3.2","9.0.3.3","9.0.3.4","9.0.4.0","9.0.5.0","9.0.5.1","9.0.5.2","9.0.5.3","9.0.6.0","9.0.6.1","9.0.6.2","9.0.6.3","9.0.7.0","9.0.8.0","9.0.9.0","9.1.0.0","9.1.0.1","9.1.0.2","9.1.0.3","9.1.1.0","9.1.1.1","9.1.1.2","9.1.1.3","9.1.1.4","9.1.10.0","9.1.10.1","9.1.11.0","9.1.11.1","9.1.12.0","9.1.12.1","9.1.2.0","9.1.3.0","9.1.4.0","9.1.4.1","9.1.4.2","9.1.4.3","9.1.4.4","9.1.5.0","9.1.6.0","9.1.6.1","9.1.6.2","9.1.7.0","9.1.8.0","9.1.8.1","9.1.9.0","9.2.0.0","9.2.1.0","9.2.10.0","9.2.10.1","9.2.10.2","9.2.10.3","9.2.10.4","9.2.10.5","9.2.11.0","9.2.11.1","9.2.11.2","9.2.11.3","9.2.11.4","9.2.2.0","9.2.3.0","9.2.4.0","9.2.5.0","9.2.5.1","9.2.6.0","9.2.7.0","9.2.8.0","9.2.9.0","9.2.9.1","9.2.9.2","9.2.9.3","9.3.0.0","9.3.1.0","9.3.2.0","9.3.2.1","9.3.2.2","9.3.2.3","9.3.3.0","9.3.3.1","9.3.3.2","9.3.4.0","9.3.4.1","9.3.5.0","9.3.6.0","9.3.7.0","9.3.8.0","9.3.8.1","9.4.0.0","9.4.1.0","9.4.2.0","9.4.2.1","9.4.2.2","9.4.2.3","9.4.2.4","9.4.2.5","9.4.2.6","9.4.3.0","9.4.3.1","9.4.3.2","9.4.3.3","9.4.3.4","9.4.3.40488","9.4.3.40537","9.4.3.5","9.4.3.6","9.4.3.7","9.4.3.8","9.4.3.9","9.4.4.0","9.4.4.1","9.4.4.2","9.4.4.3","9.4.4.40053","9.4.5.0","9.4.5.1","9.4.5.2","9.4.6.0","9.4.6.1","9.4.6.2","9.4.6.3","9.4.7.0","9.4.7.1","9.4.7.2","9.4.8.0","9.4.8.1","9.4.8.2","9.4.9.0","9.4.9.1","9.5.0.0","9.5.1.0","9.5.1.1","9.5.2.0","9.5.2.1","9.5.3.0","9.5.3.1","9.5.3.2","9.5.3.3","9.5.3.4","9.5.3.5","9.5.3.6","9.5.3.7","9.5.3.8","9.5.4.0","9.5.4.1","9.5.4.2","9.5.5.0","9.5.5.1","9.5.5.2","9.5.6.0","9.5.6.1","9.5.6.2","9.5.6.3","9.5.6.4","9.5.6.5","9.5.6.6","9.5.7.0","9.5.7.1","9.5.8.0","9.5.8.1","9.5.9.0","9.5.9.1","9.6.0.0","9.6.1.0","9.6.2.0","9.6.2.1","9.6.3.0","9.6.3.1","9.6.4.0","9.6.4.1","9.7.0.0","9.7.1.0"]; var KNOWN_ECOS_MAX = null; KNOWN_ECOS.forEach(function(v){ if(!parseV(v)) return; if(!KNOWN_ECOS_MAX || cmp(parseV(v), parseV(KNOWN_ECOS_MAX)) > 0) KNOWN_ECOS_MAX = v; }); var KNOWN_ORCH_MAX = null; (function(){ var c = RULES.constants, names = RULES.targets.map(function(t){ return t.orch; }); (c.ecosNeedsOrchByBuild || []).forEach(function(b){ names.push(b[1]); }); Object.keys(c.ecosNeedsOrchCrossStream || {}).forEach(function(k){ var m = c.ecosNeedsOrchCrossStream[k]; Object.keys(m).forEach(function(L){ names.push(m[L]); }); }); [c.orchStagingByLine, c.ecosNeedsOrchByLine].forEach(function(m){ Object.keys(m || {}).forEach(function(L){ names.push(m[L]); }); }); names.forEach(function(v){ if(!parseV(v)) return; if(!KNOWN_ORCH_MAX || cmp(parseV(v), parseV(KNOWN_ORCH_MAX)) > 0) KNOWN_ORCH_MAX = v; }); })(); function orchAboveKnown(v){ var p = parseV(v), k = parseV(KNOWN_ORCH_MAX); if(!p || !k) return false; return cmp([p[0], p[1], p[2], 0], [k[0], k[1], k[2], 0]) > 0; } function parseV(s){ if(!s) return null; s = String(s).trim(); if(!/^\d+(\.\d+){1,3}$/.test(s)) return null; var p = s.split('.').map(Number); while(p.length < 4) p.push(0); return p; } function cmp(a,b){ for(var i=0;i<4;i++){ if(a[i]!==b[i]) return a[i]=0; } function lt(v,f){ var a=parseV(v), b=parseV(f); return a&&b&&cmp(a,b)<0; } function eq(v,f){ var a=parseV(v), b=parseV(f); return !!a && !!b && cmp(a,b)===0; } function anyEq(v,list){ return list.filter(function(x){ return eq(v,x); }).length > 0; } function line(v){ var p=parseV(v); return p ? p[0]+'.'+p[1] : ''; } function floorFor(map, ln){ if(map[ln]) return map[ln]; var keys = Object.keys(map); if(!keys.length) return null; var lowest = null, highest = null; keys.forEach(function(k){ var v = map[k]; if(!lowest || lt(v, lowest)) lowest = v; if(!highest || ge(v, highest)) highest = v; }); if(lt(ln + '.0', lowest)) return lowest; return null; } function recommendedFor(ln){ var hit = RULES.targets.filter(function(t){ return t.id === ln; })[0]; return hit ? hit.ecos : null; } function landingFor(floor){ var rec = recommendedFor(line(floor)); if(!rec){ var entry = RULES.level1.entryEcos; return (entry && ge(entry, floor)) ? entry : floor; } return (rec && ge(rec, floor)) ? rec : floor; } function needOrchFor(build){ var c = RULES.constants, bands = c.ecosNeedsOrchByBuild || []; for (var i = 0; i < bands.length; i++) { if (!lt(build, bands[i][0])) return bands[i][1]; } return c.ecosNeedsOrchByLine[line(build)] || null; } function crossStreamMapFor(build){ var all = RULES.constants.ecosNeedsOrchCrossStream || {}, L = line(build), best = null; Object.keys(all).forEach(function(k){ if(line(k) !== L || lt(build, k)) return; if(!best || lt(best, k)) best = k; }); return best ? all[best] : null; } function crossStreamNeedFor(build, orchAt){ var m = crossStreamMapFor(build); if(!m) return null; var floor = floorFor(m, line(orchAt)); return { ok: !floor || ge(orchAt, floor), floor: floor, map: m }; } function crossStreamWording(m){ var parts = Object.keys(m) .sort(function(a,b){ return cmp(parseV(a + '.0'), parseV(b + '.0')); }) .map(function(L){ return m[L] + ' or later'; }); if(parts.length < 3) return parts.join(' or '); return parts.slice(0, -1).join(', ') + ', or ' + parts[parts.length - 1]; } function pushGate(to, orchAt){ var need = needOrchFor(to); var cs = crossStreamNeedFor(to, orchAt); var ok = (!need || ge(orchAt, need)) && (!cs || cs.ok); var wording = cs ? crossStreamWording(cs.map) : (need ? need + ' or later' : ''); return { ok: ok, need: need, cs: cs, wording: wording }; } function normV(v){ var s = stripBuildSuffix(v); if(!/^\d+(\.\d+){1,3}$/.test(s)) return s; return s.split('.').map(function(p){ return String(Number(p)); }).join('.'); } function sshCiphersFloor(v){ var m = RULES.constants.sshCiphersFrom, own = m[line(v)]; if(own) return own; var top = null; Object.keys(m).forEach(function(k){ if(!top || ge(m[k], top)) top = m[k]; }); return (top && ge(v, top)) ? top : null; } function sshCiphersRetired(v){ var f = sshCiphersFloor(v); return !!f && ge(v, f); } function rockyFirstBuild(){ var m = RULES.constants.rockyCapableFrom, lowest = null; Object.keys(m).forEach(function(k){ if(!lowest || lt(m[k], lowest)) lowest = m[k]; }); return lowest; } function bootLoopBandText(){ var c = RULES.constants, p = parseV(c.bootLoopFixed94); var last = p ? (p[0] + '.' + p[1] + '.' + p[2] + '.' + (p[3] - 1)) : ''; return '9.' + (p ? p[1] : 4) + '.0.x to ' + last + (c.bootLoopExtra && c.bootLoopExtra.length ? ', ' + c.bootLoopExtra.slice(0, -1).join(', ') + (c.bootLoopExtra.length > 1 ? ' and ' : '') + c.bootLoopExtra[c.bootLoopExtra.length - 1] : ''); } function bootLoopStateNote(s){ if(!s.bootLoop) return ''; if(s.bootLoopBuilds.indexOf(s.ecos) !== -1) return 'In the boot-loop band'; var declared = s.bootLoopBuilds.filter(function(b){ return b !== s.ecos; }); return 'Not in the boot-loop band itself - the declared ' + declared.join(' and ') + (declared.length > 1 ? ' are' : ' is'); } function unmanagedWarning(s){ var c = RULES.constants; var bands = Object.keys(c.orchLeadFloors) .map(function(k){ return c.orchLeadFloors[k] + '+'; }).join(', ') + ' or 9.7.0.0+'; var nameOf = function(list){ return list.map(function(u){ return 'ECOS ' + u.build + ' on the ' + u.line + ' line' + (u.floor ? ' (below its floor ' + u.floor + ')' : ' (that line is not in the bands at all)'); }).join(', and '); }; var hard = s.unmanagedNow.filter(function(u){ return lt(u.build, c.orch97HardFloor); }); var portal = s.unmanagedNow.filter(function(u){ return !lt(u.build, c.orch97HardFloor); }); var portalCheck = portal.length ? (hard.length ? ', and that the Cloud Portal connection is up on the ones above the floor' : ' and that its Cloud Portal connection is up') : ''; var partial = s.unmanagedNow.length < Object.keys(s.lineLowest).length; return { head: (partial ? 'Some of these appliances are' : 'These appliances are') + (hard.length ? (portal.length ? ' outside what this Orchestrator manages, or managed only while the Cloud Portal is reachable' : ' outside what this Orchestrator manages') : ' managed only while the Cloud Portal is reachable') + ' — read this before scheduling.', body: 'The Orchestrator is on ' + s.orch + ', and from 9.7.0 its release notes set the floor at ECOS ' + c.orch97HardFloor + ': ' + '“' + c.orch97CannotManageSentence + '” ' + 'They add a condition above that floor: “' + c.orch97CloudPortalSentence + '” ' + (hard.length ? nameOf(hard) + (hard.length > 1 ? ' are' : ' is') + ' below the floor itself, so the note puts ' + (hard.length > 1 ? 'them' : 'it') + ' outside what this Orchestrator manages. ' : '') + (portal.length ? nameOf(portal) + (portal.length > 1 ? ' are' : ' is') + ' above the floor but below ' + bands + ', so HPE says ' + (portal.length > 1 ? 'they need' : 'it needs') + ' Cloud Portal connectivity for this Orchestrator to manage ' + (portal.length > 1 ? 'them' : 'it') + '. ' : '') + 'The first appliance hop below is a push to appliances in ' + (hard.length && portal.length ? 'one of those states' : 'that state') + ' now. ' + 'Before scheduling it, confirm each of those appliances still shows reachable in Orchestrator' + portalCheck + '; any that does not is a support case, not a step. ' + 'Raise the state with HPE support in parallel either way, and treat that first hop as the way back inside the bands — it is not a place to stay. ' + 'The Orchestrator cannot be taken back down: that crossing is one-way past ' + c.oneWayDoor + '. ' + 'And re-check the version boxes first, because a typo is the likelier explanation.' }; } function bootLoopExactBuildAsk(s){ if(!s.bootLoop) return ''; var fixed = parseV(RULES.constants.bootLoopFixed94); if(!fixed) return ''; var maint = fixed[0] + '.' + fixed[1] + '.' + fixed[2]; var hit = s.bootLoopBuilds.filter(function(b){ return b === maint; }); return hit.length ? hit[0] : ''; } function stripBuildSuffix(v){ return String(v == null ? '' : v).trim().replace(/_\d+\s*$/, ''); } function typedShapeOk(v){ return /^\d+\.\d+\.\d+(\.\d+)?$/.test(stripBuildSuffix(v)); } function readForm(){ var s = { orch: normV(document.getElementById('upp-orch').value), ecos: normV(document.getElementById('upp-ecos').value), host: document.getElementById('upp-host').value, tunnel: document.getElementById('upp-tunnel').value, tOrch: document.getElementById('upp-target-orch').value, tEcos: document.getElementById('upp-target-ecos').value, f: { fips: document.getElementById('upp-f-fips').checked, radius: document.getElementById('upp-f-radius').checked, stats: document.getElementById('upp-f-stats').checked, cert: document.getElementById('upp-f-cert').checked, aws: document.getElementById('upp-f-aws').checked, ecvmem: document.getElementById('upp-f-ecvmem').checked, ecus: document.getElementById('upp-f-ecus').checked, ecxs: document.getElementById('upp-f-ecxs').checked, ec10150: document.getElementById('upp-f-ec10150').checked, boost: document.getElementById('upp-f-boost').checked, zscaler: document.getElementById('upp-f-zscaler').checked, restapi: document.getElementById('upp-f-restapi').checked, awswan: document.getElementById('upp-f-awswan').checked }, signoff: document.getElementById('upp-f-signoff').checked }; s.mixed = document.getElementById('upp-f-mixed').checked; s.mixedLines = {}; s.mixedAll = []; s.mixedBad = []; if(s.mixed){ document.getElementById('upp-m-list').value.split(/[\s,;\/]+/).forEach(function(raw){ var v = raw.trim(); if(!v) return; if(!typedShapeOk(v)){ s.mixedBad.push(v); return; } v = normV(v); var ln = line(v); if(!s.mixedLines[ln] || lt(v, s.mixedLines[ln])) s.mixedLines[ln] = v; if(!s.mixedAll.some(function(x){ return eq(x, v); })) s.mixedAll.push(v); }); s.mixedAll.sort(function(a, b){ return cmp(parseV(a), parseV(b)); }); } s.mixedEmpty = s.mixed && Object.keys(s.mixedLines).length === 0; s.oaas = s.host === 'oaas'; s.f.udp = s.tunnel === 'udp' || s.tunnel === 'unsure'; s.tunnelSure = s.tunnel !== 'unsure'; s.centos = s.host === 'centos'; s.selfHosted = !s.oaas; s.orchLine = line(s.orch); s.ecosLine = line(s.ecos); var tOrchDef = RULES.targets.filter(function(t){ return t.id === s.tOrch; })[0]; var tEcosDef = RULES.targets.filter(function(t){ return t.id === s.tEcos; })[0]; s.tgtOrchDef = tOrchDef; s.tgtEcosDef = tEcosDef; s.target = (tOrchDef && tEcosDef) ? (cmp(parseV(s.tOrch + '.0'), parseV(s.tEcos + '.0')) >= 0 ? s.tOrch : s.tEcos) : (s.tOrch || s.tEcos); s.split = s.tOrch !== s.tEcos; s.tgt = { orch: tOrchDef ? tOrchDef.orch : '', ecos: tEcosDef ? tEcosDef.ecos : '', label: (tOrchDef && tEcosDef) ? (s.split ? tOrchDef.label + ' / EdgeConnect ' + s.tEcos : tOrchDef.label) : '' }; var c = RULES.constants, pe = parseV(s.ecos); s.allBuilds = [s.ecos]; (s.mixedAll || []).forEach(function(b){ if(!s.allBuilds.some(function(x){ return eq(x, b); })) s.allBuilds.push(b); }); function inBootLoopBand(v){ var p = parseV(v); if(!p) return false; return (line(v) === '9.4' && (p[2] < c.bootLoopLine94MaxPatch || (p[2] === c.bootLoopLine94MaxPatch && lt(v, c.bootLoopFixed94)))) || anyEq(v, c.bootLoopExtra); } s.bootLoopBuilds = s.allBuilds.filter(inBootLoopBand); s.bootLoop = s.bootLoopBuilds.length > 0; var brickFloor = floorFor(c.brickFloors, s.ecosLine); s.brickTarget = s.tEcos === '9.7' || s.tEcos === '9.6'; s.brick = s.brickTarget && !!brickFloor && lt(s.ecos, brickFloor); s.brickFloor = brickFloor; var leadFloor = c.orchLeadFloors[s.ecosLine] || null; s.orchLead = s.tOrch === '9.7' && !!leadFloor && lt(s.ecos, leadFloor); s.leadFloor = leadFloor; s.orchDone = ge(s.orch, s.tgt.orch); s.ecosDone = ge(s.ecos, s.tgt.ecos); s.orchAhead = cmp(parseV(s.orchLine), parseV(s.tOrch)) > 0; var highestBuild = s.ecos; Object.keys(s.mixedLines).forEach(function(ln){ if(lt(highestBuild, s.mixedLines[ln])) highestBuild = s.mixedLines[ln]; }); s.ecosHighest = highestBuild; var needNow = needOrchFor(highestBuild); if (needNow && lt(highestBuild, '9.0.0.0')) needNow = null; s.orchBehind = !!needNow && lt(s.orch, needNow); s.orchBehindNeeds = needNow; s.orchBehindBuild = highestBuild; s.rockyImpossible = false; s.rockyNoImage = false; s.rockyNeeds = null; if (!s.oaas && !s.centos) { if (lt(s.orch, rockyFirstBuild())) { s.rockyImpossible = true; } else { var rf = c.rockyCapableFrom[line(s.orch)]; if (rf && lt(s.orch, rf)) { s.rockyNoImage = true; s.rockyNeeds = rf; } } } function buildUnknown(v){ return /^\d+\.\d+\.\d+\.\d+$/.test(v) && KNOWN_ECOS.length > 0 && KNOWN_ECOS.indexOf(v) === -1; } s.ecosUnknownList = []; s.ecosNewerList = []; function noteUnknown(v){ if(!buildUnknown(v)) return; var bucket = (KNOWN_ECOS_MAX && parseV(v) && cmp(parseV(v), parseV(KNOWN_ECOS_MAX)) > 0) ? s.ecosNewerList : s.ecosUnknownList; if(bucket.indexOf(v) === -1) bucket.push(v); } noteUnknown(s.ecos); (s.mixedAll || []).forEach(function(b){ noteUnknown(b); }); s.ecosUnknown = s.ecosUnknownList.length > 0; s.ecosNewer = s.ecosNewerList.length > 0; s.mixedBelow = []; s.lineLowest = {}; Object.keys(s.mixedLines).forEach(function(ln){ s.lineLowest[ln] = s.mixedLines[ln]; }); if(!s.lineLowest[s.ecosLine] || lt(s.ecos, s.lineLowest[s.ecosLine])) s.lineLowest[s.ecosLine] = s.ecos; s.orchAt97 = ge(s.orch, '9.7.0'); s.unmanagedNow = []; if(s.orchAt97){ Object.keys(s.lineLowest).forEach(function(ln){ var b = s.lineLowest[ln]; var mf = c.orchLeadFloors[ln]; var ok = ln === '9.7' || (!!mf && ge(b, mf)); if(!ok) s.unmanagedNow.push({ line: ln, build: b, floor: mf || null }); }); s.unmanagedNow.sort(function(a, b){ return a.line < b.line ? -1 : 1; }); } s.mixedUnderMain = []; Object.keys(s.mixedLines).forEach(function(ln){ if(lt(s.mixedLines[ln], s.ecos)) s.mixedUnderMain.push(s.mixedLines[ln]); }); s.mixedUnderMain.sort(function(a, b){ return cmp(parseV(a), parseV(b)); }); function leadFloorFor(ln){ return floorFor(c.orchLeadFloors, ln); } if(s.tOrch === '9.7' || s.orchAt97){ Object.keys(s.lineLowest).forEach(function(ln){ var b = s.lineLowest[ln]; var floor = leadFloorFor(ln); if(!floor || !lt(b, floor)) return; s.mixedBelow.push({ line: ln, build: b, floor: floor, main: ln === s.ecosLine && eq(b, s.ecos) }); }); s.mixedBelow.sort(function(a,b){ return a.line < b.line ? -1 : 1; }); } s.brickLines = []; if(s.brickTarget){ Object.keys(s.lineLowest).forEach(function(ln){ var floor = floorFor(c.brickFloors, ln), b = s.lineLowest[ln]; if(floor && lt(b, floor)){ var exposed = s.allBuilds.filter(function(x){ return line(x) === ln && lt(x, floor); }) .sort(function(p, q){ return cmp(parseV(p), parseV(q)); }); s.brickLines.push({ line: ln, build: b, builds: exposed, floor: floor, main: ln === s.ecosLine && lt(s.ecos, floor) }); } }); s.brickLines.sort(function(a,b){ return a.line < b.line ? -1 : 1; }); } var L = RULES.level1; s.ecos8 = s.ecos.charAt(0) === '8'; s.orch8 = s.orch.charAt(0) === '8'; s.any8 = s.allBuilds.some(function(b){ var p = parseV(b); return !!p && p[0] < 9; }); s.belowCommsFloor = s.allBuilds.filter(function(b){ return lt(b, c.ecosCommsFloor); }) .sort(function(a, b){ return cmp(parseV(a), parseV(b)); }); s.level1 = lt(s.orch, L.belowLine) || lt(s.ecos, L.belowLine); s.staging = L.staging.byLine[s.orchLine] || L.staging['default']; s.stagingIsDefault = !L.staging.byLine[s.orchLine]; s.stagingExact = (L.staging.exact || []).indexOf(s.orchLine) !== -1; s.antiReplay = classifyAntiReplay(s); s.antiReplayIfUdp = classifyAntiReplay(s, true); return s; } function classifyOneAntiReplay(s, ecos, forceUdp){ var a = RULES.level1.antiReplay; if(!forceUdp && !s.f.udp) return 'safe'; var ln = line(ecos), hit = null; a.affected.forEach(function(r){ if(ln === r.line && ge(ecos, r.from) && lt(ecos, r.below)) hit = r; }); if(hit) return 'applies'; if(ge(ecos, a.safeAbove)) return 'safe'; var floor = a.safeFloors[ln]; if(floor && ge(ecos, floor)) return 'safe'; return 'unknown'; } function classifyAntiReplay(s, forceUdp){ if(s.ecos8 && (s.allBuilds || []).length < 2) return 'na'; var worst = 'safe'; (s.allBuilds || [s.ecos]).forEach(function(b){ if(parseV(b) && parseV(b)[0] < 9) return; var v = classifyOneAntiReplay(s, b, forceUdp); if(v === 'applies') worst = 'applies'; else if(v === 'unknown' && worst !== 'applies') worst = 'unknown'; }); if(worst === 'safe' && s.ecos8) return 'na'; return worst; } function antiReplayNames(s, want){ want = want || 'applies'; var hits = (s.allBuilds || [s.ecos]).filter(function(b){ return parseV(b) && parseV(b)[0] >= 9 && classifyOneAntiReplay(s, b) === want; }); if(!hits.length) hits = [s.ecos]; return hits.join(' and ') + (hits.length > 1 ? ' are' : ' is'); } function whoOrch(s, from){ if(!s.oaas) return 'You — on the Orchestrator server.'; return lt(from, RULES.constants.oaasSelfServiceFrom) ? 'HPE — raise a support case. Below Orchestrator ' + RULES.constants.oaasSelfServiceFrom + ' an OaaS upgrade is not self-service.' : 'You — pick the version in the Orchestrator UI. No HPE ticket.'; } var WHO_EC = 'You — from Orchestrator.'; function buildPlan(s){ var c = RULES.constants; var orchNow = s.orch, ecosNow = s.ecos; var lineNow = {}; Object.keys(s.lineLowest || {}).forEach(function(L){ lineNow[L] = s.lineLowest[L]; }); var groupNow = {}; (s.allBuilds || [s.ecos]).forEach(function(b){ groupNow[b] = b; }); function groupsBelow(to, onLine){ var out = []; Object.keys(groupNow).forEach(function(b){ if(onLine && line(b) !