From 47b75398d133207c655a9f9eb08cab8b64a0be24 Mon Sep 17 00:00:00 2001
From: Emilien Macchi <emilien@redhat.com>
Date: Tue, 16 Oct 2018 12:43:06 -0400
Subject: [PATCH] upgrade: remove Docker containers now managed by Podman

For all containers where restart=always is configured and that are not
managed by Pacemaker (this part will be handled later), we remove these
containers at step 1 of post_upgrade_tasks.

Change-Id: Id446dbf7b0a18bd1d4539856e6709d35c7cfa0f0
---
 docker/services/aodh-api.yaml                 |  7 +++++++
 docker/services/aodh-evaluator.yaml           |  7 +++++++
 docker/services/aodh-listener.yaml            |  7 +++++++
 docker/services/aodh-notifier.yaml            |  7 +++++++
 docker/services/barbican-api.yaml             |  9 +++++++++
 docker/services/ceilometer-agent-central.yaml |  7 +++++++
 docker/services/ceilometer-agent-compute.yaml |  7 +++++++
 docker/services/ceilometer-agent-ipmi.yaml    |  7 +++++++
 .../ceilometer-agent-notification.yaml        |  7 +++++++
 docker/services/cinder-api.yaml               |  8 ++++++++
 docker/services/cinder-backup.yaml            |  7 +++++++
 docker/services/cinder-scheduler.yaml         |  7 +++++++
 docker/services/cinder-volume.yaml            |  7 +++++++
 docker/services/congress.yaml                 |  7 +++++++
 docker/services/database/mongodb.yaml         |  7 +++++++
 docker/services/database/mysql.yaml           |  6 ++++++
 docker/services/database/redis.yaml           | 13 ++++++++++++
 docker/services/designate-api.yaml            |  7 +++++++
 docker/services/designate-central.yaml        |  7 +++++++
 docker/services/designate-mdns.yaml           |  7 +++++++
 docker/services/designate-producer.yaml       |  7 +++++++
 docker/services/designate-sink.yaml           |  7 +++++++
 docker/services/designate-worker.yaml         |  8 ++++++++
 docker/services/ec2-api.yaml                  | 14 +++++++++++++
 docker/services/etcd.yaml                     |  7 +++++++
 docker/services/fluentd.yaml                  |  7 +++++++
 docker/services/glance-api.yaml               | 13 ++++++++++++
 docker/services/gnocchi-api.yaml              |  7 +++++++
 docker/services/gnocchi-metricd.yaml          |  7 +++++++
 docker/services/gnocchi-statsd.yaml           |  7 +++++++
 docker/services/haproxy.yaml                  |  7 +++++++
 docker/services/heat-api-cfn.yaml             |  7 +++++++
 docker/services/heat-api.yaml                 |  8 ++++++++
 docker/services/heat-engine.yaml              |  7 +++++++
 docker/services/horizon.yaml                  |  7 +++++++
 docker/services/ironic-api.yaml               |  7 +++++++
 docker/services/ironic-conductor.yaml         |  7 +++++++
 docker/services/ironic-inspector.yaml         |  8 ++++++++
 docker/services/ironic-neutron-agent.yaml     |  7 +++++++
 docker/services/ironic-pxe.yaml               |  8 ++++++++
 docker/services/iscsid.yaml                   |  7 +++++++
 docker/services/keepalived.yaml               |  7 +++++++
 docker/services/keystone.yaml                 |  8 ++++++++
 docker/services/liquidio-compute-config.yaml  |  7 +++++++
 docker/services/logrotate-crond.yaml          |  7 +++++++
 docker/services/manila-api.yaml               |  7 +++++++
 docker/services/manila-scheduler.yaml         |  7 +++++++
 docker/services/manila-share.yaml             |  7 +++++++
 docker/services/memcached.yaml                |  7 +++++++
 .../services/messaging/notify-rabbitmq.yaml   |  7 +++++++
 docker/services/messaging/rpc-qdrouterd.yaml  |  7 +++++++
 docker/services/messaging/rpc-rabbitmq.yaml   |  7 +++++++
 docker/services/metrics/collectd.yaml         |  7 +++++++
 docker/services/metrics/qdr.yaml              |  7 +++++++
 docker/services/mistral-api.yaml              |  7 +++++++
 docker/services/mistral-engine.yaml           |  7 +++++++
 docker/services/mistral-event-engine.yaml     |  7 +++++++
 docker/services/mistral-executor.yaml         |  7 +++++++
 docker/services/multipathd.yaml               |  7 +++++++
 docker/services/neutron-api.yaml              | 13 ++++++++++++
 docker/services/neutron-dhcp.yaml             |  6 ++++++
 docker/services/neutron-l3.yaml               |  6 ++++++
 docker/services/neutron-metadata.yaml         |  7 +++++++
 docker/services/neutron-ovs-agent.yaml        |  7 +++++++
 docker/services/neutron-sriov-agent.yaml      |  7 +++++++
 docker/services/nova-api.yaml                 |  8 ++++++++
 docker/services/nova-compute.yaml             |  7 +++++++
 docker/services/nova-conductor.yaml           |  7 +++++++
 docker/services/nova-consoleauth.yaml         |  7 +++++++
 docker/services/nova-ironic.yaml              |  7 +++++++
 docker/services/nova-libvirt.yaml             |  8 ++++++++
 docker/services/nova-metadata.yaml            |  7 +++++++
 docker/services/nova-migration-target.yaml    |  7 +++++++
 docker/services/nova-placement.yaml           |  7 +++++++
 docker/services/nova-scheduler.yaml           |  7 +++++++
 docker/services/nova-vnc-proxy.yaml           |  7 +++++++
 docker/services/novajoin.yaml                 |  8 ++++++++
 docker/services/octavia-api.yaml              | 13 ++++++++++++
 docker/services/octavia-health-manager.yaml   |  7 +++++++
 docker/services/octavia-housekeeping.yaml     |  7 +++++++
 docker/services/octavia-worker.yaml           |  7 +++++++
 docker/services/opendaylight-api.yaml         |  6 ++++++
 docker/services/ovn-controller.yaml           |  7 +++++++
 docker/services/ovn-dbs.yaml                  |  9 +++++++++
 docker/services/ovn-metadata.yaml             |  7 +++++++
 docker/services/pacemaker/clustercheck.yaml   |  7 +++++++
 docker/services/panko-api.yaml                |  7 +++++++
 docker/services/qdrouterd.yaml                |  7 +++++++
 docker/services/rabbitmq.yaml                 |  7 +++++++
 docker/services/sahara-api.yaml               |  7 +++++++
 docker/services/sahara-engine.yaml            |  7 +++++++
 docker/services/sensu-client.yaml             |  7 +++++++
 docker/services/swift-proxy.yaml              | 12 +++++++++++
 docker/services/swift-storage.yaml            | 20 +++++++++++++++++++
 docker/services/tacker.yaml                   |  7 +++++++
 docker/services/tripleo-ui.yaml               |  7 +++++++
 docker/services/zaqar.yaml                    |  8 ++++++++
 97 files changed, 738 insertions(+)

diff --git a/docker/services/aodh-api.yaml b/docker/services/aodh-api.yaml
index 789d53bee9..4fae439e5c 100644
--- a/docker/services/aodh-api.yaml
+++ b/docker/services/aodh-api.yaml
@@ -211,6 +211,13 @@ outputs:
               when: remove_aodh_api_package|bool
       metadata_settings:
         get_attr: [AodhApiPuppetBase, role_data, metadata_settings]
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - aodh_api
       fast_forward_upgrade_tasks:
         - when:
             - step|int == 0
diff --git a/docker/services/aodh-evaluator.yaml b/docker/services/aodh-evaluator.yaml
