Missing [barbican] Section in nova.conf Causes Host Upgrade Convergence Failure During PCD Upgrade

Problem

One or more hosts fail to converge during a Private Cloud Director (PCD) host upgrade and remain offline or stuck in a failed upgrade state in the Management Plane.

Observed symptoms may include:

• Host upgrade failure during reconciliation.

• Host shown offline/unreachable in the Management Plane.

• Upgrade unable to proceed for the affected node.

• Repeated pf9-ostackhost:get_config failed: 'barbican' errors in hostagent logs.

• Missing [barbican] section in nova.conf.

Example log entries in /var/log/pf9/hostagent.log:

pf9_app.py ERROR - pf9-ostackhost:get_config failed: 'barbican'session.py ERROR - Bad message, app config or reading current app config

Environment

• Private Cloud Director Virtualization - v2025.4 and Higher

• Private Cloud Director Kubernetes – v2025.4 and Higher

• Self-Hosted Private Cloud Director Virtualization - v2025.4 and Higher

• Self-Hosted Private Cloud Director Kubernetes - v2025.4 and Higher

Cause

This issue is caused by a reconciliation sequencing issue during the upgrade process.

During the upgrade, the reconciliation process fails before the [barbican] configuration section is written into the nova.conf file. As a result, the pf9-ostackhost application fails repeatedly during configuration reconciliation and the host does not converge successfully.

Diagnostics

• Check hostagent logs for Barbican reconciliation failures

grep -i -C5 barbican /var/log/pf9/pf9-hostagent.log

Expected error:

pf9-ostackhost:get_config failed: 'barbican'

• Verify whether the [barbican] section exists

grep -C5 "\[barbican\]" /opt/pf9/etc/nova/conf.d/nova.conf

If no output is returned, the section is missing.

Resolution

• Step 1: Copy the [barbican] section from a healthy node

From a healthy upgraded node, copy the complete [barbican] section from:

/opt/pf9/etc/nova/conf.d/nova.conf

Example:

[barbican]
barbican_region_name = [REGION_NAME]
auth_url = http://localhost:8158/keystone/v3
barbican_endpoint_type = admin

Step 2: Paste the [barbican] section into the affected node

Add the copied section into:

/opt/pf9/etc/nova/conf.d/nova.conf

Step 3: Verify whether the host converges automatically

Monitor the hostagent logs:

tail -f /var/log/pf9/pf9-hostagent.log

Check whether the host becomes healthy in the Management Plane.

Step 4: Restart services if the host does not converge automatically

Restart the following services on the affected host:

systemctl restart pf9-hostagent
systemctl restart pf9-ostackhost

Step 5: Verify host convergence

Confirm:

• Host becomes online in the Management Plane.

• Upgrade stage completes successfully.

• Reconciliation errors no longer appear in logs.

Validation

Validate the following after remediation:

• Host status becomes healthy/online.

• Upgrade workflow completes successfully.

• /var/log/pf9/hostagent.log no longer reports:

  • pf9-ostackhost:get_config failed: 'barbican'

• [barbican] section exists in nova.conf.