== onLine) return; if(lt(groupNow[b], to) && !out.some(function(x){ return eq(x, groupNow[b]); })) out.push(groupNow[b]); }); out.sort(function(a, b){ return cmp(parseV(a), parseV(b)); }); return out; } function advanceGroups(to, onLine, onlyThese){ Object.keys(groupNow).forEach(function(b){ if(onLine && line(b) !== onLine) return; if(onlyThese && !onlyThese.some(function(x){ return eq(x, groupNow[b]); })) return; if(lt(groupNow[b], to)) groupNow[b] = to; }); } var hops = [], note = null, orchMoved = false, ecosMoved = false; var stagedForRocky = false, stagedForLead = false, stagedForGroup = null; var blocked = []; var entryOrchUsed = null; function pushCheck(to){ var g = pushGate(to, orchNow); if(g.ok) return ''; blocked.push({ to: to, orch: orchNow, wording: g.wording }); return ' \x3cstrong>This step cannot be pushed from the Orchestrator on ' + orchNow + '\x3c/strong> — ECOS ' + to + ' requires Orchestrator ' + g.wording + '. Do not schedule this plan as it stands.'; } function orchHop(to, plus, action, hint){ if(ge(orchNow, to)) return false; hops.push({ a: action + '\x3cdiv class="hint">' + hint + '\x3c/div>', m: orchNow + ' → ' + to + (plus ? '+' : ''), w: whoOrch(s, orchNow) }); orchNow = to; orchMoved = true; return true; } function stageToPush(landTo){ var g = pushGate(landTo, orchNow); if(g.ok) return null; var own = g.cs ? floorFor(g.cs.map, line(orchNow)) : g.need; if(own && lt(orchNow, own) && lt(own, s.tgt.orch) && (ge(orchNow, c.oneWayDoor) || lt(own, c.oneWayDoor)) && pushGate(landTo, own).ok){ return { to: own, wording: g.wording, pastDoor: false, ownLine: line(own) === line(orchNow) }; } if(ge(orchNow, '9.7.0') && lt(orchNow, s.tgt.orch) && pushGate(landTo, s.tgt.orch).ok){ return { to: s.tgt.orch, wording: g.wording, pastDoor: true, ownLine: true }; } var fb = c.orchStagingByLine[line(landTo)]; if(fb && lt(orchNow, fb)) return { to: fb, wording: g.wording, pastDoor: false, ownLine: line(fb) === line(orchNow), fallback: true }; return null; } function doorClause(){ return ge(orchNow, c.oneWayDoor) ? 'Already past ' + c.oneWayDoor + ', so this crosses nothing new.' : 'It stops short of ' + c.oneWayDoor + ', so nothing here is one-way.'; } function ecosHop(to, plus, action, hint){ var anyBelow = lt(ecosNow, to); Object.keys(lineNow).forEach(function(L){ if(lt(lineNow[L], to)) anyBelow = true; }); if(!anyBelow) return false; var moverLines = [], stayLines = []; Object.keys(lineNow).forEach(function(L){ (lt(lineNow[L], to) ? moverLines : stayLines).push(L); }); moverLines.sort(function(a, b){ return cmp(parseV(a + '.0'), parseV(b + '.0')); }); stayLines.sort(function(a, b){ return cmp(parseV(a + '.0'), parseV(b + '.0')); }); var namesGroups = s.mixed && moverLines.length > 0 && stayLines.length > 0; if(namesGroups){ var many = moverLines.length > 1; action = action.replace(/all EdgeConnect appliances/i, 'the appliances on the ' + moverLines.join(' and ') + ' line' + (many ? 's' : '')) + ' \x3cspan class="allines">— ' + (many ? 'these groups' : 'this group') + ' only\x3c/span>'; } if(s.f.ec10150 && line(to) === RULES.constants.ec10150.barredLine){ action = action.replace(/all EdgeConnect appliances/i, 'every EdgeConnect appliance except the EC-10150s'); hint += ' The EC-10150s are not included — they cannot run ' + RULES.constants.ec10150.barredLine + ' at all.'; } var movers = groupsBelow(to, null); if(!movers.some(function(x){ return eq(x, ecosNow); }) && lt(ecosNow, to)) movers.push(ecosNow); if(!movers.length) movers = [ecosNow]; movers.sort(function(a, b){ return cmp(parseV(a), parseV(b)); }); if(namesGroups){ hint += ' The ' + stayLines.join(' and ') + '-line ' + (stayLines.length > 1 ? 'groups are' : 'group is') + ' already at or past this build — see the per-line table below.'; } else if(movers.length > 1){ hint += ' \x3cstrong>Every build in the Move column takes this step.\x3c/strong>'; } Object.keys(lineNow).forEach(function(L){ if(lt(lineNow[L], to)) lineNow[L] = to; }); advanceGroups(to, null); hint += pushCheck(to); hops.push({ a: action + '\x3cdiv class="hint">' + hint + '\x3c/div>', m: movers.join(', ') + ' → ' + to + (plus ? '+' : ''), w: WHO_EC }); if(lt(ecosNow, to)) ecosNow = to; ecosMoved = true; ecosMovedTo(); return true; } var turnedOff = false; function allEcosSafe(){ var builds = [ecosNow]; Object.keys(lineNow).forEach(function(L){ builds.push(lineNow[L]); }); return builds.every(function(b){ if(!parseV(b)) return false; if(parseV(b)[0] < 9) return false; return classifyOneAntiReplay(s, b, true) === 'safe'; }); } function ecosMovedTo(){ if(!turnedOff) return; if(!allEcosSafe()) return; turnedOff = false; reenableStep('Only if you turned them off above. Safe now, not before: every line in the Fabric is at or above ' + 'its floor in the compatibility matrix, so both ends of every tunnel interoperate. ' + 'Leaving them off is a standing security gap.'); } function reenableStep(hint){ step('\x3cstrong>Turn key rotation and anti-replay back on\x3c/strong>', hint, null, null, 'Whichever one you turned off. \x3cstrong>Key rotation:\x3c/strong> \x3cstrong>Configuration > Overlays & Security > ' + 'Security > IPSec Key Rotation\x3c/strong>, select \x3cstrong>Enable Key Rotation\x3c/strong>. ' + '\x3cstrong>Anti-replay:\x3c/strong> \x3cstrong>Orchestrator > Orchestrator Server > Tools > Tunnel Settings\x3c/strong>, ' + 'click \x3cstrong>IPSec\x3c/strong>, set the \x3cstrong>IPSec anti-replay window\x3c/strong> dropdown back to its previous value ' + 'and click \x3cstrong>Save\x3c/strong> — this bounces every tunnel once more, so do it inside a window.', 'Turn key rotation and anti-replay back on'); } function step(action, hint, move, who, how, title){ hops.push({ a: action + '\x3cdiv class="hint">' + hint + '\x3c/div>', m: move || '—', w: who || 'You', how: how || null, title: title || null }); } var L1 = RULES.level1; var rollbackText = null; function rollbackNote(baselineTaken){ var commsFloor = ge(orchNow, '9.0') ? c.ecosCommsFloor : null; if(commsFloor && lt(L1.ecos8Baseline, commsFloor)){ return 'No rollback below ' + commsFloor + ' from an Orchestrator on ' + orchNow + ', and the notes name no rollback build above it.'; } if(!baselineTaken){ var movers8 = [ecosNow].concat(Object.keys(lineNow).map(function(Ln){ return lineNow[Ln]; })) .filter(function(b){ var p = parseV(b); return !!p && p[0] < 9 && lt(b, L1.ecos8Final); }); if(movers8.length && movers8.every(function(b){ return eq(b, L1.ecos8Baseline); })){ return 'Roll back to ' + L1.ecos8Baseline + ' if this one misbehaves — the build they are on now.'; } return 'No rollback point below this one: your appliances are already past the ' + L1.ecos8Baseline + ' baseline, and skipping it removes the clean way to reverse this hop.'; } return 'Roll back to ' + L1.ecos8Baseline + ' if this one misbehaves.'; } if(s.antiReplay === 'applies'){ step('\x3cstrong>Disable IPSec key rotation or anti-replay on all labels\x3c/strong>', 'Required: ECOS ' + antiReplayNames(s, 'applies') + ' in an affected range and ' + (s.tunnelSure ? 'your tunnels are IPSec UDP' : 'tunnel mode is Not sure, so IPSec UDP is assumed') + '. ' + 'Appliances moved to ' + L1.antiReplay.safeAbove + '+ will not pass traffic with those that have not. ' + 'Turn them back on only where the plan says so.', null, null, L1.antiReplay.how, 'Disable IPSec key rotation or anti-replay on all labels'); turnedOff = true; } else if(s.antiReplay === 'unknown'){ step('\x3cstrong>Decide the anti-replay precaution\x3c/strong> before you start', 'ECOS ' + antiReplayNames(s, 'unknown') + ' named in neither the affected ranges nor the safe floors, and ' + (s.tunnelSure ? 'your tunnels are IPSec UDP' : 'tunnel mode is Not sure, so IPSec UDP is assumed') + '. ' + 'Disabling IPSec key rotation costs nothing and settles it — do it unless you can confirm the build is unaffected.', null, null, L1.antiReplay.how, 'Decide the anti-replay precaution'); turnedOff = true; } if(s.level1 && s.any8){ var baselineNeeded = lt(ecosNow, L1.ecos8Baseline); Object.keys(lineNow).forEach(function(Ln){ if(lt(lineNow[Ln], L1.ecos8Baseline)) baselineNeeded = true; }); orchHop(L1.orch8Final, false, 'Upgrade the \x3cstrong>Orchestrator\x3c/strong> to the final 8.x build', 'It manages the Fabric through the ' + (baselineNeeded ? 'two 8.x appliance hops' : '8.x appliance hop') + ' below, and as the last build on the line it clears the minimum Orchestrator for ' + (baselineNeeded ? 'both' : 'it') + ' in one move. A field-proven choice, not a documented mandate — no release note names it.'); var baselineTaken = ecosHop(L1.ecos8Baseline, false, 'Upgrade \x3cstrong>all EdgeConnect appliances\x3c/strong> to one 8.1 baseline', 'Also your rollback point if the next hop misbehaves. Skipping it is supported, but you give up a clean way to reverse the next step.'); rollbackText = rollbackNote(baselineTaken); ecosHop(L1.ecos8Final, false, 'Upgrade \x3cstrong>all EdgeConnect appliances\x3c/strong> to the last 8.x build', 'The launch point for 9.4. ' + rollbackText); } if(s.centos){ var beforeStaging = orchNow; orchHop(s.staging, !s.stagingExact, 'Upgrade the \x3cstrong>Orchestrator\x3c/strong> to a 9.x staging version', 'This exact version is reused when the Rocky VM is built, so a mismatch fails. ' + (s.stagingExact ? 'The lowest ' + s.orchLine + ' build with a Rocky image, chosen on purpose — go no higher on CentOS.' : s.stagingIsDefault ? 'This is the ' + L1.staging.defaultWhy + '.' : 'Stay in your own line at its latest dot.')); var staged = orchNow !== beforeStaging; stagedForRocky = staged; step('\x3cstrong>Build the new Rocky Linux Orchestrator VM, then migrate onto it\x3c/strong>', 'A new VM, not an in-place OS upgrade, at ' + (staged ? 'the exact staging version above' + (s.stagingExact ? ', ' + orchNow : '') : 'the build it is on now, ' + orchNow) + '. Check FIPS first with fips-mode-setup --check: Rocky may default it on, ' + 'which breaks contact with ECOS 9.3.x or older and RMA units at ZTP.', 'CentOS → Rocky Linux', 'You — new VM, then restore.'); } if(s.level1){ if(s.f.fips && lt(s.ecos, '9.4.0')){ var fipsAlready = ge(orchNow, '9.4.0'); step('\x3cstrong>Turn FIPS off\x3c/strong>' + (fipsAlready ? ' on the Orchestrator now' : ' before the Orchestrator crosses 9.4'), (fipsAlready ? 'Already on ' + orchNow + ', so with FIPS on it cannot talk to ECOS ' + s.ecos + ': it negotiates only FIPS-compliant ciphers, which your appliances lack. If they are still reachable, FIPS is not on — check with fips-mode-setup --check. Only a root user can change it.' : 'An Orchestrator on 9.4+ with FIPS on cannot talk to ECOS ' + s.ecos + ' — it negotiates only ' + 'FIPS-compliant ciphers, which your appliances do not offer. It shows as appliances going unreachable, ' + 'not an upgrade failure. Only a root user can change it.')); } var entryGate = pushGate(L1.entryEcos, orchNow); var entryOrchTo = entryGate.ok ? L1.entryOrch : (entryGate.cs && !entryGate.cs.ok ? entryGate.cs.floor : (entryGate.need || L1.entryOrch)); if(lt(entryOrchTo, L1.entryOrch)) entryOrchTo = L1.entryOrch; entryOrchUsed = entryOrchTo; orchHop(entryOrchTo, true, 'Upgrade the \x3cstrong>Orchestrator\x3c/strong> to ' + entryOrchTo + '+', (s.oaas ? '' : 'In place - no new VM at this step. ') + 'The Orchestrator has to reach ' + entryOrchTo + '+ before the appliances are taken to ' + L1.entryEcos + '+' + (eq(entryOrchTo, L1.entryOrch) ? '.' : ' — on its own line, that is the build that can install it.')); ecosHop(L1.entryEcos, true, 'Upgrade \x3cstrong>all EdgeConnect appliances\x3c/strong> to ' + L1.entryEcos + '+', 'This also clears the brick floor, so 9.6 and 9.7 become reachable afterwards.'); } if(s.tOrch === '9.7'){ function canTake(build, to){ if(line(to) !== '9.6' && line(to) !== '9.7') return true; var bf = floorFor(c.brickFloors, line(build)); return !bf || ge(build, bf); } function fabricWideReaches(floor, build){ return hops.filter(function(h){ if(h.w !== WHO_EC || /-line appliances/.test(String(h.a))) return false; var mm = /→\s*([\d.]+)/.exec(String(h.m)); return !!mm && ge(mm[1], floor) && canTake(build, mm[1]); }).length > 0; } function leadWant(){ var lily = line(c.lilyPad) === line(s.leadFloor) && ge(c.lilyPad, s.leadFloor); var tgtOnLine = line(s.tgt.ecos) === line(s.leadFloor) && ge(s.tgt.ecos, s.leadFloor) && (!lily || ge(s.tgt.ecos, c.lilyPad)); var to = tgtOnLine ? s.tgt.ecos : lily ? c.lilyPad : landingFor(s.leadFloor); return { to: to, onTgt: tgtOnLine, lily: lily, rec: !tgtOnLine && !lily && !eq(to, s.leadFloor) }; } function leadLanding(orchAt){ var w = leadWant(); var gate = pushGate(w.to, orchAt); if(gate.ok) return { to: w.to, onTgt: w.onTgt, lily: w.lily, rec: w.rec, need: gate.need, wording: gate.wording }; if(w.lily) return { to: c.lilyPad, onTgt: false, lily: true, rec: false, need: gate.need, wording: gate.wording }; return { to: s.leadFloor, onTgt: false, lily: false, rec: false, need: gate.need, wording: gate.wording, want: w.to }; } function leadStageTo(){ var w = leadWant(); var pre = leadLanding(orchNow); var canNow = pushGate(pre.to, orchNow).ok; if(lt(pre.to, w.to) || !canNow){ var st = stageToPush(w.to); if(st){ var post = leadLanding(st.to); if(ge(post.to, w.to)) return { to: st.to, lands: post.to, wording: st.wording, floor: pre.to, pastDoor: st.pastDoor, ownLine: st.ownLine, kind: !canNow ? 'move' : w.onTgt ? 'once' : 'recommended' }; } } if(canNow) return null; var fb = c.orchStagingByLine[s.ecosLine]; if(!fb || !lt(orchNow, fb)) return null; return { to: fb, lands: pre.to, wording: pushGate(pre.to, orchNow).wording, kind: 'move', pastDoor: false, ownLine: line(fb) === line(orchNow) }; } var leadCoversTo = null, projStageTo = null; if(s.orchLead){ projStageTo = leadStageTo(); var projected = projStageTo ? projStageTo.to : orchNow; leadCoversTo = leadLanding(projected).to; } var stageFor = null; s.mixedBelow.forEach(function(m){ if(m.main) return; if(fabricWideReaches(m.floor, m.build)) return; if(leadCoversTo && ge(leadCoversTo, m.floor) && canTake(m.build, leadCoversTo)) return; var landTo = landingFor(m.floor); var st = stageToPush(landTo); if(!st) return; if(!stageFor || lt(stageFor.to, st.to)){ stageFor = { to: st.to, needs: st.wording, lands: landTo, floor: m.floor, line: m.line, pastDoor: st.pastDoor, ownLine: st.ownLine, couldFloor: pushGate(m.floor, orchNow).ok }; } }); if(stageFor && projStageTo && line(projStageTo.to) === line(stageFor.to) && ge(projStageTo.to, stageFor.to)){ stageFor.to = projStageTo.to; } if(stageFor){ var gAction = 'Upgrade the \x3cstrong>Orchestrator\x3c/strong> first, so the ' + stageFor.line + '-line appliances ' + (stageFor.couldFloor ? 'land on ' + stageFor.lands : 'can move at all'); var gHint = stageFor.pastDoor ? 'Up its own line to ' + stageFor.to + '+, where it is going anyway: ECOS ' + stageFor.lands + ' needs Orchestrator ' + stageFor.needs + ' and yours is below that. ' + doorClause() : stageFor.couldFloor ? (stageFor.ownLine ? 'Up its own line' : 'Up to ' + stageFor.to + '+') + ': ECOS ' + stageFor.lands + ' needs Orchestrator ' + stageFor.needs + ', so the ' + stageFor.line + '-line step below lands on the recommended ' + stageFor.lands + ', not the ' + stageFor.floor + ' floor. ' + doorClause() : (stageFor.ownLine ? 'Up its own line' : 'Up to ' + stageFor.to + '+') + ', not to the target: ECOS ' + stageFor.lands + ' needs Orchestrator ' + stageFor.needs + ' to install, so without this the ' + stageFor.line + '-line step below cannot run. ' + doorClause(); if(orchHop(stageFor.to, true, gAction, gHint)) stagedForGroup = stageFor.line; } s.mixedBelow.forEach(function(m){ if(m.main) return; if(ge(m.build, m.floor)) return; if(fabricWideReaches(m.floor, m.build)) return; if(leadCoversTo && ge(leadCoversTo, m.floor) && canTake(m.build, leadCoversTo)) return; var landTo = landingFor(m.floor); var landsHigher = !eq(landTo, m.floor); var perLineMovers = groupsBelow(m.floor, m.line); if(!perLineMovers.length) perLineMovers = [m.build]; var mergeKind = eq(landTo, s.tgt.ecos) ? 'target' : (s.tEcos === '9.7' && eq(landTo, c.lilyPad)) ? 'lily' : null; if(mergeKind && pushGate(landTo, orchNow).ok){ var others = [], mergeOk = true; Object.keys(groupNow).forEach(function(b){ var cur = groupNow[b]; if(!lt(cur, landTo)) return; if(perLineMovers.some(function(x){ return eq(x, cur); })) return; others.push(cur); if(!canTake(cur, landTo)) mergeOk = false; var band = line(cur) === '9.7' ? null : floorFor(c.orchLeadFloors, line(cur)); if(band && lt(cur, band)) mergeOk = false; }); if(mergeOk && others.length){ var orchThereNow = ge(orchNow, '9.7.0'); ecosHop(landTo, mergeKind === 'target', 'Upgrade \x3cstrong>all EdgeConnect appliances\x3c/strong> to ' + landTo + (mergeKind === 'target' ? '+' : ''), 'The ' + m.line + '-line group is below its 9.7 band, so it ' + (orchThereNow ? 'comes back inside now' : 'moves before the crossing') + '; every other build below ' + landTo + ' can take it now and lands here anyway — one rollout, not two.'); return; } } hops.push({ a: 'Upgrade the \x3cstrong>' + m.line + '-line appliances\x3c/strong> to ' + landTo + '+' + ' \x3cspan class="allines">— this group only\x3c/span>' + '\x3cdiv class="hint">' + (ge(orchNow, '9.7.0') ? 'Below what an Orchestrator on 9.7 can manage on the ' + m.line + ' line, and yours is already on ' + orchNow + '. ' + '\x3cstrong>This group alone\x3c/strong> — floors are per line. ' + (landsHigher ? 'Brings them back inside the bands, onto the recommended ' + landTo + ', not the ' + m.floor + ' floor; confirm they show reachable in Orchestrator first.' : 'This hop brings them back inside the bands; confirm they show reachable in Orchestrator first.') : 'Below what an Orchestrator on 9.7 can manage on the ' + m.line + ' line. ' + '\x3cstrong>This group alone\x3c/strong> — floors are per line, so the route\'s lower build ' + '(' + s.ecos + ') does not make these safe. ' + (landsHigher ? 'Lands on ' + landTo + ', the recommended build, not the ' + m.floor + ' floor, before the Orchestrator crosses into 9.7 — one-way.' : 'Do it before the Orchestrator crosses into 9.7, which is one-way.')) + pushCheck(landTo) + '\x3c/div>', m: perLineMovers.join(', ') + ' → ' + landTo + '+', w: WHO_EC }); lineNow[m.line] = landTo; advanceGroups(landTo, m.line, perLineMovers); ecosMoved = true; ecosMovedTo(); }); if(s.orchLead){ var stage = leadStageTo(); if(stage){ var lTitle = 'Upgrade the \x3cstrong>Orchestrator\x3c/strong> first, so the appliances ' + (stage.kind === 'once' ? 'land once' : stage.kind === 'recommended' ? 'land on ' + stage.lands : 'can move at all'); var lHint; if(stage.pastDoor){ lHint = 'Up its own line to ' + stage.to + '+, where it is going anyway: ECOS ' + stage.lands + ' needs Orchestrator ' + stage.wording + ' and yours is below that. ' + doorClause(); } else if(stage.kind === 'once'){ lHint = (stage.ownLine ? 'Up its own line to ' + stage.to + '+' : 'Up to ' + stage.to + '+') + ', not to the target: ECOS ' + stage.lands + ' needs Orchestrator ' + stage.wording + '. From ' + orchNow + ' the appliances could only reach the ' + stage.floor + ' floor and would roll out again after the crossing; from ' + stage.to + ' they land on ' + stage.lands + ' once.'; } else if(stage.kind === 'recommended'){ lHint = (stage.ownLine ? 