Bug 53030 - Trying to update to UCS 5 with any Appbox App on any other system fails in preup.sh
Trying to update to UCS 5 with any Appbox App on any other system fails in pr...
Status: CLOSED FIXED
Product: UCS
Classification: Unclassified
Component: App Center
UCS 5.0
Other Linux
: P5 normal (vote)
: UCS 5.0
Assigned To: Dirk Wiesenthal
Florian Best
: interim-3
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2021-04-06 14:47 CEST by Felix Botner
Modified: 2021-05-25 16:02 CEST (History)
3 users (show)

See Also:
What kind of report is it?: Development Internal
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Max CVSS v3 score:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Felix Botner univentionstaff 2021-04-06 14:47:58 CEST
updater.log

Do you want to continue [Y/n]?
Custom preupdate script /var/lib/local-preup.sh not found
Checking adc_mapping ...                          OK
Checking architecture ...                         OK
Checking disk_space ...                           OK
Checking failed_ldif ...                          OK
Checking hold_packages ...                        OK
Checking kernel ...                               OK
Checking ldap_connection ...                      OK
Checking ldap_schema ...                          OK
Checking legacy_objects ...                       OK
Checking master_version ...                       OK
Checking md5_signature_is_used ...                OK
Checking min_version ...                          OK
Checking minimum_ucs_version_of_all_systems_in_domain ... FAIL
Checking old_packages ...                         OK
Checking overwritten_umc_templates ...            OK
Checking package_status ...                       OK
Checking role_package_removed ...                 OK
Checking samba_server_schannel ...                OK
Checking slapd_on_member ...                      OK
Checking ssh ...                                  OK
Checking system_date_too_old ...                  OK
Checking system_role ...                          OK
Checking term ...                                 OK
Checking usr_mountpoint ...                       OK
Checking valid_machine_credentials ...            OK

The system can not be updated to UCS 5.0 due to the following reasons:

minimum_ucs_version_of_all_systems_in_domain:
The following hosts must be upgraded to UCS 4.4-7 first:
        cn=ether-09111697,cn=memberserver,cn=computers,dc=four,dc=four: 4.3-3

Error: Update aborted by pre-update script of release 5.0-0
Comment 1 Florian Best univentionstaff 2021-04-13 10:30:40 CEST

*** This bug has been marked as a duplicate of bug 51850 ***
Comment 2 Felix Botner univentionstaff 2021-04-15 11:34:56 CEST
4.3/etherpad-lite=1.6.6 will never support UCS 5.0-0, i have removed 5.0-0 from SupportUCSVersions from this App.
Comment 3 Dirk Wiesenthal univentionstaff 2021-04-15 12:04:04 CEST
The problem is that Appbox Apps join into the domain. So a 4.3 system exists and therefore no update on any system is possible.

We should remove 5.0-0 from all Appbox images.

But we should also try softening up the check "minimum_ucs_version_of_all_systems_in_domain".
Comment 4 Dirk Wiesenthal univentionstaff 2021-04-15 12:15:24 CEST
Installing an Appbox App with a UCS 5 Primary is possible! Inside the container, there does not exist an "appcenter/app" module. But that's it.

Appbox Hosts do have
univentionObjectFlag: docker

This could be used in the filter of minimum_ucs_version_of_all_systems_in_domain
Comment 5 Dirk Wiesenthal univentionstaff 2021-04-15 12:16:25 CEST
BTW: We do not prevent administrators from installing etherpad on a 4.4 system with a UCS 5 Primary...
Comment 6 Ingo Steuwer univentionstaff 2021-04-27 14:15:47 CEST
AppBox Apps will not be supported in UCS 5.0. We need a clear message during update in case AppBox Apps are installed, this should be the message that "this App is not yet Available for UCS 5.0" or similar.
Comment 7 Dirk Wiesenthal univentionstaff 2021-05-11 22:29:03 CEST
All Appbox versions of the Apps will not be available in UCS 5.

I changed the filter in minimum_ucs_version_of_all_systems_in_domain

from
(&(univentionOperatingSystem=Univention Corporate Server))

to
(&(univentionOperatingSystem=Univention Corporate Server)(!(univentionObjectFlag=docker)))

[5.0-0 9c8611b765] Bug #53030: Do not find Appbox computers when checking whether any UCS systems < 4.4-8 are present
 2 files changed, 8 insertions(+), 1 deletion(-)

Package: univention-updater
Version: 15.0.3-59A~5.0.0.202105111753
Comment 8 Florian Best univentionstaff 2021-05-12 13:35:56 CEST
Now, with some objects the upgrade can be tricked.