index 366d70f4ad..ce7436d252 100644
--- a/docker/services/aodh-evaluator.yaml
+++ b/docker/services/aodh-evaluator.yaml
@@ -150,6 +150,13 @@ outputs:
               package: name=openstack-aodh-evaluator state=removed
               ignore_errors: True
               when: remove_aodh_evaluator_package|bool
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - aodh_evaluator
       fast_forward_upgrade_tasks:
         - when:
             - step|int == 0
diff --git a/docker/services/aodh-listener.yaml b/docker/services/aodh-listener.yaml
index 3212e884ff..51adb1a655 100644
--- a/docker/services/aodh-listener.yaml
+++ b/docker/services/aodh-listener.yaml
@@ -157,6 +157,13 @@ outputs:
               package: name=openstack-aodh-listener state=removed
               ignore_errors: True
               when: remove_aodh_listener_package|bool
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - aodh_listener
       fast_forward_upgrade_tasks:
         - when:
             - step|int == 0
diff --git a/docker/services/aodh-notifier.yaml b/docker/services/aodh-notifier.yaml
index 1faae608bb..fb42d38b5a 100644
--- a/docker/services/aodh-notifier.yaml
+++ b/docker/services/aodh-notifier.yaml
@@ -157,6 +157,13 @@ outputs:
               package: name=openstack-aodh-notifier state=removed
               ignore_errors: True
               when: remove_aodh_notifier_package|bool
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - aodh_notifier
       fast_forward_upgrade_tasks:
         - when:
             - step|int == 0
diff --git a/docker/services/barbican-api.yaml b/docker/services/barbican-api.yaml
index e63c3cbc05..278684c53c 100644
--- a/docker/services/barbican-api.yaml
+++ b/docker/services/barbican-api.yaml
@@ -270,5 +270,14 @@ outputs:
               package: name=openstack-barbican-api state=removed
               ignore_errors: True
               when: remove_barbican_api_package|bool
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - barbican_api
+              - barbican_keystone_listener
+              - barbican_worker
       metadata_settings:
         get_attr: [BarbicanApiBase, role_data, metadata_settings]
diff --git a/docker/services/ceilometer-agent-central.yaml b/docker/services/ceilometer-agent-central.yaml
index 36d7a6e096..05894595d5 100644
--- a/docker/services/ceilometer-agent-central.yaml
+++ b/docker/services/ceilometer-agent-central.yaml
@@ -178,6 +178,13 @@ outputs:
               package: name=openstack-ceilometer-central state=removed
               ignore_errors: True
               when: remove_ceilometer_central_package|bool
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - ceilometer_agent_central
       fast_forward_upgrade_tasks:
         - when:
             - step|int == 0
diff --git a/docker/services/ceilometer-agent-compute.yaml b/docker/services/ceilometer-agent-compute.yaml
index a48931e21a..ea74f2b3cf 100644
--- a/docker/services/ceilometer-agent-compute.yaml
+++ b/docker/services/ceilometer-agent-compute.yaml
@@ -164,6 +164,13 @@ outputs:
               package: name=openstack-ceilometer-polling state=removed
               ignore_errors: True
               when: remove_ceilometer_compute_polling_package|bool
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - ceilometer_agent_compute
       fast_forward_upgrade_tasks:
         - when:
             - step|int == 0
diff --git a/docker/services/ceilometer-agent-ipmi.yaml b/docker/services/ceilometer-agent-ipmi.yaml
index 8e17690808..c52fd4ff83 100644
--- a/docker/services/ceilometer-agent-ipmi.yaml
+++ b/docker/services/ceilometer-agent-ipmi.yaml
@@ -157,6 +157,13 @@ outputs:
               package: name=openstack-ceilometer-ipmi state=removed
               ignore_errors: True
               when: remove_ceilometer_ipmi_package|bool
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - ceilometer_agent_ipmi
       fast_forward_upgrade_tasks:
         - when:
             - step|int == 0
diff --git a/docker/services/ceilometer-agent-notification.yaml b/docker/services/ceilometer-agent-notification.yaml
index edb0e742c5..1278cc6c13 100644
--- a/docker/services/ceilometer-agent-notification.yaml
+++ b/docker/services/ceilometer-agent-notification.yaml
@@ -174,6 +174,13 @@ outputs:
               package: name=openstack-ceilometer-notification state=removed
               ignore_errors: True
               when: remove_ceilometer_notification_package|bool
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - ceilometer_agent_notification
       fast_forward_upgrade_tasks:
         - when:
             - step|int == 0
diff --git a/docker/services/cinder-api.yaml b/docker/services/cinder-api.yaml
index e8a8426047..cac43649eb 100644
--- a/docker/services/cinder-api.yaml
+++ b/docker/services/cinder-api.yaml
@@ -302,6 +302,14 @@ outputs:
               tags:
                 - online_upgrade
                 - online_upgrade_cinder
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - cinder_api
+              - cinder_api_cron
       fast_forward_upgrade_tasks:
         - when:
             - step|int == 0
diff --git a/docker/services/cinder-backup.yaml b/docker/services/cinder-backup.yaml
index ff9c411790..57f9d88a5f 100644
--- a/docker/services/cinder-backup.yaml
+++ b/docker/services/cinder-backup.yaml
@@ -181,6 +181,13 @@ outputs:
           file:
             path: /etc/ceph
             state: directory
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - cinder_backup
       upgrade_tasks:
         - when: step|int == 0
           tags: common
diff --git a/docker/services/cinder-scheduler.yaml b/docker/services/cinder-scheduler.yaml
index 5ba5c863c4..43c92e4124 100644
--- a/docker/services/cinder-scheduler.yaml
+++ b/docker/services/cinder-scheduler.yaml
@@ -177,6 +177,13 @@ outputs:
               package: name=openstack-cinder state=removed
               ignore_errors: True
               when: remove_cinder_package|bool
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - cinder_scheduler
       fast_forward_upgrade_tasks:
         - when:
             - step|int == 0
diff --git a/docker/services/cinder-volume.yaml b/docker/services/cinder-volume.yaml
index 5026a55578..acd333821c 100644
--- a/docker/services/cinder-volume.yaml
+++ b/docker/services/cinder-volume.yaml
@@ -198,6 +198,13 @@ outputs:
               package: name=openstack-cinder state=removed
               ignore_errors: True
               when: remove_cinder_package|bool
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - cinder_volume
       fast_forward_upgrade_tasks:
         - when:
             - step|int == 0
diff --git a/docker/services/congress.yaml b/docker/services/congress.yaml
index a8df4327cf..c3a307decb 100644
--- a/docker/services/congress.yaml
+++ b/docker/services/congress.yaml
@@ -146,6 +146,13 @@ outputs:
               Log files from congress containers can be found under
               /var/log/containers/congress.
