Univention Bugzilla – Bug 47333
Joinscript 40ucs-school-import-http-api.inst fails during upgrade 4.2 -> 4.3 during DB schema migration
Last modified: 2018-09-11 11:34:18 CEST
UCS 4.2-4 errata423 -> 4.3-1 errata145 ucs-school-import-http-api 15.0.3-37A~4.2.0.201804201645 -> 16.0.1-27A~4.3.0.201804251526 40ucs-school-import-http-api.inst fails hard during "Migrating DB schema...": > univention-run-join-scripts started > Fr 6. Jul 14:48:06 CEST 2018 > [...] > RUNNING 40ucs-school-import-http-api.inst > 2018-07-06 14:48:08.809403283+02:00 (in joinscript_init) > Object exists: cn=ucsschoolImportGroup,cn=UCSschool,cn=custom attributes,cn=univention,dc=edu,dc=silk-it,dc=de > Object exists: cn=ucsschoolSchool-ImportSchool,cn=UCSschool,cn=custom attributes,cn=univention,dc=edu,dc=silk-it,dc=de > Object exists: cn=ucsschoolSchool-ImportRole,cn=UCSschool,cn=custom attributes,cn=univention,dc=edu,dc=silk-it,dc=de > Using existing secret for Django service. > Using existing password for RabbitMQ. > Using existing RabbitMQ user and vhost. > Using existing password for PostgreSQL. > Setting password on existing PostgreSQL user. > ALTER ROLE > Using existing PostgreSQL database. > System check identified some issues: > > WARNINGS: > ?: (security.W004) You have not set a value for the SECURE_HSTS_SECONDS setting. If your entire site is served only over SSL, you may want to consider setting a value and enabling HTTP Strict Transport Security. Be sure to read the documentation first; enabling HSTS carelessly can cause serious, irreversible problems. > > System check identified 1 issue (0 silenced). > Collecting static files... > > 0 static files symlinked to '/var/lib/ucs-school-import-http-api/static', 85 unmodified. > Migrating DB schema... > Traceback (most recent call last): > File "/usr/share/pyshared/ucsschool/http_api/manage.py", line 23, in <module> > execute_from_command_line(sys.argv) > File "/usr/lib/python2.7/dist-packages/django/core/management/__init__.py", line 367, in execute_from_command_line > utility.execute() > File "/usr/lib/python2.7/dist-packages/django/core/management/__init__.py", line 359, in execute > self.fetch_command(subcommand).run_from_argv(self.argv) > File "/usr/lib/python2.7/dist-packages/django/core/management/base.py", line 294, in run_from_argv > self.execute(*args, **cmd_options) > File "/usr/lib/python2.7/dist-packages/django/core/management/base.py", line 345, in execute > output = self.handle(*args, **options) > File "/usr/lib/python2.7/dist-packages/django/core/management/commands/migrate.py", line 86, in handle > executor.loader.check_consistent_history(connection, fake_initial=options['fake_initial']) > File "/usr/lib/python2.7/dist-packages/django/db/migrations/loader.py", line 301, in check_consistent_history > connection.alias, parent[0], parent[1], > django.db.migrations.exceptions.InconsistentMigrationHistory: Migration import_api.0001_initial is applied before its dependency djcelery.0001_initial on database 'default'. The migration djcelery.0001_initial may be faked using '--fake-initial'. > EXITCODE=1
root@ucs01:~# su postgres -c "psql --command='SELECT version();'" could not change directory to "/root": Keine Berechtigung version ------------------------------------------------------------------------------------------------ PostgreSQL 9.4.15 on x86_64-unknown-linux-gnu, compiled by gcc (Debian 4.9.2-10) 4.9.2, 64-bit (1 row) root@ucs01:~# univention-app info UCS: 4.3-1 errata145 Installed: samba4=4.7 self-service=3.0 ucsschool=4.3 v4 Upgradable:
