Re: Debian unattended-upgrades

[Chuck Lever <chuck.lever@oracle.com>]

On 4/10/25 4:29 AM, Daniel Gomez wrote:
> On Wed, Apr 09, 2025 at 04:16:44PM +0100, Chuck Lever wrote:
>> On 4/9/25 3:54 PM, Chuck Lever wrote:
>>>
>>> - I did a "dpkg --purge unattended-upgrades" on each of the
>>>   instances, and this failure went away
>>>
>>> - "make cleancache" might be appropriate for a libvirt installation,
>>>   but it definitely won't do anything for cloud; a fresh OS image
>>>   will always have that package (unless we make a custom image)
>>>
>>> - Even so, if the libvirt OS image provider installs that package,
>>>   "make cleancache" won't eliminate the failure
>>>
>>> Noting that later steps in
>>> playbooks/roles/devconfig/tasks/install-deps/debian/main.yml disable and
>>> uninstall unattended-upgrades anyway, what
>>> is the purpose for the above logic? Can it be removed?
> 
> I was reviewing these tasks the other day with Swarna. My suggestion is to
> reorganize the task order to the following:
> 
> - name: Check if unattended-upgrades is installed
> - name: Set fact if unattended-upgrades is installed
> - name: Stop and disable unattended-upgrades related services
> - name: Remove unattended-upgrades package
> - name: Remove optional unattended-upgrades configuration files if they exist
> - name: Verify unattended-upgrades is not installed
> - name: Upgrade Packages
> 
> I think the dpkg --purge should cleanup the unnatended-upgrades package files
> as we do we do in "Remove optional...", right? In that case, we can replace this
> task with the more appropiate dpkg command you have suggested above.

I'm wondering about the repetition of "remove unattended-upgrades"
/after/ the full update in the current Ansible script. Is there a
possibility that the full update will reinstall unattended-upgrades? If
not, then your proposed order looks OK to me.


>> This is a possible solution I found on StackOverflow:
>>
>> https://stackoverflow.com/questions/45269225/ansible-playbook-fails-to-lock-apt/51919678#51919678
>>
>> I see that bringup_guestfs.sh already attempts to uninstall
>> unattended-upgrades on new images. We'll want something that works
>> for cloud instances too.
> 
> Agree. And I think that was the intention of that part of the playbook.
> 
>>
>>
>> -- 
>> Chuck Lever


-- 
Chuck Lever