'Up its own line to ' + stage.to + '+' : 'Up to ' + stage.to + '+') + ': ECOS ' + stage.lands + ' needs Orchestrator ' + stage.wording + '. The ' + stage.floor + ' floor would do; ' + stage.lands + ' is the build to install — an Orchestrator hop is no outage. ' + doorClause(); } else { lHint = (stage.ownLine ? 'Up its own line' : 'Up to ' + stage.to + '+') + ', not to the target: ECOS ' + stage.lands + ' needs Orchestrator ' + stage.wording + ' and yours is below that. Going straight to 9.7 would leave the appliances below ' + s.leadFloor + ' managed only through the Cloud Portal.'; } stagedForLead = orchHop(stage.to, true, lTitle, lHint); } var landing = leadLanding(orchNow); var landsOnTgt = landing.onTgt, landsOnLily = landing.lily, leadTo = landing.to; var tgtOnThisLine = line(s.tgt.ecos) === line(s.leadFloor) && ge(s.tgt.ecos, s.leadFloor); var orchThere = ge(orchNow, '9.7.0'); ecosHop(leadTo, landsOnTgt || !landsOnLily, orchThere ? 'Bring the low appliances \x3cstrong>back inside the bands\x3c/strong>' : 'Bring the low appliances up \x3cstrong>before\x3c/strong> the Orchestrator crosses into 9.7', (orchThere ? 'Yours is already on ' + orchNow + ', and it manages ECOS below ' + s.leadFloor + ' on the ' + s.ecosLine + ' line only while the Cloud Portal is reachable. Confirm these still show reachable in Orchestrator before scheduling.' : 'Orchestrator 9.7 manages ECOS below ' + s.leadFloor + ' on the ' + s.ecosLine + ' line only through the Cloud Portal; these move first.') + (landsOnTgt ? ' Straight to ' + leadTo + ', where they are going anyway — the Orchestrator on ' + orchNow + ' can push it, so one rollout, not two.' + (landsOnLily ? ' That also clears the mandatory ' + c.lilyPad + ' stepping stone.' : '') : landsOnLily ? ' It goes straight to ' + c.lilyPad + ', the mandatory stepping stone for 9.7, which clears the floor too — one rollout, not two.' : landing.rec ? (s.mixed ? ' Onto the recommended ' + leadTo + ', not the ' + s.leadFloor + ' floor.' : ' Straight to ' + leadTo + ', the recommended build, not the ' + s.leadFloor + ' floor — the Orchestrator on ' + orchNow + ' can push it.') : landing.want && landing.need ? ' The floor, not ' + landing.want + ': ECOS ' + landing.want + ' needs Orchestrator ' + landing.wording + ' and yours is on ' + orchNow + ' here.' + (tgtOnThisLine ? ' They finish on ' + s.tgt.ecos + '+ after the crossing.' : '') : '')); } } var orchStays = ge(orchNow, s.tgt.orch); var crossesDoor = lt(orchNow, c.oneWayDoor) && ge(s.tgt.orch, c.oneWayDoor); var pastDoorAlready = ge(orchNow, c.oneWayDoor); var dont = s.tOrch === '9.5' ? 'Do not take it past ' + c.oneWayDoor + ' — that crossing is one-way and buys you nothing if 9.5 is where it stops.' : s.tOrch === '9.4' ? (ge(s.tgt.orch, c.libssl956.orchFrom) ? 'This lands at or above ' + c.libssl956.orchFrom + ', which closes off ' + c.libssl956.blocked + ' as a later 9.5 build — the day you move on to 9.5 it has to be ' + c.libssl956.useInstead + ' or later.' : 'Do not overshoot onto ' + c.libssl956.orchFrom + ' or later. An Orchestrator there cannot upgrade to ' + c.libssl956.blocked + ', which narrows your options the day you move on to 9.5.') : crossesDoor ? 'This crosses ' + c.oneWayDoor + ', and that crossing is one-way — no route back to 9.5 or 9.4. Take the backup seriously.' : pastDoorAlready ? 'Already past ' + c.oneWayDoor + ', so this hop crosses nothing new — but there is still no route back to an earlier line. Take the backup seriously.' : 'Take the backup seriously.'; var orchLead97 = s.tOrch === '9.7' ? ' There is no Orchestrator stepping stone — ' + c.ecosFloorsNotOrch.join(' and ') + ' are ECOS floors, not Orchestrator ones.' : ''; orchHop(s.tgt.orch, true, 'Upgrade the \x3cstrong>Orchestrator\x3c/strong>' + (s.split ? ' to ' + s.tgt.orch + '+' : ''), 'The Orchestrator always leads. ' + dont + orchLead97); function lineCovered(bl){ return hops.filter(function(h){ if(h.w !== WHO_EC) return false; var parts = String(h.m).split('→'); if(parts.length < 2) return false; var froms = parts[0].replace(/\+/g, '').split(',').map(function(x){ return x.trim(); }).filter(parseV); var to = parts[1].replace(/\+/g, '').trim(); if(!parseV(to)) return false; if(line(to) === '9.6' || line(to) === '9.7') return false; var isPerLine = /-line appliances/.test(String(h.a)); if(isPerLine && !froms.filter(function(f){ return line(f) === bl.line; }).length) return false; return ge(to, bl.floor); }).length > 0; } s.brickHopped = []; s.brickLines.forEach(function(bl){ if(lineCovered(bl)) return; var why = 'The notes say a \x3cstrong>direct upgrade\x3c/strong> from below the brick floor into 9.6 or 9.7 bricks the appliance ' + 'and needs a hardware replacement, so this cannot be skipped. Any build at or above the Move column target ' + 'satisfies it — take the newest.'; var land = bl.floor, atMgmt = false; if(ge(orchNow, '9.7.0')){ var mgmt = floorFor(c.orchLeadFloors, bl.line); if(mgmt && lt(land, mgmt)){ land = mgmt; atMgmt = true; } } var rec = landingFor(land); var entryLanding = !recommendedFor(line(bl.floor)); if(!eq(rec, land)){ var st = stageToPush(rec); if(pushGate(rec, orchNow).ok || st){ if(st) orchHop(st.to, true, 'Upgrade the \x3cstrong>Orchestrator\x3c/strong> first, so the appliances can clear the brick floor on ' + rec, (st.ownLine ? 'Up its own line to ' + st.to + '+' : 'Up to ' + st.to + '+') + ': ECOS ' + rec + ' needs Orchestrator ' + st.wording + ' and yours is below that. ' + doorClause()); land = rec; why = (bl.main && !s.mixed ? 'A \x3cstrong>direct upgrade\x3c/strong> from below the brick floor into 9.6 or 9.7 bricks the appliance — hardware replacement — so this cannot be skipped. ' : 'Below the brick floor, a jump into 9.6 or 9.7 bricks the appliance — hardware replacement. ') + (entryLanding ? 'This line has no recommended build, so the Move column lands on the 9.4 entry build; any later build also satisfies it.' : 'The Move column lands on the line\'s recommended build, above the floor the note names; any later build also satisfies it.') + (atMgmt ? ' The Orchestrator is already on ' + orchNow + ', so this also brings them back inside the bands.' : ''); } else if(atMgmt){ why = 'A \x3cstrong>direct upgrade\x3c/strong> from below the brick floor into 9.6 or 9.7 bricks the appliance, so this cannot be skipped. ' + 'It lands on the 9.7 management floor: the Orchestrator is already on ' + orchNow + ', so this brings them back inside the bands.'; } } else if(atMgmt){ why = 'A \x3cstrong>direct upgrade\x3c/strong> from below the brick floor into 9.6 or 9.7 bricks the appliance, so this cannot be skipped. ' + 'It lands on the 9.7 management floor: the Orchestrator is already on ' + orchNow + ', so this brings them back inside the bands.'; } s.brickHopped.push(bl.line); var sweepsUnexposed = s.mixed && groupsBelow(land, bl.line).length > groupsBelow(bl.floor, bl.line).length; if(bl.main && !sweepsUnexposed){ ecosHop(land, true, 'Upgrade \x3cstrong>all EdgeConnect appliances\x3c/strong> to ' + land + '+ first', why); } else { var exposedNow = groupsBelow(bl.floor, bl.line); if(!exposedNow.length) exposedNow = [bl.build]; hops.push({ a: 'Upgrade the \x3cstrong>' + bl.line + '-line appliances on ' + exposedNow.join(', ') + '\x3c/strong> to ' + land + '+ first' + ' \x3cspan class="allines">— this group only\x3c/span>' + '\x3cdiv class="hint">\x3cstrong>Per-line floor, this group alone.\x3c/strong> ' + why + pushCheck(land) + '\x3c/div>', m: exposedNow.join(', ') + ' → ' + land + '+', w: WHO_EC }); lineNow[bl.line] = land; advanceGroups(land, bl.line, exposedNow); if(bl.main && lt(ecosNow, land)) ecosNow = land; ecosMoved = true; ecosMovedTo(); } }); if(s.tEcos === '9.7'){ var lilyNeeded = lt(ecosNow, c.lilyPadFloor); Object.keys(lineNow).forEach(function(L){ if(lt(lineNow[L], c.lilyPadFloor)) lilyNeeded = true; }); if(lilyNeeded){ ecosHop(c.lilyPad, false, 'Upgrade \x3cstrong>all EdgeConnect appliances\x3c/strong> to ' + c.lilyPad, 'Mandatory stepping stone — ' + c.lilyPadFloor + ' or a later 9.6.x.x build. Use the newest, ' + c.lilyPad + '. Pass through only — do not rest on the 9.6 line.'); } } var gate = orchStays ? 'The Orchestrator is already on ' + orchNow + ', at or above the ' + s.tgt.orch + '+ this needs, so it does not move — appliance work only.' : 'Only once the Orchestrator is on ' + s.tgt.orch + '+.'; var tgtNeedWording = pushGate(s.tgt.ecos, orchNow).wording; var also = s.tEcos === '9.5' ? (orchStays ? '' : ' That also satisfies what ECOS ' + s.tgt.ecos + ' requires: Orchestrator ' + tgtNeedWording + '.') : s.tEcos === '9.6' ? (eq(s.tgt.ecos, c.lilyPadFloor) ? ' This is ' + c.lilyPadFloor + ', the build the 9.7 route passes through, so nothing here is undone if you move on later.' : ' This lands at or above ' + c.lilyPadFloor + ', the 9.7 route\'s stepping stone, so nothing here is undone if you move on later.') : ''; var oeH = orchEndsOn(s); var held = (s.split && cmp(parseV(s.tEcos + '.0'), parseV(oeH.line + '.0')) < 0) ? ' The appliances stop on ' + s.tEcos + ' by choice while the Orchestrator ' + (oeH.stays ? 'stays on ' : 'goes on to ') + oeH.line + ' — a supported state, since the Orchestrator is always allowed to lead.' : ''; ecosHop(s.tgt.ecos, true, 'Upgrade \x3cstrong>all EdgeConnect appliances\x3c/strong>' + (s.split ? ' to ' + s.tgt.ecos + '+' : ''), gate + also + held); var ec10150Split = s.f.ec10150 && s.tEcos === c.ec10150.barredLine; if(ec10150Split){ var orch97 = s.tOrch === '9.7'; var need95 = c.ecosNeedsOrchByLine['9.5']; hops.push({ a: 'Leave the \x3cstrong>EC-10150 appliances\x3c/strong> where they are' + '\x3cdiv class="hint">The EC-10150 (part \x3ccode>' + c.ec10150.part + '\x3c/code>) cannot run the ' + c.ec10150.barredLine + ' line (earliest build ' + c.ec10150.floor + ', shipping build ' + c.ec10150.ships + '), so it stays on 9.5. ' + (orch97 ? 'An Orchestrator on 9.7 manages the 9.5 line only from ' + c.orchLeadFloors['9.5'] + ' — if any EC-10150 is below that, tick the mixed-line box and give its build so it gets its own step first.' : (ge(orchNow, need95) ? 'Your Orchestrator on ' + orchNow + ' can still take them up the 9.5 line; only 9.4 is closed to them. ' : 'Nor can they move up 9.5 under this plan: even the ' + c.orchLeadFloors['9.5'] + ' floor needs Orchestrator ' + need95 + ', and yours ends on ' + orchNow + '. ') + 'A supported end state: an Orchestrator on 9.6 or earlier manages any ECOS build.') + '\x3c/div>', m: '-', w: WHO_EC }); } if(turnedOff){ turnedOff = false; reenableStep('Not yet: at least one line is still below its floor in the compatibility matrix, so some tunnels still do not ' + 'interoperate. Turn them back on as soon as that group moves above it — leaving them off is a standing security gap.'); } if(!hops.length) return { steps: [], note: null, nothingToDo: true, orchMoved: false, ecosMoved: false, rollback: null, stagedForRocky: false, stagedForLead: false, stagedForGroup: null, ec10150Held: false, blocked: [], entryOrchTo: null, applied: {}, cross: { orch96: false, orch941: false, ecos96: false, ecos97: false, orchOn96Plus: ge(s.orch, c.oneWayDoor), orchOn952Plus: ge(s.orch, '9.5.2'), bothOn96Plus: ge(s.orch, '9.6.0') && ge(s.ecos, '9.6.0'), bothWere96Plus: ge(s.orch, '9.6.0') && ge(s.ecos, '9.6.0'), orchEnd: s.orch, ecosEnd: s.ecos } }; var cross = { orch96: lt(s.orch, c.oneWayDoor) && ge(orchNow, c.oneWayDoor), orch941: lt(s.orch, '9.4.1') && ge(orchNow, '9.4.1'), orchOn96Plus: ge(orchNow, c.oneWayDoor), orchOn952Plus: ge(orchNow, '9.5.2'), orch950: lt(s.orch, '9.5.0') && ge(orchNow, '9.5.0'), orchSshCiphers: !sshCiphersRetired(s.orch) && sshCiphersRetired(orchNow), orchEndsOn95: line(orchNow) === '9.5', ecos96: lt(s.ecos, '9.6.0') && ge(ecosNow, '9.6.0'), ecos97: lt(s.ecos, '9.7.0') && ge(ecosNow, '9.7.0'), ecosRadiusAuth: lt(s.ecos, c.radiusMsgAuthFrom) && ge(ecosNow, c.radiusMsgAuthFrom), orch930: lt(s.orch, '9.3.0') && ge(orchNow, '9.3.0'), orch950any: lt(s.orch, '9.5.0') && ge(orchNow, '9.5.0'), bothOn96Plus: ge(orchNow, '9.6.0') && ge(ecosNow, '9.6.0'), bothWere96Plus: ge(s.orch, '9.6.0') && ge(s.ecos, '9.6.0'), verifyImageSig: lt(s.ecos, c.verifyImageSigExemptFrom), ecosMoved: ecosMoved, orchMoved: orchMoved, orchEnd: orchNow, ecosEnd: ecosNow }; var gates = { certToPsk: s.f.cert && cross.ecos97, radiusMsgAuth: s.f.radius && cross.ecosRadiusAuth, mschapSwitch: s.f.radius && cross.orch941, statsSnapshot: s.f.stats && !s.oaas && cross.orch96, statsMigrate: s.f.stats && !s.oaas && cross.orch96, awsEcvInventory:s.f.aws && cross.ecos96, ecvMemory: s.f.ecvmem && cross.ecosMoved, zscalerGre: s.f.zscaler && orchMoved, restApiMigrate: s.f.restapi && cross.orch930, awsWanAutomation: s.f.awswan && orchMoved && ge(orchNow, c.awsNetworkManager.orchFrom), awsImds: s.f.aws && ecosMoved, logFacilities: ecosMoved && !s.bootLoop && s.allBuilds.some(function(b){ return lt(b, c.logFacilityStrictBelow); }), cifsAccelOff: s.f.boost && ecosMoved && s.allBuilds.some(function(b){ return lt(b, c.cifsRemovedFrom); }) }; s.preWindow = RULES.preWindow.filter(function(p){ var from = p.side === 'orch' ? s.orch : s.ecos; var to = (p.side === 'orch' ? cross.orchEnd : cross.ecosEnd) || from; var moved = p.side === 'orch' ? orchMoved : ecosMoved; var any = false; if(p.crosses) { any = true; if(!(lt(from, p.crosses) && ge(to, p.crosses))) return false; } if(p.fromAtMost) { any = true; if(!lt(from, p.fromAtMost) && !eq(from, p.fromAtMost)) return false; } if(p.fromAtLeast) { any = true; if(!ge(from, p.fromAtLeast)) return false; } if(p.fromPrefix) { any = true; if((from + '.').indexOf(p.fromPrefix + '.') !== 0) return false; } if(p.fromLine) { any = true; if(line(from) !== p.fromLine) return false; } if(p.toAtLeast) { any = true; if(!ge(to, p.toAtLeast)) return false; } if(p.toExactly) { any = true; if(!eq(to, p.toExactly)) return false; } if(p.needsMove) { any = true; if(!moved) return false; } return any; }); var applied = {}; var pre = []; RULES.preflight.forEach(function(p){ var on = (p.when === 'always') || (p.when === 'ecosUpgraded' && ecosMoved) || (p.when === 'verifyImageSig' && ecosMoved && cross.verifyImageSig) || (p.when === 'bootLoop' && s.bootLoop) || (p.when === 'selfHosted' && s.selfHosted) || (p.when === 'oaas' && s.oaas); if(!on) return; var detail = p.detailByTarget ? p.detailByTarget[s.tEcos] : p.detail; var how = p.howByTarget ? (Object.prototype.hasOwnProperty.call(p.howByTarget, s.tEcos) ? p.howByTarget[s.tEcos] : (p.how || null)) : (p.how || null); if(p.detailByTarget){ if(!Object.prototype.hasOwnProperty.call(p.detailByTarget, s.tEcos)) detail = p.detail || ''; else if(detail === null) return; } if(p.id === 'backup-oaas'){ note = p.action + (detail ? '. ' + detail : ''); return; } pre.push({ a: p.action + '\x3cdiv class="hint">' + detail + '\x3c/div>', m: '—', w: 'You', how: how, title: p.action }); }); RULES.conditional.forEach(function(p){ if(p.phase !== 'pre' || !gates[p.gate]) return; applied[p.gate] = true; pre.push({ a: p.action + '\x3cdiv class="hint">' + p.detail + '\x3c/div>', m: '—', w: p.who || 'You', how: p.how || null, title: p.action }); }); var steps = pre.concat(hops); RULES.conditional.forEach(function(p){ if(p.phase !== 'post' || !gates[p.gate]) return; applied[p.gate] = true; steps.push({ a: p.action + '\x3cdiv class="hint">' + p.detail + '\x3c/div>', m: '—', w: p.who || 'You', how: p.how || null, title: p.action }); }); RULES.closeout.forEach(function(p){ var on = (p.when === 'always') || (p.when === 'orchUpgraded' && orchMoved) || (p.when === 'verifyImageSig' && ecosMoved && cross.verifyImageSig) || (p.when === 'ecosUpgraded' && ecosMoved); if(!on) return; steps.push({ a: p.action + '\x3cdiv class="hint">' + p.detail + '\x3c/div>', m: '—', w: p.who || 'You', how: p.how || null, title: p.action }); }); return { steps: steps, note: note, nothingToDo: false, orchMoved: orchMoved, ecosMoved: ecosMoved, rollback: rollbackText, stagedForRocky: stagedForRocky, stagedForLead: stagedForLead, stagedForGroup: stagedForGroup, ec10150Held: ec10150Split, blocked: blocked, entryOrchTo: entryOrchUsed, applied: applied, cross: cross }; } function routeFacts(plan){ var f = { orchHops: [], ecosHops: [], first: null }; (plan.steps || []).forEach(function(x, i){ var parts = String(x.m || '').split('→'); if(parts.length < 2) return; var to = parts[1].replace(/\+/g, '').replace(/—/g, '').trim(); if(!parseV(to)) return; var froms = parts[0].replace(/\+/g, '').split(',').map(function(v){ return v.trim(); }).filter(parseV); if(!froms.length) return; var hop = { i: i, froms: froms, to: to, plus: parts[1].indexOf('+') !== -1, orch: x.w !== WHO_EC, perLine: /-line appliances/.test(String(x.a)) }; (hop.orch ? f.orchHops : f.ecosHops).push(hop); if(!f.first) f.first = hop; }); return f; } function orderSentence(s, R, bare){ if(R.orchHops.length && R.ecosHops.length){ if(R.first.orch) return bare ? 'The Orchestrator moves first, then the appliances.' : 'The ordering is the standing rule: the Orchestrator moves first, then the appliances.'; return 'The appliances move first, then the Orchestrator.'; } if(R.ecosHops.length) return 'Only the appliances move — the Orchestrator is already at or above ' + s.tgt.orch + '.'; return 'Only the Orchestrator moves — the appliances are already at or above ' + s.tgt.ecos + '.'; } function driver(s, plan){ var c = RULES.constants, L1 = RULES.level1, R = routeFacts(plan); if(plan.nothingToDo) return 'Nothing to do: Orchestrator ' + s.orch + ' and ECOS ' + s.ecos + ' already satisfy the ' + s.target + ' target of ' + s.tgt.orch + '+ / ' + s.tgt.ecos + '+. The only thing to act on is the resting-point date below.'; if(s.bootLoop) return 'Your ECOS build sits in the boot-loop band — ' + bootLoopBandText() + ' — defect ' + c.bootLoopDefect + '. Before any appliance is upgraded, Verify System Files Integrity and FIPS/CC come off: a boot loop is recoverable only by serial console, which a cloud EC-V does not have. That check outranks everything else here.'; if(s.brick){ var clear = null; R.ecosHops.forEach(function(h){ if(clear || h.perLine) return; if(ge(h.to, s.brickFloor) && line(h.to) !== '9.6' && line(h.to) !== '9.7') clear = h; }); return 'Your appliances are below ECOS ' + s.brickFloor + ', and a jump from there straight into 9.6 or 9.7 bricks them. ' + (clear ? 'The plan takes them ' + (line(clear.to) === s.ecosLine ? 