This breaks also the UMC module of the HTTP API userimport: > Ein Fehler ist aufgetreten: > > Interner Server-Fehler. > > Fehlernachricht des Servers: > > Der UCS@school Import API HTTP Server ist nicht erreichbar: > Received status_code=500 with reason='Internal Server Error' for requests.get(**files=None, url=u'https://ucs01.school.example.org/api/v1/imports/users/', auth=('Administrator', u'**********'), headers={u'Accept': u'application/json'}, params={'ordering': 'date_created', 'limit': 20, 'dryrun': False}, data=None). Additional Traceback appearing in a window behind the error message: > Interner Server-Fehler in "schoolimport/schools". > Request: schoolimport/schools > > Traceback (most recent call last): > File "/usr/lib/pymodules/python2.7/univention/management/console/base.py", line 253, in execute > function.__func__(self, request, *args, **kwargs) > File "/usr/lib/pymodules/python2.7/univention/management/console/modules/decorators.py", line 636, in _decorated > return function(self, request, *args, **kwargs) > File "/usr/lib/pymodules/python2.7/univention/management/console/modules/decorators.py", line 318, in _response > result = _multi_response(self, request) > File "/usr/lib/pymodules/python2.7/univention/management/console/modules/decorators.py", line 192, in _response > return function(self, request) > File "/usr/lib/pymodules/python2.7/univention/management/console/modules/decorators.py", line 440, in _response > return list(function(self, iterator, *nones)) > File "/usr/lib/pymodules/python2.7/univention/management/console/modules/decorators.py", line 286, in _fake_func > yield function(self, *args) > File "/usr/lib/pymodules/python2.7/univention/management/console/modules/schoolimport/__init__.py", line 75, in schools > schools = [dict(id=school.name, label=school.displayName) for school in self.client.school.list()] > File "/usr/lib/pymodules/python2.7/ucsschool/http_api/client.py", line 537, in list > return self._to_python(self._list_resource(**params)) > File "/usr/lib/pymodules/python2.7/ucsschool/http_api/client.py", line 492, in _list_resource > return self._resource_from_url(resource_url, **params) > File "/usr/lib/pymodules/python2.7/ucsschool/http_api/client.py", line 484, in _resource_from_url > return self.client.call_api('get', url, params=params) > File "/usr/lib/pymodules/python2.7/ucsschool/http_api/client.py", line 465, in call_api > raise exc(msg, status_code=response.status_code) > ServerError: Received status_code=500 with reason='Internal Server Error' for requests.get(**files=None, url=u'https://ucs01.school.example.org/api/v1/schools/', auth=('Administrator', u'**********'), headers={u'Accept': u'application/json'}, params={}, data=None).
Other customer has the exact same problem after updating UCS@school from 4.3 v3 to 4.3 v4. Is this a general regression?
This seems to be only a problem for systems coming from 4.2. But @schoool 4.3 v4 is the first version that increased that join script number. Workaround: ''' python /usr/share/pyshared/ucsschool/http_api/manage.py migrate --no-color --noinput --fake-initial ''' execute the join script again systemctl restart ucs-school-import-http-api.service The Problem: django-celery is now using another way to create its database. The importer has a dependency that celery has an initialized database. Due to the change how the database is created, django things that the celery database still needs to be initialized. The ---fake-initial option tells django that the database is already created and the script to create celery's db does not need to be executed. According to the celery changelog no actual database changes happened so using that option should be no problem.
Workaround works as described :) In one case I also needed to set the password for uid=importhttpapi to match the one given in /etc/ucsschool-import/ldap_unprivileged.secret. Otherwise "/usr/share/pyshared/ucsschool/http_api/manage.py updateschools --all" would fail with "Authentication failed" while re-executing the joinscript - but I'm not sure if this is related to this specific bug.