           ignore_errors: true
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - congress_api
       upgrade_tasks:
         - when: step|int == 0
           tags: common
diff --git a/docker/services/database/mongodb.yaml b/docker/services/database/mongodb.yaml
index db61282f34..8a96d43ffe 100644
--- a/docker/services/database/mongodb.yaml
+++ b/docker/services/database/mongodb.yaml
@@ -202,3 +202,10 @@ outputs:
             - release == 'ocata'
             - mongod_enabled|bool
           service: name=mongod state=stopped enabled=no
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - mongodb
diff --git a/docker/services/database/mysql.yaml b/docker/services/database/mysql.yaml
index 6f6fbfbe6d..1b6576dcaa 100644
--- a/docker/services/database/mysql.yaml
+++ b/docker/services/database/mysql.yaml
@@ -289,6 +289,12 @@ outputs:
               when: mariadb_enabled|bool
               service: name=mariadb state=stopped enabled=no
       post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - mysql
         - name: Check and upgrade Mysql database after major version upgrade
           command: "{{ container_cli }} exec -u root mysql mysql_upgrade"
           when: step|int == 2
diff --git a/docker/services/database/redis.yaml b/docker/services/database/redis.yaml
index 83ecceec09..422c8664df 100644
--- a/docker/services/database/redis.yaml
+++ b/docker/services/database/redis.yaml
@@ -185,3 +185,16 @@ outputs:
             - name: Stop and disable redis service
               when: redis_enabled|bool
               service: name=redis state=stopped enabled=no
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              with_items:
+                list_concat:
+                  - - redis
+                  - - if:
+                        - internal_tls_enabled
+                        - - redis_tls_proxy
+                        - null
diff --git a/docker/services/designate-api.yaml b/docker/services/designate-api.yaml
index 66de35a219..bc4519d1b0 100644
--- a/docker/services/designate-api.yaml
+++ b/docker/services/designate-api.yaml
@@ -151,3 +151,10 @@ outputs:
               Log files from designate containers can be found under
               /var/log/containers/designate.
           ignore_errors: true
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - designate_api
diff --git a/docker/services/designate-central.yaml b/docker/services/designate-central.yaml
index a490965c20..441ac64875 100644
--- a/docker/services/designate-central.yaml
+++ b/docker/services/designate-central.yaml
@@ -169,3 +169,10 @@ outputs:
               Log files from designate containers can be found under
               /var/log/containers/designate.
           ignore_errors: true
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - designate_central
diff --git a/docker/services/designate-mdns.yaml b/docker/services/designate-mdns.yaml
index 9133bfde7d..b24f93a9b2 100644
--- a/docker/services/designate-mdns.yaml
+++ b/docker/services/designate-mdns.yaml
@@ -131,3 +131,10 @@ outputs:
               Log files from designate containers can be found under
               /var/log/containers/designate.
           ignore_errors: true
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - designate_mdns
diff --git a/docker/services/designate-producer.yaml b/docker/services/designate-producer.yaml
index b0d87ae1bb..64fa986232 100644
--- a/docker/services/designate-producer.yaml
+++ b/docker/services/designate-producer.yaml
@@ -132,3 +132,10 @@ outputs:
               Log files from designate containers can be found under
               /var/log/containers/designate.
           ignore_errors: true
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - designate_producer
diff --git a/docker/services/designate-sink.yaml b/docker/services/designate-sink.yaml
index b7df6349ef..4418084c50 100644
--- a/docker/services/designate-sink.yaml
+++ b/docker/services/designate-sink.yaml
@@ -132,3 +132,10 @@ outputs:
               Log files from designate containers can be found under
               /var/log/containers/designate.
           ignore_errors: true
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - designate_sink
diff --git a/docker/services/designate-worker.yaml b/docker/services/designate-worker.yaml
index 08765a6e6e..decc86a205 100644
--- a/docker/services/designate-worker.yaml
+++ b/docker/services/designate-worker.yaml
@@ -178,3 +178,11 @@ outputs:
             path: /var/named-persistent
             state: directory
             setype: svirt_sandbox_file_t
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - designate_backend_bind9
+              - designate_worker
diff --git a/docker/services/ec2-api.yaml b/docker/services/ec2-api.yaml
index 5e98c1ea7d..b606f6544c 100644
--- a/docker/services/ec2-api.yaml
+++ b/docker/services/ec2-api.yaml
@@ -249,5 +249,19 @@ outputs:
             - name: Stop and disable EC2-API-METADATA service
               when: ec2_api_metadata_enabled|bool
               service: name=openstack-ec2-api-metadata state=stopped enabled=no
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              with_items:
+                list_concat:
+                  - - ec2_api
+                  - - ec2_api_metadata
+                  - - if:
+                        - internal_tls_enabled
+                        - - ec2_api_tls_proxy
+                        - null
       metadata_settings:
         get_attr: [Ec2ApiPuppetBase, role_data, metadata_settings]
diff --git a/docker/services/etcd.yaml b/docker/services/etcd.yaml
index 4cdb239bd6..d00ed0ab9f 100644
--- a/docker/services/etcd.yaml
+++ b/docker/services/etcd.yaml
@@ -134,3 +134,10 @@ outputs:
             - name: Stop and disable etcd service
               when: etcd_enabled|bool
               service: name=etcd state=stopped enabled=no
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - etcd
diff --git a/docker/services/fluentd.yaml b/docker/services/fluentd.yaml
index 7ee50e6138..f3e80ce87c 100644
--- a/docker/services/fluentd.yaml
+++ b/docker/services/fluentd.yaml
@@ -140,6 +140,13 @@ outputs:
             - name: Stop and disable fluentd service
               service: name=fluentd.service state=stopped enabled=no
               when: fluentd_enabled|bool
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - fluentd
       fast_forward_upgrade_tasks:
         - when:
             - step|int == 0
diff --git a/docker/services/glance-api.yaml b/docker/services/glance-api.yaml
index f6ac067bed..8888474a53 100644
--- a/docker/services/glance-api.yaml
+++ b/docker/services/glance-api.yaml
@@ -265,6 +265,19 @@ outputs:
               when: remove_glance_package|bool
       metadata_settings:
         get_attr: [GlanceApiPuppetBase, role_data, metadata_settings]
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              with_items:
+                list_concat:
+                  - - glance_api
+                  - - if:
+                        - internal_tls_enabled