'up their own line ' : '') + 'to ' + clear.to + (clear.plus ? '+' : '') + ', clear of the floor, before anything goes near the 9.6 or 9.7 stream — it is built around that.' : 'They come clear of that floor before anything goes near the 9.6 or 9.7 stream — the plan below is built around that.'); } if(s.centos){ if(!s.level1){ return 'The Orchestrator is still on CentOS, and that gates everything.' + (plan.stagedForRocky ? ' ' + s.orch + ' has no Rocky image, so the plan stages the Orchestrator on ' + s.staging + ' first' + (s.stagingExact ? ' — the lowest ' + s.orchLine + ' build that has one —' : ',') + ' then builds the Rocky VM there and migrates.' : ' It takes no Orchestrator upgrade until it is on Rocky: the plan builds the Rocky VM at the build it is on now, ' + s.orch + ', and migrates onto it.') + ' Rocky Linux is required from ' + c.rockyRequiredFrom['9.4'] + '+, so every later Orchestrator hop runs on the new VM.'; } return 'The Orchestrator is still on CentOS, and that gates everything.' + (plan.stagedForRocky ? ' The Rocky VM has to be built at a version that has a Rocky image, so the plan stages the Orchestrator on ' + s.staging + ' first and only then migrates.' : ' The Rocky VM has to be built at a version that has a Rocky image, so the plan migrates at the version this Orchestrator is on now, ' + s.orch + ', already at or past the staging build.') + ' Do not go to ' + L1.entryOrch + '+ on CentOS and migrate afterwards.'; } if(s.level1 && s.ecos8){ var n8 = R.ecosHops.filter(function(h){ return parseV(h.to)[0] < 9; }).length; if(n8 >= 2) return 'Your appliances are still on 8.x, so the Fabric takes the full 8.x path before it joins the 9.x route: two appliance hops on 8.x first. The middle one is not busy work — ' + L1.ecos8Baseline + ' is the build you fall back to if ' + L1.ecos8Final + ' misbehaves.'; if(n8 === 1) return 'Your appliances are still on 8.x, so they take the last 8.x hop, to ' + L1.ecos8Final + ', before they join the 9.x route. ' + (plan.rollback || ''); return 'Your appliances are already on ' + s.ecos + ', at or past the last 8.x hop, so they join the 9.x route directly: the jump to ' + L1.entryEcos + '+ is their first move. ' + orderSentence(s, R, false); } if(s.antiReplay === 'applies') return 'Your appliances are in the anti-replay affected range and your tunnels are IPSec UDP — both conditions are true. Appliances moved to 9.4.1.0+ will not pass traffic with those that have not, so the exposure is the whole rollout window. Disable IPSec key rotation or anti-replay on all labels before you start.'; if(s.level1){ var ord = orderSentence(s, R, true); var entryO = plan.entryOrchTo || L1.entryOrch; return 'Everything is set by the ' + entryO + '+ / ' + L1.entryEcos + '+ landing point: the entry state the rest of the route assumes, and what clears the brick floor so 9.6 and 9.7 become reachable. Inside it, ' + ord.charAt(0).toLowerCase() + ord.slice(1); } if(s.orchLead){ if(s.orchAt97){ var firstIsOrch = !!R.first && R.first.orch; return 'Your Orchestrator is already on ' + s.orch + ', and ECOS ' + s.ecos + ' is below the ' + s.leadFloor + ' threshold on the ' + s.ecosLine + ' line, so HPE says it is managed only with Cloud Portal connectivity — the warning above quotes the note. ' + (firstIsOrch ? 'The Orchestrator moves up its own line first, then they come back inside the bands.' : 'The appliances move first, straight back inside the bands.') + ' Confirm they still show reachable in Orchestrator first.'; } var stagesFirst = !!R.first && R.first.orch && lt(R.first.to, s.tgt.orch); var ownLine = stagesFirst && line(R.first.to) === s.orchLine; var mainHops = R.ecosHops.filter(function(h){ return !h.perLine; }); var twoMoves = mainHops.length >= 2 && lt(mainHops[0].to, mainHops[mainHops.length - 1].to) && line(mainHops[0].to) === line(mainHops[mainHops.length - 1].to); var lastTo = twoMoves ? mainHops[mainHops.length - 1].to : null; var firstLands = mainHops.length ? mainHops[0].to : null; return 'Some appliances are below ECOS ' + s.leadFloor + ', which an Orchestrator on 9.7 manages only through the Cloud Portal. ' + (stagesFirst ? 'The Orchestrator still moves first, but only ' + (ownLine ? 'up its own line' : 'as far as ' + R.first.to + '+') + (twoMoves ? ' — far enough to reach the ' + mainHops[0].to + ' floor — then crosses into 9.7.' : ' — far enough for the appliances to ' + (firstLands ? 'reach ' + firstLands : 'install their target build') + ' — and crosses into 9.7 once they have landed.') : 'Your Orchestrator on ' + s.orch + (twoMoves ? ' can already install the ' + mainHops[0].to + ' floor, so the appliances move first, then it crosses into 9.7.' : ' can already install ' + (firstLands ? firstLands : 'their target build') + ', so the appliances move first and it crosses into 9.7 once they have landed.')) + (twoMoves ? ' Two appliance moves, not one: an Orchestrator on ' + (stagesFirst ? R.first.to : s.orch) + ' cannot install ' + lastTo + ', so they finish there after the crossing.' : '') + ' The lowest appliance sets the plan.'; } if(s.orchAhead) return 'Your Orchestrator is already on ' + s.orch + ', a line above the ' + s.tOrch + ' you picked, so it does not move — appliance work only, and a supported state since the Orchestrator is always allowed to lead. ' + (s.orchLine === '9.6' ? 'It rests on 9.6 (SSR, End of Maintenance ' + RULES.streams['9.6'].eom + '): move it to 9.7.1+ once the appliances have landed.' : 'Bring the appliances up to meet it.'); var crossesLily = lt(s.ecos, c.lilyPadFloor); if(s.tEcos === '9.7' && crossesLily){ var nO = R.orchHops.length; var stageOwnLine = nO >= 2 && line(R.orchHops[0].to) === s.orchLine; var lilyHop = R.ecosHops.filter(function(h){ return eq(h.to, c.lilyPad); })[0]; var lilyFirst = !!lilyHop && nO > 0 && lilyHop.i < R.orchHops[nO - 1].i; var passes = ' every appliance still below ' + c.lilyPadFloor + ' passes through ' + c.lilyPad + ' on the way to 9.7 — passes through, never stops, because 9.6 is a Short Supported Release.'; return 'The ordering is set by the mandatory ECOS ' + c.lilyPadFloor + ' stepping stone. ' + (nO === 0 ? 'The Orchestrator is already on ' + s.orch + ', at or above ' + s.tgt.orch + '+, so it does not move, and' + passes : lilyFirst ? 'Every appliance still below ' + c.lilyPadFloor + ' passes through ' + c.lilyPad + ' first — passes through, never stops, because 9.6 is a Short Supported Release — and the Orchestrator reaches ' + s.tgt.orch + '+ ' + (nO === 1 ? 'in one hop' : 'in two hops') + ' before the appliances finish on 9.7.' : nO === 1 ? 'The Orchestrator reaches ' + s.tgt.orch + '+ in one hop, then' + passes : 'The Orchestrator reaches ' + s.tgt.orch + '+ in two hops, the first ' + (stageOwnLine ? 'up its own line' : 'up to ' + R.orchHops[0].to + '+') + ' so every group can take its step, then' + passes); } if(s.tEcos === '9.7') return 'Nothing unusual gates this one. Your appliances are already at or above ' + c.lilyPadFloor + ', so the mandatory stepping stone is behind them and there is no 9.6 hop. ' + orderSentence(s, R, false); if(s.split) return 'Nothing hazardous gates this one; what shapes it is the split you asked for. The Orchestrator ' + (plan.orchMoved ? 'goes to ' : 'is already at or above ') + s.tgt.orch + '+ on the ' + s.tOrch + ' line while the appliances ' + (plan.ecosMoved ? 'stop at ' : 'already sit at or above ') + s.tgt.ecos + '+ on the ' + s.tEcos + ' line — a supported state, not an unfinished upgrade, because the Orchestrator is always allowed to lead.'; var orchEnd94 = (plan.cross || {}).orchEnd || s.orch; if(s.target === '9.4') return 'Nothing gates this one — the shortest route on the chart, never near 9.6, so the one-way door, the mandatory ECOS stepping stone and the 9.6 behavior changes do not arise. ' + orderSentence(s, R, true) + ' ' + (ge(orchEnd94, c.libssl956.orchFrom) ? 'Carry forward: an Orchestrator on ' + c.libssl956.orchFrom + ' or later cannot upgrade to ' + c.libssl956.blocked + ', so a later 9.5 move must be ' + c.libssl956.useInstead + ' or later.' : 'Be careful not to overshoot: an Orchestrator taken to ' + c.libssl956.orchFrom + ' or later cannot then upgrade to ' + c.libssl956.blocked + '.'); var reqWording = pushGate(s.tgt.ecos, s.orch).wording; if(s.tEcos === '9.6') return (lt(s.orch, c.oneWayDoor) ? 'Weigh the one-way door at Orchestrator ' + c.oneWayDoor + ' first: it is crossed on the way in and there is no route back. ' : 'The one-way door at Orchestrator ' + c.oneWayDoor + ' is already behind you, so nothing here is new on that side. ') + (plan.orchMoved ? 'The ordering is the standing rule — the Orchestrator goes to ' + s.tgt.orch + '+, which also satisfies what ECOS ' + s.tgt.ecos + ' requires (Orchestrator ' + reqWording + '), then the appliances follow.' : orderSentence(s, R, false)); return 'Nothing unusual gates this one. ' + orderSentence(s, R, false) + (plan.orchMoved ? ' Going to ' + s.tgt.orch + '+ also satisfies what ECOS ' + s.tgt.ecos + ' requires: Orchestrator ' + reqWording + '.' : ' It already satisfies what ECOS ' + s.tgt.ecos + ' requires: Orchestrator ' + reqWording + '.'); } function verdicts(s, plan){ var c = RULES.constants, v = {}; var did = plan.applied || {}, cross = plan.cross || {}; function chk(flag, yesWhy, noWhy){ return flag ? ['Yes', yesWhy] : ['Check', noWhy]; } var udpPhrase = s.tunnelSure ? 'tunnel mode is IPSec UDP' : 'tunnel mode was left as Not sure, so IPSec UDP is assumed'; v['anti-replay'] = s.antiReplay === 'applies' ? ['Yes', 'ECOS ' + antiReplayNames(s) + ' in an affected range and ' + udpPhrase + '. Both conditions are true, so the precaution is required, not optional.'] : s.antiReplay === 'unknown' ? ['Check', 'ECOS ' + antiReplayNames(s, 'unknown') + ' named in neither the affected ranges nor the safe floors, and ' + udpPhrase + '. The planner will not guess; disabling key rotation for the rollout costs nothing.'] : s.antiReplay === 'na' ? ['No', 'The 8.x path never sits the Fabric on an affected 9.1 or 9.2 build, so the mismatch cannot arise. Turning key rotation off anyway is a fair precaution.'] : (!s.f.udp ? ['No', 'Tunnel mode is IPSec IKE, and both conditions have to be true. The affected builds are irrelevant to you.'] : ['No', 'ECOS ' + s.ecos + ' is at or above ' + RULES.level1.antiReplay.safeAbove + ', the highest floor in the matrix, so the gap cannot arise on any line.']); v['fips'] = s.f.fips ? (lt(s.ecos, '9.4.0') ? (ge(s.orch, '9.4.0') ? ['Yes', 'FIPS is on, the Orchestrator is already on ' + s.orch + ' and your appliances are on ECOS ' + s.ecos + ', so those two cannot talk at all now. It is in the plan as its own step.'] : ['Yes', 'FIPS is on and your appliances are on ECOS ' + s.ecos + '. Once the Orchestrator crosses 9.4 those two cannot talk at all. It is in the plan as its own step.']) : ['Check', 'FIPS is on but your appliances are already on 9.4 or later, so the cipher mismatch does not arise. It still stops an RMA appliance phoning home at ZTP, because a replacement ships on an older build.']) : ['Check', 'FIPS not ticked. Confirm rather than assume' + (s.centos ? ' — a newly built Rocky VM may default it on, so the plan checks it at the migration step.' : ' — most deployments never turned it on deliberately.')]; v['boot-loop'] = s.bootLoop ? ['Yes', 'ECOS ' + s.bootLoopBuilds.join(' and ') + (s.bootLoopBuilds.length > 1 ? ' are' : ' is') + ' in the affected band.'] : ['No', 'ECOS ' + s.ecos + ' is outside the affected band — ' + bootLoopBandText() + '.']; var logFacBelow = s.allBuilds.filter(function(b){ return lt(b, c.logFacilityStrictBelow); }); v['log-facilities'] = did.logFacilities ? ['Mitigated by plan', 'ECOS ' + logFacBelow.join(' and ') + ' leaves a build that ignores an overlap. Checking the Log Facilities is a step in the plan, before the first appliance moves.'] : !cross.ecosMoved ? ['No', 'No appliance moves in this plan, so no template is pushed to a new build.'] : !logFacBelow.length ? ['No', 'Every appliance starts on 9.4 or later, so none leaves a build that ignored an overlap.'] : ['Mitigated by plan', 'The boot-loop step already puts the Log Facilities back to their defaults, which clears any overlap.']; v['verify-image-signature'] = !cross.ecosMoved ? ['No', 'No appliance moves in this plan, so no image is installed and the setting cannot block anything.'] : (cross.verifyImageSig ? ['Mitigated by plan', 'ECOS ' + s.ecos + ' is below 8.3.3.0, which is the one case the notes do not exempt, so the plan turns the setting off before the first appliance hop and back on at the end.'] : ['No', 'Every ECOS note exempts appliances upgrading from 8.3.3.0 or later, and yours are on ' + s.ecos + '. Leave the setting alone — turning it off would weaken the Orchestrator for no benefit.']); var brickWord = s.brickLines.map(function(b){ return 'ECOS ' + (b.builds || [b.build]).join(' and ') + ' on the ' + b.line + ' line, below ' + b.floor; }); var brickUncovered = (s.brickHopped || []).length; var brickLandKinds = (s.brickHopped || []).map(function(L){ return recommendedFor(L) ? 'rec' : 'entry'; }); var brickLandWord = brickLandKinds.length && brickLandKinds.every(function(k){ return k === 'entry'; }) ? 'the 9.4 entry build' : brickLandKinds.length && brickLandKinds.every(function(k){ return k === 'rec'; }) ? 'the line\'s recommended build' : 'a recommended build'; v['brick-floor'] = !s.brickTarget ? ['No', 'The brick rule is scoped to appliances entering the 9.6 or 9.7 stream. Yours stop on ' + s.tEcos + '.'] : (!s.brickLines.length ? ['No', 'Every line in this Fabric is at or above its own floor' + (s.brickFloor ? ' - ' + s.brickFloor + ' on the ' + s.ecosLine + ' line' : '') + '.'] : (!brickUncovered ? ['Mitigated by plan', brickWord.join('; ') + '. A direct upgrade from there into 9.6 or 9.7 bricks the appliance. ' + 'The plan already lifts ' + (s.brickLines.length > 1 ? 'those groups' : 'them') + ' clear of the floor first — do not shortcut straight to the target.'] : ['Mitigated by plan', brickWord.join('; ') + '. A direct jump into 9.6 or 9.7 bricks the appliance. ' + 'The plan lifts ' + (s.brickLines.length > 1 ? 'each group' : 'them') + ' clear first, onto ' + brickLandWord + ' — do not collapse that into one hop.' + (s.mixed ? ' Floors are per line, so the lowest number can hide an exposed group.' : '')])); var ulfHard = (s.unmanagedNow || []).filter(function(u){ return lt(u.build, c.orch97HardFloor); }); var ulfPortal = (s.unmanagedNow || []).filter(function(u){ return !lt(u.build, c.orch97HardFloor); }); var ulfMany = (s.unmanagedNow || []).length > 1; var ulfState = ulfHard.length ? (ulfPortal.length ? ' sit below the bands it manages.' : (ulfMany ? ' sit' : ' sits') + ' outside the bands it manages.') : (ulfMany ? ' need' : ' needs') + ' Cloud Portal connectivity to be managed.'; v['orch-lead-floor'] = s.orchAt97 && s.unmanagedNow.length ? ['Needs review', 'The Orchestrator is on ' + s.orch + ' now, and ECOS ' + s.unmanagedNow.map(function(u){ return u.build; }).join(', ').replace(/, ([^,]*)$/, ' and $1') + ulfState + (ulfHard.length ? ' The note: “' + c.orch97CannotManageSentence + '”' : ' The warning above quotes the note\'s Cloud Portal condition.') + ' The appliance hops below take them back inside; confirm they show reachable in Orchestrator first.'] : s.orchAt97 ? ['No', 'Your Orchestrator is already on ' + s.orch + ', and every line in this Fabric is at or above the floor it manages.'] : s.tOrch !== '9.7' ? ['No', 'This is about an Orchestrator on 9.7 managing older appliances. Yours stops at ' + s.tOrch + '.'] : (s.level1 ? ['Mitigated by plan', 'The plan brings the appliances to ' + RULES.level1.entryEcos + '+ before the Orchestrator goes anywhere near 9.7, and that build is the floor.'] : (s.orchLead ? ['Mitigated by plan', 'ECOS ' + s.ecos + ' is below ' + s.leadFloor + ', so the plan moves those appliances before the Orchestrator crosses into 9.7.'] : s.leadFloor && eq(s.ecos, s.leadFloor) ? ['No', 'ECOS ' + s.ecos + ' is exactly the floor for the ' + s.ecosLine + ' line, so it is already clear of this.'] : ['No', 'ECOS ' + s.ecos + ' is at or above ' + (s.leadFloor || 'the floor') + '.'])); var pastDoor = ge(s.orch, c.oneWayDoor); v['one-way-door'] = pastDoor ? ['Irreversible', 'Your Orchestrator is already on ' + s.orch + ', past ' + c.oneWayDoor + '. That crossing has happened, and there is no way back to an earlier line whatever this plan does.'] : cross.orch96 ? ['Irreversible', 'Your Orchestrator crosses ' + c.oneWayDoor + ' on the way to ' + s.tgt.orch + '+. Nothing to mitigate — there is no way back, which is what the backup is for.'] : ['No', 'Your Orchestrator stops at ' + s.tgt.orch + '+ and never reaches ' + c.oneWayDoor + '. Keep it that way.']; var orchEndV = cross.orchEnd || s.orch; var lib956Start = s.orchLine === '9.4' && ge(s.orch, c.libssl956.orchFrom); var lib956End = line(orchEndV) === '9.4' && ge(orchEndV, c.libssl956.orchFrom); v['libssl-956'] = lib956Start && s.tOrch !== '9.4' ? ['Mitigated by plan', 'Orchestrator ' + s.orch + ' is at or above ' + c.libssl956.orchFrom + ', so the trap is real — but the plan targets ' + s.tgt.orch + '+, which clears it. Do not pick ' + c.libssl956.blocked + ' from the list.'] : lib956End ? ['Mitigated by plan', (lib956Start ? 'Orchestrator ' + s.orch + ' is already at or above ' + c.libssl956.orchFrom : 'This plan takes the Orchestrator to ' + s.tgt.orch + '+, at or above ' + c.libssl956.orchFrom) + ', so the trap is armed. It does not bite here because you never go to 9.5 — the day you do, it has to be ' + c.libssl956.useInstead + ' or later, never ' + c.libssl956.blocked + '.'] : s.orchAhead ? ['No', 'Orchestrator ' + s.orch + ' is already past the 9.4 line and this plan does not move it, so the ' + c.libssl956.blocked + ' question is behind it.'] : (s.tOrch === '9.4' ? ['No', 'Orchestrator ' + s.orch + ' is below ' + c.libssl956.orchFrom + ', and the plan lands on ' + s.tgt.orch + ', which is still below it. Overshoot past ' + c.libssl956.orchFrom + ' and you arm it for later.'] : ['No', 'Orchestrator ' + s.orch + ' is below ' + c.libssl956.orchFrom + '.']); var lib961 = (s.orchLine === '9.4' && ge(s.orch, c.libssl961.orchFrom[0])) || (s.orchLine === '9.5' && ge(s.orch, c.libssl961.orchFrom[1])); var lib961End = (line(orchEndV) === '9.4' && ge(orchEndV, c.libssl961.orchFrom[0])) || (line(orchEndV) === '9.5' && ge(orchEndV, c.libssl961.orchFrom[1])); v['libssl-961'] = lib961 ? ['Mitigated by plan', 'Orchestrator ' + s.orch + ' is inside the affected range, but the plan never targets ' + c.libssl961.blocked + '. Do not pick it from the list.'] : lib961End ? ['Mitigated by plan', 'This plan lands the Orchestrator on ' + s.tgt.orch + '+, inside the range that cannot upgrade to ' + c.libssl961.blocked + '. It does not bite here because the plan never targets ' + c.libssl961.blocked + ' — the day you move on to 9.6, pick ' + c.libssl961.useInstead + ' or later.'] : ge(s.orch, c.libssl961.blocked) ? ['No', 'Orchestrator ' + s.orch + ' is already at or past ' + c.libssl961.blocked + ', so the question cannot arise.'] : ['No', 'Orchestrator ' + s.orch + ' is outside the affected range — ' + c.libssl961.orchFrom[0] + ' or later on the 9.4 line, ' + c.libssl961.orchFrom[1] + ' or later on the 9.5 line.']; v['centos'] = s.centos ? ['Yes', 'Migration to Rocky Linux is in the plan and blocks the later upgrade steps.'] : ['No', s.oaas ? 'OaaS — there is no VM of yours to migrate.' : 'Already on Rocky Linux.']; var hw = c.hardware; v['hardware-97'] = s.tEcos === '9.6' ? chk(s.f.ecus, 'EC-US present and the appliances finish on 9.6. HPE\'s Hardware/ECOS Compatibility Matrix marks ' + hw.ecUs97 + ' N/A (not enforced) on the 9.6 line — unsupported, though the install is not blocked — and a flat N/A at 9.7. Check every one against that list.', 'No EC-US ticked. If any turn up, the numbers to check are ' + hw.ecUs97 + ' — unsupported on 9.6 (the install is not blocked) and on 9.7 or later.') : s.tEcos !