Monitor global resource migration
Classic infrastructure
After the VPC cluster is created and all worker nodes reach normal state, the migration service automatically runs background sub-operations for policy migration, add-on migration, and global resources migration. Monitor these sub-operations
until all complete, then review any flagged items that require your attention before proceeding to workload migration.
Before you begin
- The VPC cluster is provisioned and in
normalstate. See Create the VPC cluster. - Access your Red Hat OpenShift cluster.
What is migrated automatically
The migration service runs the following sub-operations automatically after cluster creation completes:
| Sub-operation | What it does |
|---|---|
| Policy migration | Migrates IAM policies, trusted profiles, tags, and context-based restriction (CBR) rules. |
| Add-on migration | Migrates the cluster-autoscaler, image-key-synchronizer, and static-route add-ons to the VPC cluster. The vpc-file-csi-driver add-on is enabled by default on the VPC cluster. |
| Global resources migration | Migrates the NodeLocal DNS Cache ConfigMap, the CoreDNS and DNS Operator configuration, the Kubernetes Metrics Server ConfigMap, the Ingress controller configuration, and MTU settings. |
Monitor migration status
Monitor each sub-operation until it shows completed. If any sub-operation shows failed, see Troubleshoot a failed sub-operation before proceeding.
From the console
- After clicking Create in the cluster creation form, return to the migration wizard. Go to Migration hub > Clusters > Eligible clusters, or go to Containers > Clusters, and open the wizard for your Classic cluster.
- In the migration wizard, navigate to the Create step in the left navigation panel.
- Monitor the sub-operation status indicators for Policy migration, Add-on migration, and Global resources migration. Each sub-operation shows its current status.
- When all sub-operations show a checkmark, the Create step is complete. Navigate to the Migrate step to proceed with workload migration.
If any sub-operation shows an error, expand it for details and see Troubleshoot a failed sub-operation.
From the CLI
-
Run the following command every 60 seconds until all sub-operations report
completed. If any reportfailed, see Troubleshoot a failed sub-operation.ibmcloud oc replatform cluster get --cluster-id CLASSIC_CLUSTER_IDExample output (all completed):
Sub-operation Status Message policy-migration completed Policy migration complete. addon-migration completed Add-on migration complete. global-resources-migration completed Global resources migration complete.Each sub-operation reports one of the following statuses:
pending,in_progress,completed, orfailed. Do not proceed to the Migrate step until all reportcompleted.
From the API
-
Poll the
clusterMigrationStatusquery every 60 seconds until allstatusfields returncompleted. If any returnfailed, see Troubleshoot a failed sub-operation.query MigrationStatus($id: ID!) { node(id: $id) { ... on KubernetesCluster { vpcMigration { clusterMigrationStatus { policyMigrationStatus { status message errorMessage } addonMigrationStatus { status message errorMessage } globalResourcesMigrationStatus { status message errorMessage additionalDetails { key value } } } } } } }{ "id": "CLASSIC_CLUSTER_ID" }Example response (all completed):
{ "data": { "node": { "vpcMigration": { "clusterMigrationStatus": { "policyMigrationStatus": { "status": "completed", "message": "Policy migration complete.", "errorMessage": null }, "addonMigrationStatus": { "status": "completed", "message": "Add-on migration complete.", "errorMessage": null }, "globalResourcesMigrationStatus": { "status": "completed", "message": "Global resources migration complete.", "errorMessage": null, "additionalDetails": [] } } } } } }Each sub-operation reports a
statusofpending,in_progress,completed, orfailed. Do not proceed to the Migrate step until all returncompleted.
Understanding network policy migration
The policy migration sub-operation does not migrate network policies. It migrates only IAM policies, trusted profiles, tags, and CBR rules.
- Global Network Policies (GNPs) are not migrated. Moving them to VPC security groups is your responsibility.
- Namespace-scoped Kubernetes and Calico network policies are migrated as is during the workload migration step. See Which network policies are migrated?.
Troubleshoot a failed sub-operation
If a sub-operation reports failed, review the error details and resolve the issue before retrying.
| Error | Resolution |
|---|---|
| Add-on not compatible with VPC | Remove the incompatible add-on from the Classic cluster and re-trigger add-on migration. |
| IAM permission error | The migration service uses the API key associated with your account. Ensure that API key has Administrator IAM platform access to the resource group that contains the Classic and VPC clusters. |
From the console
- On the VPC cluster overview page, click the Add-on status tile if it shows an error.
- Review the error details displayed. Resolve the issue indicated.
- Reopen the migration wizard. Go to Migration hub > Clusters > Eligible clusters, or go to Containers > Clusters, and open the wizard for your Classic cluster.
- On the Create step, the failed sub-operation is highlighted. Click Retry next to the failed sub-operation to re-trigger it.
- Monitor the status until the sub-operation shows as complete before proceeding.
From the CLI
-
Check which sub-operation failed and review the error message.
ibmcloud oc replatform cluster get --cluster-id CLASSIC_CLUSTER_IDExample output showing a failure:
Sub-operation Status Message policy-migration failed addon-migration completed Add-on migration complete. global-resources-migration completed Global resources migration complete. -
Resolve the issue, then re-trigger the failed sub-operation using the API or console — CLI retry is not available in this release. See From the API below.
-
Run the status command again every 60 seconds until all sub-operations report
completed.ibmcloud oc replatform cluster get --cluster-id CLASSIC_CLUSTER_IDExample output (all completed):
Sub-operation Status Message policy-migration completed Policy migration complete. addon-migration completed Add-on migration complete. global-resources-migration completed Global resources migration complete.
From the API
-
Query the migration status to identify which sub-operation failed and read its
errorMessage.query MigrationStatus($id: ID!) { node(id: $id) { ... on KubernetesCluster { vpcMigration { clusterMigrationStatus { policyMigrationStatus { status message errorMessage } addonMigrationStatus { status message errorMessage } globalResourcesMigrationStatus { status message errorMessage additionalDetails { key value } } } } } } }{ "id": "CLASSIC_CLUSTER_ID" } -
Resolve the issue, then call the
retryMigrationSubOperationmutation to re-trigger the failed sub-operation. ReplaceOPERATION_NAMEwith one of:policy-migration,addon-migration, orglobal-resources-migration.mutation RetrySubOp($input: RetryMigrationSubOperationInput!) { retryMigrationSubOperation(input: $input) { message status } }{ "input": { "clusterID": "CLASSIC_CLUSTER_ID", "operationName": "OPERATION_NAME" } }Example response:
{ "data": { "retryMigrationSubOperation": { "message": "Sub-operation 'policy-migration' re-triggered successfully.", "status": "in_progress" } } } -
Poll
clusterMigrationStatusagain every 60 seconds until all sub-operations returncompleted.
Your Classic cluster is not affected by a failed sub-operation and continues to serve traffic. If retrying a sub-operation does not resolve the issue, open a support case. Include the errorMessage value from the clusterMigrationStatus query and your Classic cluster ID so that IBM Support can investigate.