How we sort of automate updating system packages across our Ubuntu machines

Re:How we sort of automate updating system packages across o... by yjftsjthsd-h on Sunday March 08, 2020 @01:27PM (#22519233)

I think I understand the motivations, but this doesn't seem like a good idea to me. You're already limiting it to "safe" packages, so why not use unattended-upgrades and take the human effort out completely? Or if you need to vet updates before pushing them out, use Pulp or something to control the rollout rather than a custom tool that you have to maintain in the face of edge cases. Heck, I'd probably take Ansible with a list of package versions over this setup.

Edit: Actually, let me slightly walk that back. The described system is probably a reasonable way to maintain a small number of pets. My objections are mostly based on the idea that you're dealing with more than a handful of servers.

[ Parent | on HN ]

Re:How we sort of automate updating system packages across o... by siebenmann on Sunday March 08, 2020 @03:35PM (#22520028)

Putting safe in quotes is accurate, because our updates are not limited to truly safe packages at all for the simple reason that the Debian package format makes all package updates potentially dangerous. Any package update can decide to ask you new questions and there is no guarantee that the default answer is what you actually want, because it's up to the package author to decide.

As a policy thing, we also want to know what packages were updated when and broadly to control this, and we have enough machines that this information needs to be aggregated. Even if unattended-upgrades was totally safe, we'd want to only trigger it only on demand, see the package list in advance, and get an all-machines summary at the end.

Life would be a lot easier if apt-get updates could be more controlled, so for instance you could say 'only update this list of packages'. But apt-get doesn't want to do that; updates are global and using 'apt-get install' to update specific packages (normally) has side effects, like marking them as manually installed.

(I'm the author of the linked-to blog entry. For reference, we currently have 119 machines that get updated through this system.)

[ Parent | on HN ]

Re:How we sort of automate updating system packages across o... by simion314 on Sunday March 08, 2020 @01:59PM (#22519459)

A reason would be to have someone read the list of updates before he presses the button. Then if for some reason weird things start to happen this person should make the connection between the package he updated and the issues. Is similar with code, I like to check the changes others do in my team so I am aware of what areas are changed and what is pushed live.

[ Parent | on HN ]