== '9.7' ? ['No', 'This restriction starts at ECOS 9.7 and your appliances finish on ' + s.tEcos + '.'] : chk(s.f.ecus, 'EC-US present and the appliances finish on 9.7. Check every one against ' + hw.ecUs97 + ' - those are not supported on 9.7 or later.', 'No EC-US ticked. If any turn up, the numbers to check are ' + hw.ecUs97 + '.'); var ecxsList = s.tEcos === '9.7' ? hw.ecXs95 + ' (unsupported from 9.5, so out at 9.7 too) and ' + hw.ecXs97 + ' (unsupported from 9.7)' : s.tEcos === '9.6' ? hw.ecXs95 + ' (unsupported from 9.5) and ' + hw.ecXs97 + ' (N/A (not enforced) on 9.6 in HPE\'s Hardware/ECOS Compatibility Matrix — unsupported, though the install is not blocked)' : hw.ecXs95; v['hardware-ecxs'] = s.tEcos === '9.4' ? ['No', 'Both EC-XS lists start above where the appliances stop - one at 9.5 and one at 9.7. Neither bites inside the 9.4 line.'] : chk(s.f.ecxs, 'EC-XS present and the appliances finish on ' + s.tEcos + '. The numbers not supported there are ' + ecxsList + '. Check the label on each appliance, not the model name.', 'No EC-XS ticked. If any turn up, the numbers to check for ' + s.tEcos + ' are ' + ecxsList + '.'); v['radius'] = did.radiusMsgAuth ? ['Mitigated by plan', 'Confirming the server sends message-authenticator is a step in the plan, before the appliances land.'] : ge(s.ecos, c.radiusMsgAuthFrom) ? ['No', 'Your appliances are already on ' + c.radiusMsgAuthFrom + ' or later, so this is already in effect.'] : !cross.ecosRadiusAuth ? ['No', 'This plan leaves the Fabric below ECOS ' + c.radiusMsgAuthFrom + ', where the requirement does not apply.'] : chk(s.f.radius, 'This plan lands the appliances on ECOS ' + c.radiusMsgAuthFrom + ' or later, where a RADIUS server that does not send message-authenticator could have its requests dropped.', 'RADIUS not ticked. Confirm before the appliances land on ' + c.radiusMsgAuthFrom + ' or later.'); var ec10150On95Risk = s.f.ec10150 && s.tOrch === '9.7' && !s.mixedLines['9.5']; v['ec10150-94'] = ec10150On95Risk ? [['Yes', 'Needs review'], 'Your EC-10150s are on ' + c.ec10150.floor + ' or later, the hardware floor. ' + 'The Orchestrator is going to 9.7, whose floor on the 9.5 line is ' + c.orchLeadFloors['9.5'] + ' — an EC-10150 still on its shipping build ' + c.ec10150.ships + ' is below that and would be managed only through the Cloud Portal. ' + 'Tick the mixed-line box and give their actual build.'] : s.tEcos !== c.ec10150.barredLine ? ['No', 'Your appliances finish on ' + s.tEcos + ', which is above the ' + c.ec10150.floor + ' floor the EC-10150 needs, so this does not arise.'] : chk(s.f.ec10150, 'EC-10150 is ticked and the appliances finish on ' + c.ec10150.barredLine + '. Those boxes cannot follow — they stay on 9.5, a supported end state and a step above.', 'EC-10150 not ticked. If any are in the Fabric they cannot come to ' + c.ec10150.barredLine + ' at all, and the plan above would be wrong for them.'); var declaredBelow = s.mixedBelow.filter(function(m){ return !m.main; }); v['mixed-lines'] = s.mixedEmpty ? [['Check', 'Needs review'], 'You ticked more than one release line but listed no other build, so the plan speaks only for ' + s.ecos + '. The per-line inventory is missing: give the lowest build on each line and rebuild, because another ' + 'line can need a first move this plan does not show.'] : (s.tOrch !== '9.7' && !s.orchAt97) ? ['No', 'The per-line floors are a property of what an Orchestrator on 9.7 can manage, and this plan does not put one there.'] : declaredBelow.length ? [['Yes', 'Needs review'], 'You declared appliances on ' + declaredBelow.map(function(m){ return m.line + ' (' + m.build + ')'; }).join(' and ') + ', below the ' + declaredBelow.map(function(m){ return m.floor; }).join(' and ') + ' those lines need. ' + (s.orchAt97 ? 'The Orchestrator is already on ' + s.orch + ' — see the warning above; their first hop below brings them back inside the bands.' : 'Each is now a step above, before the Orchestrator moves.')] : s.mixed ? ['No', 'You gave the lowest build on each line and every one of them is at or above its own floor.'] : ['Check', 'Mixed lines not ticked. If any appliance sits on a line other than ' + s.ecosLine + ', its floor differs from the one this plan used — tick the box and give them.']; v['zscaler-gre'] = did.zscalerGre ? ['Mitigated by plan', 'Confirming GRE is enabled on the Zscaler account is a step in the plan, before the Orchestrator moves.'] : !cross.orchMoved ? ['No', 'The Orchestrator does not move in this plan, so there is no upgrade for it to fail.'] : chk(s.f.zscaler, 'Zscaler is integrated, and the notes say the Orchestrator upgrade fails outright if the Zscaler account does not have GRE enabled.', 'Zscaler not ticked. If it is integrated, check GRE is enabled on the account before the window - the upgrade fails without it.'); v['restapi-migrate'] = did.restApiMigrate ? ['Mitigated by plan', 'Migrating the integrations is a step in the plan, before the Orchestrator crosses 9.3.0.'] : !cross.orch930 ? ['No', 'The Orchestrator does not cross 9.3.0 in this plan, which is where the APIs changed.'] : chk(s.f.restapi, 'The Orchestrator crosses 9.3.0, where most APIs changed for API-based RBAC. Anything wired into them stops until it is migrated.', 'REST API not ticked. The Orchestrator crosses 9.3.0, so confirm nothing is wired into the old APIs.'); v['aws-wan-automation'] = did.awsWanAutomation ? ['Mitigated by plan', 'Confirming AWS Network Manager access is a step in the plan, before the Orchestrator moves.'] : !cross.orchMoved ? ['No', 'The Orchestrator does not move in this plan, so there is no upgrade for this to interrupt.'] : !ge(cross.orchEnd, c.awsNetworkManager.orchFrom) ? ['No', 'The Orchestrator does not reach ' + c.awsNetworkManager.orchFrom + ', which is the first release carrying this requirement.'] : chk(s.f.awswan, 'The Orchestrator reaches ' + cross.orchEnd + ' with an AWS subscription for WAN automation, and without Network Manager access the note says it may be unable to complete the upgrade.', 'AWS WAN automation not ticked. This is the Orchestrator\'s own AWS subscription, not EC-V instance types — confirm it separately.'); v['aws-imds'] = did.awsImds ? ['Mitigated by plan', 'Confirming IMDSv1 is still enabled is a step in the plan, before the appliances reboot.'] : !cross.ecosMoved ? ['No', 'No appliance moves in this plan, so nothing reboots into it.'] : chk(s.f.aws, 'EC-V in AWS is ticked. Every ECOS note says EC-V does not support IMDSv2, and losing IMDSv1 costs SSH access and appliance initialization.', 'EC-V in AWS not ticked. If any EC-V runs in AWS, confirm IMDSv1 is still enabled before the window.'); var cifsBelow = s.allBuilds.filter(function(b){ return lt(b, c.cifsRemovedFrom); }); v['cifs-accel'] = did.cifsAccelOff ? ['Mitigated by plan', 'Turning off CIFS Protocol Acceleration is a step in the plan, before ECOS ' + cifsBelow.join(' and ') + ' crosses ' + c.cifsRemovedFrom + '.'] : !cross.ecosMoved ? ['No', 'No appliance moves in this plan, so nothing crosses ' + c.cifsRemovedFrom + '.'] : !cifsBelow.length ? ['No', 'Every appliance starts on ' + c.cifsRemovedFrom + ' or later, so CIFS optimization was removed before this plan.'] : ['Check', 'WAN optimization not ticked. If Boost is in use, turn off CIFS Protocol Acceleration in the Optimization Policies template before ECOS ' + cifsBelow.join(' and ') + ' crosses ' + c.cifsRemovedFrom + '.']; v['mschap'] = did.mschapSwitch ? ['Mitigated by plan', 'Moving those logins to PAP, CHAP, OAUTH or SAML is a step in the plan, before the Orchestrator crosses 9.4.1.'] : !cross.orch941 ? (ge(s.orch, '9.4.1') ? ['No', 'Orchestrator ' + s.orch + ' is already past 9.4.1, so any MSCHAP login has already stopped working.'] : ['No', 'This plan does not take the Orchestrator to 9.4.1 or later.']) : chk(s.f.radius, 'The Orchestrator crosses 9.4.1. If those logins use MSCHAP, MSCHAPv2 or EAP-MSCHAPv2 they will fail - move them to PAP or CHAP, or OAUTH or SAML.', 'Not ticked. If Orchestrator logins use TACACS+ or RADIUS, check which method before the window.'); v['ecos-comms-floor'] = s.belowCommsFloor.length ? (function(){ var mainLow = s.belowCommsFloor.some(function(b){ return eq(b, s.ecos); }); var declaredLow = s.belowCommsFloor.filter(function(b){ return !eq(b, s.ecos); }); var who = mainLow ? 'Your appliances on ECOS ' + s.ecos + (declaredLow.length ? ', and the declared ' + declaredLow.join(' and ') + ',' : '') + ' are' : 'The declared ' + declaredLow.join(' and ') + (declaredLow.length > 1 ? ' are' : ' is'); return ['Mitigated by plan', who + ' below ' + c.ecosCommsFloor + ', so the plan takes ' + (mainLow ? 'them' : 'that group') + ' to ' + RULES.level1.ecos8Final + ' before the Orchestrator moves into 9.x. Do not reorder those two.']; })() : ['No', 'ECOS ' + s.ecos + (s.allBuilds.length > 1 ? ' and every declared build' : '') + ' is at or above ' + c.ecosCommsFloor + '.']; v['branch-nat'] = cross.bothWere96Plus ? ['No', 'Both sides are already on 9.6 or later, so this is already in effect.'] : cross.bothOn96Plus ? ['Check', 'Only bites if segmentation is already on and branch NAT rules are configured - those start forwarding once both sides are on 9.6.'] : ['No', !ge(cross.ecosEnd || s.ecos, '9.6.0') ? 'It takes 9.6 on both sides, and your appliances stay below it.' : 'It takes 9.6 on both sides, and your Orchestrator stays below it.']; v['bgp-peer-ip'] = cross.orchOn96Plus ? ['Needs review', 'Audit BGP neighbors for a peer IP reused on two LAN interfaces in the same segment. No version check can settle this one - it is a look at your config.'] : ['No', 'Your Orchestrator stays below 9.6.0.']; v['portal-url'] = cross.orchOn952Plus ? ['Needs review', 'Optional and not changed by this upgrade - staying on portal.silverpeak.cloud is fine and common. Moving is one-way and needs every appliance on ECOS 9.5.2.0+ first.'] : ['No', 'The choice starts at Orchestrator 9.5.2 and yours stays below it.']; v['stats-collector'] = did.statsMigrate ? ['Needs review', 'The snapshot is a step in the plan. It protects the data; it does not migrate it. Decide before the window whether you will run the migration scripts — the notes say if you will not, do not upgrade to 9.6.0 or later.'] : s.oaas ? ['No', 'OaaS - HPE migrates the collector.'] : cross.orch96 ? chk(s.f.stats, 'You cross 9.6.0, so the collector moves to the new database and minute stats do not carry across.', 'Self-hosted collector not ticked. Confirm before crossing 9.6.0.') : cross.orchOn96Plus ? ['No', 'Your Orchestrator is already past ' + c.oneWayDoor + ', so the migration has happened.'] : ['No', 'Your Orchestrator stays below ' + c.oneWayDoor + ' in this plan, and that is where the collector changes.']; var routeSelFrom = '9.6.2.0'; var rsLadder = null; RULES.risks.forEach(function(r){ if(r.id === 'route-selection' && r.ladder) rsLadder = r.ladder; }); var rsOrder = rsLadder ? ' Order from ' + routeSelFrom + ': ' + rsLadder.map(function(x, i){ return (i + 1) + ') ' + x; }).join(' ') + '.' : ''; v['route-selection'] = ge(cross.ecosEnd || s.ecos, routeSelFrom) ? (lt(s.ecos, routeSelFrom) ? [['Yes', 'Needs review'], 'This plan takes your appliances across ' + routeSelFrom + '. Compare AS-path lengths on any prefix reachable two ways — prepending done for the underlay now steers the fabric.' + rsOrder] : [['Yes', 'Needs review'], 'Your appliances are already at or above ' + routeSelFrom + ', so the new order is already choosing your paths. Review AS-paths if it has not been done since.' + rsOrder]) : ['No', 'Your appliances stay below ' + routeSelFrom + ', which is where the order changes.']; v['cert-ipsec'] = did.certToPsk ? ['Mitigated by plan', 'Certificate-based IPSec is in use and the appliances reach 9.7 on this plan, so moving them to pre-shared keys before the rollout and back afterwards are both steps in it.'] : s.tEcos !== '9.7' ? ['No', 'This starts when the appliances reach 9.7, and yours finish on ' + s.tEcos + '.'] : !cross.ecos97 ? ['No', 'Your appliances are already on 9.7, so the mixed-version window this describes is behind them.'] : chk(s.f.cert, 'Certificate-based IPSec in use — convert to pre-shared keys before 9.7.', 'Certificate IPSec not ticked. Confirm before the window.'); v['ecv-memory'] = did.ecvMemory ? ['Mitigated by plan', 'You told us there is a 4 GB EC-V or customized System Limits, so growing the memory — or a lab test on an identical system first — is a step in this plan, before the window.'] : !cross.ecosMoved ? ['No', 'No appliance moves in this plan, so nothing can come up in a reboot loop.'] : chk(s.f.ecvmem, 'A 4 GB EC-V, or one whose System Limits were customized, can come up in a continuous reboot after the upgrade.', 'Not ticked. Worth confirming before the window - the remedy is hypervisor work, and the failure is the appliance not coming back.'); v['appliance-signing'] = !cross.ecosMoved ? ['No', 'No appliance moves in this plan, so nothing crosses the point where this starts to apply.'] : ['Yes', 'Once these appliances land with image signature verification enabled, they can only take builds signed using the HPE Aruba Networking certificate. That constrains rollback and the next upgrade, not this one.']; v['aws-ecv'] = did.awsEcvInventory ? ['Mitigated by plan', 'You have EC-V in AWS and the appliances cross onto the 9.6 line, so the instance-type inventory is a step in this plan — and the ' + c.lilyPad + ' hop it protects is the build carrying the fix.'] : cross.ecos96 ? chk(s.f.aws, 'EC-V in AWS — confirm instance types. The ' + c.lilyPad + ' hop in the plan already carries the fix.', 'No AWS EC-V ticked. Confirm instance types before the window.') : ge(cross.ecosEnd || s.ecos, '9.6.0.0') ? ['No', 'Your appliances are already on the 9.6 line, so this defect has either already bitten or does not apply to your instance types. The ' + c.lilyPad + ' hop still carries the fix.'] : ['No', 'Your appliances never reach the 9.6 line, which is where this defect lives.']; var trapBuilds = '9.4.3.40537 and 9.4.4.40053 or later'; v['orch-95-upgrade-trap'] = s.orchLine !== '9.4' ? ['No', 'Orchestrator ' + s.orch + ' is not on the 9.4 line, which is where this applies.'] : !ge(s.orch, c.orch952Trap.from) ? ['No', 'Orchestrator ' + s.orch + ' is below ' + c.orch952Trap.from + ', where the affected builds begin - the notes name ' + trapBuilds + '.'] : cross.orchEndsOn95 ? ['Mitigated by plan', 'Orchestrator ' + s.orch + ' is at or past ' + c.orch952Trap.from + ' - the notes name ' + trapBuilds + ' - but the plan lands on ' + s.tgt.orch + '+, above the ' + c.orch952Trap.mustReach + ' required. Do not pick a lower 9.5 build.'] : ['No', 'Orchestrator ' + s.orch + ' is at or past ' + c.orch952Trap.from + ' - the notes name ' + trapBuilds + ' - but this plan does not stop on the 9.5 line.']; v['ssh-ciphers'] = s.oaas ? ['No', 'OaaS - HPE holds the Orchestrator backups.'] : cross.orchSshCiphers ? chk(false, '', 'Your Orchestrator crosses ' + sshCiphersFloor(cross.orchEnd) + ' on the ' + line(cross.orchEnd) + ' line, where ssh-rsa, ssh-dss and the CBC ciphers were retired for backup uploads. If backups go to SFTP or SCP, check the target still offers a cipher that has not been retired.') : sshCiphersRetired(s.orch) ? ['No', 'Orchestrator ' + s.orch + ' is already past ' + sshCiphersFloor(s.orch) + ', where its line retired those ciphers, so any backup target still working is unaffected.'] : ['No', 'Your Orchestrator stays below the build where its line retires those ciphers — ' + Object.keys(c.sshCiphersFrom).sort(function(a, b){ return cmp(parseV(a + '.0'), parseV(b + '.0')); }) .map(function(L){ return c.sshCiphersFrom[L] + ' on ' + L; }).join(', ') + ' and later.']; v['db-passwords'] = s.oaas ? ['No', 'OaaS - no VM of yours to hold credentials.'] : cross.orch96 ? chk(false, '', 'Your Orchestrator crosses ' + c.oneWayDoor + ', which gives the VM its own database password. Keep that file with the backup, not only on the VM.') : cross.orchOn96Plus ? ['No', 'Your Orchestrator is already past ' + c.oneWayDoor + ', so the password file already exists.'] : ['No', 'Your Orchestrator stays below ' + c.oneWayDoor + '.']; v['ecv-disk'] = !cross.ecos97 ? (s.tEcos === '9.7' ? ['No', 'Your appliances are already on 9.7, so any EC-V short of disk would have failed getting there.'] : ['No', 'The requirement starts when the appliances reach 9.7, and yours finish on ' + s.tEcos + '.']) : ['Check', 'Any EC-V reaching 9.7 needs a 60GB disk. Check the long-lived ones: an EC-V built from an old 30GB OVF keeps that disk through every in-place upgrade.']; var ecosRests96 = s.tEcos === '9.6'; var orchRests96 = line(cross.orchEnd || s.orch) === '9.6'; v['96-ssr'] = ecosRests96 ? ['Yes', 'You have chosen to stop the appliances on the 9.6 line, the one Short Supported Release — End of Maintenance ' + RULES.streams['9.6'].eom + ', after which fixes and CVE patches arrive only on 9.7. ' + 'Moving on later is one more Orchestrator hop and one more appliance hop.'] : orchRests96 ? ['Yes', 'The appliances finish on ' + s.tEcos + ' and never rest on 9.6, but your Orchestrator does — a Short Supported Release, ' + 'End of Maintenance ' + RULES.streams['9.6'].eom + '. Nothing in this plan moves it off; taking it to 9.7.1+ is its own piece of work.'] : s.tEcos === '9.7' ? (lt(s.ecos, c.lilyPadFloor) ? ['Mitigated by plan', 'The plan passes the appliances through ' + c.lilyPad + ' and does not rest them on the 9.6 line.'] : ['No', 'Your appliances are already at or above ' + c.lilyPadFloor + ', so this plan has no 9.6 hop in it at all.']) : ['No', 'Neither the appliances nor the Orchestrator come to rest on 9.6.']; var restEcos = ge(s.ecos, s.tgt.ecos) ? s.ecos : s.tgt.ecos; v['newer-patch'] = ['Your call', 'This plan leaves the Fabric on the ' + line(restEcos) + ' line, at ' + restEcos + ' or later. Take the newest build on that line — the + already allows it. If you are stable and nothing ' + 'the newer builds fix describes what you run, staying put is legitimate; make it a decision.']; return v; } function questions(s, plan){ var c = RULES.constants, q = []; var cross = (plan && plan.cross) || {}; if(s.orchBehind){ q.push(['Is the Orchestrator really on ' + s.orch + ' while appliances are on ' + s.orchBehindBuild + '?', 'These two do not go together: an Orchestrator below ' + s.orchBehindNeeds + ' could not have put appliances on that build. ' + 'If the Orchestrator number is wrong, everything below changes with it, because the plan is ordered around where the Orchestrator starts.']); } if(s.mixedEmpty){ q.push(['Which builds are on the other release lines?', 'You ticked more than one release line and listed none, so the plan is built from ' + s.ecos + ' alone. Another line has its own floor and can need a first move this plan does not show. ' + 'Give the lowest build on each line and rebuild.']); } else if(s.mixed){ var declaredLines = Object.keys(s.mixedLines).concat([s.ecosLine]) .filter(function(v, i, a){ return a.indexOf(v) === i; }) .sort(function(a, b){ return cmp(parseV(a + '.0'), parseV(b + '.0')); }); q.push(['Are there appliances on any line other than ' + declaredLines.slice(0, -1).join(', ') + (declaredLines.length > 1 ? ' and ' : '') + declaredLines[declaredLines.length - 1] + '?', 'The plan is built from the lowest build you gave on each of those lines. A line not in the list has its own floor ' + 'and can need a first move this plan does not show. If there is one, add its lowest build and rebuild.']); } else { q.push(['Is every appliance on the ' + s.ecosLine + ' line?', s.tOrch === '9.7' ? 