Please add an additional more user friendly message like:

diff --git base/univention-updater/script/check.sh base/univention-updater/script/check.sh
index f12b6a0155..a37e6397b2 100755
--- base/univention-updater/script/check.sh
+++ base/univention-updater/script/check.sh
@@ -667,6 +667,12 @@ REQUIRED_VERSION = environ["MIN_VERSION"]
 V5 = LooseVersion("5.0-0")
 
 ATTR = "univentionOperatingSystemVersion"
+blocking_apps = [
+    "%s: %s" % (dn, attrs[ATTR][0].decode("UTF-8", "replace"))
+    for dn, attrs in lo.search("(&(%s=*)(univentionOperatingSystem=Univention Corporate Server)(univentionObjectFlag=docker))" % ATTR, attr=[ATTR])
+    if LooseVersion(attrs[ATTR][0].decode("UTF-8", "replace")) < LooseVersion(REQUIRED_VERSION)
+]
+
 blocking_computers = [
     "%s: %s" % (dn, attrs[ATTR][0].decode("UTF-8", "replace"))
     for dn, attrs in lo.search("(&(%s=*)(univentionOperatingSystem=Univention Corporate Server)(!(univentionObjectFlag=docker)))" % ATTR, attr=[ATTR])
@@ -689,8 +695,10 @@ if blocking_computers:
     print("The following hosts must be upgraded to UCS %s first:\n\t%s" % (REQUIRED_VERSION, "\n\t".join(blocking_computers)))
 if blocking_objects:
     print("The following extensions are incompatible with UCS 5.0:\n\t%s" % "\n\t".join(blocking_objects))
+if blocking_apps:
+    print("The host objects of some apps are still using a too old docker image. The belonging computer objects are:\n\t%s" % ("\n\t".join(blocking_computers),))
 
-if blocking_computers or blocking_objects:
+if blocking_computers or blocking_objects or blocking_apps:
     exit(1)'
 }
Comment 9 Dirk Wiesenthal univentionstaff 2021-05-12 23:02:34 CEST
(In reply to Florian Best from comment #8)
> Now, with some objects the upgrade can be tricked.

What do you mean by tricked? By adding univentionObjectClass=docker to a computer object?

> 
> Please add an additional more user friendly message like:

This is not the scope of the bug as I understand it. We do not want a more user friendly message (although the current message _is_ confusing). We want a domain with the App etherpad-lite installed to allow another UCS system to upgrade to 5.0. Not the system running the App, of course, as that won't work due to etherpad-lite not being available in 5.0.
Comment 10 Florian Best univentionstaff 2021-05-17 11:22:36 CEST
(In reply to Dirk Wiesenthal from comment #9)
> (In reply to Florian Best from comment #8)
> > Now, with some objects the upgrade can be tricked.
> 
> What do you mean by tricked? By adding univentionObjectClass=docker to a
> computer object?
No, by adding SupportedUCSVersions=5.0-0 to any app with an UCS 4.x appbox image.


> > 
> > Please add an additional more user friendly message like:
> 
> This is not the scope of the bug as I understand it. We do not want a more
> user friendly message (although the current message _is_ confusing). We want
> a domain with the App etherpad-lite installed to allow another UCS system to
> upgrade to 5.0. Not the system running the App, of course, as that won't
> work due to etherpad-lite not being available in 5.0.

OK. it is now clearer what you want.
I understood it like that, see the following comment:

(In reply to Ingo Steuwer from comment #6)
> AppBox Apps will not be supported in UCS 5.0. We need a clear message during
> update in case AppBox Apps are installed, this should be the message that
> "this App is not yet Available for UCS 5.0" or similar.

This message exists for systems having the app directly installed:

> The system can not be updated to UCS 5.0 due to the following reasons:
> blocking_apps:
> The update to 5.0 is currently not possible,
> because the following Apps are not available for UCS 5.0:
>  * Etherpad

And this message can now be omitted if the app is installed on a non-UCS-5 system in a UCS-5 domain.
The patch from comment 8 was suggested to prevent this.
Because now all domains having appbox-apps  - in any version - installed like tine20, benno-mailarchiv, digitec-suitecrm, etherpad-lite, horde, openproject can be upgraded to UCS 5.0.

But we did decide that this is not supported.
For an older benno-mailarchiv installation this breaks the container completely because UDM extensions in UCS 5.0 break it.

So for which apps do you want an exception? Only etherpad? Or every app?
Comment 11 Dirk Wiesenthal univentionstaff 2021-05-17 12:40:32 CEST
As discussed, we consider the advantage of enabling some domains to (partly) upgrade to 5.0 higher than the risk of having 4.3-Appbox in these domains.

No Appbox App will be available for 5.0. So the mixed environments will end as soon as UCS 4.4 will be EOL.
Comment 12 Florian Best univentionstaff 2021-05-17 14:07:19 CEST
OK
Comment 13 Florian Best univentionstaff 2021-05-25 16:02:39 CEST
UCS 5.0 has been released:
 https://docs.software-univention.de/release-notes-5.0-0-en.html
 https://docs.software-univention.de/release-notes-5.0-0-de.html

If this error occurs again, please use "Clone This Bug".