+                        - - glance_api_tls_proxy
+                        - null
       fast_forward_upgrade_tasks:
         - when:
             - step|int == 0
diff --git a/docker/services/gnocchi-api.yaml b/docker/services/gnocchi-api.yaml
index e51ae3ec71..2b0480fff3 100644
--- a/docker/services/gnocchi-api.yaml
+++ b/docker/services/gnocchi-api.yaml
@@ -297,6 +297,13 @@ outputs:
               service: name=httpd state=stopped enabled=no
       metadata_settings:
         get_attr: [GnocchiApiPuppetBase, role_data, metadata_settings]
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - gnocchi_api
       fast_forward_upgrade_tasks:
         - when:
             - step|int == 0
diff --git a/docker/services/gnocchi-metricd.yaml b/docker/services/gnocchi-metricd.yaml
index 50560a4276..a8819d837b 100644
--- a/docker/services/gnocchi-metricd.yaml
+++ b/docker/services/gnocchi-metricd.yaml
@@ -178,6 +178,13 @@ outputs:
             - name: Stop and disable openstack-gnocchi-metricd service
               when: gnocchi_metricd_enabled|bool
               service: name=openstack-gnocchi-metricd.service state=stopped enabled=no
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - gnocchi_metricd
       fast_forward_upgrade_tasks:
         - when:
             - step|int == 0
diff --git a/docker/services/gnocchi-statsd.yaml b/docker/services/gnocchi-statsd.yaml
index 60d5e8b864..cedd6b0f82 100644
--- a/docker/services/gnocchi-statsd.yaml
+++ b/docker/services/gnocchi-statsd.yaml
@@ -178,6 +178,13 @@ outputs:
             - name: Stop and disable openstack-gnocchi-statsd service
               when: gnocchi_statsd_enabled|bool
               service: name=openstack-gnocchi-statsd.service state=stopped enabled=no
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - gnocchi_statsd
       fast_forward_upgrade_tasks:
         - name: FFU check if openstack-gnocchi-statsd is deployed
           command: systemctl is-enabled --quiet openstack-gnocchi-statsd
diff --git a/docker/services/haproxy.yaml b/docker/services/haproxy.yaml
index 56abe74ff6..e4718eb8c2 100644
--- a/docker/services/haproxy.yaml
+++ b/docker/services/haproxy.yaml
@@ -289,6 +289,13 @@ outputs:
               package: name=haproxy state=removed
               ignore_errors: True
               when: remove_haproxy_package|bool
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - haproxy
       host_prep_tasks:
         - {get_attr: [HAProxyBase, role_data, host_prep_tasks]}
         - name: create persistent directories
diff --git a/docker/services/heat-api-cfn.yaml b/docker/services/heat-api-cfn.yaml
index bda4ed8cf6..d21e1fad52 100644
--- a/docker/services/heat-api-cfn.yaml
+++ b/docker/services/heat-api-cfn.yaml
@@ -187,6 +187,13 @@ outputs:
                 - httpd_running|bool
       metadata_settings:
         get_attr: [HeatBase, role_data, metadata_settings]
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - heat_api_cfn
       fast_forward_upgrade_tasks:
         - when:
             - step|int == 0
diff --git a/docker/services/heat-api.yaml b/docker/services/heat-api.yaml
index fe1fda8880..a57305df17 100644
--- a/docker/services/heat-api.yaml
+++ b/docker/services/heat-api.yaml
@@ -229,6 +229,14 @@ outputs:
                 state: absent
       metadata_settings:
         get_attr: [HeatBase, role_data, metadata_settings]
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - heat_api
+              - heat_api_cron
       fast_forward_upgrade_tasks:
         - when:
             - step|int == 0
diff --git a/docker/services/heat-engine.yaml b/docker/services/heat-engine.yaml
index 24447a77f7..e5c28a7d39 100644
--- a/docker/services/heat-engine.yaml
+++ b/docker/services/heat-engine.yaml
@@ -182,6 +182,13 @@ outputs:
             - name: Stop and disable heat_engine service
               when: heat_engine_enabled|bool
               service: name=openstack-heat-engine state=stopped enabled=no
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - heat_engine
       fast_forward_upgrade_tasks:
         - when:
             - step|int == 0
diff --git a/docker/services/horizon.yaml b/docker/services/horizon.yaml
index 2f6df667be..22a7cc584f 100644
--- a/docker/services/horizon.yaml
+++ b/docker/services/horizon.yaml
@@ -216,5 +216,12 @@ outputs:
             - step|int == 2
             - httpd_running|bool
           service: name=httpd state=stopped enabled=no
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - horizon
       metadata_settings:
         get_attr: [HorizonBase, role_data, metadata_settings]
diff --git a/docker/services/ironic-api.yaml b/docker/services/ironic-api.yaml
index 9eb1af18f4..7cee5a8d87 100644
--- a/docker/services/ironic-api.yaml
+++ b/docker/services/ironic-api.yaml
@@ -237,6 +237,13 @@ outputs:
               tags:
                 - online_upgrade
                 - online_upgrade_ironic
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - ironic_api
       fast_forward_upgrade_tasks:
         - when:
             - step|int == 0
diff --git a/docker/services/ironic-conductor.yaml b/docker/services/ironic-conductor.yaml
index 963a9485fa..ae6b243d02 100644
--- a/docker/services/ironic-conductor.yaml
+++ b/docker/services/ironic-conductor.yaml
@@ -272,6 +272,13 @@ outputs:
               package: name=openstack-ironic-conductor state=removed
               ignore_errors: True
               when: remove_ironic_conductor_package|bool
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - ironic_conductor
       fast_forward_upgrade_tasks:
         - when:
             - step|int == 0
diff --git a/docker/services/ironic-inspector.yaml b/docker/services/ironic-inspector.yaml
index 2303b37915..6a7e8a527d 100644
--- a/docker/services/ironic-inspector.yaml
+++ b/docker/services/ironic-inspector.yaml
@@ -269,3 +269,11 @@ outputs:
               package: name=openstack-ironic-inspector state=removed
               ignore_errors: True
               when: remove_ironic_inspector_package|bool
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - ironic_inspector
+              - ironic_inspector_dnsmasq
diff --git a/docker/services/ironic-neutron-agent.yaml b/docker/services/ironic-neutron-agent.yaml
index 02e4998569..c49f734ce9 100644
--- a/docker/services/ironic-neutron-agent.yaml
+++ b/docker/services/ironic-neutron-agent.yaml
@@ -123,3 +123,10 @@ outputs:
             - name: Stop and disable ironic-neutron-agent service
               when: ironic_neutron_agent_enabled|bool
               service: name=ironic-neutron-agent state=stopped enabled=no
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - ironic_neutron_agent
diff --git a/docker/services/ironic-pxe.yaml b/docker/services/ironic-pxe.yaml
index 1c7b9ae148..fd5c158bf8 100644
--- a/docker/services/ironic-pxe.yaml
+++ b/docker/services/ironic-pxe.yaml
@@ -172,3 +172,11 @@ outputs:
               Log files from ironic containers can be found under
               /var/log/containers/ironic and /var/log/containers/httpd/ironic-*.