'The plan is built from ' + s.ecos + '; appliances above it on the same line take the same steps. ' + 'A different line has its own floor — ' + Object.keys(c.orchLeadFloors).map(function(k){ return c.orchLeadFloors[k] + ' on ' + k; }).join(', ').replace(/, ([^,]*)$/, ' and $1') + ' — ' + 'and can need a first move this plan does not show. List what is out there by line.' : 'The plan is built from ' + s.ecos + '; appliances above it take the same steps. What it cannot see is a hazardous build elsewhere — the boot-loop band spans the 9.4 and 9.5 lines, so one appliance in it needs the pre-step even when the lowest build does not.']); } if(bootLoopExactBuildAsk(s)){ var askBuild = bootLoopExactBuildAsk(s); q.push(['Which exact ' + askBuild + ' build is it?', 'The fix for defect ' + c.bootLoopDefect + ' landed in ' + c.bootLoopFixed94 + '. Below that, the boot-loop exposure is live now, not only during the upgrade.']); } var orchOld = lt(s.orch, RULES.level1.belowLine); if(s.selfHosted && !s.centos && !orchOld){ q.push(['Is the Orchestrator genuinely on Rocky Linux?', 'The version number does not tell you. If it is actually CentOS, the Rocky rebuild goes into the plan before the Orchestrator moves on.']); } var t97 = null; RULES.targets.forEach(function(t){ if(t.id === '9.7') t97 = t; }); if(s.target === '9.7' && t97 && t97.ga === false){ q.push(['Has the 9.7 target build gone GA?', 'The 9.7 route is drawn ahead of the release. Confirm the recommended GA build before you schedule anything.']); } if(s.tOrch === '9.4' && s.centos && lt(s.tgt.orch, c.rockyRequiredFrom['9.4'])){ q.push(['Does a ' + s.tgt.orch + ' Orchestrator strictly require Rocky Linux?', 'The sources disagree over 9.4.0–9.4.8 and the plan does not settle it — the migration is in the plan either way. CentOS 7 went end-of-life 30 June 2024, and CentOS Orchestrators on the 9.4 line have caused real trouble in the field.']); } if(s.antiReplay === 'unknown'){ q.push(['Is ECOS ' + antiReplayNames(s, 'unknown').replace(/ (is|are)$/, '') + ' actually anti-replay affected?', 'It is named in neither the affected ranges nor the safe floors. If it is, the precaution moves from advisable to required; disabling IPSec key rotation for the rollout settles it either way.']); } if(s.ecos8 && s.ecos.indexOf('8.1') !== 0){ q.push(['Does a Fabric already on ECOS ' + s.ecos + ' still need the 8.1 baseline?', 'The 8.x column is written for 8.1.x. The plan skips any 8.x hop you are past and goes straight to ' + RULES.level1.ecos8Final + ', so you start with no rollback point below it.']); } if(s.level1 && s.orch8){ q.push(['What is the Orchestrator on today, exactly?', 'The step to ' + RULES.level1.orch8Final + ' is drawn as one hop with no floor beneath it. A much older 8.x Orchestrator may need its own stepping stone — a release-note question, not a chart one.']); } if((s.antiReplay === 'applies' || s.antiReplay === 'unknown') && !s.tunnelSure){ q.push(['What tunnel mode is the Fabric actually running?', 'Half of the anti-replay test. Left at \x3cem>Not sure\x3c/em> the planner assumes IPSec UDP and keeps the precaution in — the safe way round, but possibly a step you do not need. Confirm it and the risk firms up or drops out.']); } else if(s.tunnelSure && !s.f.udp && s.antiReplayIfUdp !== 'safe'){ q.push(['Is every tunnel really not IPSec UDP?', 'It is the half of the anti-replay test that rules the risk out, so a single overlay still on IPSec UDP puts it back. If any are, change the dropdown and rebuild the plan.']); } if(s.level1 && s.selfHosted && !s.centos && orchOld){ var rockyFirsts = Object.keys(c.rockyCapableFrom).sort(function(a, b){ return cmp(parseV(a + '.0'), parseV(b + '.0')); }) .map(function(k){ return c.rockyCapableFrom[k] + '+'; }); q.push(['A self-hosted Orchestrator this old, already on Rocky Linux?', 'Rocky only became available at ' + rockyFirsts.slice(0, -1).join(', ') + ' and ' + rockyFirsts[rockyFirsts.length - 1] + ', so it is possible but worth confirming. If it is really CentOS, the staging hop and the VM rebuild go into the plan.']); } var unticked = []; if(!s.f.fips) unticked.push('FIPS or CC mode'); if(!s.f.radius && cross.ecosRadiusAuth) unticked.push('RADIUS'); if(!s.f.stats && !s.oaas && cross.orch96) unticked.push('self-hosted Statistics Collector'); if(!s.f.cert && cross.ecos97) unticked.push('certificate-based IPSec'); if(!s.f.aws && cross.ecos96) unticked.push('AWS EC-V'); if(!s.f.ecus && (s.tEcos === '9.7' || s.tEcos === '9.6')) unticked.push('EC-US appliances'); if(!s.f.ecxs && s.tEcos !== '9.4') unticked.push('EC-XS appliances'); if(!s.f.boost && cross.ecosMoved && s.allBuilds.some(function(b){ return lt(b, c.cifsRemovedFrom); })) unticked.push('Boost'); if(unticked.length){ q.push(['Confirm what was left unticked: ' + unticked.join(', ') + '.', 'Each is reported as Check rather than ruled out. Each one present adds a row to the risk table and, where there is something to do about it, a step to the plan.']); } return q; } function guides(s, plan){ var c = RULES.constants; return RULES.guides.filter(function(g){ if(g.id === 'orch-upgrade') return plan.orchMoved; if(g.id === 'centos-rocky') return s.centos; if(g.id === 'release-notes') return !plan.nothingToDo; if(g.id === 'whats-new') return plan.orchMoved && ge((plan.cross || {}).orchEnd || s.orch, c.oneWayDoor); if(g.id === 'route-selection') return plan.ecosMoved && lt(s.ecos, '9.6.2.0') && ge((plan.cross || {}).ecosEnd || s.ecos, '9.6.2.0'); if(g.id === 'before-window' || g.id === 'post-window') return !plan.nothingToDo; return false; }); } var LAST = null; function sigCell(id, what){ return '\x3ctd class="sg">\x3cinput type="text" class="sig" id="upp-' + id + '"' + ' aria-label="' + htmlEsc(what || 'Sign-off') + '" title="' + htmlEsc(what || 'Sign-off') + '" autocomplete="off" />\x3c/td>'; } function sigKey(text){ var s = String(text || '').replace(/\x3c[^>]+>/g, ' ').replace(/&[a-z]+;/gi, ' ') .replace(/[^A-Za-z0-9]+/g, '').toLowerCase(); var h = 0; for(var i = 0; i < s.length; i++){ h = ((h << 5) - h + s.charCodeAt(i)) | 0; } return s.slice(0, 18) + Math.abs(h).toString(36); } function sigVal(id){ var e = document.getElementById('upp-' + id); return e && e.value ? e.value.trim() : ''; } function riskSigKey(r, d){ return sigKey(r.id + '|' + pillTags(d[0]).join('+') + '|' + String(d[1] || '') + '|' + String(r.detail || '')); } function groupSigKey(g){ return sigKey(g.line + '|' + g.build + '|' + g.route.join('>')); } function questionSigKey(q){ return sigKey(String(q[0]) + '|' + String(q[1] || '')); } function riskExportCell(r){ var det = String(r.detail || ''); if(det.indexOf('@LADDER@') !== -1){ det = det.replace('@LADDER@', (r.ladder || []).map(function(x, i){ return (i + 1) + ') ' + x; }).join(' ')); } return strip('\x3cstrong>' + r.risk + '\x3c/strong>' + (det ? '\x3cdiv class="hint">' + det + '\x3c/div>' : '')); } function sigSnapshot(){ var m = {}, els = document.querySelectorAll('#upp-out .sig'); for(var i = 0; i < els.length; i++){ if(els[i].value) m[els[i].id] = els[i].value; } return m; } function sigRestore(m){ for(var k in m){ var e = document.getElementById(k); if(e) e.value = m[k]; } } function pillTags(verdict){ return Object.prototype.toString.call(verdict) === '[object Array]' ? verdict : [verdict]; } function pillClass(tag){ return tag === 'Yes' ? 'yes' : tag === 'No' ? 'no' : tag === 'Check' ? 'chk' : tag === 'Irreversible' ? 'irr' : tag === 'Needs review' ? 'rev' : 'rtd'; } function riskApplies(d){ var t = pillTags(d[0]); return !(t.length === 1 && t[0] === 'No'); } function riskIsPrompt(d){ var t = pillTags(d[0]); return t.length === 1 && t[0] === 'Check'; } var RISK_WEIGHT = { 'Yes': 0, 'Needs review': 1, 'Irreversible': 2, 'Mitigated by plan': 3, 'Check': 4, 'No': 5 }; function riskRank(d){ var t = pillTags(d[0]), best = 9; for(var i = 0; i < t.length; i++){ var w = RISK_WEIGHT[t[i]]; if(w !== undefined && w < best) best = w; } return best; } function sortRisks(list, v){ return list.map(function(r, i){ return { r: r, i: i, w: riskRank(v[r.id]) }; }) .sort(function(a, b){ return a.w - b.w || a.i - b.i; }) .map(function(x){ return x.r; }); } function lineGroups(s, steps){ if(!s.mixed) return []; var lines = Object.keys(s.mixedLines); var builds = {}; lines.forEach(function(ln){ builds[ln] = s.mixedLines[ln]; }); if(!builds[s.ecosLine] || lt(s.ecos, builds[s.ecosLine])) builds[s.ecosLine] = s.ecos; var rows = (s.allBuilds || [s.ecos]).slice(); rows.sort(function(a, b){ return cmp(parseV(a), parseV(b)); }); if(rows.length < 2) return []; var ecosSteps = []; steps.forEach(function(x, i){ if(x.w !== WHO_EC) return; var perLine = /-line appliances/.test(x.a); var to = String(x.m).split('→')[1]; if(!to) return; to = to.replace(/\+/g, '').replace(/—/g, '').trim(); if(!parseV(to)) return; var froms = String(x.m).split('→')[0].replace(/\+/g, '').split(',').map(function(f){ return f.trim(); }).filter(parseV); ecosSteps.push({ n: i + 1, to: to, plus: String(x.m).indexOf('+') !== -1, onlyFroms: perLine && froms.length ? froms : null }); }); return rows.map(function(from){ var ln = line(from), cur = from, route = [], nums = []; ecosSteps.forEach(function(st){ if(st.onlyFroms && !st.onlyFroms.some(function(f){ return eq(f, cur); })) return; if(ge(cur, st.to)) return; route.push(st.to + (st.plus ? '+' : '')); nums.push(st.n); cur = st.to; }); return { line: ln, build: from, route: route, nums: nums, lowest: ln === s.ecosLine && eq(from, builds[ln]) }; }); } function orchEndsOn(s){ var stays = ge(s.orch, s.tgt.orch); return { stays: stays, line: stays ? s.orchLine : s.tOrch, build: stays ? s.orch : s.tgt.orch + '+' }; } function streamClause(id){ var x = RULES.streams[id]; if(!x || !x.class) return id + ' has no lifecycle data in this tool'; return (x.eom && x.eom !== 'not yet published') ? id + ' is an ' + x.class + ' maintained to ' + x.eom : id + ' is an ' + x.class + ', no End of Maintenance date yet'; } function streamShort(id){ var x = RULES.streams[id]; return (x && x.class) ? x.class + ', EoM ' + x.eom : 'no lifecycle data'; } function landingLine(s, st){ var known = st.eom && st.eom !== 'not yet published'; var heldBack = s.f.ec10150 && s.tEcos === RULES.constants.ec10150.barredLine; var except = heldBack ? ', except the EC-10150s, which stay on 9.5' : ''; if(s.split){ var oe = orchEndsOn(s); if(oe.line === s.tEcos){ return 'Orchestrator ' + oe.build + ' and ECOS ' + s.tgt.ecos + '+ — both on the ' + oe.line + ' line' + except + '; the Orchestrator was already there and stays. ' + streamClause(oe.line) + '. ' + RULES.eomMeaning; } return 'Orchestrator ' + oe.build + ' on the ' + oe.line + ' line, appliances ' + s.tgt.ecos + '+ on the ' + s.tEcos + ' line' + except + ' — not a matched pair, by choice; the Orchestrator is always allowed to lead. ' + 'Two streams to track: ' + streamClause(oe.line) + ', and ' + streamClause(s.tEcos) + '. ' + RULES.eomMeaning; } return (s.orchAhead ? 'Orchestrator ' + s.orch + ' and ECOS ' + s.tgt.ecos + '+ — the Orchestrator stays a line ahead on ' + s.orchLine + '; the appliances land on ' + s.target + except + '. ' : 'Orchestrator ' + s.tgt.orch + '+ and ECOS ' + s.tgt.ecos + '+ — a matched pair on the ' + s.target + ' line' + except + '. ') + (known ? s.target + ' is an ' + st.class + ' maintained to ' + st.eom + '. ' + RULES.eomMeaning : s.target + ' is an ' + st.class + ' with no End of Maintenance date published yet. ' + 'When one is set, the systems keep running normally past it; what stops is new builds on that branch.'); } function render(){ var keepSigs = sigSnapshot(); var eo = document.getElementById('upp-orch'), ee = document.getElementById('upp-ecos'); var errEl = document.getElementById('upp-err'), out = document.getElementById('upp-out'); eo.classList.remove('bad'); ee.classList.remove('bad'); errEl.innerHTML = ''; out.style.display = 'none'; ['upp-copy', 'upp-dl-html', 'upp-dl-md'].forEach(function(id){ document.getElementById(id).disabled = true; }); var po = typedShapeOk(eo.value) ? parseV(stripBuildSuffix(eo.value)) : null; var pe = typedShapeOk(ee.value) ? parseV(stripBuildSuffix(ee.value)) : null; if(!po || !pe){ if(!po) eo.classList.add('bad'); if(!pe) ee.classList.add('bad'); var badFields = []; if(!po) badFields.push({ label: 'Orchestrator version', got: String(eo.value || '').trim() }); if(!pe) badFields.push({ label: 'ECOS version', got: String(ee.value || '').trim() }); var blank = badFields.filter(function(f){ return !f.got; }); var typo = badFields.filter(function(f){ return !!f.got; }); var msg = ''; if(typo.length){ msg += '\x3cstrong>' + typo.map(function(f){ return f.label; }).join(' and ') + ': that is not a version number.\x3c/strong> You entered ' + typo.map(function(f){ return '\x3ccode>' + htmlEsc(f.got) + '\x3c/code>'; }).join(' and ') + '.\x3cbr>\x3cbr>Copy it from Orchestrator exactly as shown, dots and all — ' + '\x3ccode>9.4.2\x3c/code> or \x3ccode>9.4.2.40649\x3c/code> for the Orchestrator, ' + '\x3ccode>9.4.2.5\x3c/code> or \x3ccode>9.4.2.5_100146\x3c/code> for an appliance. ' + 'A build number on the end is fine.\x3cbr>\x3cbr>' + 'The usual slip is losing the dots inside the version while keeping the build number, ' + 'which turns \x3ccode>9.4.2.40649\x3c/code> into \x3ccode>942.40649\x3c/code> — ' + 'and \x3ccode>942\x3c/code> could mean 9.4.2 or 9.42, so this planner will not assume which.'; } if(blank.length){ msg += (msg ? '\x3cbr>\x3cbr>' : '') + '\x3cstrong>' + blank.map(function(f){ return f.label; }).join(' and ') + (blank.length > 1 ? ': both are empty.' : ': this is empty.') + '\x3c/strong> ' + 'Fill it in as \x3ccode>9.4.2\x3c/code> or \x3ccode>9.5.8.0\x3c/code>.'; } errEl.innerHTML = '\x3cdiv class="callout stop">' + msg + '\x3c/div>'; return; } var vOrch = normV(eo.value), vEcos = normV(ee.value); var s = readForm(); var belowScope = s.allBuilds.filter(function(b){ return lt(b, RULES.scope.minEcos); }); if(lt(vOrch, RULES.scope.minOrch) || belowScope.length){ errEl.innerHTML = '\x3cdiv class="callout stop">\x3cstrong>Below the scope of this planner.\x3c/strong> ' + RULES.scope.belowScope + (belowScope.length && !lt(vEcos, RULES.scope.minEcos) ? ' The declared ' + belowScope.map(htmlEsc).join(' and ') + (belowScope.length > 1 ? ' are' : ' is') + ' below it.' : '') + '\x3c/div>'; return; } var rockyReq = RULES.constants.rockyRequiredFrom; var hostIsCentos = document.getElementById('upp-host').value === 'centos'; if(hostIsCentos && ge(vOrch, rockyReq['9.4'])){ var orchLn = line(vOrch); var ownReq = rockyReq[orchLn] || null; var lineReq = ownReq || (ge(vOrch, '9.7.0') ? rockyReq['9.6'] : null); if(lineReq && ge(vOrch, lineReq)){ errEl.innerHTML = '\x3cdiv class="callout stop">\x3cstrong>Check the version and the hosting answer.\x3c/strong> ' + 'The Orchestrator notes require a move to Rocky Linux \x3cem>before\x3c/em> upgrading to ' + lineReq + ' or later' + (ownReq ? (orchLn !== '9.4' ? ' on the ' + orchLn + ' line' : '') : ' — which is before any ' + orchLn + ' build') + ', ' + 'so an Orchestrator on ' + htmlEsc(vOrch) + ' that is still on CentOS is an upgrade run against the notes, and this planner has no published route to draw from it. ' + 'A misread radio button or a mistyped version is the likelier explanation — a CentOS Orchestrator below ' + rockyReq['9.4'] + ' does get a route here.\x3c/div>'; return; } errEl.innerHTML = '\x3cdiv class="callout stop">\x3cstrong>No CentOS route is drawn above the 9.4 line.\x3c/strong> ' + 'Every route this planner draws from the ' + orchLn + ' line assumes the Orchestrator is already on Rocky Linux, and the notes require it from ' + lineReq + ' onward. ' + 'If this Orchestrator really is on CentOS at ' + htmlEsc(vOrch) + ', migrate it first — build the Rocky VM at the build it is on now and move onto it, using the CentOS to Rocky guide — ' + 'then re-run this planner with Rocky Linux selected. Do not upgrade it on CentOS first.\x3c/div>'; return; } if(ge(vOrch, '9.0') && s.belowCommsFloor.length){ var declaredLow = s.belowCommsFloor.filter(function(b){ return !eq(b, s.ecos); }); var lowNames = s.belowCommsFloor.map(htmlEsc).join(' and '); errEl.innerHTML = '\x3cdiv class="callout stop">\x3cstrong>These two cannot be talking to each other.\x3c/strong> ' + 'An Orchestrator on ' + htmlEsc(vOrch) + ' cannot manage appliances below ECOS ' + RULES.constants.ecosCommsFloor + ', so appliances on ' + lowNames + (declaredLow.length ? (declaredLow.length === s.belowCommsFloor.length ? ' — a declared group, not the main box —' : ' — including a declared group —') : '') + ' have already lost contact with it and cannot be upgraded from Orchestrator. ' + 'Get them to ' + RULES.constants.ecosCommsFloor + '+ by other means first — or re-check the versions, ' + 'because a typo is the more likely explanation.\x3c/div>'; return; } if(s.mixedUnderMain && s.mixedUnderMain.length){ errEl.innerHTML = '\x3cdiv class="callout stop">\x3cstrong>The lowest build has to go in the EdgeConnect box.\x3c/strong> You listed ' + s.mixedUnderMain.map(htmlEsc).join(' and ') + ', which is below the \x3ccode>' + htmlEsc(s.ecos) + '\x3c/code> in the EdgeConnect box. The route, the risks and the per-line floors are all set by the lowest ' + 'appliance in the Fabric, so no plan is drawn from the wrong one: put ' + htmlEsc(s.mixedUnderMain[0]) + ' in that box, move ' + htmlEsc(s.ecos) + ' into the mixed-line list, and build the plan again.\x3c/div>'; return; } var tl = parseV(s.tEcos), el = parseV(s.ecosLine); var aboveTarget = []; Object.keys(s.lineLowest).forEach(function(ln){ if(cmp(parseV(ln), tl) > 0) aboveTarget.push({ line: ln, build: s.lineLowest[ln] }); }); aboveTarget.sort(function(a, b){ return a.line < b.line ? -1 : 1; }); if(cmp(el, tl) > 0 || aboveTarget.length){ var names = aboveTarget.map(function(a){ return a.build + ' on the ' + a.line + ' line'; }).join(', and '); errEl.innerHTML = '\x3cdiv class="callout stop">\x3cstrong>That destination is behind the Fabric.\x3c/strong> You asked for the appliances to finish on \x3cem>' + s.tEcos + '\x3c/em>, but ' + (aboveTarget.length > 1 ? 'some are already past it: ' : 'they are already on ') + (names || s.ecosLine) + '. There is no supported way back down a line — pick a destination at or above where the Fabric is.\x3c/div>'; return; } var needOrchForTarget = needOrchFor(s.tgt.ecos); if(needOrchForTarget && !ge(s.tgt.orch, needOrchForTarget)){ errEl.innerHTML = '\x3cdiv class="callout stop">\x3cstrong>Those two destinations cannot both be true.\x3c/strong> ' + 'ECOS ' + s.tgt.ecos + ' needs Orchestrator ' + needOrchForTarget + ' or later to install, and you have asked the ' + 'Orchestrator to finish on ' + s.tOrch + ' (' + s.tgt.orch + '). Take the Orchestrator at least to ' + needOrchForTarget + ', or stop the appliances on an earlier line.