Unsupported RHEL7 to CentOS8 Upgrade

RHEL 7.9 to CentOS 8.5.2111 Migration Runbook for VMs

Important warning

This is an unsupported in-place conversion path. Use this only on VMs where you have a working snapshot, console access, and a recovery plan. A fresh install of AlmaLinux, Rocky Linux, RHEL, or another supported EL distribution is generally safer for production systems.

Scope

This runbook captures the field-tested steps used to convert a VM from:

Red Hat Enterprise Linux Server release 7.9 (Maipo)

to:

CentOS Linux 8.5.2111

The key breakthrough was getting the VM booted on the EL8 kernel first, then completing the userspace conversion with dnf distro-sync.

1. Snapshot and capture the current state

Take a VM snapshot before making changes.

Capture package and repo state:

cat /etc/redhat-release
rpm -qa | sort > /root/packages.before-rhel7-to-centos8.txt
cp -a /etc/yum.repos.d /root/yum.repos.d.before-rhel7-to-centos8

Install DNF if it is not already present:

yum install -y dnf

2. Remove the RHEL release package

The CentOS release package conflicts with redhat-release-server because both own files such as:

/etc/os-release
/etc/redhat-release
/etc/system-release
/etc/system-release-cpe
/etc/rpm/macros.dist

Remove the RHEL release package:

rpm -e --nodeps redhat-release-server

If the system already has no /etc/redhat-release, verify the release package state:

rpm -q redhat-release-server

3. Install CentOS 8.5.2111 release packages

Install the CentOS release, repo, and GPG key RPMs from the CentOS vault:

dnf install -y \
    http://vault.centos.org/8.5.2111/BaseOS/x86_64/os/Packages/centos-linux-repos-8-3.el8.noarch.rpm \
    http://vault.centos.org/8.5.2111/BaseOS/x86_64/os/Packages/centos-linux-release-8.5-1.2111.el8.noarch.rpm \
    http://vault.centos.org/8.5.2111/BaseOS/x86_64/os/Packages/centos-gpg-keys-8-3.el8.noarch.rpm

Verify:

rpm -q centos-linux-release
rpm -q centos-linux-repos
rpm -q centos-gpg-keys

Expected examples:

centos-linux-release-8.5-1.2111.el8.noarch
centos-linux-repos-8-3.el8.noarch
centos-gpg-keys-8-3.el8.noarch

4. Replace repo configuration with a clean CentOS vault repo

The repo files installed by centos-linux-repos may point at dead mirrorlist or duplicate repo definitions. The cleanest approach was to remove existing repo files and create a single vault repo file.

Back up and remove current repo files:

mkdir -p /root/yum.repos.d.after-centos-release-install
cp -a /etc/yum.repos.d/*.repo /root/yum.repos.d.after-centos-release-install/ 2>/dev/null || true
rm -f /etc/yum.repos.d/*.repo

Create /etc/yum.repos.d/CentOS-Linux-Vault-8.5.2111.repo:

cat > /etc/yum.repos.d/CentOS-Linux-Vault-8.5.2111.repo <<'EOF'
[baseos]
name=CentOS Linux 8.5.2111 - BaseOS
baseurl=http://vault.centos.org/8.5.2111/BaseOS/x86_64/os/
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial

[appstream]
name=CentOS Linux 8.5.2111 - AppStream
baseurl=http://vault.centos.org/8.5.2111/AppStream/x86_64/os/
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial

[extras]
name=CentOS Linux 8.5.2111 - Extras
baseurl=http://vault.centos.org/8.5.2111/extras/x86_64/os/
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial

[powertools]
name=CentOS Linux 8.5.2111 - PowerTools
baseurl=http://vault.centos.org/8.5.2111/PowerTools/x86_64/os/
enabled=0
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial
EOF

Clean and verify repo metadata:

dnf clean all
rm -rf /var/cache/dnf/*
dnf repolist

Expected healthy repo result:

appstream  CentOS Linux 8.5.2111 - AppStream
baseos     CentOS Linux 8.5.2111 - BaseOS
extras     CentOS Linux 8.5.2111 - Extras

If DNF reports duplicate repos such as baseos is listed more than once, remove the duplicate .repo files and keep only the vault repo above.

5. Install EL8 kernel packages

Install the EL8 kernel packages:

dnf --releasever=8 install -y kernel-core kernel-modules

Verify:

rpm -qa 'kernel*' | sort

You want to see:

kernel-core-4.18.0-348.7.1.el8_5.x86_64
kernel-modules-4.18.0-348.7.1.el8_5.x86_64

At this point, the system may still be booted on the EL7 kernel:

uname -r

Example:

3.10.0-1160.119.1.el7.x86_64

6. Repair incomplete EL8 kernel installation if needed

In the observed migration, the RPM database showed the EL8 kernel installed, but /boot/vmlinuz-4.18... was initially missing and GRUB had no EL8 entry.

