Hold package versions so staging and production install identical updates
I'm not sure if this is already really on the roadmap, but I think it's an important feature.
For example, we first update our test/acc platform before deploying updates to the prod platform, and we have about 5 days in between test/acc and prod updates.
In between those days, newer updates can get released, that could mess the prod environment up, since we haven't tested them on test/acc.
So it would be nice if we can sort of hold the same packages that will be installed on the other environment, to be sure it'll be the exact same.
Originally requested by gompstar in Discord #ideas.
7 Comments
Foreman/Katello/Satellite/apt-cache can all do the 2nd point across RPM and DEB based distributions.
Package locks prevents deps from being updated as well provided that they are direct dependencies.
There are a few solutions to this:
- Impose a package lock, e.g
dnf versionlock kernel-*, apt also has such functionality. Have your own repository that you pull a snapshot from upstream to and use how you see fit.
Staging your updates from the same source but control when/how the different environments are patched.
Some distributions provide snapshots of their repositories to avoid this kind of problem. Have you checked out https://snapshot.debian.org/, for example?
But if we update once a month for example, then it's not 5 days in between updates, but possible up to 25days.
If the day after the prod environment an updates comes out, then the next time, it's a day before the prod environment.
then acc, has installed the 25day old update, and prod didn't.
And it could be an update with breaking changes as well (or one that has a bug, and it could break everything), that's why we've got the test/acc environments..
On Linux repository systems, the new version replaces the older version on the same repository.
If a new version is published less than 5 days after the previous one, you probably will not install the old version on the production server and check the reason for the replacement.
I know there are other solutions for this, but I'd rather have one panel for everything, and not also have other things running. We've now got Uyuni running, but we're looking to replace it with something else, and patchmon looks most promising for that.
But having the ability to update the same packages on acc and prd on different days, is for us important. But if we need to keep Uyuni and next to it run patchmon, then I can just keep Uyuni and that's it. (and that's not what I'd want)