\x3c/div>'; return; } var orchFinishesOn = ge(s.orch, s.tgt.orch) ? s.orch : s.tgt.orch; var crossStream = crossStreamNeedFor(s.tgt.ecos, orchFinishesOn); if(crossStream && !crossStream.ok){ errEl.innerHTML = '\x3cdiv class="callout stop">\x3cstrong>Those two destinations cannot both be true.\x3c/strong> ' + 'ECOS ' + s.tgt.ecos + ' requires Orchestrator ' + crossStreamWording(crossStream.map) + ', and Orchestrator ' + orchFinishesOn + ' is not one of those. ' + (ge(s.orch, s.tgt.orch) ? 'Yours is already on ' + s.orch + ', past the ' + s.tOrch + ' you asked it to finish on, so this plan does not move it at all — ' + 'the appliances would be installing from ' + s.orch + '. ' : '') + 'Take the Orchestrator to ' + crossStream.floor + ' or later, or stop the appliances on an earlier build.\x3c/div>'; return; } var landingFloor = RULES.constants.orchLeadFloors[s.tEcos]; if(s.tOrch === '9.7' && landingFloor && lt(s.tgt.ecos, landingFloor)){ errEl.innerHTML = '\x3cdiv class="callout stop">\x3cstrong>Those two destinations cannot both be true.\x3c/strong> ' + 'An Orchestrator on 9.7 manages ECOS below ' + landingFloor + ' on the ' + s.tEcos + ' line only through the Cloud Portal, and this plan would leave the appliances on ' + s.tgt.ecos + ', dependent on it from the moment ' + 'the Orchestrator crossed. Take the appliances to ' + landingFloor + ' or later, or stop the Orchestrator short of 9.7.\x3c/div>'; return; } var plan = buildPlan(s), steps = plan.steps; var v = verdicts(s, plan), qs = questions(s, plan), gs = guides(s, plan); var st = RULES.streams[s.target] || {}; var h = []; var caveatGuide = RULES.guides.filter(function(g){ return g.id === RULES.caveat.linkGuide; })[0]; h.push('\x3cdiv class="callout warn">\x3cstrong>' + RULES.caveat.head + '\x3c/strong> ' + RULES.caveat.body + (caveatGuide ? ' \x3ca href="' + caveatGuide.url + '">' + caveatGuide.name + '\x3c/a>.' : '') + '\x3c/div>'); if(s.orchBehind){ h.push('\x3cdiv class="callout stop">\x3cstrong>Check these two numbers before you go any further.\x3c/strong> ' + 'An Orchestrator on ' + s.orch + ' could not have put appliances on ECOS ' + s.orchBehindBuild + ': ' + 'HPE publishes the minimum Orchestrator for each ECOS build, and ECOS ' + s.orchBehindBuild + ' requires ' + s.orchBehindNeeds + ' or later. ' + 'The likeliest explanation is that one number is misread or the two are the wrong way round. ' + 'The plan below is drawn from the Orchestrator version, so if that is wrong, so is the plan. ' + 'If both are right — an Orchestrator restored from an old backup is the usual way — bring the Orchestrator ' + 'back up to at least ' + s.orchBehindNeeds + ' before anything else.\x3c/div>'); } if(s.unmanagedNow && s.unmanagedNow.length){ var uw = unmanagedWarning(s); h.push('\x3cdiv class="callout stop">\x3cstrong>' + uw.head + '\x3c/strong> ' + uw.body + '\x3c/div>'); } if(plan.blocked && plan.blocked.length){ h.push('\x3cdiv class="callout stop">\x3cstrong>Do not schedule this plan as it stands.\x3c/strong> ' + plan.blocked.map(function(b){ return 'Step landing on ECOS ' + b.to + ' cannot be pushed from the Orchestrator on ' + b.orch + ' — that build requires Orchestrator ' + b.wording + '.'; }).join(' ') + ' The planner should never draw this; treat the plan as unverified and raise it with HPE before any window is booked.\x3c/div>'); } if(KNOWN_ORCH_MAX && orchAboveKnown(s.orch)){ h.push('\x3cdiv class="callout warn">\x3cstrong>That Orchestrator version is above every build this tool knows.\x3c/strong> ' + '\x3ccode>' + s.orch + '\x3c/code> is newer than ' + KNOWN_ORCH_MAX + ', the newest Orchestrator build in this tool\'s rules, ' + 'so the likely reason is a release published since. The plan below still holds: every floor and one-way door in it ' + 'is decided by comparing version numbers. What this tool cannot know is anything the new release changed, so check its ' + 'release notes for a floor or a known issue of its own.\x3c/div>'); } if(s.rockyImpossible){ h.push('\x3cdiv class="callout stop">\x3cstrong>Check how the Orchestrator is really hosted.\x3c/strong> ' + 'You answered Rocky Linux, but an Orchestrator on ' + s.orch + ' cannot be running it: ' + 'no Rocky build exists at or below that version — the first is ' + rockyFirstBuild() + ', on the ' + line(rockyFirstBuild()) + ' line.' + ' The machine is most likely on CentOS. The plan below is drawn for a Rocky host, so it leaves out the ' + 'CentOS migration, which is the step the whole route is ordered around. Re-run it with CentOS selected.\x3c/div>'); } if(s.rockyNoImage){ h.push('\x3cdiv class="callout warn">\x3cstrong>Confirm the Orchestrator is really on Rocky Linux.\x3c/strong> ' + 'You answered Rocky Linux, but no Rocky install image was published for ' + s.orch + ' — the first on the ' + line(s.orch) + ' line is ' + s.rockyNeeds + '. That is possible only if the VM was built on Rocky at an earlier build and the ' + 'Orchestrator application was upgraded in place; an Orchestrator installed at ' + s.orch + ' is on CentOS. ' + 'Check with \x3ccode>cat /etc/redhat-release\x3c/code> on the server. If it is CentOS, re-run with CentOS selected — ' + 'the plan below leaves out the migration that Orchestrator needs.\x3c/div>'); } if(s.ecosNewer){ var nList = s.ecosNewerList.map(function(v){ return '\x3ccode>' + v + '\x3c/code>'; }).join(' and '); var nOne = s.ecosNewerList.length === 1; h.push('\x3cdiv class="callout warn">\x3cstrong>' + (nOne ? 'That ECOS build is newer than this tool\'s list.' : 'Those ECOS builds are newer than this tool\'s list.') + '\x3c/strong> ' + nList + (nOne ? ' is above' : ' are above') + ' every build on the compatibility page this tool was built from, ' + 'so the likely reason is a release published since, not a typo. The plan below still holds: every floor and ' + 'stepping stone in it is decided by comparing version numbers. What this tool cannot know is anything the new ' + 'release changed, so check its release notes for a floor or a known issue of its own.\x3c/div>'); } if(s.ecosUnknown){ var uList = s.ecosUnknownList.map(function(v){ return '\x3ccode>' + v + '\x3c/code>'; }).join(' and '); var uOne = s.ecosUnknownList.length === 1; h.push('\x3cdiv class="callout warn">\x3cstrong>' + (uOne ? 'That ECOS build is not one HPE lists.' : 'Those ECOS builds are not ones HPE lists.') + '\x3c/strong> ' + uList + (uOne ? ' does not appear' : ' do not appear') + ' in the compatibility page this tool was built from, ' + 'and the usual reason is a typo. The plan below is still drawn, because a build released after the page would ' + 'look exactly like this — but check ' + (uOne ? 'the number' : 'them') + ' against ' + 'Support > Software Downloads before you rely on it. Everything under it is reasoned from ' + (uOne ? 'that build' : 'those builds') + '.\x3c/div>'); } h.push('\x3ch2>Current state\x3c/h2>\x3ctable>\x3ctr>\x3cth>Component\x3c/th>\x3cth>Version\x3c/th>\x3cth>Notes\x3c/th>\x3c/tr>'); h.push('\x3ctr>\x3ctd>Orchestrator\x3c/td>\x3ctd>\x3ccode>' + s.orch + '\x3c/code>\x3c/td>\x3ctd>' + (s.oaas ? (lt(s.orch, RULES.constants.oaasSelfServiceFrom) ? 'Cloud / OaaS, but \x3cstrong>below ' + RULES.constants.oaasSelfServiceFrom + '\x3c/strong> — the self-service dropdown does not cover you. Raise an HPE support case to get the Orchestrator moved.' : 'Cloud / OaaS. The upgrade is self-service — you pick the target in the UI, no HPE ticket.') : 'Self-hosted on ' + (s.centos ? '\x3cstrong>CentOS\x3c/strong>' : 'Rocky Linux') + '.') + (s.orchBehind ? ' \x3cstrong>Below the ' + s.orchBehindNeeds + ' that the appliances\' own build required\x3c/strong> — see above.' : '') + '\x3c/td>\x3c/tr>'); h.push('\x3ctr>\x3ctd>EdgeConnect — lowest in the Fabric\x3c/td>\x3ctd>\x3ccode>' + s.ecos + '\x3c/code>\x3c/td>\x3ctd>On the ' + s.ecosLine + ' line.' + (bootLoopStateNote(s) ? ' \x3cstrong>' + bootLoopStateNote(s) + '.\x3c/strong>' : '') + '\x3c/td>\x3c/tr>'); var orchStaysPut = ge(s.orch, s.tgt.orch); var destCell = (orchStaysPut ? s.orch : s.tgt.orch + '+') + ' / ' + s.tgt.ecos + '+'; var oeD = orchEndsOn(s); h.push('\x3ctr>\x3ctd>Destination\x3c/td>\x3ctd>\x3ccode>' + destCell + '\x3c/code>\x3c/td>\x3ctd>' + (orchStaysPut ? 'The Orchestrator is already at or above the ' + s.tgt.orch + ' this needs, so it stays on ' + s.orch + ' — appliance work only. ' : '') + (s.split ? 'Orchestrator on ' + oeD.line + ' (' + streamShort(oeD.line) + '), appliances on ' + s.tEcos + ' (' + streamShort(s.tEcos) + ').' : s.tgt.label + '. ' + st.class + ', End of Maintenance ' + st.eom + '.') + '\x3c/td>\x3c/tr>\x3c/table>'); h.push('\x3ch2>The one thing that drives the plan\x3c/h2>\x3cp>' + driver(s, plan) + '\x3c/p>'); h.push('\x3ch2>The plan\x3c/h2>'); if(plan.nothingToDo){ h.push('\x3cdiv class="callout ok">\x3cstrong>Already there — no upgrade steps.\x3c/strong> Both sides are at or above the ' + s.target + ' target. Do not turn Verify Image Signature off' + (ge(s.orch, RULES.constants.oneWayDoor) ? '. Your Orchestrator is already past ' + RULES.constants.oneWayDoor + ', so that door is behind you.' : ', and do not take the Orchestrator any further: past ' + RULES.constants.oneWayDoor + ' there is no way back.') + '\x3c/div>'); } else { h.push('\x3ctable>\x3ctr>\x3cth class="n">#\x3c/th>\x3cth>Action\x3c/th>\x3cth>Move\x3c/th>\x3cth>Who runs it\x3c/th>' + (s.signoff ? '\x3cth class="sg">Tech\x3c/th>\x3cth class="sg">Supervisor\x3c/th>\x3cth class="sg-d">Date done\x3c/th>' : '') + '\x3c/tr>'); steps.forEach(function(x, i){ var ptr = x.how ? '\x3cdiv class="hint">\x3cstrong>Full instructions under “How to run these steps”, just below this table.\x3c/strong>\x3c/div>' : ''; h.push('\x3ctr>\x3ctd class="n">' + (i + 1) + '\x3c/td>\x3ctd>' + x.a + ptr + '\x3c/td>\x3ctd>' + x.m + '\x3c/td>\x3ctd>' + x.w + '\x3c/td>' + (s.signoff ? (function(k){ return sigCell('sg-s' + k + '-t', 'Technician for step ' + (i + 1)) + sigCell('sg-s' + k + '-s', 'Supervisor for step ' + (i + 1)) + sigCell('sg-s' + k + '-d', 'Date done for step ' + (i + 1)); })(sigKey(x.m + x.a)) : '') + '\x3c/tr>'); }); h.push('\x3c/table>'); if(plan.note) h.push('\x3cdiv class="callout">\x3cstrong>' + plan.note + '\x3c/strong>\x3c/div>'); } var howSteps = []; steps.forEach(function(x, i){ if(x.how) howSteps.push({ n: i + 1, title: x.title || x.a, how: x.how }); }); if(howSteps.length){ h.push('\x3ch3>How to run these steps\x3c/h3>'); h.push('\x3cp class="hint">The ' + howSteps.length + ' step' + (howSteps.length === 1 ? ' above that needs' : 's above that need') + ' more than a line. Numbered to match the plan.\x3c/p>'); h.push('\x3ctable>\x3ctr>\x3cth class="n">#\x3c/th>\x3cth>Step\x3c/th>\x3cth>How to run it\x3c/th>\x3c/tr>'); howSteps.forEach(function(x){ h.push('\x3ctr>\x3ctd class="n">' + x.n + '\x3c/td>\x3ctd>\x3cstrong>' + x.title + '\x3c/strong>\x3c/td>\x3ctd>' + x.how + '\x3c/td>\x3c/tr>'); }); h.push('\x3c/table>'); } h.push('\x3cdiv class="callout ok">\x3cstrong>Where that leaves you.\x3c/strong> ' + landingLine(s, st) + '\x3c/div>'); var groups = lineGroups(s, steps); if(groups.length){ h.push('\x3ch2>Which appliances take which steps\x3c/h2>'); h.push('\x3cp class="hint">The plan above is drawn from the lowest build in the Fabric. A group already past a hop does not take it, so these are the steps each group runs; everything else in the plan applies to all of them.\x3c/p>'); h.push('\x3ctable>\x3ctr>\x3cth>Appliances on\x3c/th>\x3cth>Their route\x3c/th>\x3cth>Steps they take\x3c/th>' + (s.signoff ? '\x3cth class="sg">Done by\x3c/th>' : '') + '\x3c/tr>'); groups.forEach(function(g, i){ h.push('\x3ctr>\x3ctd>\x3ccode>' + g.build + '\x3c/code>' + (g.lowest ? ' \x3cstrong>(lowest — drives the plan)\x3c/strong>' : '') + '\x3cdiv class="hint">' + g.line + ' line\x3c/div>\x3c/td>' + '\x3ctd>' + (g.route.length ? g.route.join(' → ') : 'Already at the target.') + '\x3c/td>' + '\x3ctd>' + (g.nums.length ? g.nums.join(', ') : '—') + '\x3c/td>' + (s.signoff ? sigCell('sg-g' + groupSigKey(g), 'Checked by, for the ' + g.line + '-line group') : '') + '\x3c/tr>'); }); h.push('\x3c/table>'); } if(s.mixedBad && s.mixedBad.length){ h.push('\x3cdiv class="callout warn">\x3cstrong>Not read as a version:\x3c/strong> ' + s.mixedBad.map(htmlEsc).join(', ') + '. Those entries were ignored, so no group above speaks for them.\x3c/div>'); } h.push('\x3ch2>Risks\x3c/h2>'); if(s.signoff) h.push('\x3cp class="hint">Both reviewers sign \x3cstrong>before\x3c/strong> the window opens — this is the approval to proceed, not a record of the work.\x3c/p>'); var shown = [], prompts = [], ruledOut = []; RULES.risks.forEach(function(r){ var d = v[r.id]; if(!d) return; if(!riskApplies(d)) { ruledOut.push(r); return; } (riskIsPrompt(d) ? prompts : shown).push(r); }); shown = sortRisks(shown, v); prompts = sortRisks(prompts, v); function riskTable(list){ h.push('\x3ctable>\x3ctr>\x3cth>Risk\x3c/th>\x3cth style="width:132px">Verdict\x3c/th>\x3cth>Why\x3c/th>' + (s.signoff ? '\x3cth class="sg">Assessed by\x3c/th>\x3cth class="sg">Accepted by\x3c/th>' : '') + '\x3c/tr>'); list.forEach(function(r){ var d = v[r.id]; var tags = pillTags(d[0]); var cls = pillClass(tags[0]); var row = cls === 'yes' ? ' class="r-yes"' : cls === 'chk' ? ' class="r-chk"' : cls === 'irr' ? ' class="r-irr"' : cls === 'rev' ? ' class="r-rev"' : ''; var pills = tags.map(function(t){ return '\x3cspan class="pill ' + pillClass(t) + '">' + t + '\x3c/span>'; }).join(' '); var det = String(r.detail || ''); if(det.indexOf('@LADDER@') !== -1){ det = det.replace('@LADDER@', (r.ladder || []).map(function(x, i){ return (i + 1) + '. ' + x.replace(/$new$/, '— \x3cstrong>new\x3c/strong>') .replace(/, new\)/, ') — \x3cstrong>new\x3c/strong>'); }).join('\x3cbr>')); } h.push('\x3ctr' + row + '>\x3ctd>\x3cstrong>' + r.risk + '\x3c/strong>\x3cdiv class="hint">' + det + '\x3c/div>\x3c/td>' + '\x3ctd>' + pills + '\x3c/td>\x3ctd>' + d[1] + '\x3c/td>' + (s.signoff ? (function(k){ return sigCell('sg-r' + k + '-1', 'Assessed by, for risk: ' + strip(r.risk)) + sigCell('sg-r' + k + '-2', 'Accepted by, for risk: ' + strip(r.risk)); })(riskSigKey(r, d)) : '') + '\x3c/tr>'); }); h.push('\x3c/table>'); } if(!shown.length && !prompts.length){ h.push('\x3cdiv class="callout ok">\x3cstrong>No risks apply to this plan.\x3c/strong> ' + 'Every risk this tool checks was assessed and ruled out — see the list below.\x3c/div>'); } else { if(shown.length){ riskTable(shown); } else { h.push('\x3cdiv class="callout ok">\x3cstrong>Nothing on this plan needs acting on.\x3c/strong> ' + 'Every risk that applies was either ruled out or is handled by the order of the steps. ' + 'The list below is what the planner was not told about.\x3c/div>'); } if(prompts.length){ h.push('\x3ch3>Not ruled out — ' + prompts.length + ' to confirm\x3c/h3>'); h.push('\x3cp class="hint">Not ruled out because the planner was not told about them — questions to answer before the window, not findings. Tick the matching boxes and re-run and most resolve to a \x3cstrong>No\x3c/strong>.\x3c/p>'); riskTable(prompts); } } if(ruledOut.length){ h.push('\x3cp class="hint">\x3cstrong>Assessed and ruled out for this plan:\x3c/strong> ' + ruledOut.map(function(r){ return r.risk; }).join(' · ') + '.\x3c/p>'); } h.push('\x3ch2>Open questions\x3c/h2>'); if(s.signoff) h.push('\x3cp class="hint">Record the answer and who cleared it. An open question left blank at the window is an unassessed risk.\x3c/p>'); h.push('\x3ctable>\x3ctr>\x3cth>Question\x3c/th>\x3cth>What it would change\x3c/th>' + (s.signoff ? '\x3cth class="sg">Answer\x3c/th>\x3cth class="sg">Cleared by\x3c/th>' : '') + '\x3c/tr>'); qs.forEach(function(q, i){ h.push('\x3ctr>\x3ctd>\x3cstrong>' + q[0] + '\x3c/strong>\x3c/td>\x3ctd>' + q[1] + '\x3c/td>' + (s.signoff ? sigCell('sg-q' + questionSigKey(q) + '-a', 'Answer to: ' + strip(q[0])) + sigCell('sg-q' + questionSigKey(q) + '-c', 'Confirmed by, for: ' + strip(q[0])) : '') + '\x3c/tr>'); }); h.push('\x3c/table>'); var chk9 = s.preWindow || []; if(chk9.length){ h.push('\x3ch2>Before the window — things this plan does not ask about\x3c/h2>'); h.push('\x3cp class="hint">Published behavior changes that depend on configuration this form does not ask for, so they are ' + 'listed rather than decided. None changes the route, and only the ones your route crosses are shown.\x3c/p>'); h.push('\x3ctable>\x3ctr>\x3cth>Crossing\x3c/th>\x3cth>What changes, and what to do\x3c/th>' + (s.signoff ? '\x3cth class="sg">Checked by\x3c/th>' : '') + '\x3c/tr>'); chk9.forEach(function(p, i){ h.push('\x3ctr>\x3ctd>\x3ccode>' + p.at + '\x3c/code>\x3c/td>\x3ctd>\x3cstrong>' + p.what + '\x3c/strong> ' + p.detail + '\x3c/td>' + (s.signoff ? sigCell('sg-w' + sigKey(p.at + p.what), 'Checked by, for: ' + strip(p.what)) : '') + '\x3c/tr>'); }); h.push('\x3c/table>'); } h.push('\x3ch2>Guides\x3c/h2>\x3ctable>\x3ctr>\x3cth>Guide\x3c/th>\x3cth>Where it applies\x3c/th>\x3c/tr>'); gs.forEach(function(g){ h.push('\x3ctr>\x3ctd>\x3ca href="' + g.url + '">' + g.name + '\x3c/a>\x3cdiv class="url">' + g.url + '\x3c/div>\x3c/td>\x3ctd>' + g.where + '\x3c/td>\x3c/tr>'); }); h.push('\x3c/table>'); out.innerHTML = h.join(''); sigRestore(keepSigs); out.style.display = 'block'; ['upp-copy', 'upp-dl-html', 'upp-dl-md'].forEach(function(id){ document.getElementById(id).disabled = false; }); LAST = { s: s, plan: plan, steps: steps, v: v, qs: qs, gs: gs, st: st }; document.getElementById('upp-copied').style.display = 'none'; } function strip(x){ return String(x) .replace(/\x3cdiv class="hint">/g, ' - ') .replace(/\x3cbr\s*\/?>/gi, ' ') .replace(/\x3c[^>]+>/g, '') .replace(/—/g, '-').replace(/–/g, '-').replace(/→/g, '->') .replace(/>/g, '>').replace(/</g, '\x3c') .replace(/“|”/g, '"').replace(/&/g, '&').replace(/ /g, ' ') .replace(/\s+/g, ' ').trim(); } function asText(){ var L = LAST; if(!L) return ''; var s = L.s, o = []; function row(){ o.push('| ' + Array.prototype.slice.call(arguments).join(' | ') + ' |'); } function rule(n){ o.push('|' + Array(n + 1).join(' --- |')); } o.push('UPGRADE PATH - Orchestrator ' + s.orch + ' / ECOS ' + s.ecos + ' -> ' + s.target); o.push(''); var cg = RULES.guides.filter(function(g){ return g.id === RULES.caveat.linkGuide; })[0]; o.push('NOTE: ' + RULES.caveat.head + ' ' + strip(RULES.caveat.body) + (cg ? ' ' + cg.name + ': ' + cg.url : '')); o.push(''); if(s.orchBehind){ o.push('*** CHECK THESE TWO NUMBERS BEFORE YOU GO ANY FURTHER ***'); o.push('An Orchestrator on ' + s.orch + ' could not have put appliances on ECOS ' + s.orchBehindBuild + ': HPE publishes the minimum Orchestrator for each ECOS build, and ECOS ' + s.orchBehindBuild + ' requires ' + s.orchBehindNeeds + ' or later. The likeliest explanation is that one' + ' number is misread or the two are the wrong way round. The plan below is drawn from the Orchestrator' + ' version, so if that is wrong, so is the plan. If both are right - an Orchestrator restored from an old' + ' backup is the usual way - bring the Orchestrator back up to at least ' + s.orchBehindNeeds + ' before anything else.'); o.push(''); } if(s.unmanagedNow && s.unmanagedNow.length){ var uwT = unmanagedWarning(s); o.push('*** ' + strip(uwT.head).replace(/\.