           ignore_errors: true
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - ironic_pxe_tftp
+              - ironic_pxe_http
diff --git a/docker/services/iscsid.yaml b/docker/services/iscsid.yaml
index 42bf567005..3ffdb0e0be 100644
--- a/docker/services/iscsid.yaml
+++ b/docker/services/iscsid.yaml
@@ -148,3 +148,10 @@ outputs:
             - name: Stop and disable iscsid.socket service
               when: iscsid_socket_enabled|bool
               service: name=iscsid.socket state=stopped enabled=no
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - iscsid
diff --git a/docker/services/keepalived.yaml b/docker/services/keepalived.yaml
index c8edb98c08..cad6ce0a93 100644
--- a/docker/services/keepalived.yaml
+++ b/docker/services/keepalived.yaml
@@ -151,3 +151,10 @@ outputs:
               package: name=keepalived state=removed
               ignore_errors: True
               when: remove_keepalived_package|bool
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - keepalived
diff --git a/docker/services/keystone.yaml b/docker/services/keystone.yaml
index 88389aef70..c02d5283f4 100644
--- a/docker/services/keystone.yaml
+++ b/docker/services/keystone.yaml
@@ -298,6 +298,14 @@ outputs:
               when: remove_keystone_package|bool
       metadata_settings:
         get_attr: [KeystoneBase, role_data, metadata_settings]
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - keystone
+              - keystone_cron
       fast_forward_upgrade_tasks:
         - when:
             - step|int == 0
diff --git a/docker/services/liquidio-compute-config.yaml b/docker/services/liquidio-compute-config.yaml
index 101b46d25b..64f9162ae4 100644
--- a/docker/services/liquidio-compute-config.yaml
+++ b/docker/services/liquidio-compute-config.yaml
@@ -100,3 +100,10 @@ outputs:
                   - /run:/run
             environment:
               - KOLLA_CONFIG_STRATEGY=COPY_ALWAYS
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - liquidio_compute_service
diff --git a/docker/services/logrotate-crond.yaml b/docker/services/logrotate-crond.yaml
index 5008fbf695..0a98fdbb91 100644
--- a/docker/services/logrotate-crond.yaml
+++ b/docker/services/logrotate-crond.yaml
@@ -101,3 +101,10 @@ outputs:
                   - /var/log/containers:/var/log/containers:z
             environment:
               - KOLLA_CONFIG_STRATEGY=COPY_ALWAYS
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - logrotate_crond
diff --git a/docker/services/manila-api.yaml b/docker/services/manila-api.yaml
index 0b10769353..aacde6a69e 100644
--- a/docker/services/manila-api.yaml
+++ b/docker/services/manila-api.yaml
@@ -157,6 +157,13 @@ outputs:
             - name: Stop and disable manila_api service
               when: manila_api_enabled|bool
               service: name=openstack-manila-api state=stopped enabled=no
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - manila_api
       fast_forward_upgrade_tasks:
         - name: Check if manila_api is deployed
           command: systemctl is-enabled --quiet openstack-manila-api
diff --git a/docker/services/manila-scheduler.yaml b/docker/services/manila-scheduler.yaml
index ec8a8c5125..b34889ff20 100644
--- a/docker/services/manila-scheduler.yaml
+++ b/docker/services/manila-scheduler.yaml
@@ -139,6 +139,13 @@ outputs:
             - name: Stop and disable manila_scheduler service
               when: manila_scheduler_enabled|bool
               service: name=openstack-manila-scheduler state=stopped enabled=no
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - manila_scheduler
       fast_forward_upgrade_tasks:
         - name: Check if manila_scheduler is deployed
           command: systemctl is-enabled --quiet openstack-manila-scheduler
diff --git a/docker/services/manila-share.yaml b/docker/services/manila-share.yaml
index bf9873a239..c072dc62c8 100644
--- a/docker/services/manila-share.yaml
+++ b/docker/services/manila-share.yaml
@@ -159,6 +159,13 @@ outputs:
             - name: Stop and disable manila_share service
               when: manila_share_enabled|bool
               service: name=openstack-manila-share state=stopped enabled=no
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - manila_share
       fast_forward_upgrade_tasks:
         - name: Check if manila_share is deployed
           command: systemctl is-enabled --quiet openstack-manila-share
diff --git a/docker/services/memcached.yaml b/docker/services/memcached.yaml
index f19a297794..7689b81bc3 100644
--- a/docker/services/memcached.yaml
+++ b/docker/services/memcached.yaml
@@ -113,6 +113,13 @@ outputs:
             - name: Stop and disable memcached service
               when: memcached_enabled|bool
               service: name=memcached state=stopped enabled=no
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - memcached
       fast_forward_upgrade_tasks:
         - when:
             - step|int == 0
diff --git a/docker/services/messaging/notify-rabbitmq.yaml b/docker/services/messaging/notify-rabbitmq.yaml
index d48751650c..0ba5b9591a 100644
--- a/docker/services/messaging/notify-rabbitmq.yaml
+++ b/docker/services/messaging/notify-rabbitmq.yaml
@@ -250,3 +250,10 @@ outputs:
         # this is under paunch control so the latest image should be
         # pulled in by the deploy steps.  Same question for other
         # usually managed by pacemaker container.
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - rabbitmq
diff --git a/docker/services/messaging/rpc-qdrouterd.yaml b/docker/services/messaging/rpc-qdrouterd.yaml
index 8587b87cd1..402ec6e346 100644
--- a/docker/services/messaging/rpc-qdrouterd.yaml
+++ b/docker/services/messaging/rpc-qdrouterd.yaml
@@ -125,3 +125,10 @@ outputs:
           - { 'path': /var/lib/qdrouterd, 'setype': svirt_sandbox_file_t }
       metadata_settings:
         get_attr: [QdrouterdBase, role_data, metadata_settings]
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - qdrouterd
diff --git a/docker/services/messaging/rpc-rabbitmq.yaml b/docker/services/messaging/rpc-rabbitmq.yaml
index e6e397ba49..a229ee00ca 100644
--- a/docker/services/messaging/rpc-rabbitmq.yaml
+++ b/docker/services/messaging/rpc-rabbitmq.yaml
@@ -250,3 +250,10 @@ outputs:
         # this is under paunch control so the latest image should be
         # pulled in by the deploy steps.  Same question for other
         # usually managed by pacemaker container.
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - rabbitmq
diff --git a/docker/services/metrics/collectd.yaml b/docker/services/metrics/collectd.yaml
index d39ec79d86..b118d9581b 100644
--- a/docker/services/metrics/collectd.yaml
+++ b/docker/services/metrics/collectd.yaml
@@ -173,3 +173,10 @@ outputs:
             - step|int == 1
             - release == 'ocata'
             - collectd_enabled|bool
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - collectd
diff --git a/docker/services/metrics/qdr.yaml b/docker/services/metrics/qdr.yaml
index 323b3667cb..496993b9fd 100644
--- a/docker/services/metrics/qdr.yaml
+++ b/docker/services/metrics/qdr.yaml
@@ -219,3 +219,10 @@ outputs:
               Log files from metrics qrouterd containers can be found under
               /var/log/containers/metrics-qdr.
