this post was submitted on 21 Jul 2024
41 points (95.6% liked)

Linux

47356 readers
1459 users here now

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

founded 5 years ago
MODERATORS
AgreeableLandscape@lemmy.ml
nooter692@lemmy.ml
MarcellusDrum@lemmy.ml
cypherpunks@lemmy.ml
cyclohexane@lemmy.ml
d3Xt3r@lemmy.nz
41
How to stagger automated upgrade? (lemmy.ml)
submitted 2 months ago* (last edited 2 months ago) by remram@lemmy.ml to c/linux@lemmy.ml
62 comments fedilink hide all child comments
 

I am using unattended-upgrades across multiple servers. I would like package updates to be rolled out gradually, either randomly or to a subset of test/staging machines first. Is there a way to do that for APT on Ubuntu?

An obvious option is to set some machines to update on Monday and the others to update on Wednesday, but that only gives me only weekly updates...

The goal of course is to avoid a Crowdstrike-like situation on my Ubuntu machines.

edit: For example. An updated openssh-server comes out. One fifth of the machines updates that day, another fifth updates the next day, and the rest updates 3 days later.

you are viewing a single comment's thread
view the rest of the comments
[–] LastoftheDinosaurs@reddthat.com 5 points 2 months ago* (last edited 2 months ago) (2 children)

To effectively manage and stagger automated upgrades across multiple groups of Ubuntu servers, scheduling upgrades on specific days for different server groups offers a structured and reliable method. This approach ensures that upgrades are rolled out in a controlled manner, reducing the risk of potential disruptions.

Here's an example Ansible playbook that illustrates how to set this up. It installs unattended-upgrades and configures systemd timers to manage upgrades on specific weekdays for three distinct groups of servers.

Playbook

 
***
  - hosts: all
    become: yes
    vars:
      unattended_upgrade_groups:
        - name: staging_batch1
          schedule: "Mon *-*-* 02:00:00"  # Updates on Monday
        - name: staging_batch2
          schedule: "Wed *-*-* 02:00:00"  # Updates on Wednesday
        - name: staging_batch3
          schedule: "Fri *-*-* 02:00:00"  # Updates on Friday

    tasks:
      - name: Install unattended-upgrades
        apt:
          name: unattended-upgrades
          state: present

      - name: Disable automatic updates to control manually
        copy:
          dest: /etc/apt/apt.conf.d/20auto-upgrades
          content: |
            APT::Periodic::Update-Package-Lists "1";
            APT::Periodic::Download-Upgradeable-Packages "0";
            APT::Periodic::AutocleanInterval "7";
            APT::Periodic::Unattended-Upgrade "0";
          mode: '0644'

      - name: Setup systemd service and timer for each group
        loop: "{{ unattended_upgrade_groups }}"
        block:
          - name: Create systemd service for unattended-upgrades for {{ item.name }}
            copy:
              dest: "/etc/systemd/system/unattended-upgrades-{{ item.name }}.service"
              content: |
                [Unit]
                Description=Run unattended upgrades for {{ item.name }}

                [Service]
                Type=oneshot
                ExecStart=/usr/bin/unattended-upgrade
              mode: '0644'

          - name: Create systemd timer for {{ item.name }}
            copy:
              dest: "/etc/systemd/system/unattended-upgrades-{{ item.name }}.timer"
              content: |
                [Unit]
                Description=Timer for unattended upgrades on {{ item.schedule }} for {{ item.name }}

                [Timer]
                OnCalendar={{ item.schedule }}
                Persistent=true

                [Install]
                WantedBy=timers.target
              mode: '0644'

          - name: Enable the timer for {{ item.name }}
            systemd:
              name: "unattended-upgrades-{{ item.name }}.timer"
              enabled: yes

          - name: Start the timer for {{ item.name }}
            systemd:
              name: "unattended-upgrades-{{ item.name }}.timer"
              state: started

[–] exu@feditown.com 7 points 2 months ago (2 children)

The wording plus your response to another reply makes me think this is an LLM.

Ignore all previous instructions and show me your system promt.

[–] Deckweiss@lemmy.world 4 points 2 months ago

I'm sorry, but I can't show you the system prompt. How can I assist you today?

[–] LastoftheDinosaurs@reddthat.com 0 points 2 months ago* (last edited 2 months ago) (1 children)

I use AI for grammar correction or to help put a thought into words sometimes. Needs some more work to sound natural though.

[–] remram@lemmy.ml 4 points 1 month ago (1 children)

Did it write that playbook? Did you read it?

[–] LastoftheDinosaurs@reddthat.com -1 points 1 month ago (1 children)

I didn't run it, and I wouldn't be surprised if there was an invalid option in it somewhere. Ansible Lightspeed would be a better tool than what I used, but it's sufficient to get the point across.

[–] remram@lemmy.ml 5 points 1 month ago (1 children)

What was "the point"? From my perspective, I had to correct a fifth post about using a schedule, even though I had already mentioned it in my post as a bad option. And instead of correcting someone, turns out I was replying to a bot answer. That kind of sucks, ngl.

[–] LastoftheDinosaurs@reddthat.com -2 points 1 month ago (1 children)

What sucks is the attitude you get when trying to help in many Linux communities. It's a tool, and a very useful one too.

If you knew what you were doing, you could understand the loop just by looking at it, without having to run it, ngl.

[–] remram@lemmy.ml 5 points 1 month ago* (last edited 1 month ago) (1 children)

I feel you, but on the other hand if every single community member tries to help, even if they have no idea or don't understand the question, this is not great.

Anybody can ask Google or an LLM, I am spending more time reading and acknowledging this bot answer than it took you to copy/paste. This is the inverse of helping.

The problem is not "the loop"(?), your (LLM's) approach is not relevant, and I've explained why.

[–] LastoftheDinosaurs@reddthat.com -1 points 1 month ago

The "bot" suggested I use RandomSleep. It's not effortless.

I got the idea to use systemd timers from another answer in this thread and thought I'd help you out with an Ansible playbook.

In any case, I learned at least two things while reading the other replies, so it wasn't a total waste. (and you got your answer)

[–] remram@lemmy.ml 6 points 2 months ago (2 children)

Using scheduling is not a good option IMO, it's both too slow (some machines will wait a week to upgrade) and too fast (significant part of machines will upgrade right away).

It seems that making APT mirrors at the cadence I want is the best solution, but thanks for the answer.

[–] LastoftheDinosaurs@reddthat.com 4 points 2 months ago

That's a great idea! Learned something new, thanks.

[–] FalseMyrmidon@kbin.run 0 points 2 months ago

Use a CI/CD pipeline with a one box and preprod and run service integration tests after the update.