$/, '').toUpperCase() + ' ***'); o.push(strip(uwT.body)); o.push(''); } if(L.plan.blocked && L.plan.blocked.length){ o.push('*** DO NOT SCHEDULE THIS PLAN AS IT STANDS ***'); o.push(L.plan.blocked.map(function(b){ return 'Step landing on ECOS ' + b.to + ' cannot be pushed from the Orchestrator on ' + b.orch + ' - that build requires Orchestrator ' + b.wording + '.'; }).join(' ') + ' The planner should never draw this; treat the plan as unverified and raise it with HPE before any window is booked.'); o.push(''); } if(KNOWN_ORCH_MAX && orchAboveKnown(s.orch)){ o.push('NOTE: Orchestrator ' + s.orch + ' is above every build this tool knows - the newest in its rules is ' + KNOWN_ORCH_MAX + ', so the likely reason is a release published since. The plan below still holds; every floor and one-way door in it is' + ' decided by comparing version numbers. Check the new release\'s notes for a floor or a known issue of its own.'); o.push(''); } if(s.rockyImpossible){ o.push('*** CHECK HOW THE ORCHESTRATOR IS REALLY HOSTED ***'); o.push('You answered Rocky Linux, but an Orchestrator on ' + s.orch + ' cannot be running it: ' + 'no Rocky build exists at or below that version - the first is ' + rockyFirstBuild() + ', on the ' + line(rockyFirstBuild()) + ' line.' + ' The machine is most likely on CentOS. The plan below is drawn for a Rocky host, so it leaves out the' + ' CentOS migration, which is the step the whole route is ordered around. Re-run it with CentOS selected.'); o.push(''); } if(s.rockyNoImage){ o.push('*** CONFIRM THE ORCHESTRATOR IS REALLY ON ROCKY LINUX ***'); o.push('You answered Rocky Linux, but no Rocky install image was published for ' + s.orch + ' - the first on the ' + line(s.orch) + ' line is ' + s.rockyNeeds + '. That is possible only if the VM was built on Rocky at an earlier build and the' + ' Orchestrator application was upgraded in place; an Orchestrator installed at ' + s.orch + ' is on CentOS.' + ' Check with cat /etc/redhat-release on the server. If it is CentOS, re-run with CentOS selected -' + ' the plan below leaves out the migration that Orchestrator needs.'); o.push(''); } if(s.ecosNewer){ o.push(s.ecosNewerList.length === 1 ? '*** THAT ECOS BUILD IS NEWER THAN THIS TOOL\'S LIST ***' : '*** THOSE ECOS BUILDS ARE NEWER THAN THIS TOOL\'S LIST ***'); o.push(s.ecosNewerList.join(' and ') + (s.ecosNewerList.length === 1 ? ' is above' : ' are above') + ' every build on the compatibility page this tool was built from, so the likely reason is a' + ' release published since, not a typo. The plan below still holds: every floor and stepping stone' + ' in it is decided by comparing version numbers. What this tool cannot know is anything the new' + ' release changed, so check its release notes for a floor or a known issue of its own.'); o.push(''); } if(s.ecosUnknown){ o.push(s.ecosUnknownList.length === 1 ? '*** THAT ECOS BUILD IS NOT ONE HPE LISTS ***' : '*** THOSE ECOS BUILDS ARE NOT ONES HPE LISTS ***'); o.push(s.ecosUnknownList.join(' and ') + (s.ecosUnknownList.length === 1 ? ' does not appear' : ' do not appear') + ' in the compatibility page this tool was built from, and the usual reason is a typo. The plan' + ' below is still drawn, because a build released after the page would look exactly like this - but' + ' check against Support > Software Downloads before you rely on it. Everything under it is reasoned' + ' from those builds.'); o.push(''); } o.push('CURRENT STATE'); row('Component','Version','Notes'); rule(3); row('Orchestrator', s.orch, (s.oaas ? (lt(s.orch, RULES.constants.oaasSelfServiceFrom) ? 'Cloud / OaaS below ' + RULES.constants.oaasSelfServiceFrom + ' - HPE support case, not self-service' : 'Cloud / OaaS - self-service upgrade, no HPE ticket') : 'Self-hosted on ' + (s.centos ? 'CentOS' : 'Rocky Linux')) + (s.orchBehind ? ' - BELOW the ' + s.orchBehindNeeds + ' the appliances own build required, see above' : '')); var blNote = bootLoopStateNote(s); row('EdgeConnect (lowest)', s.ecos, 'On the ' + s.ecosLine + ' line' + (blNote ? ' - ' + blNote.charAt(0).toLowerCase() + blNote.slice(1) : '')); var oeT = orchEndsOn(s); row('Destination', (ge(s.orch, s.tgt.orch) ? s.orch : s.tgt.orch + '+') + ' / ' + s.tgt.ecos + '+', (ge(s.orch, s.tgt.orch) ? 'Orchestrator already at or above ' + s.tgt.orch + ', so it stays on ' + s.orch + ' - appliance work only. ' : '') + (s.split ? 'Orchestrator on ' + oeT.line + ' (' + streamShort(oeT.line) + '), appliances on ' + s.tEcos + ' (' + streamShort(s.tEcos) + ')' : s.tgt.label + ', ' + L.st.class + ', EoM ' + L.st.eom)); o.push(''); o.push('WHAT DRIVES THE PLAN'); o.push(strip(driver(s, L.plan))); o.push(''); o.push('THE PLAN'); if(L.plan.nothingToDo){ o.push('Already there - no upgrade steps. Both sides are at or above the ' + s.target + ' target. Do not turn Verify Image Signature off, and do not take the Orchestrator any further.'); } else { row.apply(null, ['#','Action','Move','Who runs it'].concat(s.signoff ? ['Tech','Supervisor','Date done'] : [])); rule(s.signoff ? 7 : 4); L.steps.forEach(function(x,i){ var act = strip(x.a) + (x.how ? ' [Full instructions under "How to run these steps", just below this table.]' : ''); row.apply(null, [String(i+1), act, strip(x.m), strip(x.w)].concat( s.signoff ? (function(k){ return [sigVal('sg-s'+k+'-t'), sigVal('sg-s'+k+'-s'), sigVal('sg-s'+k+'-d')]; })(sigKey(x.m + x.a)) : [])); }); if(L.plan.note) o.push('Note: ' + strip(L.plan.note)); } o.push(''); var tHow = []; L.steps.forEach(function(x, i){ if(x.how) tHow.push({ n: i + 1, title: x.title || x.a, how: x.how }); }); if(tHow.length){ o.push('HOW TO RUN THESE STEPS'); o.push('The ' + tHow.length + ' step' + (tHow.length === 1 ? ' above that needs' : 's above that need') + ' more than a line. Numbered to match the plan.'); row('#','Step','How to run it'); rule(3); tHow.forEach(function(x){ row(String(x.n), strip(x.title), strip(x.how)); }); o.push(''); } o.push('WHERE THAT LEAVES YOU'); o.push(strip(landingLine(s, L.st))); var tGroups = lineGroups(s, L.steps); if(tGroups.length){ o.push(''); o.push('WHICH APPLIANCES TAKE WHICH STEPS'); o.push('The plan above is drawn from the lowest build in the Fabric. A group already past a hop does not take it.'); row.apply(null, ['Appliances on', 'Their route', 'Steps they take'].concat(s.signoff ? ['Done by'] : [])); rule(s.signoff ? 4 : 3); tGroups.forEach(function(g, i){ row.apply(null, [ g.build + (g.lowest ? ' (lowest - drives the plan)' : '') + ' [' + g.line + ' line]', g.route.length ? g.route.join(' -> ') : 'Already at the target.', g.nums.length ? g.nums.join(', ') : '-' ].concat(s.signoff ? [sigVal('sg-g' + groupSigKey(g))] : [])); }); } if(s.mixedBad && s.mixedBad.length){ o.push(''); o.push('Not read as a version: ' + s.mixedBad.join(', ') + '. Those entries were ignored.'); } o.push(''); o.push('RISKS'); if(s.signoff) o.push('Both reviewers sign before the window opens - this is the approval to proceed.'); var tShown = [], tPrompts = [], tRuledOut = []; RULES.risks.forEach(function(r){ var d = L.v[r.id]; if(!d) return; if(!riskApplies(d)) { tRuledOut.push(r); return; } (riskIsPrompt(d) ? tPrompts : tShown).push(r); }); tShown = sortRisks(tShown, L.v); tPrompts = sortRisks(tPrompts, L.v); function textRiskTable(list){ row.apply(null, ['Risk','Verdict','Why'].concat(s.signoff ? ['Assessed by','Accepted by'] : [])); rule(s.signoff ? 5 : 3); list.forEach(function(r){ var d = L.v[r.id]; row.apply(null, [riskExportCell(r), pillTags(d[0]).join(' + '), strip(d[1])].concat( s.signoff ? (function(k){ return [sigVal('sg-r' + k + '-1'), sigVal('sg-r' + k + '-2')]; })(riskSigKey(r, d)) : [])); }); } if(!tShown.length && !tPrompts.length){ o.push('No risks apply to this plan. Every risk this tool checks was assessed and ruled out.'); } else { if(tShown.length){ textRiskTable(tShown); } else { o.push('Nothing on this plan needs acting on. Every risk that applies was either ruled out or is handled by the order of the steps.'); } if(tPrompts.length){ o.push(''); o.push('NOT RULED OUT - ' + tPrompts.length + ' TO CONFIRM'); o.push('Not ruled out because the planner was not told about them - questions to answer before the window, not findings.'); textRiskTable(tPrompts); } } if(tRuledOut.length){ o.push(''); o.push('Assessed and ruled out for this plan: ' + tRuledOut.map(function(r){ return strip(r.risk); }).join('; ') + '.'); } o.push(''); o.push('OPEN QUESTIONS'); if(s.signoff) o.push('An open question left blank at the window is an unassessed risk.'); row.apply(null, ['Question','What it would change'].concat(s.signoff ? ['Answer','Cleared by'] : [])); rule(s.signoff ? 4 : 2); L.qs.forEach(function(q, i){ row.apply(null, [strip(q[0]), strip(q[1])].concat( s.signoff ? [sigVal('sg-q' + questionSigKey(q) + '-a'), sigVal('sg-q' + questionSigKey(q) + '-c')] : [])); }); o.push(''); var tchk = s.preWindow || []; if(tchk.length){ o.push('BEFORE THE WINDOW - THINGS THIS PLAN DOES NOT ASK ABOUT'); o.push('Published behavior changes on the versions this route crosses. They depend on configuration this' + ' tool cannot see, so each is a check to make, not a step to run.'); row.apply(null, ['#','Crossing','What changes','What to do about it'] .concat(s.signoff ? ['Checked by'] : [])); rule(s.signoff ? 5 : 4); tchk.forEach(function(p, i){ row.apply(null, [String(i+1), p.at, strip(p.what), strip(p.detail)] .concat(s.signoff ? [sigVal('sg-w' + sigKey(p.at + p.what))] : [])); }); o.push(''); } o.push('GUIDES'); row('Guide','URL','Where it applies'); rule(3); L.gs.forEach(function(g){ row(g.name, g.url, g.where); }); return o.join('\n'); } var DOC_BLOCK_RULES = { isRule: function(l){ return /^\|(\s*---\s*\|)+$/.test(l); }, isRow: function(l){ return /^\|.*\|$/.test(l); }, isAlert: function(l){ return /^\*\*\* .+ \*\*\*$/.test(l); }, isNote: function(l){ return l.indexOf('NOTE: ') === 0; }, isHead: function(l){ return l.length > 0 && !/[a-z]/.test(l) && /[A-Z]/.test(l); } }; function asBlocks(){ var t = asText(); if(!t) return null; var lines = t.split('\n'), out = [], i = 0, R = DOC_BLOCK_RULES; out.push({ kind: 'title', text: lines[0] }); i = 1; while(i < lines.length){ var l = lines[i]; if(l === ''){ i++; continue; } if(R.isRow(l) && !R.isRule(l)){ var cells = function(x){ return x.slice(1, -1).split(' | ').map(function(c){ return c.trim(); }); }; var head = cells(l), body = []; var j = i + 1; if(j < lines.length && R.isRule(lines[j])){ j++; while(j < lines.length && R.isRow(lines[j]) && !R.isRule(lines[j])){ body.push(cells(lines[j])); j++; } out.push({ kind: 'table', head: head, body: body }); i = j; continue; } out.push({ kind: 'para', text: l }); i++; continue; } if(R.isAlert(l)){ out.push({ kind: 'alert', text: l.replace(/^\*\*\* | \*\*\*$/g, '') }); i++; continue; } if(R.isNote(l)){ out.push({ kind: 'note', text: l.slice(6) }); i++; continue; } if(R.isHead(l)){ out.push({ kind: 'head', text: l }); i++; continue; } out.push({ kind: 'para', text: l }); i++; } return out; } function mdEsc(s){ return String(s).replace(/\|/g, '\\|'); } function asMarkdown(){ var bs = asBlocks(); if(!bs) return ''; var o = []; bs.forEach(function(b){ if(b.kind === 'title'){ o.push('# ' + b.text, ''); } else if(b.kind === 'head'){ o.push('## ' + b.text, ''); } else if(b.kind === 'alert'){ o.push('> **' + b.text + '**', ''); } else if(b.kind === 'note'){ o.push('> ' + b.text, ''); } else if(b.kind === 'para'){ o.push(b.text, ''); } else if(b.kind === 'table'){ o.push('| ' + b.head.map(mdEsc).join(' | ') + ' |'); o.push('|' + b.head.map(function(){ return ' --- |'; }).join('')); b.body.forEach(function(r){ o.push('| ' + r.map(mdEsc).join(' | ') + ' |'); }); o.push(''); } }); return o.join('\n').replace(/\n{3,}/g, '\n\n').trim() + '\n'; } function htmlEsc(s){ return String(s).replace(/&/g, '&').replace(/\x3c/g, '<') .replace(/>/g, '>').replace(/"/g, '"'); } function linkify(s){ return htmlEsc(s).replace(/(https?:\/\/[^\s\x3c]+)/g, '\x3ca href="$1">$1\x3c/a>'); } function asHtml(fragment){ var bs = asBlocks(); if(!bs) return ''; var F = 'font-family:Segoe UI,Arial,Helvetica,sans-serif;'; var o = []; bs.forEach(function(b){ if(b.kind === 'title'){ o.push('\x3ch1 style="' + F + 'font-size:19px;margin:0 0 14px">' + htmlEsc(b.text) + '\x3c/h1>'); } else if(b.kind === 'head'){ o.push('\x3ch2 style="' + F + 'font-size:15px;margin:22px 0 8px;border-bottom:1px solid #c6cbd1;padding-bottom:4px">' + htmlEsc(b.text) + '\x3c/h2>'); } else if(b.kind === 'alert'){ o.push('\x3cp style="' + F + 'margin:12px 0;padding:10px 12px;border-left:4px solid #D36D00;' + 'background:#fdf2e6;font-weight:600">' + htmlEsc(b.text) + '\x3c/p>'); } else if(b.kind === 'note'){ o.push('\x3cp style="' + F + 'margin:12px 0;padding:10px 12px;border-left:4px solid #01a982;' + 'background:#eefaf5">' + linkify(b.text) + '\x3c/p>'); } else if(b.kind === 'para'){ o.push('\x3cp style="' + F + 'margin:10px 0;line-height:1.55">' + linkify(b.text) + '\x3c/p>'); } else if(b.kind === 'table'){ var th = b.head.map(function(c){ return '\x3cth style="' + F + 'text-align:left;padding:7px 10px;border:1px solid #c6cbd1;' + 'background:#f2f4f5;font-size:13px">' + htmlEsc(c) + '\x3c/th>'; }).join(''); var tr = b.body.map(function(r){ return '\x3ctr>' + r.map(function(c){ return '\x3ctd style="' + F + 'padding:7px 10px;border:1px solid #c6cbd1;font-size:13px;' + 'vertical-align:top">' + linkify(c) + '\x3c/td>'; }).join('') + '\x3c/tr>'; }).join(''); o.push('\x3ctable style="border-collapse:collapse;margin:10px 0;width:100%">' + '\x3cthead>\x3ctr>' + th + '\x3c/tr>\x3c/thead>\x3ctbody>' + tr + '\x3c/tbody>\x3c/table>'); } }); var body = o.join('\n'); if(fragment) return body; return '\x3c!doctype html>\n\x3chtml lang="en">\n\x3chead>\n\x3cmeta charset="utf-8">\n' + '\x3ctitle>' + htmlEsc(bs[0].text) + '\x3c/title>\n' + '\x3cstyle>body{margin:0;padding:28px;max-width:1000px;background:#fff;color:#1c1f24}' + '@media print{body{padding:0;max-width:none}}\x3c/style>\n\x3c/head>\n\x3cbody>\n' + body + '\n\x3c/body>\n\x3c/html>\n'; } function docName(ext){ var L = LAST; var s = L && L.s ? L.s : { orch: 'x', ecos: 'x', target: 'x' }; var safe = function(x){ return String(x).replace(/[^0-9A-Za-z.]+/g, '-'); }; return 'upgrade-path-' + safe(s.orch) + '_' + safe(s.ecos) + '-to-' + safe(s.target) + '.' + ext; } (function init(){ RULES.targets.forEach(function(t){ var a = document.createElement('option'); a.value = t.id; a.textContent = t.label.replace(/^(Hold|Finish) at /, '') + ' (' + t.orch + '+)'; document.getElementById('upp-target-orch').appendChild(a); var b = document.createElement('option'); b.value = t.id; b.textContent = t.label.replace(/^(Hold|Finish) at /, '') + ' (' + t.ecos + '+)'; document.getElementById('upp-target-ecos').appendChild(b); }); document.getElementById('upp-target-orch').selectedIndex = RULES.targets.length - 1; document.getElementById('upp-target-ecos').selectedIndex = RULES.targets.length - 1; document.getElementById('upp-go').addEventListener('click', render); ['upp-orch', 'upp-ecos'].forEach(function(id){ document.getElementById(id).addEventListener('keydown', function(e){ if(e.key === 'Enter') render(); }); }); var host = document.getElementById('upp-host'), fStats = document.getElementById('upp-f-stats'), lStats = document.getElementById('upp-l-stats'), naStats = document.getElementById('upp-stats-na'); function syncStats(){ var oaas = host.value === 'oaas'; fStats.disabled = oaas; if(oaas) fStats.checked = false; lStats.classList.toggle('off', oaas); lStats.title = oaas ? 'Not applicable on a cloud Orchestrator - HPE migrates the Statistics Collector.' : ''; naStats.style.display = oaas ? 'inline' : 'none'; } host.addEventListener('change', syncStats); syncStats(); var mixedCb = document.getElementById('upp-f-mixed'), mixedBox = document.getElementById('upp-mixed-box'); function syncMixed(){ mixedBox.style.display = mixedCb.checked ? 'block' : 'none'; } mixedCb.addEventListener('change', syncMixed); syncMixed(); function flash(label){ var c = document.getElementById('upp-copied'); c.textContent = label || 'Copied'; c.style.display = 'inline'; setTimeout(function(){ c.style.display = 'none'; }, 2200); } document.getElementById('upp-copy').addEventListener('click', function(){ var t = asText(); if(!t) return; var h = asHtml(true); if(window.ClipboardItem && navigator.clipboard && navigator.clipboard.write){ try { navigator.clipboard.write([new window.ClipboardItem({ 'text/html': new Blob([h], { type: 'text/html' }), 'text/plain': new Blob([t], { type: 'text/plain' }) })]).then(flash, function(){ plainCopy(t); }); return; } catch(e) { } } plainCopy(t); }); function plainCopy(t){ if(navigator.clipboard && navigator.clipboard.writeText){ navigator.clipboard.writeText(t).then(flash, function(){ fallback(t, flash); }); } else { fallback(t, flash); } } function download(text, mime, name){ var b = new Blob([text], { type: mime + ';charset=utf-8' }); var u = URL.createObjectURL(b); var a = document.createElement('a'); a.href = u; a.download = name; a.rel = 'noopener'; a.click(); setTimeout(function(){ URL.revokeObjectURL(u); }, 4000); flash('Downloaded'); } function onDownload(btn, make, mime, ext){ if(!btn) return; btn.addEventListener('click', function(e){ if(e){ e.preventDefault(); e.stopPropagation(); } var t = make(); if(!t) return; download(t, mime, docName(ext)); }); } onDownload(document.getElementById('upp-dl-html'), function(){ return asHtml(false); }, 'text/html', 'html'); onDownload(document.getElementById('upp-dl-md'), asMarkdown, 'text/markdown', 'md'); function fallback(t, done){ var ta = document.createElement('textarea'); ta.value = t; ta.style.position = 'fixed'; ta.style.opacity = '0'; document.body.appendChild(ta); ta.select(); try { document.execCommand('copy'); done(); } catch(e) { window.prompt('Copy this:', t); } document.body.removeChild(ta); } })(); return { render: render, asText: asText, asMarkdown: asMarkdown, asHtml: asHtml, docName: docName }; }; export const UpgradePathPlanner = () => { const hostRef = useRef(null); const doneRef = useRef(false); useEffect(() => { const host = hostRef.current; if (!host || doneRef.current) return undefined; doneRef.current = true; /* The markup goes in as HTML rather than as JSX. That is deliberate: it is the planner's own form, unchanged, and hand-converting it to JSX would be a transcription with no way to prove it faithful - exactly the thing this port avoids everywhere else. React never manages these children, so there is nothing for it to disagree with. */ host.innerHTML = upp_MARKUP; try { upp_init(host, host); } catch (e) { /* A planner that throws on mount would otherwise leave an empty box on the page with no indication why. */ host.innerHTML = '\x3cp style="padding:16px">The planner could not start: ' + String(e && e.message ? e.message : e) + '\x3c/p>'; } /* No teardown. The engine binds listeners only to elements inside this markup - nothing on document and nothing on window - so React removing the markup removes them with it. There is no animation loop either. Deliberately NOT given an empty cleanup that looks like one. */ return undefined; }, []); return (

); };