           ignore_errors: true
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - metrics_qdr
diff --git a/docker/services/mistral-api.yaml b/docker/services/mistral-api.yaml
index 1b22576cf1..eb0b55900b 100644
--- a/docker/services/mistral-api.yaml
+++ b/docker/services/mistral-api.yaml
@@ -219,3 +219,10 @@ outputs:
               package: name=openstack-mistral-api state=removed
               ignore_errors: True
               when: remove_mistral_api_package|bool
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - mistral_api
diff --git a/docker/services/mistral-engine.yaml b/docker/services/mistral-engine.yaml
index 9a053ad364..7e13f8c924 100644
--- a/docker/services/mistral-engine.yaml
+++ b/docker/services/mistral-engine.yaml
@@ -162,3 +162,10 @@ outputs:
               package: name=openstack-mistral-engine state=removed
               ignore_errors: True
               when: remove_mistral_engine_package|bool
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - mistral_engine
diff --git a/docker/services/mistral-event-engine.yaml b/docker/services/mistral-event-engine.yaml
index ef89d0ac95..e864ff92c6 100644
--- a/docker/services/mistral-event-engine.yaml
+++ b/docker/services/mistral-event-engine.yaml
@@ -162,3 +162,10 @@ outputs:
               package: name=openstack-mistral-event-engine state=removed
               ignore_errors: True
               when: remove_mistral_event_engine_package|bool
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - mistral_event_engine
diff --git a/docker/services/mistral-executor.yaml b/docker/services/mistral-executor.yaml
index d37e427013..e35f5c56a8 100644
--- a/docker/services/mistral-executor.yaml
+++ b/docker/services/mistral-executor.yaml
@@ -192,3 +192,10 @@ outputs:
               package: name=openstack-mistral-executor state=removed
               ignore_errors: True
               when: remove_mistral_executor_package|bool
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - mistral_executor
diff --git a/docker/services/multipathd.yaml b/docker/services/multipathd.yaml
index 32aa4db405..2a76309826 100644
--- a/docker/services/multipathd.yaml
+++ b/docker/services/multipathd.yaml
@@ -113,3 +113,10 @@ outputs:
             - name: Stop and disable multipathd service
               when: multipathd_enabled|bool
               service: name=multipathd state=stopped enabled=no
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - multipathd
diff --git a/docker/services/neutron-api.yaml b/docker/services/neutron-api.yaml
index d1a7f4ad5c..7e305e017d 100644
--- a/docker/services/neutron-api.yaml
+++ b/docker/services/neutron-api.yaml
@@ -228,6 +228,19 @@ outputs:
               when: remove_neutron_package|bool
       metadata_settings:
         get_attr: [NeutronBase, role_data, metadata_settings]
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              with_items:
+                list_concat:
+                  - - neutron_api
+                  - - if:
+                        - internal_tls_enabled
+                        - - neutron_server_tls_proxy
+                        - null
       fast_forward_upgrade_tasks:
         - when:
             - step|int == 0
diff --git a/docker/services/neutron-dhcp.yaml b/docker/services/neutron-dhcp.yaml
index 5c5f1e1931..8ce2399377 100644
--- a/docker/services/neutron-dhcp.yaml
+++ b/docker/services/neutron-dhcp.yaml
@@ -303,6 +303,12 @@ outputs:
             - release == 'ocata'
             - neutron_dhcp_agent_enabled|bool
       post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - neutron_dhcp
         - name: Check for neutron user
           getent:
             database: passwd
diff --git a/docker/services/neutron-l3.yaml b/docker/services/neutron-l3.yaml
index 2db1af1330..8ed22a35a4 100644
--- a/docker/services/neutron-l3.yaml
+++ b/docker/services/neutron-l3.yaml
@@ -300,6 +300,12 @@ outputs:
             - release == 'ocata'
             - neutron_l3_agent_enabled|bool
       post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - neutron_l3_agent
         - name: Check for neutron user
           getent:
             database: passwd
diff --git a/docker/services/neutron-metadata.yaml b/docker/services/neutron-metadata.yaml
index 021f115387..c6feb3233d 100644
--- a/docker/services/neutron-metadata.yaml
+++ b/docker/services/neutron-metadata.yaml
@@ -163,6 +163,13 @@ outputs:
             - name: Stop and disable neutron_metadata service
               when: neutron_metadata_agent_enabled|bool
               service: name=neutron-metadata-agent state=stopped enabled=no
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - neutron_metadata_agent
       fast_forward_upgrade_tasks:
         - when:
             - step|int == 0
diff --git a/docker/services/neutron-ovs-agent.yaml b/docker/services/neutron-ovs-agent.yaml
index c780e3d118..8680a04851 100644
--- a/docker/services/neutron-ovs-agent.yaml
+++ b/docker/services/neutron-ovs-agent.yaml
@@ -259,6 +259,13 @@ outputs:
                       regexp=".*neutron-"
                       state=absent
           when: step|int == 5
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - neutron_ovs_agent
       fast_forward_upgrade_tasks:
         - when:
             - step|int == 0
diff --git a/docker/services/neutron-sriov-agent.yaml b/docker/services/neutron-sriov-agent.yaml
index 04b0ead912..48aa9832d0 100644
--- a/docker/services/neutron-sriov-agent.yaml
+++ b/docker/services/neutron-sriov-agent.yaml
@@ -141,3 +141,10 @@ outputs:
             - name: Stop and disable neutron_sriov_agent service
               when: neutron_sriov_nic_agent_enabled|bool
               service: name=neutron-sriov-nic-agent state=stopped enabled=no
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - neutron_sriov_agent
diff --git a/docker/services/nova-api.yaml b/docker/services/nova-api.yaml
index 559847ec47..210466381e 100644
--- a/docker/services/nova-api.yaml
+++ b/docker/services/nova-api.yaml
@@ -408,6 +408,14 @@ outputs:
               tags:
                 - online_upgrade
                 - online_upgrade_nova
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - nova_api
+              - nova_api_cron
       fast_forward_upgrade_tasks:
         - when:
             - step|int == 0
diff --git a/docker/services/nova-compute.yaml b/docker/services/nova-compute.yaml
index 0c69810af6..bb7b98c9df 100644
--- a/docker/services/nova-compute.yaml
+++ b/docker/services/nova-compute.yaml
@@ -315,6 +315,13 @@ outputs:
               package: name=openstack-nova-compute state=removed
               ignore_errors: True
               when: remove_nova_compute_package|bool
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - nova_compute
       fast_forward_upgrade_tasks:
         - when:
             - step|int == 0
diff --git a/docker/services/nova-conductor.yaml b/docker/services/nova-conductor.yaml
index 7cd16595f1..9fd49c263e 100644
--- a/docker/services/nova-conductor.yaml
+++ b/docker/services/nova-conductor.yaml
@@ -181,6 +181,13 @@ outputs:
               package: name=openstack-nova-conductor state=removed
               ignore_errors: True
               when: remove_nova_conductor_package|bool
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - nova_conductor
       fast_forward_upgrade_tasks:
         - when:
             - step|int == 0
diff --git a/docker/services/nova-consoleauth.yaml b/docker/services/nova-consoleauth.yaml
index a3c4e51e75..143a605591 100644
--- a/docker/services/nova-consoleauth.yaml
+++ b/docker/services/nova-consoleauth.yaml
@@ -168,6 +168,13 @@ outputs:
               package: name=openstack-nova-console state=removed
               ignore_errors: True
               when: remove_nova_console_package|bool
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - nova_consoleauth
       fast_forward_upgrade_tasks:
         - when:
             - step|int == 0
diff --git a/docker/services/nova-ironic.yaml b/docker/services/nova-ironic.yaml
index faff6486f9..7e0bf5e81e 100644
--- a/docker/services/nova-ironic.yaml
+++ b/docker/services/nova-ironic.yaml
@@ -193,6 +193,13 @@ outputs:
               package: name=openstack-nova-compute state=removed