(In reply to Michael Grandjean from comment #0) > UCS 4.2-4 errata423 -> 4.3-1 errata145 > ucs-school-import-http-api 15.0.3-37A~4.2.0.201804201645 -> > 16.0.1-27A~4.3.0.201804251526 15.0.3-37 -> 16.0.1-27 is: 4.2 v9 -> 4.3 v3 (ucsschool_20180502162627 -> ucsschool_20180502162627)
In 4.2 we use django-celerys version 3.1.16, in 4.3 we use 3.1.17. The project changed in that minor version (!) from South migrations to Djangos new builtin migration mechanism. django-celerys changelog: https://github.com/celery/django-celery/blob/master/Changelog
UCS: 4.2-4 errata426 ucsschool=4.2 v10 # univention-install ucs-school-import-http-api --------------------------------------------------------------------------- Calling joinscript 40ucs-school-import-http-api.inst ... 2018-08-20 10:55:44.025739204+02:00 (in joinscript_init) [..] Migrating DB schema... Operations to perform: Synchronize unmigrated apps: django_filters, staticfiles, djcelery, messages, django_pam, rest_framework Apply all migrations: admin, contenttypes, import_api, auth, sessions Synchronizing apps without migrations: Creating tables... Creating table celery_taskmeta Creating table celery_tasksetmeta Creating table djcelery_intervalschedule Creating table djcelery_crontabschedule Creating table djcelery_periodictasks Creating table djcelery_periodictask Creating table djcelery_workerstate Creating table djcelery_taskstate Running deferred SQL... Installing custom SQL... Running migrations: Rendering model states... DONE Applying contenttypes.0001_initial... OK Applying auth.0001_initial... OK Applying admin.0001_initial... OK Applying contenttypes.0002_remove_content_type_name... OK Applying auth.0002_alter_permission_name_max_length... OK Applying auth.0003_alter_user_email_max_length... OK Applying auth.0004_alter_user_username_opts... OK Applying auth.0005_alter_user_last_login_null... OK Applying auth.0006_require_contenttypes_0002... OK Applying import_api.0001_initial... OK Applying import_api.0002_auto_20180309_1104... OK Applying import_api.0003_auto_20180601_0848... OK Applying sessions.0001_initial... OK [..] 2018-08-20 10:56:00.903890054+02:00 (in joinscript_save_current_version) Joinscript 40ucs-school-import-http-api.inst finished with exitcode 0 # grep ucs-school-import-http-api /var/univention-join/status ucs-school-import-http-api v2 successful # univention-upgrade [..] Starting update to UCS version 4.3-0 [..] Starting update to UCS version 4.3-1 [..] Calling joinscript 40ucs-school-import-http-api.inst ... 2018-08-20 11:57:12.345233695+02:00 (in joinscript_init) [..] Handling django-celerys upgrade (faking DB schema migration)... Operations to perform: Apply all migrations: djcelery Running migrations: Applying djcelery.0001_initial... FAKED Migrating DB schema... Operations to perform: Apply all migrations: admin, auth, contenttypes, djcelery, import_api, sessions Running migrations: Applying admin.0002_logentry_remove_auto_add... OK Applying auth.0007_alter_validators_add_error_messages... OK Applying auth.0008_alter_user_username_max_length... OK [..] Joinscript 40ucs-school-import-http-api.inst finished with exitcode 0 --------------------------------------------------------------------------- → 4.3-1 errata202 ucsschool=4.3 v4 → manual test of the API was OK [4.3 3898b22a0] Bug #47333: handle django-celerys upgrade [4.3 9d442f894] Bug #47333: advisory ucs-school-import (16.0.2-36)
Changelog & Advisories: OK Package installable: OK DB migration fixed: OK (*) (*) After upgrading from 4.2 to 4.3 (with ucs-school-import being installed) the joinscript was still pending. After mounting the test packages and upgrading to ucs-school-import 16.0.2-38A~4.3.0.201808201754 the joinscript finished successful and import processes could be run without problems.
UCS@school 4.3 v5 has been released. https://docs.software-univention.de/changelog-ucsschool-4.3v5-de.html If this error occurs again, please clone this bug.