Check:

ls -l /boot/vmlinuz-4.18.0-348.7.1.el8_5.x86_64
rpm -ql kernel-core-4.18.0-348.7.1.el8_5.x86_64 | grep vmlinuz

If the file is missing, reinstall the kernel packages:

dnf --releasever=8 reinstall -y \
    kernel-core-4.18.0-348.7.1.el8_5 \
    kernel-modules-4.18.0-348.7.1.el8_5

If you see this during reinstall:

Symvers dump file /boot/symvers-4.18.0-348.7.1.el8_5.x86_64.gz not found
warning: %posttrans(kernel-core...) scriptlet failed

continue with the manual repair steps below.

7. Generate EL8 module dependencies

If dracut reports:

/lib/modules/4.18.0-348.7.1.el8_5.x86_64/modules.dep is missing. Did you run depmod?

run:

depmod 4.18.0-348.7.1.el8_5.x86_64

Verify:

ls -l /lib/modules/4.18.0-348.7.1.el8_5.x86_64/modules.dep

8. Build the EL8 initramfs

dracut -f \
    /boot/initramfs-4.18.0-348.7.1.el8_5.x86_64.img \
    4.18.0-348.7.1.el8_5.x86_64

Verify:

ls -l /boot/initramfs-4.18.0-348.7.1.el8_5.x86_64.img

9. Add the EL8 kernel to GRUB

kernel-install add \
    4.18.0-348.7.1.el8_5.x86_64 \
    /boot/vmlinuz-4.18.0-348.7.1.el8_5.x86_64

Verify GRUB entries:

grubby --info=ALL | egrep '^(index|kernel|title)'

Expected EL8 entry:

kernel=/boot/vmlinuz-4.18.0-348.7.1.el8_5.x86_64
title=CentOS Linux (4.18.0-348.7.1.el8_5.x86_64) 8

Set it as default:

grubby --set-default /boot/vmlinuz-4.18.0-348.7.1.el8_5.x86_64

Verify:

grubby --default-kernel

Expected:

/boot/vmlinuz-4.18.0-348.7.1.el8_5.x86_64

10. Reboot into the EL8 kernel

Once the EL8 kernel, initramfs, and GRUB entry are present:

sync
reboot

After boot:

uname -r
cat /etc/os-release

Expected:

4.18.0-348.7.1.el8_5.x86_64

and CentOS Linux 8 identity in /etc/os-release.

This was the major breakthrough. After booting the EL8 kernel, the previous protected-kernel error became easier to work around.

11. Remove known blockers before userspace sync

Some EL7 packages blocked the EL8 transaction through dependency pins or file ownership conflicts.

Remove known blockers as needed:

rpm -e --nodeps systemd-sysv || true
rpm -e --nodeps dracut-network || true
rpm -e --nodeps python3-setuptools || true
rpm -e --nodeps sysvinit-tools || true
rpm -e --nodeps python-sssdconfig || true
rpm -e --nodeps python-syspurpose || true

Optional cleanup of RHEL subscription/support packages:

rpm -e --nodeps \
    subscription-manager-rhsm \
    subscription-manager-rhsm-certificates \
    redhat-support-lib-python \
    redhat-support-tool \
    insights-client \
    python-syspurpose 2>/dev/null || true

Expected recurring blockers encountered:

systemd-sysv
python3-setuptools
redhat-rpm-config
annobin
vim-minimal
yum
sysvinit-tools
python-sssdconfig
python-syspurpose
dracut-network

12. Run the main userspace distro-sync

Run the conversion sync with known build-tool blockers excluded initially:

dnf --releasever=8 \
    --allowerasing \
    --setopt=deltarpm=false \
    --exclude=annobin \
    --exclude=redhat-rpm-config \
    --exclude=gcc \
    --exclude=gcc-c++ \
    --exclude=rpm-build \
    distro-sync

If it fails with file conflicts, use the pattern below.

13. Resolve file ownership conflicts

A common error pattern is:

file /path/from install of EL8-package conflicts with file from package EL7-package

Resolve by identifying and removing the old EL7 package:

rpm -qf /path/from/error
rpm -e --nodeps old-el7-package

Then rerun:

dnf --releasever=8 \
    --allowerasing \
    --setopt=deltarpm=false \
    --exclude=annobin \
    --exclude=redhat-rpm-config \
    --exclude=gcc \
    --exclude=gcc-c++ \
    --exclude=rpm-build \
    distro-sync

Repeat until the transaction succeeds.

Examples encountered:

`sysvinit-tools`

Conflicted with EL8 procps-ng and util-linux for:

/usr/sbin/pidof
/usr/bin/last
/usr/bin/mesg
/usr/bin/wall

Fix:

rpm -e --nodeps sysvinit-tools

`python-sssdconfig`

Conflicted with EL8 python3-sssdconfig.