               ignore_errors: True
               when: remove_nova_compute_package|bool
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - nova_compute
       fast_forward_upgrade_tasks:
         - when:
             - step|int == 0
diff --git a/docker/services/nova-libvirt.yaml b/docker/services/nova-libvirt.yaml
index 10aee6a3e8..c92f0a6194 100644
--- a/docker/services/nova-libvirt.yaml
+++ b/docker/services/nova-libvirt.yaml
@@ -501,3 +501,11 @@ outputs:
             - name: Stop and disable libvirtd service
               when: nova_libvirt_enabled|bool
               service: name=libvirtd state=stopped enabled=no
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - nova_virtlogd
+              - nova_libvirt
diff --git a/docker/services/nova-metadata.yaml b/docker/services/nova-metadata.yaml
index 764e85b752..0b90f3b031 100644
--- a/docker/services/nova-metadata.yaml
+++ b/docker/services/nova-metadata.yaml
@@ -162,3 +162,10 @@ outputs:
       metadata_settings:
         get_attr: [NovaMetadataBase, role_data, metadata_settings]
       host_prep_tasks: {get_attr: [NovaMetadataLogging, host_prep_tasks]}
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - nova_metadata
diff --git a/docker/services/nova-migration-target.yaml b/docker/services/nova-migration-target.yaml
index 7cf63a0682..6b36823068 100644
--- a/docker/services/nova-migration-target.yaml
+++ b/docker/services/nova-migration-target.yaml
@@ -151,3 +151,10 @@ outputs:
                   - /var/lib/nova:/var/lib/nova:shared
             environment:
              - KOLLA_CONFIG_STRATEGY=COPY_ALWAYS
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - nova_migration_target
diff --git a/docker/services/nova-placement.yaml b/docker/services/nova-placement.yaml
index 6c7e0b1e71..2bc3adb47c 100644
--- a/docker/services/nova-placement.yaml
+++ b/docker/services/nova-placement.yaml
@@ -195,3 +195,10 @@ outputs:
               package: name=httpd state=removed
               ignore_errors: True
               when: remove_httpd_package|bool
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - nova_placement
diff --git a/docker/services/nova-scheduler.yaml b/docker/services/nova-scheduler.yaml
index 20643653fd..ee5f85294e 100644
--- a/docker/services/nova-scheduler.yaml
+++ b/docker/services/nova-scheduler.yaml
@@ -187,3 +187,10 @@ outputs:
             - step|int == 1
             - release == 'ocata'
             - nova_scheduler_enabled|bool
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - nova_scheduler
diff --git a/docker/services/nova-vnc-proxy.yaml b/docker/services/nova-vnc-proxy.yaml
index e89551c9ca..47619b9449 100644
--- a/docker/services/nova-vnc-proxy.yaml
+++ b/docker/services/nova-vnc-proxy.yaml
@@ -245,3 +245,10 @@ outputs:
             - step|int == 1
             - release == 'ocata'
             - nova_vncproxy_enabled|bool
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - nova_vnc_proxy
diff --git a/docker/services/novajoin.yaml b/docker/services/novajoin.yaml
index 5326edb3ea..db8e6e5960 100644
--- a/docker/services/novajoin.yaml
+++ b/docker/services/novajoin.yaml
@@ -219,3 +219,11 @@ outputs:
           shell: "/usr/bin/kinit -kt /etc/krb5.keytab && ipa-getkeytab -s $(grep xmlrpc_uri /etc/ipa/default.conf  | cut -d/ -f3) -p nova/{{ ansible_nodename }} -k /etc/novajoin/krb5.keytab"
           args:
             creates: /etc/novajoin/krb5.keytab
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - novajoin_server
+              - novajoin_notifier
diff --git a/docker/services/octavia-api.yaml b/docker/services/octavia-api.yaml
index b8bc9b0bbc..18a9e77dfb 100644
--- a/docker/services/octavia-api.yaml
+++ b/docker/services/octavia-api.yaml
@@ -271,3 +271,16 @@ outputs:
               service: name=httpd state=stopped
       metadata_settings:
         get_attr: [OctaviaApiPuppetBase, role_data, metadata_settings]
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              with_items:
+                list_concat:
+                  - - octavia_api
+                  - - if:
+                        - internal_tls_enabled
+                        - - octavia_api_tls_proxy
+                        - null
diff --git a/docker/services/octavia-health-manager.yaml b/docker/services/octavia-health-manager.yaml
index 76ee23e6fc..7a86f77903 100644
--- a/docker/services/octavia-health-manager.yaml
+++ b/docker/services/octavia-health-manager.yaml
@@ -174,3 +174,10 @@ outputs:
               package: name=openstack-octavia-health-manager state=removed
               ignore_errors: True
               when: remove_octavia_health_manager_package|bool
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - octavia_health_manager
diff --git a/docker/services/octavia-housekeeping.yaml b/docker/services/octavia-housekeeping.yaml
index e13a911fff..7d25f47562 100644
--- a/docker/services/octavia-housekeeping.yaml
+++ b/docker/services/octavia-housekeeping.yaml
@@ -161,3 +161,10 @@ outputs:
             - name: Stop and disable octavia_housekeeping service
               when: octavia_housekeeping_enabled|bool
               service: name=openstack-octavia-housekeeping state=stopped enabled=no
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - octavia_housekeeping
diff --git a/docker/services/octavia-worker.yaml b/docker/services/octavia-worker.yaml
index 914d195f5c..50bf3f4007 100644
--- a/docker/services/octavia-worker.yaml
+++ b/docker/services/octavia-worker.yaml
@@ -180,3 +180,10 @@ outputs:
             - name: Stop and disable octavia_worker service
               when: octavia_worker_enabled|bool
               service: name=openstack-octavia-worker state=stopped enabled=no
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - octavia_worker
diff --git a/docker/services/opendaylight-api.yaml b/docker/services/opendaylight-api.yaml
index c28a951442..f6f9131dc0 100644
--- a/docker/services/opendaylight-api.yaml
+++ b/docker/services/opendaylight-api.yaml
@@ -251,6 +251,12 @@ outputs:
                 $ODL_PASSWORD: {get_attr: [OpenDaylightBase, role_data, config_settings, 'opendaylight::password']}
                 $ODL_URI: {get_param: [EndpointMap, OpenDaylightInternal, uri]}
           when: step|int == 0
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - opendaylight_api
       update_tasks:
         - name: Get ODL update level
           block: &get_odl_update_level
diff --git a/docker/services/ovn-controller.yaml b/docker/services/ovn-controller.yaml
index b06882f136..171b54a9f3 100644
--- a/docker/services/ovn-controller.yaml
+++ b/docker/services/ovn-controller.yaml
@@ -158,3 +158,10 @@ outputs:
             - name: Stop and disable ovn-controller service
               when: ovn_controller_enabled|bool
               service: name=ovn-controller state=stopped enabled=no
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - ovn_controller
diff --git a/docker/services/ovn-dbs.yaml b/docker/services/ovn-dbs.yaml
index 2f270fd04b..933bd34067 100644
--- a/docker/services/ovn-dbs.yaml
+++ b/docker/services/ovn-dbs.yaml
@@ -225,3 +225,12 @@ outputs:
             - name: Stop and disable ovn-northd service
               when: ovn_northd_enabled|bool
               service: name=ovn-northd state=stopped enabled=no
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - ovn_north_db_server
+              - ovn_south_db_server
+              - ovn_northd
diff --git a/docker/services/ovn-metadata.yaml b/docker/services/ovn-metadata.yaml
index 4468295238..df165a1f10 100644
--- a/docker/services/ovn-metadata.yaml
+++ b/docker/services/ovn-metadata.yaml
@@ -235,3 +235,10 @@ outputs:
             - name: Stop and disable networking_ovn_metadata service
               when: networking_ovn_metadata_agent_enabled|bool
               service: name=networking-ovn-metadata-agent state=stopped enabled=no
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - ovn_metadata_agent
diff --git a/docker/services/pacemaker/clustercheck.yaml b/docker/services/pacemaker/clustercheck.yaml
index 39e38451b9..a99aa4ea55 100644
--- a/docker/services/pacemaker/clustercheck.yaml
+++ b/docker/services/pacemaker/clustercheck.yaml
@@ -97,3 +97,10 @@ outputs:
       upgrade_tasks:
       update_tasks:
         # Nothing: It's not managed by pacemaker, so let paunch do it.
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - clustercheck
diff --git a/docker/services/panko-api.yaml b/docker/services/panko-api.yaml
index bf8ed237d2..b4801543e0 100644
--- a/docker/services/panko-api.yaml
+++ b/docker/services/panko-api.yaml
@@ -157,3 +157,10 @@ outputs:
       host_prep_tasks: {get_attr: [PankoApiLogging, host_prep_tasks]}
       metadata_settings:
         get_attr: [PankoApiPuppetBase, role_data, metadata_settings]
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - panko_api
diff --git a/docker/services/qdrouterd.yaml b/docker/services/qdrouterd.yaml
index f7103053ff..7546f149f2 100644
--- a/docker/services/qdrouterd.yaml
+++ b/docker/services/qdrouterd.yaml
@@ -124,3 +124,10 @@ outputs:
         ignore_errors: true
       metadata_settings:
         get_attr: [QdrouterdBase, role_data, metadata_settings]
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - qdrouterd
diff --git a/docker/services/rabbitmq.yaml b/docker/services/rabbitmq.yaml
index 3f493f4b18..f3d57e863c 100644
--- a/docker/services/rabbitmq.yaml
+++ b/docker/services/rabbitmq.yaml
@@ -250,3 +250,10 @@ outputs:
         # this is under paunch control so the latest image should be
         # pulled in by the deploy steps.  Same question for other
         # usually managed by pacemaker container.
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - rabbitmq
diff --git a/docker/services/sahara-api.yaml b/docker/services/sahara-api.yaml
index 50462bd023..5fd8b2cafc 100644
--- a/docker/services/sahara-api.yaml
+++ b/docker/services/sahara-api.yaml
@@ -186,6 +186,13 @@ outputs:
               package: name=openstack-sahara-api state=removed
               ignore_errors: True
               when: remove_sahara_api_package|bool
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - sahara_api
       fast_forward_upgrade_tasks:
         - when:
             - step|int == 0
diff --git a/docker/services/sahara-engine.yaml b/docker/services/sahara-engine.yaml
index bece1dbc63..40daeb531e 100644
--- a/docker/services/sahara-engine.yaml
+++ b/docker/services/sahara-engine.yaml
@@ -175,6 +175,13 @@ outputs:
               package: name=openstack-sahara-engine state=removed
               ignore_errors: True
               when: remove_sahara_engine_package|bool
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - sahara_engine
       fast_forward_upgrade_tasks:
         - when:
             - step|int == 0
diff --git a/docker/services/sensu-client.yaml b/docker/services/sensu-client.yaml
index 1377d827d8..2e7b39ee37 100644
--- a/docker/services/sensu-client.yaml
+++ b/docker/services/sensu-client.yaml
@@ -184,6 +184,13 @@ outputs:
               when: sensu_enabled|bool
               service: name=sensu-client state=stopped enabled=no
               #TODO: Removal of package
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - sensu_client
       fast_forward_upgrade_tasks:
         - when:
             - step|int == 0
diff --git a/docker/services/swift-proxy.yaml b/docker/services/swift-proxy.yaml
index 78ca20cd5c..34132864de 100644
--- a/docker/services/swift-proxy.yaml
+++ b/docker/services/swift-proxy.yaml
@@ -309,6 +309,18 @@ outputs:
               when: remove_swift_proxy_package|bool
       metadata_settings:
         get_attr: [SwiftProxyBase, role_data, metadata_settings]
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              list_concat:
+                - - swift_proxy
+                - - if:
+                      - internal_tls_enabled
+                      - - swift_proxy_tls_proxy
+                      - null
       fast_forward_upgrade_tasks:
         - when:
             - step|int == 0
diff --git a/docker/services/swift-storage.yaml b/docker/services/swift-storage.yaml
index 2c3d6fc742..8dc011a252 100644
--- a/docker/services/swift-storage.yaml
+++ b/docker/services/swift-storage.yaml
@@ -604,6 +604,26 @@ outputs:
           file:
             path: /var/run/rsyncd.pid
             state: absent
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - swift_account_auditor
+              - swift_account_reaper
+              - swift_account_replicator
+              - swift_account_server
+              - swift_container_auditor
+              - swift_container_replicator
+              - swift_container_server
+              - swift_container_updater
+              - swift_object_auditor
+              - swift_object_expirer
+              - swift_object_replicator
+              - swift_object_server
+              - swift_object_updater
+              - swift_rsync
       fast_forward_upgrade_tasks:
         - when:
             - step|int == 0
diff --git a/docker/services/tacker.yaml b/docker/services/tacker.yaml
index 0a2d8ed389..9357cda3c5 100644
--- a/docker/services/tacker.yaml
+++ b/docker/services/tacker.yaml
@@ -163,3 +163,10 @@ outputs:
               when: tacker_enabled|bool
               service: name=openstack-tacker-server state=stopped enabled=no
               #TODO: Removal of package
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - tacker_api
diff --git a/docker/services/tripleo-ui.yaml b/docker/services/tripleo-ui.yaml
index 47afa84224..1a90e34abd 100644
--- a/docker/services/tripleo-ui.yaml
+++ b/docker/services/tripleo-ui.yaml
@@ -158,5 +158,12 @@ outputs:
               package: name=openstack-tripleo-ui state=removed
               ignore_errors: True
               when: {get_param: UpgradeRemoveUnusedPackages}
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - tripleo_ui
       metadata_settings:
         get_attr: [TripleoUIPuppetBase, role_data, metadata_settings]
diff --git a/docker/services/zaqar.yaml b/docker/services/zaqar.yaml
index 189f141729..7f88301cc3 100644
--- a/docker/services/zaqar.yaml
+++ b/docker/services/zaqar.yaml
@@ -250,5 +250,13 @@ outputs:
               package: name=openstack-zaqar state=removed
               ignore_errors: True
               when: remove_zaqar_package|bool
+      post_upgrade_tasks:
+        - when: step|int == 1
+          import_role:
+            name: tripleo-docker-rm
+          vars:
+            containers_to_rm:
+              - zaqar
+              - zaqar_websocket
       metadata_settings:
         get_attr: [ZaqarBase, role_data, metadata_settings]