Fix:

rpm -e --nodeps python-sssdconfig

`python-syspurpose`

Conflicted with EL8 python3-syspurpose.

Fix:

rpm -e --nodeps python-syspurpose

`dracut-network`

EL7 dracut-network required the exact EL7 dracut version.

Fix:

rpm -e --nodeps dracut-network

14. Validate core userspace after successful sync

After a successful userspace sync, check:

uname -r
cat /etc/os-release
rpm -q rpm rpm-libs rpm-build-libs
rpm -q dnf python3-dnf
rpm -q systemd dracut kmod
rpm -q glibc bash openssl openssh-server

Expected direction:

rpm-4.14.x.el8
systemd-239.x.el8
dracut-049.x.el8
dnf-4.7.x.el8
glibc-2.28.x.el8

Check remaining EL7 packages:

rpm -qa | grep el7 | sort > /root/packages.remaining-el7.txt
wc -l /root/packages.remaining-el7.txt

Continue cleaning up remaining EL7 packages case by case.

15. Reinstall build tooling after RPM stack becomes EL8

Only after the RPM/DNF stack is converted to EL8, reinstall build tools:

dnf install -y \
    gcc \
    gcc-c++ \
    make \
    rpm-build \
    redhat-rpm-config \
    annobin

This avoids early errors such as:

rpmlib(RichDependencies) <= 4.12.0-1 is needed by annobin

16. Final checks

uname -r
cat /etc/os-release
dnf repolist
systemctl --failed
rpm -qa | grep el7 | sort

Check SSH:

systemctl status sshd
sshd -t

Check SELinux if SSH or login behavior changes:

getenforce
ausearch -m avc -ts recent

Key Lessons Learned

Fix repos first. Duplicate or mirrorlist-based CentOS 8 repo files caused DNF to report 0 B metadata and misleading Nothing to do results.
Boot the EL8 kernel before completing userspace conversion. The protected-kernel failure was caused by DNF trying to remove the currently running EL7 kernel.
Manually repair the EL8 kernel install if posttrans fails. depmod, dracut, and kernel-install add were required to make the EL8 kernel bootable.
Expect repeated EL7 file ownership conflicts. Remove the old EL7 owner with rpm -e --nodeps, then rerun distro-sync.
Delay build tooling until the RPM stack is EL8. Packages like annobin and redhat-rpm-config use rich dependencies that the EL7 RPM stack cannot process cleanly.
This is a migration bridge, not a final ideal state. CentOS 8.5.2111 is end-of-life. Once the system is stable, consider moving to a supported EL8 or EL9 platform such as AlmaLinux, Rocky Linux, or RHEL.

CentOS/Dirty RHEL7 to CentOS8

Unsupported RHEL7 to CentOS8 Upgrade

RHEL 7.9 to CentOS 8.5.2111 Migration Runbook for VMs

Scope

1. Snapshot and capture the current state

2. Remove the RHEL release package

3. Install CentOS 8.5.2111 release packages

4. Replace repo configuration with a clean CentOS vault repo

5. Install EL8 kernel packages

6. Repair incomplete EL8 kernel installation if needed

7. Generate EL8 module dependencies

8. Build the EL8 initramfs

9. Add the EL8 kernel to GRUB

10. Reboot into the EL8 kernel

11. Remove known blockers before userspace sync

12. Run the main userspace distro-sync

13. Resolve file ownership conflicts

`sysvinit-tools`

`python-sssdconfig`

`python-syspurpose`

`dracut-network`

14. Validate core userspace after successful sync

15. Reinstall build tooling after RPM stack becomes EL8

16. Final checks

Key Lessons Learned

Navigation menu

CentOS/Dirty RHEL7 to CentOS8

Unsupported RHEL7 to CentOS8 Upgrade

RHEL 7.9 to CentOS 8.5.2111 Migration Runbook for VMs

Scope

1. Snapshot and capture the current state

2. Remove the RHEL release package

3. Install CentOS 8.5.2111 release packages

4. Replace repo configuration with a clean CentOS vault repo

5. Install EL8 kernel packages

6. Repair incomplete EL8 kernel installation if needed

7. Generate EL8 module dependencies

8. Build the EL8 initramfs

9. Add the EL8 kernel to GRUB

10. Reboot into the EL8 kernel

11. Remove known blockers before userspace sync

12. Run the main userspace distro-sync

13. Resolve file ownership conflicts

sysvinit-tools

python-sssdconfig

python-syspurpose

dracut-network

14. Validate core userspace after successful sync

15. Reinstall build tooling after RPM stack becomes EL8

16. Final checks

Key Lessons Learned

Navigation menu

Search

`sysvinit-tools`

`python-sssdconfig`

`python-syspurpose`

`dracut-network`